Tracing the Optimization

The tracing feature described here is optional. However, if you want to use this feature, you must turn off the condition optimization setting. The tracing feature enables you to capture information about how your rules were optimized. The information is stored here:

server.log if you have ESM in compact mode
server.log and correlator.log if you have ESM in distributed mode

To use the tracing feature, use this property setting:

rule.dm.trace.optimize.evaluation=true

Enter the above setting in the following files:

In compact ESM, edit the server.properties file.
In distributed ESM, edit server.properties and correlator.properties files.

This setting records in the log files the original sequence of conditions and how these conditions are re-ordered (optimized).

To locate the information in the log file, search for the rule’s name. The following example shows the log statements that include the evaluated rule’s URI (shown to be under Real-Time Rules) and a sampling of the profiled values. The profile describes the average time in nanoseconds a specific condition took to process. The condition’s position is indicated by an index starting with position 0. The profile in the log indicates that the costliest condition at Index 4 took an average of 2,375 nanoseconds over a sampling of 23:

The following lines indicate the order of conditions (denoted as nodes) as originally defined. Red numbers correspond to the index:

The following lines indicate the optimized order of conditions (denoted as nodes):

Observe how nodes were moved up and down to indicate which conditions are evaluated first. Index 4, profiled as the costliest, is now evaluated last.

To save a rule in its optimized state:

If you are a content author, you can leverage this log information to modify your rule permanently. This procedure is optional.

Refer to the log's Optimized nodes section.
Edit the rule by re-ordering the rule conditions to match the log's optimized sequence.
Save the rule in its optimized state.

You may then disable the optimization tool, described in Disabling the Optimization Feature.