Status Menu

The Status menu allows you to monitor the status and performance of Snare Central.
This includes general system information, events statistics, summaries of the data in the data store and general health check information.

The key sub-categories are:

Collection Status - Agent Information

This objective displays an overview of the systems that have recently reported to Snare Central.  The number of days of historical data to query is configurable.  Ensure to Regenerate the objective to review current information.  The output is available as a CSV and PDF attachment.

General Statistics

This objective provides a number of graphical displays, summarising the data currently held in the Snare Central data store.

Tabs include:

  • A stacked horizontal bar graph of events per month.
  • A vertical bar graph of total events for the current year.
  • A vertical bar graph of events per second, per day, for the last 12 weeks.
  • A collective clickable graph that displays total number of events, compressed storage size, and average compressed bytes per event for each log type, and each agent within the log type.
  • A pattern map of events per system over the last 12 weeks.

A horizontal graph of total events per system, sorted by system.

Monitor Live Data

This objective provides a way to preview the events that are being received by Snare Central live. It is designed for debugging and event collection health checking, rather than for auditing the exact events received by the server.

The box on the left lists all of the Log Types for the incoming Events, and the number of bytes received for each Log Type. Clicking on a specific Log Type filters the other displays to make it easier to drill down and see specific events coming into the server.

The box on the right lists all of the Servers or hosts that are sending events to Snare Central. Like the Log Types list, it shows the number of bytes received. Clicking on a Log Type will filter the Servers listed in this box to only those that have sent events of that specific type.

The bottom box shows the last 10 events received, to provide a preview of the events coming in for the selected Log Type and Server.

This objective consumes system resources while active. It may have a small negative effect on event collection rates if left open for long periods of time.

Snare Health Checker

This objective provides a 'health check' for Snare Central by querying the status of key functions of Snare Central, including, but not limited to:

  • licensing,
  • whether the key services are still functioning,
  • reporting agents,
  • integrity checks
  • the amount of disk space available and,
  • status of the Reflector/Collector disk cache.

Functions are configurable via the "Configure" tab and includes:

  • reports may be configured to be emailed when there is an exception (any issues) in the Snare Health Checker
  • disk space thresholds
  • agent event volumes and reporting
  • discarding event reporting

It is recommended that any (red) problem indications are reported and resolved immediately.

Warning messages (in orange) should be investigated when time permits.

Unlike most other Snare Central objectives, it is not necessary to 'regenerate' this objective. The results are calculated 'on the fly' every time it is loaded.

System Status

This objective provides the details of the Snare Central status. It includes hardware description, operating system distribution, uptime and information and graphs on CPU, network, memory, swap and mounted file system usage.