PEM statistics tables

F5 BIG-IP Policy Enforcement Manager (PEM) exposes a set of statistics tables that help you monitor subscriber sessions, policy enforcement, protocol interactions, and system performance. Use these tables to verify that PEM is working as expected, identify issues early, and troubleshoot problems in your deployment.

This reference covers each statistics table, its fields, and troubleshooting tips to help you interpret the data.

Before you begin

To view PEM statistics, run the tmctl command on the BIG-IP system. For example:

tmctl -d blade pem_actions_stat

Use the -w flag to set the column width for readability:

tmctl -d blade -w 300 pem_sessiondb_rtt_stats

pem_actions_stat

This table tracks policy enforcement actions. Use it to verify that PEM is applying the correct action (pass or drop) to each flow and to identify the reason for any dropped flows.

Supported actions

PEM supports the following enforcement actions:

• Gate status (allow or drop)

• UDP rate pacing

• TCP optimization

Fields

Counter	Description
pass	Number of flows that passed (gate enabled).
drop	Total number of dropped flows. This value is the sum of all drop_* counters listed below, plus any flows dropped by a policy rule action set to drop.
reeval_cnt	Total number of policy reevaluations.
reeval_max	Highest number of policy reevaluations in the current window.
tcpopt_to_net	Number of flows with TCP optimization applied to the uplink (network) side.
tcpopt_to_sub	Number of flows with TCP optimization applied to the subscriber side.
drop_no_session	Flows dropped because no matching session was found.
drop_dssm_timeout	Flows dropped because the Distributed Session State Manager (DSSM) did not respond in time.
drop_dssm_err	Flows dropped because DSSM returned an error or was unavailable.
drop_session_cleanup	Flows dropped because the session was being cleared or had moved to another pod.
drop_policy_gate	Flows dropped because a PEM gate policy is explicitly set to drop.
drop_ingress	UDP or non-TCP ingress data that arrived after a drop was signaled but before the flow was fully removed.
drop_egress	UDP or non-TCP egress data that arrived after a drop was signaled but before the flow was fully removed.
drop_server_side_flow	Flows dropped because a new server-side flow arrived for unknown traffic.
drop_redirect_fallback	Flows dropped because an HTTP redirect failed and the fallback action is set to drop.

Drop counter relationship

The drop counter is the sum of all individual drop reasons:

drop = drop_no_session + drop_dssm_timeout + drop_dssm_err + drop_session_cleanup
 + drop_policy_gate + drop_server_side_flow + drop_redirect_fallback
 + drop_ingress + drop_egress + (policy rule action drops)

If drop does not equal the sum of all drop_* counters plus policy-action drops, report this as a defect.

Key Diagnostics

• drop_dssm_timeout or drop_dssm_err increasing: These counters point to a DSSM connectivity or performance issue. Check DSSM reachability and review the pem_dssm_rtt_stats table.

• drop does not match the sum of drop_* counters: This indicates a counting inconsistency.

• Any drop_* counter increasing unexpectedly: Investigate each counter individually to determine whether the drops are expected (for example, a policy gate set to drop) or indicate a problem.

pem_sessions_stat

This table tracks the full lifecycle of PEM subscriber sessions, including how sessions are created, provisioned, updated, deleted, and how IP addresses are assigned.

Columns

Every row in this table includes three columns:

Column	Description
current	Number of sessions in this state right now.
max	Highest value that current has reached since the last reset.
total	Total number of sessions that have entered this state at least once since the system started.

Session lifecycle states

Field	Description
sess_active	Sessions currently active in PEM (not yet marked for deletion).
sess_del_marked	Sessions marked for deletion but not yet fully removed.
sess_del_total	Total number of session deletions completed.

Provisioning states

Every active session is in exactly one of the following four states at any time. The current values of these four fields should add up to sess_active.current.

Field	Description
sess_prov_wait	Session is waiting for the first provisioning response (from Gx, Sd, static config, or iRule).
sess_prov_hold	Session is held before provisioning starts (for example, during late binding).
sess_provisioned	Session has active policy rules installed and is fully provisioned.
sess_prov_fail	The most recent provisioning attempt for this session failed.

The following fields are derived counters that overlap with the four states above. They are not part of the partition.

