NetWitness Suite Version 126.96.36.199 provides the ability for Administrators to view usage statistics of device types that are eligible for a Metered license. Licensing usage statistics are made available to Administrators in CSV and PDF formats.
Hourly statistics are captured for all supported services connected to the NetWitness Server.
Metrics can be tracked securely, allowing Administrators to save data locally on their systems to use in reporting usage compliance.
To access Export Usage Stats:
- Go ADMIN > System and select Licensing in the Options panel.
Select the Overview tab.
The Overview tab is displayed.
Select Export Usage Stats from the Licensing Actions drop-down menu.
The Export Usage Stats dialog is displayed.
- Select a License Type, Preset Range, Date Range, and Format that you want the statistics report saved in.
Do one of the following:
- Click Export to export the report.
- Click Cancel to return to the Overview tab
Examine Decoder Service Usage Statistics in the Explore View
The Decoder has service usage statistics that can help you determine the best way to manage packet traffic, so that the Decoder is kept within the usage limits allowed by its license. These statistics are located in the /decoder/stats folder for each Decoder service, and you can see them in Administration > Explore view.
- capture.netfilter.bytes: This statistic tracks the total size of packets that were filtered out due to matching network rules. Packets are only considered filtered at this stage if the network rule specifies that the packets will not be assembled into sessions.
- capture.appfilter.bytes: This statistic tracks the total size of bytes removed from the packet stream due to application rule actions. Application rules may filter packet or truncate packets. If an application rule filters packets, the entire packet is dropped from the collection. If the packet is truncated, only the packet payload is dropped, while the header is still stored. This statistics counts up how many bytes are dropped, be they from entire packets, or dropped payloads.
- capture.processed.bytes: This statistic is equal to the total bytes processed, minus any bytes counted in the capture.appfilter.bytes or capture.netfilter.bytes statistics.