Viewing Multiple Systems Status (Management Station)

The Management Station System Status is the fastest way to view the condition and status of your appliances as traffic flows through your system.

You can use this information to provide for rapid reporting to the operations staff and acquire information about syslog messages at any particular time.

The appliance list can be sorted by ID, Model, or IP Address when the page opens. Administrators can set the default sort order.

The System Status information uses a proprietary technology for optimizing and then collecting security data for immediate use. Administrators can monitor the CPU usage when necessary to check on its congestion.

Procedure

  1. Choose Dashboards > Management Station from the navigation menu.
  2. View the following sections on the Management Station tab for information about an appliance’s status. For detailed descriptions of each section, see the following table.
    • Message Statistics
    • Message Rate
    • New Alerts
    • Message Counters
  3. Click the Refresh button to view updated status information for the appliance.
    Management Station Screen Elements
    Element Description
    General information
    Software Version Management Station appliance’s software version.
    Management Station sections
    Appliances Lists the appliances in your Management Station cluster. To view the System Status for an Appliance, click its name.
    • A green square indicates the appliance is online.
    • A red square indicates the appliance is offline.
    • A blank square indicates the appliance entry is being updated.
    Message Statistics Displays the following message statistics:
    • Total, Processed, Dropped, Unapproved, and Skipped: Message processing information about each managed appliance.

      Click a number in these columns to change the displayed value to the nearest thousand, million, or billion value.

      Click the ID, Model, or IP columns to sort the appliances as required.

    • Message Rate/Sec: Message rate, per second, by time segments of 1, 5, and 15 minutes.

      Click on the message rate values to set the Message Rate graph to 4, 12, and 24 hour timescales, respectively.

    • Time Skew: Time delta, in seconds, between the Management Station appliance and each remote appliance.
    Message Rate Graph Monitors the rate at which messages are collected.

    The Message Rate graph displays the current message rate by time segments of 1, 5, and 15 minutes. For example, 1 min – 100 msgs/sec. On LogLogic ST Appliances, to the right of the minutes is the number of messages per second (xxx msgs/sec) for the appliance. xxx does not reflect the amount of messages that comes in via the LogLogic TCP protocol.

    • The pink line represents the average number of messages per time segment.
    • The blue line represents the real-time incoming message rate for your appliance.
    • The red line appears when inbound traffic exceeds the preset threshold
    New Alerts The number of activated alerts, by hour and priority (High, Medium, Low, All).

    Click an alert value to show the Aggregated Alert Log for LogLogic LX Appliance or LogLogic MX Appliance.

    Message Counters Statistics on each message category stored in the syslog database. The count corresponds to a percentage related to the total number of messages received. This is useful in calculating data retention settings and maximum syslog message rates.

    The following is a list of message counters:

    • Total Received: Total number of incoming messages for all categories.
    • Processed: Total number of messages received and parsed into the database.
    • Skipped: Total number of messages ignored by the appliance when the log source entry in LogLogic® LMI exists but is disabled.
    • Unapproved: Messages received from a log source that is not in the Manage Devices table. These messages are discarded. The most recent 100 messages are accessible from the Data Sources screen. If auto-identify is on, all messages are auto-identified and no messages are unapproved.
    • Dropped: Total number of messages recognized but not processed due to network congestion.
    Updates the system status information for your appliance.