Data Center Real User Monitoring

Transcription

1 Data Center Real User Monitoring Citrix/Windows Terminal Services Monitoring User Guide Release 12.1

2 Please direct questions about Data Center Real User Monitoring or comments on this document to: APM Customer Support FrontLine Support Login Page: Copyright 2013 Compuware Corporation. All rights reserved. Unpublished rights reserved under the Copyright Laws of the United States. U.S. GOVERNMENT RIGHTS-Use, duplication, or disclosure by the U.S. Government is subject to restrictions as set forth in Compuware Corporation license agreement and as provided in DFARS (a) and (a) (1995), DFARS (c)(1)(ii) (OCT 1988), FAR (a) (1995), FAR , or FAR (ALT III), as applicable. Compuware Corporation. This product contains confidential information and trade secrets of Compuware Corporation. Disclosure is prohibited without the prior express written permission of Compuware Corporation. Use of this product is subject to the terms and conditions of the user's License Agreement with Compuware Corporation. Documentation may only be reproduced by Licensee for internal use. The content of this document may not be altered, modified or changed without the express written consent of Compuware Corporation. Compuware Corporation may change the content specified herein at any time, with or without notice. All current Compuware Corporation product documentation can be found at Compuware, FrontLine, Network Monitoring, Synthetic Monitoring, Server Monitoring, Transaction Trace Analysis, Compuware APM, VantageView, Compuware APM, Real-User Monitoring First Mile, and Gomez Performance Network are trademarks or registered trademarks of Compuware Corporation. Cisco is a trademark or registered trademark of Cisco Systems, Inc. Internet Explorer, Outlook, SQL Server, Windows, Windows Server, and Windows Vista are trademarks or registered trademarks of Microsoft Corporation. Firefox is a trademark or registered trademark of Mozilla Foundation. Red Hat and Red Hat Enterprise Linux are trademarks or registered trademarks of Red Hat, Inc. J2EE, Java, and JRE are trademarks or registered trademarks of Oracle Corporation. VMware is a trademark or registered trademark of VMware, Inc. SAP and SAP R/3 are trademarks or registered trademarks of SAP AG. Adobe Reader is a registered trademark of Adobe Systems Incorporated in the United States and/or other countries. All other company and product names are trademarks or registered trademarks of their respective owners. Build: August 5, 2013, 10:36

3 Contents Contents Introduction Who Should Read This Guide Organization of the Guide Related Publications Customer Support Information Reporting a Problem Documentation Conventions Chapter 1 Configuration Process Overview of Citrix Servers or Windows Terminal Services Monitoring Chapter 2 Thin Client Analysis Module Thin Client Analysis Module Installation and Configuration TCAM Installation and Configuration from GUI TCAM Installation and Configuration from Command Line TCAM Administration via Command Line Interface TCAM Administration via GUI Upgrading TCAM from GUI Uninstalling TCAM Chapter 3 Adding Basic DCRUM Devices Adding an AMD to the Devices List Adding CAS to Devices List Chapter 4 Verification of Traffic Monitoring Quality Sniffing Point Diagnostics Application Overview Chapter 5 Basic Monitoring Configuration Configuring General Data Collector Settings Configuring Operation-Related Global Settings Chapter 6 Configuring AMD to Monitor User-Defined Software Services Citrix or Windows Terminal Services Monitoring Configuring AMD to Monitor ICA Traffic

4 Contents Defining Software Services Configuring Rules for User-Defined Software Services Example of Configuring Citrix or Windows Terminal Software Services Creating a New Rule for Citrix or Windows Terminal Software Service Managing User-Defined Software Services Chapter 7 Monitoring Sequence Transactions Adding Transactions Adding Transactions for a Range of AMDs Modifying, Deleting, and Cloning Transactions for a Single AMD Chapter 8 Citrix Traffic on CAS Reports Chapter 9 Citrix/WTS (Presentation) Tier Citrix Landing Page Report Citrix Servers Report Citrix Published Applications Citrix Channels Citrix Sites Report Appendix A Diagnostics and Troubleshooting Report-related Issues Troubleshooting Thin Client Analysis Module Troubleshooting TCAM Troubleshooting TCAM Settings on AMD Appendix B Regular Expression Fundamentals Testing Regular Expressions Best Practices for Regular Expressions Appendix C Graphical Explanation of Network Performance Metrics Glossary Index

