Displays SmartVision-specific statistics for the appliance:
General statistics
Error statistics
Event statistics
Rule statistics
SmartVision appliances are described in the Network Security SmartVision Feature Guide
.
Note
You can also run this command remotely from the command line of an integrated TrellixCentral Management System appliance using the central management appliance proxying mechanism.
To view smaller subsets of these statistics, use the following commands:
Syntax
show smartvision full-stats [json]Parameters
json
Display detailed SmartVision processing statistics in JSON format.
Example
The following example displays SmartVision statistics in a user-friendly format:
hostname # show smartvision full-stats ---------- Wed Oct 31 08:18:54 2018 General statistics: ZMQ receive total message count 11335700 ZMQ receive success message count 11335700 ZMQ receive success message size (279/1240/6021) ZMQ receive batch count (2/7/41) ZMQ drop count 0 File events received ok 0 Total ingested events 11335700 Total expired events 8442785 Current events per second 0 Average events per second (0/3/188) Current events in alert index 1915816 Suricata alerts consumed 3465032 Expired Suricata alerts 1549215 Suricata alerts out of range 4397 Reinjected smartvision alerts 0 Expired smartvision alerts 0 Current events in archival index 977097 Total events added to archival index 7870660 Total events removed from archival index 6893563 Total XFF events added to archival index 0 Total XFF events removed from archival index 0 Silverfish mvx events consumed 1 Expired Silverfish mvx events 1 Silverfish static analysis signatures consumed 3 Expired Silverfish static analysis signatures 3 Silverfish dynamic analysis signatures consumed 14 Expired Silverfish dynamic analysis signatures 14 Data exfil telemetry events processed 6 Total archives created 0 Time taken to create archive (0/0/0) Number of past events in archive (0/0/0) Number of future events in archive (0/0/0) Time to store alert in DB (6522/10579/12788) Time to store signature in DB (174/216/3452) Alerts total 720 Alerts duplicate 708 Alerts unique 12 Alerts suppressed 0 Alerts whitelisted 0 Alerts logged 10 Number of rules scheduled for evaluation 3877701 Number of rules evaluated 3877701 Current lag in rule evaluation 0 Evaluation lag statistics (only max is useful) (0/0/0) Number of context requests created 10 Number of context requests destroyed 10 Number of open context requests 0 Number of context requests per event (0/0/1) Number of events per context (0/22/94) Number of past events per context (0/10/42) Number of future events per context (0/11/52) Size of the event queue to the context service (0/0/461) Instantaneous size of the event queue to the context service 3 Size of the context request queue to the context service (0/0/1) Instantaneous size of the context gzip queue 0 Size of the context gzip queue (0/0/1) Time to gzip context file (221/478/1371) Number of gzip requests with no context file 2 Error statistics: . . . Event statistics: . . . Rule statistics: . . .
The following example displays SmartVision statistics in JSON format.
hostname # show smartvision full-stats json
{
"desc": "SmartVision Statistics",
"time": "Wed May 16 08:19:47 2018\n",
"wicad_core": {
"zmq_recv_msg_cnt": {
"name": "zmq_recv_msg_cnt",
"desc": "ZMQ receive total message count",
"count": 42
},
"zmq_recv_success": {
"name": "zmq_recv_success",
"desc": "ZMQ receive success message count",
"count": 42
},
"zmq_recv_success_msg_size": {
"name": "zmq_recv_success_msg_size",
"desc": "ZMQ receive success message size",
"count": 42,
"min": 357,
"max": 595,
"avg": 1103
},
.
.
.
"context_service_event_queue_overflow": {
"name": "context_service_event_queue_overflow",
"desc": "Context service event queue overflow",
"count": 0
},
"context_gzip_error": {
"name": "context_gzip_error",
"desc": "Context file gzip compression error",
"count": 0
},
.
.
.
"event_stats": {
"suri_alerts": {
"desc": "Suricata Rule Alert Counters"
},
"wicad_alerts": {
"desc": "SmartVision Rule Alert Counters"
},
"event_types": {
"desc": "Event Type Counters"
}
},
"rule_stats": {
"desc": "SmartVision Rule Statistics",
.
.
.User role
Admin, Analyst, or Operator.
Command mode
Enable
Supported appliances
This command is supported on the following appliances running the specified releases or later:
Network Security: Release 8.0