Field	Description
sess_not_provisioned	Sessions that don't currently have active policy rules. This includes sessions in sess_prov_wait, sess_prov_hold, or sess_prov_fail.
sess_prov_after_hold	Sessions that became provisioned after being held in sess_prov_hold.
sess_prov_no_rad_att	Non-static sessions that have not yet received RADIUS attributes. Clears when RADIUS attributes arrive.

Provisioned-by source stats

These counters indicate which protocol or mechanism provisioned each session.

Field	Description
sess_prov_by_gx	Provisioned by a Gx interface (Policy and Charging Rules Function, or PCRF).
sess_prov_by_sd	Provisioned by an Sd interface (Traffic Detection Function).
sess_prov_by_rad_aaa	Provisioned by RADIUS authentication, authorization, and accounting (AAA).
sess_prov_by_irule	Provisioned by an iRule.
sess_prov_by_static	Provisioned by a static (pre-configured) subscriber policy.

Sessions added by source stats

These counters show what triggered the creation of each session.

Field	Description
sess_added_by_rad	Created when PEM received a RADIUS Accounting-Start for a subscriber with no existing session.
sess_added_by_dhcp	Created when PEM saw a new DHCP lease assigned to a subscriber.
sess_added_by_dhcp_leasequery	Created from a DHCP Lease Query response (for example, after a restart to recover state).
sess_added_by_traff	Created by data-plane traffic. This is the sum of sess_added_by_clnt_traff and sess_added_by_svr_traff.
sess_added_by_clnt_traff	Created when the first packet of a new flow arrived from the subscriber (client) side and no session existed.
sess_added_by_svr_traff	Created when the first packet of a new flow arrived from the network (server) side and no session existed.
sess_added_by_irule	Created explicitly by an iRule (for example, a PEM::session create call).
sess_added_by_static	Loaded from the static subscriber database rather than triggered by a live event.

Session updates stats

Field	Description	Notes
updates	Total session-update attempts from all sources.	Increments when the request is received, before the outcome is known.
updates_ok	Update attempts that succeeded.
updates_from_rad	Updates triggered by a RADIUS Interim-Update.
updates_from_gx	Updates triggered by a Gx message (Re-Auth-Request or Credit-Control-Answer Update).
updates_from_sd	Updates triggered by an Sd message.
updates_from_irule	Updates triggered by an iRule.
updates_from_dhcp_leasequery	Updates triggered by a DHCP Lease Query response.

Session deletions stats

The sess_del_total counter breaks down by the session’s provisioning state at the time of deletion and by which source requested the deletion.

Field	Description
sess_del_provisioned	Session was provisioned when deleted.
sess_del_prov_wait	Session was still waiting for provisioning when deleted.
sess_del_prov_fail	Session was in a provisioning-failed state when deleted.
sess_del_replaced	Session was deleted because it was replaced (for example, when an IP was reassigned to a new session).
sess_del_by_rad	Deleted by a RADIUS Accounting-Stop.
sess_del_by_gx	Deleted by a Gx request.
sess_del_gx_problem	Deleted because the Gx link or session broke unexpectedly, not because of a normal Gx-initiated delete.
sess_del_by_sd	Deleted by an Sd request.
sess_del_sd_problem	Deleted because of an Sd link failure (similar to sess_del_gx_problem).
sess_del_by_dhcp	Deleted by a DHCP lease-release event.
sess_del_by_dhcp_leasequery	Deleted because a DHCP Lease Query indicated the lease no longer exists.
sess_del_idle	Deleted because the session reached the idle timeout (no traffic or activity).
sess_del_by_irule	Deleted explicitly by an iRule.
sess_del_by_admin	Deleted by an administrative action (for example, using tmsh).
sess_del_static	A statically provisioned session was deleted.
sess_del_stat_precnf	A pre-configured static session that had reached provisioned status was deleted.

Session IP address stats

Field	Description
sess_ip_single	Sessions currently holding exactly one IP address.
sess_ip_mult	Sessions currently holding more than one IP address.
sess_ip_dual	Sessions currently using both IPv4 and IPv6 (dual stack).
sess_ip_mult_v4	Sessions currently holding more than one IPv4 address.
sess_ip_mult_v6	Sessions currently holding more than one IPv6 address.
ip_v4_count	Total IPv4 addresses tracked across all sessions.
ip_v6_count	Total IPv6 addresses tracked across all sessions.
ip_added_after_prov	IP addresses added to a session after provisioning was already complete.
ip_rem_no_sess_del	IP addresses removed from a session without deleting the session itself.