5 INTRODUCTION Who Should Read This Guide This manual is intended for users of Data Center Real User Monitoring who want to monitor the Citrix Presentation or Windows Terminal Services. Organization of the Guide This guide is organized as follows: Configuration Process Overview of Citrix Servers or Windows Terminal Services Monitoring [p. 11] - Provides an overview of the configuration process. Thin Client Analysis Module [p. 15] - Describes how to deploy, install and configure Thin Client Analysis Module, a software module that supports monitoring application traffic in enterprise environments that use Citrix Presentation Server or Windows Terminal Services. Adding Basic DCRUM Devices [p. 27] - Describes how to add and configure the data sources and report servers using the RUM Console. Verification of Traffic Monitoring Quality [p. 31] - Describes how to verify sniffing points traffic detection quality before the actual monitoring begins. Basic Monitoring Configuration [p. 35] - Describes AMD general settings. Configuring AMD to Monitor User-Defined Software Services [p. 43] - Describes the creation and management of Citrix or Windows Terminal Services-based software services. Monitoring Sequence Transactions [p. 51] - Describes how to monitor transactions. Citrix/WTS (Presentation) Tier [p. 61] - Describes the tier that present Citrix or Windows Terminal Services data. Citrix Traffic on CAS Reports [p. 59] - - Lists CAS reports that display statistics for Citrix or Windows Terminal Services data. Diagnostics and Troubleshooting [p. 65] - Lists common CAS support issues in the form of questions and answers. 5

6 Introduction Regular Expression Fundamentals [p. 81] - Describes how to use regular expressions in CAS. Graphical Explanation of Network Performance Metrics [p. 87] - Uses charts to illustrate network performance metrics. Related Publications Documentation for your product is distributed on the product media. For DCRUM, it is located in the \Documentation directory. It can also be accessed from the Media Browser. You can also access online documentation for Compuware products via our FrontLine support site at FrontLine provides fast access to information about your Compuware products. You can download documentation and FAQs as well as browse, ask questions, and get answers on user forums (requires subscription). The first time you access FrontLine, you are required to register and obtain a password. Registration is free. PDF files can be viewed with Adobe Reader version 7 or later. If you do not have the Reader application installed, you can download the setup file from the Adobe Web site at Customer Support Information FrontLine Support Website You can access information for Compuware products via our FrontLine support site. You can review frequently asked questions, read or download documentation, access product fixes, or your questions or comments. The first time you access FrontLine, you are required to register and obtain a password. Registration is free. To access FrontLine, log in to Select your product from the Product Support dropdown list. Contacting Customer Support Phone USA and Canada: or All other countries: Contact your local Compuware office. Contact information is available at Web You can report issues via the Report and Track Calls tab on the FrontLine home page. NOTE Please report all high-priority issues by phone. APM Community You can find product documentation, forums with product experts, product fixes and more information at the Compuware APM Community. You must register and login to access the Community. 6

7 Introduction Mail Customer Support Compuware Corporation One Campus Martius Detroit, MI Corporate Website To access the Compuware website, go to The Compuware site provides a variety of product and support information. Reporting a Problem When contacting APM Customer Support, please provide as much information as possible about your environment and the circumstances that led to the difficulty. You should be ready to provide: Client number. This number is assigned to you by Compuware and is recorded on your sales contract. The version number of the AMD, report servers, and RUM Console with RUM Console Server. Report Server Use the report server GUI by selecting Help Product Information About, or Tools Diagnostics System Status. AMD In RUM Console, navigate to Devices and Connections Manage Devices, select an AMD from the devices list and read the version. RUM Console and RUM Console Server Use the RUM Console GUI by selecting Help About menu item. TCAM Use the TCAM GUI by selecting Help About menu item. Environment information, such as the operating system and release (including service pack level) on which the product (AMD, report server) is installed, memory, hardware/network specifications, and the names and releases of other applications that were running. Problem description, including screen captures. Exact error messages, if any (screen captures recommended). Whether or not the problem is reproducible. If it is, include a sequence of steps for problem recreation. If it is not, include a description of the actions taken before the problem occurred. A description of the actions that may have been taken to recover from the problem, and their results. Debug information for specific components obtained from RUM Console. 7

