This topic describes the components of the Services Config view Advanced tab for ESA.
If you want to configure advanced settings for an ESA service, you can do that from the Services Config view > Advanced tab of the ESA.
The following are the sections in the Advanced view:
- Alert Engine
- Event Stream Engine
Alert Engine Settings
In the Alert Engine section, you specify values to preserve events for rules that choose multiple events.
The following figure shows the Alert Engine section.
The following table lists the parameters in the Alert Engine section and their descriptions.
|Max Constituent Events||For rules that choose multiple events, this configuration value decides how many of the associated events are preserved. For example, if a rule fires an alert with 200 associated events and this parameter is set to 100, only the first 100 are preserved by ESA, the rest are dropped. The default value is 100.|
|Debug Rules?||Selecting enables debugging rules.|
|Forward Alerts On Message Bus||To forward ESA alerts for Incident Management, you must select this option. The ESA alerts generated will be sent to the Message Bus and subsequently to Incident Management. This option is selected by default. You may want to ensure that the Incident Management service is running.|
|Max Alerts Per Second for a Trial Rule||You can specify the maximum number of alerts to be forwarded to the Message Bus for the trial rule. For example, if the value is set to 50, only 50 alerts will be forwarded to the Message Bus for the trial rule. If the value is set to 0, then the alerts generated by the trial rule will not be forwarded to the Message Bus. The default value is 10.|
Event Stream Engine Settings
In the Event Stream Engine section, you specify details to improve performance.
The following figure shows the Event Stream Engine section.
The following table lists the parameter in the Event Stream Engine section and its description.
|Max Pattern Subexpressions||Certain rules require ESPER to maintain subexpressions in memory before deciding to fire them or not. These subexpressions consume memory and if left unchecked may cause the service to go down with memory exhaustion. This parameter is a safety measure that keeps such memory hogging rules under check. If a rule exceeds the specified number of subexpressions, its processing is delayed. The default value is 0 which means this setting is disabled. You must set a value if there are service stability issues.|