Draining the Short Term Canister refers to when one or more of the thresholds used to monitor STC health is exceeded, and the Extended Decoupler begins the queuing process to let the Canister process the existing session data.

For example, if the maximum number of unevaluated hits reaches a threshold, the Extended Decoupler begins queuing hits, which allows the Short Term Canister to drain its store of unevaluated hits: aggregating hits into sessions, sending interesting hits to the Long Term Archive, and deleting non-interesting session data.

The Extended Decoupler monitors the following thresholds to determine whether the Canister needs to drain:

• ctree cache usage level
• processing unevaluated hits
• processing sessions waiting to be archived
• processing sessions waiting to be indexed.

The Extended Decoupler keeps track of the hit arrival rate and the hit departure rate as hits pass through the capture socket pipeline into the Canister. If the Canister is healthy, hits pass through without being queued. The health of the Canister is determined by examining the following conditions in the Short Term Canister:

• Number of unevaluated hits versus evaluated hits
• Number of sessions waiting for long term archive
• Number of sessions waiting to be indexed
• Maximum percentage of Faircom Cache used

Each of the above values is configurable. The size of the values depends greatly on the size of the computer on which the CX Server is installed. These values are given equal priority.

• If one value is over the threshold, Extended Decoupler stops sending hits to the Canister and begins queuing hits until the minimum threshold value is reached. For example, when the Short Term Canister size is greater than 1 GB, queuing may begin, and hits are queued until the STC size is less than 500 MB.

After the system has regained healthy status, the Extended Decoupler sends queued data into the Canister at an outflow rate specified in the session agent configuration settings. The outflow rate acts as a governor on data flow so hits don't immediately overflow the Canister.