Optimizing the Evaluation of Event Filters for Data Monitors

The information described here applies to correlation data monitors that use event filters. This topic is written for advanced content authors. The topic describes how to automate the optimization of event conditions to reduce impact on CPU usage.

Evaluating event conditions is one of the most resource-intensive operation in event processing. ESM evaluates event conditions in the sequence they appear on the filter’s Filter tab. The following example shows event conditions:

The outer and inner nodes indicate nested conditions. As a guideline, order these conditions from the most economical to the most expensive by putting the least costly condition on top. However, this may not be enough; you must also consider the TRUE/FALSE rate and whether you are using OR or AND operators.