Manager Grid EPS

[argwfm]

Is anyone else's Grid showing a manager node w/ EPS of 0/0? Distributed v2.3.200 deployment here w/ a manager + receiver node. Manager status is OK and consuming events per Grafana but Grid isn't reflecting.

[InfosecGoon]

Does everything look normal in Grafana for those nodes? That is, does it show the expected level of traffic on the management ports and in the ingestion pipeline?

[argwfm]

Yes, everything looks good via Grafana for the manager. Checked the raw output of /sensoroniagents/api/grid and the consumption EPS is 0 as reflected w/in the Grid UI. Manager redis queue is showing ~100 event mean over the last 7 days.

[argwfm]

Just wanted to report this issue still persists w/ a fresh install using the latest SOv2.4.30 ISO.
Since upgrading from SOv2.3 forward nodes are no longer showing EPS via the Grid.
Please LMK if I can provide any additional data to support.

[dougburks]

In 2.3, there were both Production EPS and Consumption EPS:
https://docs.securityonion.net/en/2.3/grid.html

In 2.4, there is only Consumption EPS:
https://docs.securityonion.net/en/2.4/grid.html

Your forward nodes are producing logs and not consuming them and so their EPS is 0.

[argwfm]

Thanks @dougburks; missed that change. Assume there's no plans of reintroducing the production EPS for the forward nodes? Was using that as the go to for monitoring the health of the forward nodes and dependent TAP infrastructure.

[dougburks]

Assume there's no plans of reintroducing the production EPS for the forward nodes?

There are no plans of reintroducing that as it relied on functionality in 2.3 that is no longer present in 2.4.

Was using that as the go to for monitoring the health of the forward nodes and dependent TAP infrastructure.

If you go to SOC Dashboards, the default Overview dashboard has an observer.name table that should show how many logs are coming from each forward node: