Using Event Data Analytics for understanding SMP Server performance

Products

• IT Management Suite

Issue/Introduction

You have noticed a very active events queue. A lot of NSEs seems to be coming in and out of the events queue (C:\ProgramData\Symantec\SMP\EventQueue\EvtQueue) on your SMP (Symantec Management Platform) Server. However, you are not sure if there is something that may be misconfigured and causing such activity.
Maybe there is a policy or task that potentially having an adverse impact on the general SMP Server performance.

Environment

ITMS 8.8

Resolution

With the ITMS 8.8 Release, there is a new feature for System Health: Metadata Statistics (for Event Data Analytics).

There are three new reports in SMP Console which benefit from this new feature:

• Pending Events: NSE files currently in queue by product/source
• Processed Events Summary: Summary of NSE files processed within defined time period by product/source
• Processed Events Timeline: Batches of NSE files from particular product/source processed at various points in time

In the SMP Console, Go to Reports > Notification Server Management > Server > Event Queue > Metadata Statistics 

1. "Pending Events" report shows current NSE queue on SMP Server which are not yet processed.
   Possible to identify which product, source causes lot of events in queue and see their common size, count of events files.
   
   
   
   
2. "Processed Events Summary" report shows summary of processed event types for defined period of time.
   Possible to see summarized information by source, product specifying required time period to see processed common amount of events, their size and taken CPU time to process them.
   There are drilldown reports available from this primary report:
   • • Timeline by Source
     • Computer Summary by Source
     • Full History by Source
       
       
3. "Processed Events Timeline" report shows list of processed event types, that were saved into database
   Possible to see what events types are processed and how often per specified time period. User can see there event count, event size, CPU time taken to process these events.
   There are drilldown reports available from this primary report:
   • • Computer Summary of Time Range
     • Full History Timeline of Time Date
     • Source History Timeline
       
       

"Processed Events Summary" and "Processed Events Timeline" reports allow "Timeline by Source", "Computer Summary by Source" and "Full History by Source" drill-down reports via right click menu.

These three new "Pending Events" (accessible from Event Queue Status section), "Processed Events Summary", and "Processed Events Timeline" reports (both accessible from Processing History section) can be launched from "Core Performance" Console page ("How to use Core Performance page"):

These reports should give you enough visibility on what policy or task may be too aggressive, what NSEs are coming in large quantities (from what policy/task), when most of those events came to the SMP Server, what computers may be the ones sending most of those events, etc.
Here, you should be able to use common sense in determining what you should adjust in order to reduce unnecessary consumption of server resources.

Additional Information

"Allow/disallow new feature for NSE categorization processing"
"Core Performance: Connections on NS machine (TCP / IIS / WS)"
"Troubleshooting NSE processing issues"