Monitoring Event Statistics

You can verify whether the Event Statistics function is available for a specific probe by running the probe with the –dumpprops option. If the EventLoadProfiling property appears in the list of properties, then the Event Statistics function is available for that probe.

If the function is not available, setting the EventLoadProfiling property or the -eventloadprofiling command line option will cause an Unknown Property error.

To enable the Event Statistics function, set the EventLoadProfiling property or the -eventloadprofiling command line option to true. To disable the function, set it to false.

The following table describes the rules functions that are available when the Event Statistics function is enabled. As with the setting of the EventLoadProfiling property, if you include any of the following functions in the rules file of a probe that does not support Event Statistics, the probe writes an error to the probe log,

Table 1. Event Statistics functions

Function name

Description

get_endpoint_load (endpoint_name)

This function reports the total event count at the endpoint. Invalid endpoint or disabled event statistics will return a negative value.

Example:

$ns_endpoint = "PRE_RULE_EVENTS"
$ns_endpoint_load = 
  get_endpoint_load($ns_endpoint)
log(DEBUG, $ns_endpoint + " endpoint load:  
  [" + $ns_endpoint_load  + "]")

get_endpoint_event_count (endpoint_name)

This function reports the total event count at the endpoint. Invalid endpoint or disabled event statistics will return a negative value.

Example:

$ns_event_count = 
  get_endpoint_event_count("PRE_RULE_EVENTS")
log(DEBUG, $ns_endpoint + " endpoint event count:  
  [" + $ns_event_count  + "]")

get_endpoint_names()

This function returns the names of the endpoint counter in a semicolon-delimited list. At least one endpoint name will be returned, that is PRE_RULE_EVENTS.

Example:

$obtained_endpoint_name = 
  get_endpoint_names()
log(DEBUG, " endpoint name:  
  [" + $obtained_endpoint_name  + "]")

get_endpoint_annotation (endpoint_name)

This function returns the annotation describing the endpoint. For example, it may include a description of the type of events being measured.

Example:

$obtained_endpoint_annotation = 
  get_endpoint_annotation($obtained_endpoint_name)
log(DEBUG, " endpoint annotation:  
  [" + $obtained_endpoint_annotation  + "]")