Open topic with navigation

# Monitoring Rules Parameters

As announced in the 23.1 release, the Collectors feature and the Connectors in Transformation Hub (CTH) feature have been deprecated, and from the ArcSight Platform 24.2 release on, only existing collectors and CTH deployments are supported. You can continue managing your collectors and CTHs in the platform, but you cannot create any new ones.

Monitoring rules are defined by rule parameters. The following table describes monitoring rules parameters and their valid values.

Monitoring Rules Parameters

Parameter | Description
--- | ---
Name | Name of the rule. (Max. length 50 characters)
Metric Type | Criterion being measured. For valid values of Metric Type, see the Valid Values for Metric Type table, below. Each metric type has a Value Type constraining the kind of value which may be assigned to it.
Product Type(s) | Managed product type (or types) to which the rule applies. These are automatically selected based on the Metric Type. For example, if you selected a metric type that applied only to hardware, such as Voltage, only products with hardware form factors would be available for selection. You can also deselect types to which to apply the rule, as applicable.
Specific Node Selector | Click View/Choose, and then select one or more specific nodes to which the rule applies. If none are chosen, then the rule applies to all nodes of the selected Product Types.
Severity | Breach severity. Valid values are Healthy, Warning, Critical and Fatal. Thresholds for each of these values are defined by the administrator.
Aggregation | Aggregation function applied to Metric Type data points. Valid values: ANY: any value AVG: average value (numeric values only) MIN: minimum value (numeric values only) MAX: maximum value (numeric values only) SUM: addition of values (numeric values only)
Measurement | A comparison between two criteria. Valid values: GREATER: One field is greater than the other LESS: One field is less than the other EQUAL: One field is equal to the other NOT_EQUAL: Two fields are unequal
Value | Threshold value for comparison. Valid values are dependent on Metric Type. Percentage: Number from 1-100 (with no %-sign). Numeric: Numeric string. Boolean: true/false (case-insensitive) Literal Status: Status of the appliance component, and can be one of the following values: Ok, Degraded, Rebuilding, Failed, Unavailable.
Notify Me | Select one or more notification mechanisms for alerts about the rule (Email, SNMP, or Audit Forwarding).
Status | If Enabled, the rule will apply and produce alerts, as specified in Notify Me. (ArcMC rule presets are Disabled by default.)
Time Range | Evaluation interval, in hours and minutes. The total of hours and minutes must not exceed 168 hours (7 days).

Note: Compound rules (AND/OR) are not supported.

Valid Values for Metric Type

Value | Description | Value Type
--- | --- | ---
Description | Brief description of the rule. (Max. length 300 characters.) | What kind of value this is.
For Connector Appliances or Loggers only
CPU Usage | CPU usage, as a percentage. | Percentage
JVM Memory | Memory of Java Virtual Machine. | Numeric
Disk Read | Number of reads of the disk. | Numeric
Disk Write | Number of writes to the disk. | Numeric
All EPS In | Total Events Per Second in. | Numeric
All EPS Out | Total Events Per Second out. | Numeric
For Connectors only
Events/Sec (SLC) | Events Per Second (EPS) in (Since Last Checked) | Numeric
EPS In | Events Per Second (EPS) in. | Numeric
EPS Out | Events Per Second (EPS) out. | Numeric
Events Processed | Number of events processed. | Numeric
Events Processed (SLC) | Events processed (Since Last Checked). | Numeric
FIPS Enabled | 1= FIPS enabled, 0=FIPS disabled. | Boolean
Command Responses Processed | Number of command responses processed. | Numeric
Queue Drop Count | Queue drop count. | Numeric
Queue Rate (SLC) | Queue rate (Since Last Checked). | Numeric
Active Thread Count | Active thread count. | Numeric
For hardware form factor products only
Fan | Hardware fan status. | Literal Status
Disk Space | Hardware disk space status. Disk space will be reported as "degraded" if storage reaches 75% of its capacity. Other statuses are not used. | Literal Status
Voltage | Hardware voltage status. | Literal Status
Current | Hardware current status. | Literal Status
Temperature | Hardware temperature status. | Literal Status
Power Supply | Hardware power supply status. | Literal Status
RAID Controller | RAID controller status. | Literal Status
RAID Battery | RAID battery status. | Literal Status
Hard Drive | Hard drive status. | Literal Status
For Loggers Only
Storage Group Usage | Current storage group usage, in bytes. | Numeric
Storage Group Capacity | Current storage group capacity, in bytes. | Numeric
For Transformation Hubs Only
Transformation Hub All Bytes In | All bytes received by the Transformation Hub cluster. | Numeric
Transformation Hub All Bytes Out | All bytes transmitted by the Transformation Hub cluster. Note that due to the replication of each topic, Bytes Out will always exceed Bytes In. | Numeric
Transformation Hub Disk Usage | Disk usage of Transformation Hub's individual nodes. | Numeric
Transformation Hub Memory Usage | Memory usage of Transformation Hub's individual nodes. | Numeric
Transformation Hub SP EPS | Count of events per second received by Transformation Hub's Stream Processor. | Numeric
Transformation Hub SP Error | Count of events per second wating to be processed received by Transformation Hub's Stream Processor which produced an error. | Numeric
Transformation Hub SP Lag | Count of events per second waiting to be received by Transformation Hub's Stream Processor. | Numeric
For Collectors Only
Collector CPU Load Average | Average load of Collector CPU. | Numeric
GC Count | Count of Java garbage collection. | Numeric
Restart Count | Number of restarts. | Numeric
Total Memory | Total JVM memory. | Numeric
Used Memory | JVM memory in use. | Numeric