Introduction
Logsign counts events at each stage of the log pipeline (collection, parsing, indexing, archiving, correlation) and shows them as time series on the Event Stats page. This article explains how to open the page and what each chart and series means.
Stats:
In the Logsign Unified SecOps Platform web interface, go to Settings > Maintenance > Event Stats. The menu item is shown only to users whose role grants access to this page.
Two selectors at the top right control all charts on the page:
- EPS / EPM: Shows values as events per second (EPS, default) or events per minute (EPM).
- Time range: 30 Minutes (default), 1 Hour, 3 Hours, 6 Hours, 12 Hours, 1 Day, 2 Days, 3 Days or 7 Days. The aggregation interval is set automatically from the range (1m for 30 Minutes and 1 Hour, 5m for 3 Hours, 10m for 6 Hours, 30m for 12 Hours, 1h for 1 Day, 2h for 2 Days, 3h for 3 Days, 6h for 7 Days) and is shown in each chart title as "(Time Interval ...)".
A series is drawn only when it has data in the selected range, so some series below may not appear on your system.
General Event Stats AVG:
Log: Syslog events received from sources defined in Data Collection.
Flow: Flow records received by the flow collector.
Poller: Events collected by API pollers.
Leaf: Events received from Leaf Mode nodes.
Alert: Events received by the correlation engine.
Total: The sum of all series above.
Correlation Engine:
Shows a single series (alert): the number of events received by the correlation (alert) engine for evaluation against alert rules.
Parser:
received: Raw events that reached the parser service.
processed: Events that the parser normalized and mapped according to the source's plugin and passed on to the next services.
failed / unknown: Events the parser could not process. These series appear only when such events occur.
Index:
Shows a single series (index): the number of normalized events successfully written to Elasticsearch by the indexer. Elasticsearch is the service that makes logs searchable in the web interface.
Log By Source Type:
Shows incoming events broken down by collection type (Log, Flow, Poller, Leaf, Alert) together with their total.
Persist:
JSON Archive: Normalized events written to the archive. Events collected on the Logsign Unified SecOps Platform are stored in the Archive after they are processed.
5651 Archive(raw): Raw events archived according to Law No. 5651.
Filtered: Normalized events excluded from the archive.
Filter:
Shows events that were intentionally excluded, one series per service (syslog, poller, parser, raw_persist, parsed_persist, index). On the syslog side, events are counted here when the source is disabled, when they are excluded by a Data Policy, or when they are removed by the source's input filter.
See also: https://support.logsign.net/hc/en-us/articles/360009693079-Data-Policies-DPM-
Drop:
Shows events that were lost or rejected. Series are named <service>_<reason>, for example:
syslog_deny: Syslog events rejected because the sending IP does not match any source in Data Collection. The per-IP breakdown is in the Unknown Sources chart.
<service>_dropped: Events a service could not pass on (for example a full queue or a failed publish). Possible services: syslog, flowd, poller, parser, raw_persist, parsed_persist, alert, index, rule-flow.
<service>_failed: Events a service failed to process or write. Possible services: syslog, flowd, raw_persist, parsed_persist, index, rule-flow.
Any rising drop series indicates data loss and should be investigated on the related service.
Backlog (JetStream pending + lag, ES in-flight):
Shows the backlog waiting in front of the indexer (index_lag) and the archive service (parsed_persist_lag). A steadily growing backlog means the service is falling behind and events may be discarded once the queue limits are reached, so watch this chart before drops start.
Unknown Sources:
Shows, per source IP, the events sent to the syslog port by devices that are not defined in Data Collection. Only the 100 IPs with the most events in the selected range are drawn.
Denied Facilities (defined device, unmatched facility):
Shows syslog events from IPs that are known to Data Collection but were rejected because no source definition matched their facility. Each series is labeled "IP (facility)". Only the 100 series with the most events are drawn. If you see a device here, check the facility setting of its source in Data Collection.