Session errors and limits stats

Field	Description
err_prov_attempts	Provisioning attempts that failed or received no response.
err_sess_limit	Session creation attempts rejected because the configured maximum session limit was reached.
err_sess_ip_limit	IP address additions rejected because the per-session IP limit was reached.
err_del_miss_rad	RADIUS Stop received for a session that PEM could not find.
err_del_miss_dhcp	DHCP release or expiration received for a session that PEM could not find.
err_del_miss_gx	Gx delete request received for a session that PEM could not find.
err_del_miss_sd	Sd delete request received for a session that PEM could not find.
err_del_miss_irule	iRule delete request received for a session that PEM could not find.
no_add_sess_by_svr_traff	A server-side flow arrived, but the profile is not configured to create sessions from server-side traffic.
db_errors	Internal session database errors.
db_errors_subs	Subscriber database lookup errors or inconsistencies.
db_errors_subs_fixup	Subscriber database inconsistencies that PEM detected and auto-corrected.

Additional field: sess_activity_log tracks sessions flagged for per-session debug or activity logging.

Key Diagnostics

• sess_active.current does not equal sess_prov_wait.current + sess_prov_hold.current + sess_provisioned.current + sess_prov_fail.current: A session’s provisioning state is unaccounted for. Report this as a defect.

• sess_prov_fail or err_prov_attempts climbing steadily: Sessions are not being provisioned. Check the relevant protocol’s error stats (for example, pem_gx_stat) and verify PCRF, Sd, or AAA reachability.

• err_sess_limit or err_sess_ip_limit is non-zero: PEM is rejecting new sessions or IP addresses because of configured limits. Confirm whether this is expected based on your capacity planning, or adjust the limit.

• Any err_del_miss_* counter is non-zero: An external system is trying to delete a session that PEM doesn’t have. This usually means PEM and the external system have different views of active sessions. Possible causes include a missed session creation, a premature local deletion, or a failover gap.

• db_errors or db_errors_subs increasing: The internal session or subscriber database is failing. Check pem_bin_stats and DSSM connectivity.

• db_errors_subs_fixup growing steadily: Subscriber database inconsistencies are recurring rather than isolated. Investigate the root cause rather than relying on auto-correction.

• no_add_sess_by_svr_traff unexpectedly high: Verify whether the profile’s server-side session creation setting matches your deployment’s expected traffic pattern.

• sess_del_gx_problem non-zero and growing: Sessions are being removed because the Gx link broke, not because of a normal Gx delete. Treat this as a Gx connectivity issue.

• sess_del_sd_problem non-zero: Sessions are being removed because of an Sd connectivity problem.

• updates_ok consistently lower than updates: Updates are failing. Check the error stats for the originating protocol (for example, pem_gx_stat CCA errors).

pem_gx_stat

This table tracks Gx interface activity between PEM and the Policy and Charging Rules Function (PCRF). It includes Gx session states and Diameter message counts.

Columns per Session-state and Diameter messages:

Column	Description
current	Number of sessions in this state, or not applicable for message rows.
max	Highest value of current since the last reset.
total	Cumulative count of sessions entering a state (first entry only) or messages sent/received.
retries	Cumulative retransmissions of a Diameter message.
errors	Cumulative error outcomes for a message type.

Rows for Session-state

Every live Gx session (sess.current) is in exactly one of sess_prov, sess_prov_no, sess_prov_pend, or sess_prov_err at any time.

Field	Description
sess	Overall Gx session count. current shows live sessions; total shows cumulative sessions created.
sess_late_binding	Session held while waiting for subscriber identity to bind (for example, early traffic before RADIUS information arrives).
sess_prov	Session is actively provisioned with policy rules from the PCRF.
sess_prov_pend	A Credit-Control-Request Initial (CCR-I) or re-provisioning request was sent and PEM is waiting for the answer.
sess_prov_no	Session exists but has no active PCRF-provisioned rules.
sess_prov_err	Session is in a provisioning-error state (for example, a CCA or Re-Auth-Request failed).
sess_term_pend	Session close has started (CCR-Terminate sent) and PEM is waiting for final cleanup.
sess_deleted	Session was fully removed. total shows the cumulative count of deletions.

