Monitoring and Reporting
What the exam tests
Monitoring and reporting tests health visibility, capacity and license monitoring, report creation, scheduling, and distribution.
Core rules
- Monitor component health: Data Processor throughput, Indexer disk, AI Engine queue, GlusterFS, and Log Source Health.
- Key metrics include MPS, license usage, unparsed logs, source silence, disk utilization, and alarm volume.
- Reports use normalized fields and entity scoping; a report is only as good as the parser.
- Report Center supports templates, scheduled reports, and distribution lists; verify recipient permissions.
- Dashboards are for operational visibility; scheduled reports are for recurring evidence and stakeholders.
- Audit configuration changes and report access.
Worked example
Weekly report: top alarm classifications by entity. Reasoning: choose a report template that uses alarm data, scope to the entity, set the time range to the last 7 days, group by classification, schedule delivery, and test with a one-time run. If counts look low, check time zone, entity scope, and whether alarms were suppressed.
Traps
- Reporting on raw log fields instead of normalized fields.
- Ignoring time zone in scheduled reports.
- Setting a report range longer than retention.
- Sending reports to users who cannot see the entity data.
- Monitoring only disk and missing license or MPS saturation.