Environment
- CB Response: All Versions
- Microsoft Windows: All Supported Versions
- Apple Mac OS: All Supported Versions
- Linux: All Supported Versions
Question
How are sensor health scores calculated?
Answer
The default score for a sensor running without issue is 100, with unhealthy symptoms subtracting from this score for events that fall outside of “healthy range,” based on severity.
- Example: A sensor experiencing high memory usage would be graded based on the below scale.
|
Memory (MB)
|
Health Score
|
Message
|
|
> 50
|
-5
|
Elevated memory usage
|
|
> 100
|
-10
|
Elevated memory usage
|
|
> 200
|
-20
|
High memory usage
|
|
> 512
|
-25
|
Very high memory usage
|
|
> 1024
|
-50
|
Excessive memory usage
|
Additional Notes
- Sensor health messages are not currently available in the console, but can be accessed via SQL queries (and API).
- In CB Response server release 6.2.4, we will provide the sensor health message on the sensor page within the console UI.
- Sensor health messages are provided when the sensor is in an unhealthy state.
- Sensor health scores are generated using a variety of inputs, such as:
- Event Load
- Event Loss
- Disk Space
- Handle Count
- Memory Usage
