Support Support Downloads Knowledge Base Juniper Support Portal Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

What is the Difference between Count and Event count in STRM



Article ID: KB16264 KB Last Updated: 19 Jan 2010Version: 1.0
STRM Event Viewer shows two columns Event Count and Count.  What is the difference between these two count values?
When Viewing events in STRM - it is possible to see Count and Event Count (as shown below):

Events with Same Src IP, Dst IP, Dst Port, QID and Category (Identical Events) within a specified time (10 secs) are coalesced together in STRM.  The coalescing time is not configurable; events can either be coalesced or non-coalesced.

Event count is total count (non coalesced)
Count is coalesced count

To alter coalescing for a specific log source, edit the Coalescing Event parameter in the log source configuration. (Admin > Log Sources > Edit the log source)

STRM License is calculated based on Event Count (non coalesced value)

Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Getting Up and Running with Junos

Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search