Hit Count Question

[gimeb]

I have created a dashboard which contains one panel with Events Over Time and another panel which lists applications residing on the server. See the attachment

The Events Over Time panel shows two applications with numbers next to each: RecallService (278) and WarrantyAPI (52) and (2062). It also have (2392) and count per 10s (2392). Does it mean that during 10sec the RecallService application was hit 278 times and WarrantyAPI 52 times.

On EMDCS Consumer Application panel there are many applications with number next to each. Please let me know what this number represent. If this is a count - then which period does it cover

[hsmith]

Does it mean that during 10sec the RecallService application was hit 278 times and WarrantyAPI 52 times.

Nope, that's how many times EVERYTHING was hit on that panel, including the *, which is generating the most pieces of information. The 278 and 56 represent the amount of times it was hit during the duration you have set, which is 15 minutes.

Please let me know what this number represent. If this is a count - then which period does it cover

This is the amount of logs matching whatever that chart is looking for that came in during the 15 minutes you have it set up for.

[gimeb]

I am trying to gage the access of applications and these number are not very clear to me. I am still not clear on the counts.

You have indicated that "The 278 and 52 represent the amount of times it was hit during the duration you have set, which is 15 minutes".
1. Does this mean that RecallService app was hit 278 times during 15min and WarrantyAPI - 52 times during 15min interval?
2. The 2062 looks to me like total number of requests for same time of 15min. Please confirm
3. The 2392 is the total of all the numbers (278+52+2062) and I do not understand what the "count per 10sec" is related to if everything else is based on 15min interval

You said that the number next to each application on the "EMDCS Consumer Applications" panel is "the amount of logs matching whatever that chart is looking for that came in during the 15 minutes you have it set up for".
1. Does the log matching means how many times the application was hit during 15min.

[jolson]

You have indicated that "The 278 and 52 represent the amount of times it was hit during the duration you have set, which is 15 minutes".

1. Does this mean that RecallService app was hit 278 times during 15min and WarrantyAPI - 52 times during 15min interval?

That is correct.

2. The 2062 looks to me like total number of requests for same time of 15min. Please confirm
2062 is the total number of all of the logs visible on that dashboard in the last 15 minutes of time, again you are correct.


3. The 2392 is the total of all the numbers (278+52+2062) and I do not understand what the "count per 10sec" is related to if everything else is based on 15min interval
Remember that logs can be counted twice. Your 'RecallService' logs will be counted inside of your '*' logs. Thinks of it this way, you have three logs:

I am a log
I am also a log
I am the third log

You have two queries:
"I am a log"
*

Your second query (*) will return (3) results, because it matched every log, while your top query will return (1) result. If you add those numbers together, you have a total greater than the amount of logs you actually have on the system.

1. Does the log matching means how many times the application was hit during 15min.
That is correct - for instance in your included picture the server 'recallservice' sent 278 logs to Nagios Log Server, while the server 'mymazdacustomer' sent a single log.

[gimeb]

Please clarify the #3 for me.

1. I though that these queries are exclusive, i.e. the numbers for RecallService (278) and WarrantyAPI (52) represent the counts only for these two applications and nothing else. Please confirm
2. As per your explanation the "2392 hits" is not the sum of all numbers (278+52+2062) and it represents some other count. Is this true?
3. I am still not clear on the "count per 10s". What does the 10s represents if everything else is based on 15min interval
4. As you can see I am trying to represent activity for particular applications on "Events Over Time" panel and this is what I came out with. Would you recommend doing it this way or you have a better way to create queries.

[hsmith]

1. I though that these queries are exclusive, i.e. the numbers for RecallService (278) and WarrantyAPI (52) represent the counts only for these two applications and nothing else. Please confirm

Correct.

2. As per your explanation the "2392 hits" is not the sum of all numbers (278+52+2062) and it represents some other count. Is this true?

Where are you getting that from? It's all the logs that are on the dashboard for the 15 minute timeframe you have selected.

3. I am still not clear on the "count per 10s". What does the 10s represents if everything else is based on 15min interval

Count per 10sec is the way the chart breaks it down, I believe. The chart spans 15 minutes.

4. As you can see I am trying to represent activity for particular applications on "Events Over Time" panel and this is what I came out with. Would you recommend doing it this way or you have a better way to create queries.

I believe you are approaching it the correct way.