Rows for Diameter messages — Credit-Control-Request (CCR)

Field	Description
ccr	All CCR messages sent (sum of ccr_init, ccr_update, and ccr_term).
ccr_init	CCR-Initial sent to bring up a session.
ccr_update	CCR-Update sent for mid-session re-provisioning.
ccr_term	CCR-Terminate sent to tear down a session.
ccr_usage	CCR-Update sent to report usage monitoring data.
ccr_app_start	CCR-Update sent to report an application start.
ccr_app_stop	CCR-Update sent to report an application stop.
ccr_init_throttle	CCR-Initial requests suppressed because the PCRF previously responded "too busy" and the backoff window has not expired.
ccr_update_throttle	CCR-Update requests suppressed for the same reason.
ccr_term_throttle	CCR-Terminate requests suppressed for the same reason.
ccr_update_filter	CCR-Update triggers suppressed locally because they were redundant or duplicates.

Rows for Diameter messages — Credit-Control-Answer (CCA)

Field	Description
cca	All CCA messages received (sum of cca_init, cca_update, and cca_term).
cca_init	CCA received in response to a CCR-Initial.
cca_update	CCA received in response to a CCR-Update.
cca_term	CCA received in response to a CCR-Terminate.
cca_usage	CCA received with usage monitoring information.
cca_unknown_type	CCA received whose request type PEM could not identify.

Rows for Diameter messages — Re-Auth-Request (RAR) and Re-Auth-Answer (RAA)

Field	Description
rar	Re-Auth-Request messages received from the PCRF (unsolicited policy push).
raa	Re-Auth-Answer messages sent back to the PCRF in response to a RAR.

Key Diagnostics

• ccr_*_throttle.errors greater than zero: This should not happen in normal operation. It indicates an internal bookkeeping issue. Report it as a defect.

• cca_unknown_type greater than zero: PEM received a CCA that it could not classify. This points to a PCRF interoperability or parsing issue.

• sess.current does not equal sess_prov.current + sess_prov_no.current + sess_prov_pend.current + sess_prov_err.current: A session is unaccounted for in the state machine. Report this as a defect.

• sess_prov_err.current non-zero and growing: Sessions cannot be provisioned. Check PCRF reachability and CCA error codes (cca.errors, cca_init.errors).

• ccr_*_throttle.total growing steadily: The PCRF is repeatedly responding “too busy.” This is a capacity issue on the PCRF side.

• ccr.retries or rar.retries growing while cca.errors or raa.errors stay flat: Requests are timing out without receiving any response. Check network connectivity and PCRF reachability.

• sess_deleted.total consistently lower than sess.total: Sessions are being created but not cleanly removed. Check for entries stuck in sess_term_pend.

pem_tcpopt_stat

This table shows how often each TCP optimization profile was applied to a flow and how often that application failed. When PEM applies a profile, it pushes eight TCP options as a batch to the TCP filter.

The eight options are: early retransmit, retransmit threshold, loss-ignore rate/burst, rate pacing, receive window, send buffer, congestion control algorithm, and proxy buffer (low/high).

Fields

Field	Description
name	Name of the TCP optimization profile, applied to the client (subscriber/uplink) or server (network/downlink) side. A row appears the first time a flow tries to apply the profile.
count	Number of flows that successfully received all eight TCP options from this profile.
failed	Number of flows where the profile could not be applied. Either the profile values were invalid or the TCP filter rejected an option for the connection's current state.

Key Diagnostics

• failed counter increasing: A healthy configuration should not fail to set TCP options. Check the TMM debug logs for TCP optimization error messages to identify the cause.

• A profile row does not appear: The profile either never matched any traffic or the flow never reached the point where TCP options are applied. Check policy match logs.

• count is much lower than expected: TCP options are applied only after the peer flow is established. If peer setup is delayed or failing, the apply step is deferred. Investigate connection setup issues.

pem_bin_stats

This table provides visibility into PEM session database and DSSM operations. It shows how the local cache and external DSSM are used and whether create, read, update, and delete (CRUD) operations are succeeding.