8 Introduction Information about the RUM Console itself. To export all the information, navigate to Help Export Console Diagnostics in the RUM Console menu. Information about the report servers. To export the information for a specific ADS or CAS, navigate to Devices and Connections Manage Devices, and choose Export diagnostic information from the context menu of the particular device. Include data collector diag. Option to include diagnostic information on data collectors attached to the report server. Installation logs Option to include installation information logged and saved on the server. SQL trace logs Option to include trace logs of SQL queries. Save as Destination path and filename for the diagnostic package file. Information about the AMD. To export the information for a specific AMD, navigate to Devices and Connections Manage Devices, and choose Export diagnostic information from the context menu of the particular device. Include data files Option to include fragments of traffic data. Begin and End Time range of the monitoring data to be included with the diagnostics. Data file filter (RegEx) Regular expression filter for monitoring data files generated during the defined time range. Save as Destination path and filename for the diagnostic package file. Information from the TCAM System Event log of the machine where the TCAM is operating. TCAM logs which by default are stored in C:\ProgramData\Compuware\VTCAM for Windows Server 2008 and C:\Documents and Settings\All Users\Compuware\VTCAM for Windows Server NOTE Please compress all the files before sending them to Customer Support. Compuware values your comments and suggestions about the Compuware APM products and documentation. Your feedback is very important to us. If you have questions or suggestions for improvement, please let us know. 8

9 Introduction Documentation Conventions The following font conventions are used throughout documentation: This font Bold Citation Documentation Conventions [p. 9] Fixed width Fixed width bold Fixed width italic Menu Item Screen Code block Indicates Terms, commands, and references to names of screen controls and user interface elements. Emphasized text, inline citations, titles of external books or articles. Links to Internet resources and linked references to titles in Compuware documentation. Cited contents of text files, inline examples of code, command line inputs or system outputs. Also file and path names. User input in console commands. Place holders for values of strings, for example as in the command: cd directory_name Menu items. Text screen shots. Blocks of code or fragments of text files. 9

10 Introduction 10

11 CHAPTER 1 Configuration Process Overview of Citrix Servers or Windows Terminal Services Monitoring Data Center Real User Monitoring (DCRUM) provides you with several ways of monitoring Citrix Servers or Windows Terminal Services. You can monitor software services, transactions, tiers, applications, and network. Before You Begin Before you start the configuration process: You should be familiar with DCRUM components and basic monitoring concepts. Refer to the Data Center Real User Monitoring Getting Started. You need to identify your monitoring goals. For more information, see Define and Prioritize Goals, Objectives, and Requirements in the Data Center Real User Monitoring Getting Started. You need to install the following DCRUM components: The latest version of AMD Refer to the Data Center Real User Monitoring Agentless Monitoring Device Installation Guide. The latest version of RUM Console Refer to the Data Center Real User Monitoring RUM Console Installation Guide. The latest version of CAS Refer to the Data Center Real User Monitoring Central Analysis Server Installation Guide. Optionally: The latest version of ADS Refer to the Data Center Real User Monitoring Advanced Diagnostics Server Installation Guide. Make sure that default ports are available for communications between the individual DCRUM components. For more information, see Network Ports Opened for DCRUM in the Data Center Real User Monitoring Administration Guide. 11

