What do probes and checks represent when looking at reports and statistics for ASM? When checking the logs versus the stats, the probe value seems to match the number of log entries - but the check entry is much lower. Why is that?
Probes and Checks provide two different ways of looking at how ASM is running monitors. For most users, the probe value is probably of more use.
A Check represents each time a monitor is activated and run. Each time a monitor reaches out to connect to a site, that is called a Probe. Depending on the outcome, there can be up to 3 Probes per Check - for this reason the Probe value will always be the same or higher than the Check value.
When looking in the logs, each entry for an attempt to run the monitor is logged as a Probe. The grouping of Probe attempts is the Check.
Also note that you can have up to 3 Probes per Check. Maintenance checks are not included and ignored from the final count in reports.
For more information, you can refer to the docops page:
https://docops.ca.com/ca-asm/using/scheduling-monitor-checks