Rows per bins

Bin	Description
pemdb_session_bin_cache	Local in-memory cache of subscriber session records.
pemdb_session_ip_bin_cache	Local cache of session-to-IP mappings.
pemdb_global_bin_cache	Local cache of subscriber ID records.
pemdb_gx_bin_cache	Local cache of Gx session records.
pemdb_session_bin	Primary subscriber session record in the external DSSM.
pemdb_session_ip_bin	Session-to-IP mapping table in the external DSSM.
pemdb_global_bin	Subscriber ID table in the external DSSM.
pemdb_gx_bin	Gx session table in the external DSSM.
pemdb_local_bin	Local session state (not replicated to DSSM).
pemdb_session_reporting_bin	Usage and reporting records.

columns per bins

Column	Description
add_total	Total create or update operations attempted.
del_total	Total delete operations attempted.
lookup_total	Total lookup operations attempted.
add_err_ok	Create operations that succeeded.
add_err_timeout	Create operations that timed out (DSSM was slow to respond).
add_err_db	Create operations that received a database error from DSSM.
add_err_mem	Create operations that failed because of insufficient memory.
add_err_inprogress	Create operations sent to DSSM asynchronously (pending completion).
del_err_timeout	Delete operations that timed out.
del_err_not_found	Delete operations attempted on a record that does not exist.
lookup_err_not_found	Lookups where the session was not in the local cache and must go to DSSM.
lookup_err_timeout	Lookups where DSSM did not respond in time.
lookup_err_db	Lookups where DSSM returned a database error.
lookup_err_inprogress	Lookups sent to DSSM asynchronously (pending completion).

Key Diagnostics

• add_err_mem, del_err_mem, or lookup_err_mem increasing: Memory allocation is failing. Check overall TMM memory pressure.

• *_err_db or *_err_other increasing: An unexpected storage failure occurred. Check DSSM logs at the corresponding timestamps. This should not happen in healthy operation.

• *_err_timeout growing on non-cache bins (pemdb_session_bin, pemdb_session_ip_bin, pemdb_global_bin, pemdb_gx_bin): The external DSSM is slow or unreachable. Cross-check with pem_sessiondb_rtt_stats and pem_dssm_rtt_stats.

• *_err_inprogress staying high without a matching rise in *_err_ok: Asynchronous DSSM callbacks are not completing. Sessions may be stuck.

• add_err_not_found increasing: A create operation reporting “not found” is abnormal. Report this as a defect.

• Error columns non-zero on pemdb_local_bin: This bin has no external dependency. Errors here point to a local resource issue (for example, memory), not a DSSM or network problem.

pem_global_stat

This table tracks PEM’s internal asynchronous processing and iRule activity. Use it to spot issues such as logging failures or iRule suspend/resume imbalances.

Fields

Field	Description
spmdb_async_cb	Total DSSM asynchronous round-trips completed.
pem_spm_async_cb	Subscriber Policy Manager (SPM) layer asynchronous completions.
pem_async_cb	PEM layer asynchronous completions.
tmm_cb	TMM layer callbacks into PEM.
irule_req	iRule requests to PEM.
tcl_susp	iRule Tcl suspension events.
tcl_resume	iRule Tcl resume events.
tcl_err	iRule Tcl errors.

Key Diagnostics

• spmdb_async_cb growing at a much higher rate than session updates: In healthy operation, expect roughly one to two DSSM round-trips per update. If the ratio reaches five to ten, each update is triggering a cascade of DSSM operations. This can indicate cache exhaustion or DSSM pressure.

• tcl_susp not roughly matching tcl_resume: An imbalance between suspensions and resumes suggests iRule processing issues.

pem_radius_stat

This table tracks RADIUS accounting messages that PEM processes.

Fields

Field	Description
start.total	RADIUS Accounting-Start messages received.
start.processed	Accounting-Start messages that successfully created a session.
start.errors	Accounting-Start messages that failed.
start.retrans	Retransmitted Accounting-Start messages.
stop.total	RADIUS Accounting-Stop messages received.
stop.processed	Accounting-Stop messages that successfully deleted a session.
stop.errors	Accounting-Stop messages that failed.
interim.total	RADIUS Interim-Update messages received.
interim.processed	Interim-Update messages that successfully updated a session.
interim.errors	Interim-Update messages that failed.
interim.retrans	Retransmitted Interim-Update messages.
acct_on.total	NAS reboot accounting-on messages received.
acct_off.total	NAS reboot accounting-off messages received.

Key Diagnostics

• For start, stop, or interim: processed + errors does not match total: Requests may be stuck and not completing.