12 Chapter 1 Configuration Process Overview of Citrix Servers or Windows Terminal Services Monitoring The following steps must be executed in order to begin monitoring the traffic using the DCRUM suite: Configuring devices 1. Adding Agentless Monitoring Device (AMD) AMD is the main data source (Data Collector) for DCRUM; it collects and presents the monitored data to DCRUM report servers for analysis and reporting. You need to add at least one AMD to the list of devices in RUM Console. For more information, see Adding an AMD to the Devices List [p. 27]. 2. Adding Central Analysis Server (CAS) CAS is the main report server for DCRUM. It uses data provided by the AMD and its monitoring and alerting mechanisms to identify, track, and report on issues affecting the security, performance, and reliability of your services. Add at least one CAS to the device list and configure its connection with the AMD. Adding a report server to a list of devices is similar to adding the AMD. For more information, see Adding CAS to Devices List [p. 29]. 3. Verifying traffic monitoring quality and completeness You can verify traffic quality and completeness before the actual monitoring begins. Sniffing point diagnostics allows you to perform pre-monitoring tasks without the need of accessing the AMD console and executing a series of Linux commands which usually serve the purpose of validating AMD physical installation and connection. For more information, see Verification of Traffic Monitoring Quality [p. 31]. 4. Installing and setting up Thin Client Analysis Module (TCAM) on Citrix Presentation Server/Citrix XenApp or Windows Terminal Server The Thin Client Analysis Module (TCAM) supports monitoring application traffic in enterprise environments that use Citrix Presentation Server or Windows Terminal Services. For more information, see Thin Client Analysis Module [p. 15]. Configuring basic monitoring 5. Configuring general settings for your AMD Before you proceed to detailed monitoring rules, you need to define global settings that will be applied to all software services monitored by a given AMD. These global settings include among others a monitoring interval and thresholds for basic metrics, and can be later overridden by more specific monitoring rules that you are going to define. For more information, see Configuring General Data Collector Settings [p. 35] and Configuring Operation-Related Global Settings [p. 39]. 6. Configuring support for WAN optimization All AMDs that monitor network traffic using WAN optimization must be configured before DCRUM can automatically recognize optimized WAN traffic. Otherwise, measurements collected from such an environment will be incorrect. Refer to the Data Center Real User Monitoring WAN Optimization Getting Started. 7. Configuring global monitoring setting for Citrix 12

13 Chapter 1 Configuration Process Overview of Citrix Servers or Windows Terminal Services Monitoring Global settings are settings that affect monitoring of all services based on ICA (Citrix) analyzers for a given AMD. It is crucial to configure these settings before defining specific Citrix monitoring rules. For more information, see Citrix or Windows Terminal Services Monitoring [p. 43]. Customizing monitoring rules 8. Defining your own software services on specified ports and for specified IP addresses If you configure user-defined software services for Citrix Presentation or Windows Terminal Servers, you will be able to see related data on many CAS reports, such as Software Services, Tiers, or Network Status: Software Service View. For more information on software service configuration, see Configuring AMD to Monitor User-Defined Software Services [p. 43] For more information on CAS reports, please refer to Central Analysis Server - User Guide. 9. Displaying reports to review statistics for monitored traffic Fine-tuning reporting configuration 10. Configuring sites, areas, and regions A site is a term for a group of users that are located in the same IP network or group of networks sharing similar routing properties. Sites can be grouped together into areas, which in turn can be grouped together into regions. The hierarchy of sites, areas, and regions provides an organized view of the monitored network on the reports. For more information, see Configuring Sites, Areas, and Regions in the Data Center Real User Monitoring Administration Guide. 11. Configuring transactions, applications, and reporting groups Transactions are sequences of information exchange that represent particular actions or functions performed by a human user or a client program. They are viewed as higher-level units of self-contained functionality and are tied to applications. For example, they may represent the procedure for an online purchase or ticket booking. AMD monitors traffic data and prepares it for transaction monitoring by an ADS and CAS. Some of the relevant configuration and processing is performed on the actual RUM Console and some is performed on the AMD. For more information, see Managing Business Units in the Data Center Real User Monitoring Administration Guide. 12. Configuring tiers A tier is a specific point where DCRUM collects performance data. You can have monitoring data reported based on the default tier configuration, or you can define tiers that fit your network architecture. For more information, see Citrix/WTS (Presentation) Tier [p. 61]. 13. Configuring monitoring of sequence transactions DCRUM enables you to define and monitor transactions that are sequences of steps. For more information, see Monitoring Sequence Transactions [p. 51]. 13

14 Chapter 1 Configuration Process Overview of Citrix Servers or Windows Terminal Services Monitoring Troubleshooting 14. Troubleshooting problems You can review the answers to the most common questions and troubleshoot your setup and report configurations. For more information, see Diagnostics and Troubleshooting in the Data Center Real User Monitoring Web Application Monitoring User Guide. 14

15 CHAPTER 2 Thin Client Analysis Module The Thin Client Analysis Module (TCAM) supports monitoring application traffic in enterprise environments that use Citrix Presentation Server or Windows Terminal Services. The TCAM does the following: Creates an association between users and their sessions. Monitors performance of hardware to which TCAM is applied. Creating Associations Between Users and Sessions The TCAM creates an association between a user and their sessions. This information is then passed to AMD as shown in Figure 1. Thin Client Analysis Module Operation [p. 15]. Figure 1. Thin Client Analysis Module Operation Front-end traffic (ICA protocol) Presentation data Citrix Presentation Server Back-end traffic Application data Users Performance data Session mapping data Application server AMD At the front end, there is a terminal session between a user and the presentation server. The user runs an application that causes a back-end session to open a session between the presentation server and an application server. The back-end session carries the actual user transactions, but it is impossible to determine which users the back sessions belong to because no user identification is carried in the sessions at the back end. 15

