Data Feed Health
The Data Feed Health page shows whether data is arriving in SentriaOne xSIEM. Check it first when dashboards show less data than expected.
Menu: System › Data Feed Health
| Panel | Description |
|---|---|
| Data Freshness | Time since the last event was received |
| SPAN Feed | Status of the packet mirroring feed, for example LIVE, and when mirrored traffic was last seen |
| SPAN Presence | Rate of mirrored traffic received over time |
| Analyzed Traffic Throughput · Peak | Peak analyzed throughput over time: total, sent (upload), and received (download) |
| Log Ingest Rate — per Log Source | Rate of log events received per log source over time |
What to check
| Symptom | Check |
|---|---|
| Data Freshness shows a long time since last event | Whether the sensor and data sources are running and connected |
| SPAN Feed is not live, or SPAN Presence drops to zero | Whether the mirror port or TAP is still sending traffic to the sensor |
| Analyzed throughput is much lower than expected | Whether all required network segments are mirrored |
| Log Ingest Rate shows No log events in this time range | Whether log sources are configured to send logs, or widen the time range |