• errors increasing on any message type: Check PCRF and session-store connectivity, and review TMM logs for matching error messages.

• start.retrans increasing: The AAA or NAS system is resending requests faster than the configured retransmit timeout.

• total increasing while processed, retrans, and errors stay flat: Messages may be stuck mid-processing. Report this as a possible defect.

• retrans incrementing for acct_on, interim, or acct_off: Retransmission should not occur for these message types. Report this as a defect.

pem_hudnode_opt_stat

This table tracks PEM data-path optimization decisions. It shows how often filter nodes (HTTP, GPA, ADAPT) were removed from a flow’s processing chain and how often flows were offloaded to a faster path.

Higher counts in this table mean more flows are bypassing unnecessary processing, which is the desired outcome.

Fields

Field	Description
http_client	HTTP filter node removed from the client (subscriber) side of the flow.
http_server	HTTP filter node removed from the server (network) side of the flow.
gpa_client	GPA filter node removed from the client side.
gpa_server	GPA filter node removed from the server side.
adapt_client	ADAPT (ICAP content adaptation) filter node removed from the client side. This can also increment automatically when http_client is removed, because ADAPT depends on HTTP.
adapt_server	ADAPT filter node removed from the server side. This can also increment automatically when http_server is removed.
epva_offload	Flow offloaded to the ePVA hardware acceleration chip, bypassing the software processing chain entirely.
fastl4_offload	Flow offloaded to the software FastL4/BigTCP path when ePVA offload was not possible.
fastl4_switch	An active flow's listener was switched to an alternate BigTCP-optimized listener mid-stream.

Key Diagnostics

• All optimization counters at zero despite high traffic and simple policies: Check for iRules on the virtual server. iRule presence explicitly skips optimization.

• fastl4_switch growing while epva_offload and fastl4_offload stay flat: Flows are being redirected mid-stream instead of being classified as offload-eligible from the start. Review the alternate-listener configuration.

• epva_offload at zero on hardware that supports ePVA while fastl4_offload is high: Flows are falling back to the software path. Check for policy actions that exclude ePVA offload and confirm ePVA hardware eligibility on the platform.

pem_sessiondb_rtt_stats

This table provides round-trip time (RTT) measurements for PEM session database operations. Use it to identify performance degradation in the local session database layer.

Columns

Column	Description
count	Number of transactions completed.
min_rtt_us	Minimum RTT in microseconds.
max_rtt_us	Maximum RTT in microseconds.
avg_rtt_us	Average RTT in microseconds.
rtt_0_15us	Transactions completed in 0–15 microseconds.
rtt_15_250us	Transactions completed in 15–250 microseconds.
rtt_250_500us	Transactions completed in 250–500 microseconds.
rtt_500_750us	Transactions completed in 500–750 microseconds.
rtt_750_1000us	Transactions completed in 750–1,000 microseconds.
rtt_1000_2000us	Transactions completed in 1,000–2,000 microseconds.
rtt_above_2000	Transactions that took more than 2,000 microseconds.

Rows

Each bin and operation type combination has its own row, in the format <bin>/<operation>. For example:

• pemdb_session_bin/ADD

• pemdb_session_bin/LOOKUP

• pemdb_session_bin/DELETE

Example output

tmctl -d blade -w 300 pem_sessiondb_rtt_stats
name                       count min_rtt_us max_rtt_us avg_rtt_us rtt_0_15us rtt_15_250us ...
--------------------------- ----- ---------- ---------- ---------- ---------- ------------ ...
pemdb_session_bin/ADD        968         11         86         28        625          343 ...
pemdb_session_bin/LOOKUP   64836          0       1259          3      64231          600 ...
pemdb_local_bin/ADD          968          2         60          3        963            5 ...
pemdb_local_bin/LOOKUP      7360          0        177          2       7264           96 ...

Key Diagnostics

• Any RTT value (minimum, maximum, or average) exceeds 15 microseconds: Treat the session database performance as degraded. Investigate local memory pressure and system load.

pem_dssm_rtt_stats

This table provides RTT measurements for PEM interactions with the external Distributed Session State Manager (DSSM). Use it to identify performance degradation in the DSSM communication path.

