ESA Correlation Details View

The ESA Correlation Details view provides information for the ESA Correlation service. The following figure shows the ESA Correlation service details.

netwitness_121_esadetails_1122_768x380.png

For the related procedure, see Monitor Service Details.

Many services, including the ESA Correlation service, have Health Stats and Java Virtual Machine (JVM) tabs. The Health Stats tab provides information about the health status of the service. The JVM tab shows the total memory used by the selected service and the total memory capacity of the host.

For more information on the ESA Correlation service and ESA Rule memory usage, see the Alerting with ESA Correlation Rules User Guide.

Health Stats Tab

The Health Stats tab provides information about the health status of the selected service.

netwitness_healthstatstab_672x100.png

The services on this tab can show one of three states:

  • Healthy: The service is healthy.
  • Unhealthy: The service is mostly functional, but it needs attention to mitigate potential down time.
  • Fatal: Action needs to be taken to restore the service.
Statistic

Description
Configuration Update Status Indicates whether the service requires a restart for configuration changes to take effect. If the Configuration Update Status shows as Unhealthy, restart the service.

Process JVM Memory

 Indicates the memory usage status. An Unhealthy status occurs when heap memory usage is greater than or equal to 80%. A Fatal status occurs when heap memory usage is greater than or equal to 95%. If the service is using too much memory, you can add more memory or move services to other hosts. For more details on memory usage, go to the JVM tab.
Data Connection Indicates the health of the database connection of the service to MongoDB.
Process Modules Indicates the health of the service. If a service is starting up, it shows as Unhealthy since its health is not yet determined. A service is Healthy if it is up and running properly. A service shows as Fatal if it is running in upgrade mode or if the service is running in safe or degraded mode.
Security PKI Certificate Indicates the service certificate health. It shows as Healthy if a given X509 certificate is self-signed.

JVM Tab

The JVM tab shows the total memory used by the selected service and the total memory capacity of the host.

netwitness_jvmtab_672x67.png

Statistic

Description
JVM Total Memory Max Shows the total memory capacity for the entire host.

JVM Total Memory Used

 Shows the total memory used by all services and processes on the host.