Spooling

Detecting spooling

When the STC cannot process enough hits to match the incoming rate of hits, all new hits are written to a temporary file on the local disk until the memory usage has dropped to a sufficient level that both incoming and spooled hits can be safely processed.

• When the STC begins spooling, all hits from new sessions are spooled. Hits from sessions currently stored in memory continue to be processed through memory. For this reason, the percentage at which spooling begins should always be set below 100%.

In the DecoupleEx report

• Select each processing server.
• Check Canister Status. If it is not listed as Healthy, check the following:
  • Canister Message options:
    1. High ctree Memory - The currently specified memory settings are inadequate for the load. See High ctree Memory.
    2. Non Evaluated Hits - If this figure is high, then the STC may be having difficulty processing events. See Event processing.

Spooling information is reported in the DecoupleEx System Status report. Key report values are described below.

• To access the DecoupleEx report, select Discover > System Status > DecoupleEx.
• For more information on the related report, see System Status.

In the DecoupleEx report

• Select All Servers.
• Review the Canister Status value for each Canister.
  • A message of Spooling indicates that the Canister is spooling.
• The count of hits that have been queued is listed for each Canister:
  • Queued Hits in Memory - Queued hits in memory are waiting for evaluation. A high number may indicate CPU constraints.
  • Queued Hits On Disk - Queued hits stored on disk waiting for the opportunity to be evaluated.
  • Queued Hits Total - Sum of the two values above. This figure should be divided by the Canister Hit/Sec In value for the Canister to determine the number of seconds of queued data.
  • Hit/Sec In versus Hit/Sec Out - Difference between these two numbers indicates the rate of change in queuing.
    • If this value is > 0, then additional hits are being spooled.
    • If this value is < 0, then there is capacity to begin processing queued hits.

Spooling by Server

require-text

In the DecoupleEx report

• From the drop-down, select the same Processing Server where the spooling is occurring.
• Most of the information in this report is self-evident. Some key information:
  • DecoupleEx Status - When Extended Decoupler session agent is deployed and operating properly, this value is Memory.
  • Canister Status - When the Canister is operating properly, this value is Real-Time.
  • Canister Message - When the Canister is operating properly, this value is Canister is operational. Other Canister messages:
    • High ctree Memory - STC lacks sufficient memory to process the incoming rate of hits and is spooling. Find ways to free memory. See High ctree Memory.
    • Non Evaluated Hits - STC lacks sufficient resources to process events. See Event processing.
  • Total Dropped Hits - This value should be 0 at all times. If it is not and spooling is in use, you should revisit the Extended Decoupler session agent configuration for this item to free up memory or processing and the hardware configuration of the server.
  • Current Spooled Hits - This value indicates how many hits are currently stored on disk for the specified Canister.
  • Hits In/Out Ratio - Rate of hits entering the STC divided by the rate of hits being written to the LTC
  • Time of First Hit in Spool Files - Timestamp for when the current spooling of the Canister was initiated. Use this value to determine for how the Canister has been spooling.

Configuration options to limit spooling

Spooling is initiated and managed by adding the Extended Decoupler Session Agent to each pipeline. The following checklist identifies the settings that enable and configure spooling behavior:

• Spool Triggers: Canister Max % Memory Used - When this percentage is reached, the session agent begins spooling hits to disk for the Short Term Canister and does not stop spooling until Canister Min % Memory Used is reached. The following settings can also trigger spooling:
  • Max Unevaluated Canister Hits - When this number of hits is in the STC waiting for evaluation, spooling begins. Spooling does not stop until Min Unevaluated Canister Hits is reached in the STC.
  • Max Sessions Waiting for LTC - When this number of sessions is in the STC waiting for writing to the LTC, spooling begins. Spooling does not stop until Min Sessions Waiting for LTC is reached in the STC.
  • Max Sessions Waiting for IDX - When this number of sessions is waiting for indexing, spooling begins. Spooling does not stop until Min Sessions Waiting for IDX is reached.
• Spool Drain: The rate at which the spool is emptied is determined by the following configuration settings for the Extended Decoupler Session Agent.
  • Control Outflow Rate - When set to ON, the flow of hits from the queue back to the Canister is moderated based on the following settings:
    • *Outflow Control Mode - Defines the method of how to control outflow of hits from the spool. For details, see "Extended Decoupler Session Agent" in the Unica Discover Configuration Manual.
    • *Max Outflow Hits Per Second - Depending on the Mode above, this setting specifies the maximum outflow in hits per second.
    • *Max Outflow Bytes Per Second - Depending on the Mode above, this setting specifies the maximum outflow in bytes per second.

For more information on the session agent, see "Extended Decoupler Session Agent" in the Unica Discover Configuration Manual.

• If you do not wish to enable disk queuing, you can use the lightweight predecessor to the above session agent. When memory limits are exceeded with the Decoupler session agent, the hits are simply dropped. See "Decouple Session Agent" in the Unica Discover Configuration Manual.