Columns

Column	Description
count	Number of transactions completed.
min_rtt_us	Minimum RTT in microseconds.
max_rtt_us	Maximum RTT in microseconds.
avg_rtt_us	Average RTT in microseconds.
rtt_0ms_3ms	Transactions completed in 0–3 milliseconds.
rtt_3ms_6ms	Transactions completed in 3–6 milliseconds.
rtt_6ms_9ms	Transactions completed in 6–9 milliseconds.
rtt_9ms_12ms	Transactions completed in 9–12 milliseconds.
rtt_above_12ms	Transactions that took more than 12 milliseconds.

Rows

Like pem_sessiondb_rtt_stats, each row represents a bin and operation combination (for example, pemdb_session_bin/ADD, pemdb_gx_session_bin/LOOKUP).

Example output

tmctl -d blade -w 300 pem_dssm_rtt_stats
name                       count min_rtt_us max_rtt_us avg_rtt_us rtt_0ms_3ms rtt_3ms_6ms ...
--------------------------- ----- ---------- ---------- ---------- ----------- ----------- ...
pemdb_session_bin/ADD        1000       2384      21735       6398         652         278 ...
pemdb_session_bin/LOOKUP      300       3793      15996       5197         266          28 ...
pemdb_gx_session_bin/ADD      300       3129      14073       5573         220          73 ...

Key Diagnostics

• Any RTT value (minimum, maximum, or average) exceeds 3 milliseconds: Treat DSSM performance as degraded. Check DSSM reachability, network latency, and DSSM resource utilization.

pem_hsl_stat

This table tracks High-Speed Logging (HSL) reporting activity for PEM.

Fields

Field	Description
session_based_records_sent	Session-level HSL call detail records (CDRs) sent.
flow_start_records_sent	Flow-start HSL records sent.
flow_stop_records_sent	Flow-stop HSL records sent.
flow_interim_records_sent	Flow-interim (periodic) HSL records sent.
transaction_records_sent	Per-transaction HSL records sent.
records_skipped	HSL records dropped because of congestion or backpressure.
media_qoe_records_sent	Quality of Experience (QoE) records sent.
media_qoe_records_skipped	QoE records dropped.
dtos_td_records_sent	Tethering-detection records sent.

Key Diagnostics

• records_skipped increasing: The HSL receiver is slow or unreachable. HSL backpressure may delay PEM flow reporting.

pem_radius_avp_stat

This table tracks RADIUS Attribute-Value Pair (AVP) parsing outcomes. When PEM processes a RADIUS accounting message, it validates each AVP twice: once during subscriber ID construction and again during attribute import.

Fields

Field	Description
success	Number of RADIUS accounting messages where parsing succeeded.
failures	Number of RADIUS accounting messages where parsing failed (for example, an attribute value exceeded the configured maximum length).
subs_id_parse_fail	Number of parsing failures in the subscriber ID construction step.
parse_failed	Number of parsing failures in the attribute import step.

Example output

tmctl -d blade -w 300 pem_radius_avp_stat
avp_key                  failures subs_id_parse_fail parse_failed
------------------------ --------- ------------------ -------------------
USER-NAME                       2                  2                   0
FRAMED-IP-ADDRESS               0                  0                   0
VENDOR-SPECIFIC [10415:1]       1                  0                   0

Key Diagnostics

• failures or subs_id_parse_fail non-zero: Review the RADIUS attributes being sent by the AAA or NAS system. Confirm that attribute values don’t exceed the configured AVP length limits.

gpa_dpi_stats

This table tracks application classification decisions made by deep packet inspection (DPI).

Fields

Field	Description
count	Number of flows classified for a specific application.
dpi	Classification decisions made by the DPI engine.
flbl	Classification decisions made because of flow bundling.
srdb	Classification decisions made by the SRDB cache.
custom	Classification decisions from custom categories.

gpa_urlcat_stats

This table tracks URL categorization decisions.

Fields

Field	Description
count	Number of flows categorized for a specific application.
srdb	Categorization decisions made by the SRDB cache.
cloud	Categorization decisions made by the cloud cache.

Statistics tables not supported in CNF

The following statistics tables are not supported in Cloud-Native Network Function (CNF) deployments:

• pem_forwarding_endpoint_stats

• pem_persistence_stats

• tmm/content_inserts

• pem_multiple_ip_stat

• pem_tethering_stat

• pem_rancon_stat

• pem_dtos_stat

• pem_sd_stat

• pem_gy_stat