topic Are _internal per_host_thruput logs always created for hosts logging events? in Getting Data In

Are _internal per_host_thruput logs always created for hosts logging events?

pj — Tue, 01 Feb 2011 02:00:23 GMT

We have seen situations where hosts logging a small number of events do not seem to be getting any _internal host_thruput_logs. Is there a certain volume amount that must be hit before a reporting hosts gets an associated _internal log?

Re: Are _internal per_host_thruput logs always created for hosts logging events?

ziegfried — Tue, 01 Feb 2011 02:13:07 GMT

Only the top 10 hosts are logged this way by default. You can override this in limits.conf:

[metrics]

maxseries = <integer>
* The number of series to include in the per_x_thruput reports in metrics.log.
* Defaults to 10.

Re: Are _internal per_host_thruput logs always created for hosts logging events?

pj — Mon, 28 Sep 2020 09:23:48 GMT

Pretty sure that it is not related to this. We have plenty of hosts (over 200+) coming into our indexers from this particular forwarder. All the hosts show up in the _internal index with per_host_thruput data apart from a handful which do not.

Re: Are _internal per_host_thruput logs always created for hosts logging events?

gkanapathy — Tue, 01 Feb 2011 15:09:17 GMT

I suspect ziegfried is correct. In any given 30-second interval, only the top 10 hosts are logged. If some hosts are never logged, it is probably because they are never in the top 10. You can have many hundreds logged if your top 10 are changing a lot.

Re: Are _internal per_host_thruput logs always created for hosts logging events?

ziegfried — Mon, 28 Sep 2020 09:23:53 GMT

You can check yourself how much series are logged per interval by executing a search like this: index=_internal source=*metrics.log group=per_host_thruput | timechart span=30s dc(series) as dc_hosts | stats avg(dc_hosts) max(dc_hosts) min(dc_hosts)