View Stats for an ESA Service

This topic describes how to view the deployment statistics (stats) for an ESA Correlation service. This procedure is useful when you are attempting to determine the effectiveness of a rule or troubleshoot an ESA rule deployment.

Caution: When you modify and re-deploy an ESA rule deployment, all of the stats are removed from that deployment. The generated alerts are not removed from NetWitness Respond.

View ESA Stats

  1. Go to netwitness_configureicon_24x21.png (Configure) > ESA Rules > Services tab.
  2. From the ESA Services list on the left, select a service.
    The deployment stats for the selected service are displayed.
    netwitness_121_esasrvtb_1122_672x379.png

  1. (This option applies to NetWitness version 11.3 and later.) In the Deployment view under the ESA Correlation service name, select the tab of the deployment you would like to view. For example, select the Deployment A tab to view the stats for deployment A. Select the Deployment B tab to view the status for deployment B.
  2. Review the following sections of ESA stats.
    For a complete description of each statistic in each section, see Services Tab.
  • Engine Stats
  • Rule Stats
  • Alert Stats
  1. In the Deployed Rule Stats, review details about the rules deployed on the ESA.
    For a complete description of each column in each section, see Services Tab.
    • If the rule is enabled or disabled
    • What the rule name is
    • The type of rule
    • If the rule is running in Trial Rule mode
    • Last detected
    • Events matched
    • The amount of memory used by the rule
    • The percentage of the deployment CPU used by the rule (available in NetWitness version 11.5 and later)
  1. To monitor overall memory usage and health of your ESA Correlation service, click Health & Wellness.

Enable or Disable Rules

  1. In the Deployed Rule Stats panel, select a rule from the grid.
  2. Click netwitness_enableicon_63x20.png to enable the rule, or click netwitness_disableicon_66x19.png to disable the rule.
    The Services tab is refreshed to show the changes, which take effect immediately.

Refresh the Statistics

The Services tab does not update statistics automatically unless you enable or disable a rule. To ensure you view current statistics:

  1. Click netwitness_ic-refresh_24x23.png in the upper right corner to refresh the information.
  2. View the updated information.