Reviewing sensor health details

Prev Next

The Sensors page shows the health of each sensor in your Helix Enterprise environment.

To open the Sensors page:

  • Select Manage > Sensors.

  • Click View All Sensors in the Sensors Needing Attention widget on the Operational Dashboard.

Note

Sensors that have been disconnected for more than seven days are not shown.

Sensor health data is collected only for the latest versions of standalone Cloud Collector and Comm Brokers. Sensors integrated with MVX Smart Grid, Cloud MVX, and Packet Capture appliances are not included.

The following information is provided for a sensor.

  • If a value is 0, 0% is displayed.

  • If no data is available for a value, dashes are displayed.

  • If a value is less than 1%, but greater than 0, <1% is displayed.

  • All other values are rounded up or down to the nearest integer. For example, 1.2% rounds down to 1% and 1.5% rounds up to 2%.

Health information

Description

Status

The status of the sensor.

  • Disconnected: The sensor is disconnected. No data has been received for at least six hours.

  • Warning: The sensor operational, but has some minor health problems. Either the root disk is more than 85% full or the maximum packet loss by the Suricata network detection engine, the Bro Network Security Monitor, or packet captures (pcap) is greater than 5%.

  • OK: The sensor is operational and has no significant packet loss.

ID

The sensor ID.

Suricata Loss

The percentage of packets lost from the Suricata network detection engine.

Bro Loss

The percentage of packets lost from the Bro Network Security Monitor. If the percentage packet loss is greater than 5%, the value is shown in orange.

PCAP Loss

The percentage of packets lost from all packet captures (pcap).

Memory Usage

The percentage of memory used for packet transfer by the sensor.

Disk Usage

The percentage of disk space used for packet transfer by the sensor.

Last Check In

The last time Helix Enterprise obtained health information about the sensor.

Name

The hostname (sender name) of the sensor.

EPS

The EPS rate generated by the sensor from five minutes ago. This may include forwarded syslog events and network traffic metadata.

Bandwidth

The bandwidth of the sensor in megabits per second (Mbps).

Delete

Click the icon to delete a disconnected sensor.