Track LogStats Log Count

Log Decoders have the ability to track the log count and last received time for each event source and forwarder that reports to it.

View Log Stats Information

To view Logs Stats information:

1. Depending on your version:

   • For Security Analytics 10.x: In the Security Analytics menu, select Administration > Services.
   • For NetWitness 11.x: In the NetWitness menu, select ADMIN > Services.
2. Select a Log Decoder service and click View > Stats.

3. Click the Log Stats tab.

   

Enable Source and Forwarder Tracking

However, this behavior is not enabled by default. To enable source and forwarder tracking, start capture and then perform the following procedure.

1. Access the REST API by entering the following URL in a web browser: http://logDecoderIP:50102, where logDecoderIP is the IP address of the Log Decoder.
2. Click decoder, then config. This displays all the configuration parameters for the Log Decoder.
3. Scroll down until you find Log Stats Enabled (log.stats.enabled).
4. In the text field, type true, and click Set.

Once set, all subsequent logs received by the Log Decoder will increment the count and update the last received time for the event source that generated the log, and the forwarder that delivers the log to Log Decoder (if there is one).

Details

The Log Stats tab displays the following information.

If you restart capture (or if you set log.stats.enabled to false), the statistics are reset.