Meta(s) Overflown in Index Slices

[Anonymous]

I'm still unclear as to the health and wellness alert "Meta(s) Overflown in Index Slices"

What causes it, what's the impact from it and how do I handle/resolve these issues?

[CarmenC]

Hi @Anonymous 

Meta(s) Overflown in Index Slices is triggered when concentrator has indexed values until ValueMax. New values, then, are not indexed and investigate could be inaccurate.

These are the steps to resolve the issue:

- From the H&W alarm, check which meta(s) is causing the alarm
- Navigate to Admin -> Services -> Concentrator -> Config -> Files
- Locate the meta in "index-concentrator.xml" file
- Copy the line which contains the meta to "index-concentrator-custom.xml" file. Any changes need to be added to the index-concentrator-custom.xml file as this overrides the original.
- Increase the valueMax in index-concentrator-custom.xml, based on your business needs (valueMax will vary between organizations and environments)
- Restart the concentrator service from SSH session #systemctl restart nwconcentrator
Following these steps for each meta should clear the alarm. 

Regards,

Carmen

[Anonymous]

Thanks @CarmenC ,

I'm not sure I quite understand what you mean by "valueMax will vary between organizations and environments".

In my mind it doesn't make sense, why would an organisation have different requirements for valueMax? Wouldn't I want to have the valueMax set at level that 1. resolves any overflow alarms and 2. allows indexing of all values that the concentrator is ingesting from the decoder?

I can't think of a time where I would say "well, we've hit the maximum that's enough for us"

[JohnSnider]

Jeremy,

The valueMax settings are there as a safety valve, to keep from bloating the index in a situation where there is runaway meta creation.  (If someone created a custom parser/rule/feed that generated massive unique values for a meta key, the valueMax setting will keep it from overloading the index and creating a HUGE index slice that can cause issue with operations. The default settings are set for average network activity. Every customer has different types of traffic, or decides to change the indexing type of a metakey that will require changes to the valueMax for a meta key. It's a process that takes a while to tune for any customer network.

One thing to keep in mind, if you make any changes to the custom index file on a concentrator, it should be replicated to ALL concentrators, (all concentrator index files should be identical), also after a change, you DO NOT need to restart the concentrator, you just need to force an index save.  This can be done by going to the explore view of the concentrators, Right click on the "index" folder and select properties, from the dropdown select "save" and hit the send button. (depending on your number of concentrators, you can open multiple concentrators in the explore view and issue the command to all of them at once.

[FPCAdmins]

Where does it show which meta(s) is causing the alarm, which value you need to change?

[JohnSnider]

On the Health & Wellness "Alarms" page, any overflow meta will cause an alarm, (if you have email alerting configured in the policy to send emails, you should also get an email alert), the alert will tell you the metakey name that needs to be adjusted.