Requirement: To optimize the evaluation of event conditions, rules must be deployed in the Console’s Real-time Rules.
About:
ESM has the ability to evaluate event conditions and if necessary, re-sequence the conditions to be evaluated through a property setting.
rule.dm.optimize.evaluation=true
server.properties file.In distributed mode ESM, in addition to server.properties, the setting is defined in the correlator node's correlator.properties file. Depending on your number of correlator instances, you should replicate the same setting in each node's correlator.properties.
The reason why the same property needs to be in both properties files is that standard and lightweight rules are affected by correlator.properties; while pre-persistence rules are affected by server.properties.
This setting automates the process of evaluating and optimizing all of your deployed rules. The optimization process occurs in memory and will leave your resources intact. If there are changes, for example, real-time rules are updated, or the user de-activates and then re-activates the rule, optimization runs again.
One or more log files record the activities of the optimization process. For compact ESM, the file is server.log. For distributed ESM, the log files are server.log and correlator.log files.
The following line in the applicable log file denotes the end of optimization:
End of conditions optimization in <n> events
Refer to the ESM Administrator’s Guide’s Configuration section for more information:
server.log file, refer to the topic, “Configuring Manager Logging.”