This topic tells ESA rule writers how to view memory metrics for an ESA Correlation service and its associated ESA rules. You can see estimated memory usage for each rule running on a server, and you can use this information to modify your rule statements and conditions if they use too much memory.
Rules can sometimes consume more memory than you expect, causing ESA to slow down or stop. To see approximately how much memory a rule is using, you can view estimated memory usage for each rule in the Health & Wellness System Stats browser (you need permissions to access this module). You can use this information to modify your rules to be more efficient.
At a high level, you need to complete the following steps to use memory metrics to troubleshoot memory usage for rules:
- Ensure you have the correct permissions to view the Health & Wellness module. For information on roles and permissions, see ESA Permissions.
- View the memory statistics in Health & Wellness.
- (Recommended) Configure Health & Wellness ESA policies to send an email if memory thresholds are exceeded. See "Manage Policies" in the System Maintenance Guide for instructions on sending email notifications.
- Use the memory metrics data to modify rules to be more efficient, if necessary.
The following are requirements for using memory metrics:
- You must have the appropriate permissions to view Health & Wellness statistics.
- (Recommended) Configure the ESA Health & Wellness policy to send an email when memory thresholds are exceeded.
In NetWitness Platform version 11.5 and later, New Health & Wellness provides improved and intuitive dashboards, monitors, and visualizations. The ESA Correlation Overview dashboard provides health statistics and trends on ESA rule deployments.
For more information, see "Monitor New Health and Wellness" and "Appendix A: New Health and Wellness Dashboards / ESA Correlation Overview Dashboard" in the System Maintenance Guide.
View Memory Metrics for an ESA Correlation Service in Health & Wellness
- Go to (Admin) > Health & Wellness > Monitoring tab.
- Locate your host and click the link in the Name field for your ESA Correlation service, for example, ESA- ESA Correlation.
- On the tab for your ESA host, click the Health Stats tab.
You can view the health status of the ESA Correlation service.
- Click the JVM tab.
You can view the JVM total memory used by the selected ESA Correlation service.
View Memory Metrics for an ESA Correlation Service and its ESA Rules
- Go to (Admin) > Health & Wellness > System Stats Browser.
To view memory metrics for an ESA Correlation service, in the Host field, select your ESA host. Select Correlation Server for Component, enter ProcessInfo for Category, and then click Apply.
<your host> Correlation Server ProcessInfo
The Memory Utilization statistic shows the total memory in use by the ESA Correlation service.
- To view the historical memory usage for the ESA Correlation service, click the Historical Graph icon.
- To view the memory metrics for individual rules, in the Category field, enter Correlation Engine Metrics and click Apply.
<your host> Correlation Server Correlation Engine Metrics
- Click to view a historical view of memory usage for the rule in the Historical Graph column.