Skip to main content

Check out Interactive Visual Stories to gain hands-on experience with the SSE product features. Click here.

Skyhigh Security

Using events in rules to measure rule set processing time

You can measure the time it takes to process an individual rule set by inserting rules with measuring events into it.

The reason for measuring processing time could be that you want to know whether performance is improved or reduced after you have applied changes to a rule set.

The events for measuring rule set processing time control an internal stopwatch on an appliance. The following events are available:

  • Stopwatch.Start — Starts the internal stopwatch
  • Stopwatch.Stop — Stops the watch
  • Stopwatch.Reset — Resets the watch

Each of these events takes a string parameter to indicate which rule set it measures. For example, an event that starts the internal watch to measure the processing time of the URL Filtering rule set, would appear in a rule as follows: Stopwatch.Start ("URLFiltering").

Rules for measuring processing time

A rule that uses, for example, the Stopwatch.Start event to start measuring processing time for the URL Filtering rule set could look as follows:

Name
Start stopwatch for rule set
Criteria          Action             Event
Always     –>     Continue     –     Stopwatch.Start (“URLFiltering”)

To measure the time consumed for processing the rule set, you need to place a rule with the starting event at the beginning of the rule set and another one that contains the stopping event at the end.

However, if you have rules in a rule set that can execute a Stop Rule Set, Stop Cycle, or Block action, you also need to insert a stopping event into each of these rules.

A URL filtering rule with an event to stop the internal watch inserted would look as follows:

Name
Allow URLs in URL Whitelist
Criteria                             Action                 Event
URL matches in URL Whitelist     –>  Continue             – Stopwatch.Stop (“URLFiltering”)

When this rule is applied, it stops processing the URL Filtering rule set because the URL that a user requested access for has been found to be on the list of allowed URLs.The stopping event must therefore be inserted into this rule.

This is required because the rule with the stopping event at the end of the rule set is then not processed as the whitelisting rule stops processing of the rule set before this rule is reached.

Logging measured processing time

You can log the time that has been measured for rule set processing. Two properties are available for this purpose, which you can use in logging rules.

  • Stopwatch.GetMilliSeconds — Time measured for rule set processing in milliseconds
  • Stopwatch.GetMicroSeconds — Time measured for rule set processing in microseconds

Both properties have a string parameter, which indicates the rule set that processing time was measured for.

For example, a property for logging the processing time of the URL Filtering rule set in milliseconds would appear in a logging rule as follows: Stopwatch.GetMilliSeconds ("URL Filtering").

  • Was this article helpful?