Data LakeData Lake Administration Guide

Parser Management

Parsers are individually managed for performance and can be paused by Exabeam Data Lake . Automated Data Lake action is based on the performance thresholds from a holistic standpoint to maintain system operability.

How to Set Parser Policy

You can select the parsing policy that determines whether Exabeam Data Lake . prioritizes parsing of all ingested raw logs, events per second throughput, or a balance of both.

For custom parsers, you can adjust the threshold for pausing parsers based on resource priority:

  1. Navigate to Settings > Parsers Management > Parsers Management.

    parsers management
  2. In the Parser Policy panel, the currently active parser policy is shown at the bottom of the text.

    data lake parser policy

    Click EDIT to expand the configuration options. Select the performance preference that best suites your operation and less likely to trigger the parser to be paused. The categories are defined by the parser's impact to performance.

    parser policy selection

    The thresholds are:

    Optimized for parsing -- The parser has consumed more than 80% of Data Lake log processor performance.

    Balanced -- The parser has consumed more than 50% of Data Lake log processor performance.

    System Focused -- The parser has consumed more than 30% of Data Lake log processor performance.

  3. Click APPLY to implement your preference. The parsing policy takes effect immediately. There is no need to restart services.

How to View Parser Performance

You may want to see how performance for a paused parser has changed after setting the parser policy or verify that parser performance is acceptable overall. The data is available within 7 days of a pause. You can view performance per parser at the Parser Management menu by clicking View in the PARSER STATISTICS column. The usage, average parsing time, average system parsing time, performance change, and time of the reading are cumulatively displayed.

DL parser statistics

To see parser performance data for a specific parser, navigate to Settings > Parser Management > Parsers Management > click View for the parser in the Parser Statistics column.

How to Re-enable Paused Parsers

Parsers may be paused by based on the performance threshold set by the Parser Policy. Parsers can be manually resumed but be aware they can be re-paused if the performance threshold is breached again.

To resume a paused parser:

  1. Navigate to Settings > Parsers Management > Parsers Management.

    parsers management
  2. Review the list of Paused Parsers. If you have resolved the cause of the slow parser, you may re-enable the paused parser by clicking START or the PARSE NAME checkbox for a batch start.

    data lake paused parsers