16 Chapter 2 Thin Client Analysis Module The monitoring system determines which back-end sessions belong to which user. Only this association allows for actual user experience monitoring. NOTE To create the associations between users and sessions, TCAM relies on applications being executed under specific user names. However, when a user runs an application that has been started as a system service, the association is not possible. Also, the session is not associated with the user if the user, using a Citrix server communicating with a monitored application, logs in and then disconnects. Basic Network Setup Figure 2. Citrix Presentation Server Without an Intermediate Device The following diagram represents monitoring a Citrix Presentation Server without an intermediate device between users and the presentation server. Users User name, User IP address Citrix Presentation Server User name, User IP address, Presentation Server TCP source port User name, User IP address Application server AMD Multiple intermediate devices can be present, although some limitations apply. Ensure that you attach the AMD to the correct points in the network. SAG or NAT Network Configuration If a Citrix Secure Access Gateway (SAG) or Network Address Translation (NAT) appliance such as a DSL router is used, correct monitoring and mapping of users and sessions is supported depending on NAT resolution setting in TCAM and point where the AMD is connected. 16

17 Chapter 2 Thin Client Analysis Module Figure 3. Citrix Presentation Server with a SAG Appliance or a NAT Device and NAT resolution off The following diagram represents an AMD monitoring between the client and an SAG or an NAT device. The NAT resolution must be turned off. Users User name User IP address SAG/NAT Citrix Server User name, User IP address, Presentation Server TCP source port User name User IP address Application server AMD Figure 4. Citrix Presentation Server with a SAG Appliance or a NAT Device and NAT Resolution On The following diagram represents anamd monitoring between the SAG/NAT device and the Citrix server. The NAT resolution must be turned on. Users User name User IP address SAG/NAT Citrix Server User name, User IP address, Presentation Server TCP source port User name User IP address Application server AMD For the traffic between the presentation server and user application servers, user name associations are always supported. User IP address associations may not be performed correctly if the AMD point of monitoring and TCAM NAT resolution setting are not matched as described above. 17

18 Chapter 2 Thin Client Analysis Module SAG and NAT Network Configuration Figure 5. Citrix Presentation Server with a SAG Appliance and a NAT Device and NAT Resolution Off The following diagram represents an AMD monitoring between the client and the NAT device. The NAT resolution must be turned off. Users User name User IP address NAT SAG Citrix Server User name, User IP address, Citrix Server TCP source port Application server User name User IP address AMD Figure 6. Citrix Presentation Server with a SAG Appliance and a NAT Device and NAT Resolution On User name, user IP address, Citrix Server TCP source port The following diagram represents an AMD monitoring between the SAG and the Citrix server. The NAT resolution must be turned on. Users User name User IP address NAT SAG Citrix Server User name, User IP address, Citrix Server TCP source port User name User IP address Application server AMD Monitoring Hardware Performance User name, user IP address, Citrix Server TCP source port TCAM also monitors the performance of the hardware to which it is applied and sends the results to the AMD. The performance information includes: CPU utilization Physical disk utilization Memory utilization Number of Terminal Services sessions Number of active Terminal Services sessions 18

19 Chapter 2 Thin Client Analysis Module Thin Client Analysis Module Installation and Configuration The Thin Client Analysis Module (TCAM) installation consists of two steps: 1. Installation and setup of the TCAM software on a Citrix or a Windows Terminal Services server. 2. AMD setup for receiving information from the TCAMs. For more information, see Citrix or Windows Terminal Services Monitoring [p. 43]. TCAM software requirements TCAM has been tested against the following MS Windows: MS Windows 2003 Server Standard with latest Service Packs (x86-32 and x86-64) MS Windows 2003 R2 Standard SP1 (x86-32 and x86-64) MS Windows 2008 (x86-64) MS Windows 2008 R2 (x86-64) and Citrix / Citrix Presentation Servers: Citrix Presentation Server 4.0 and 4.5 Citrix XenApp 5.0 Citrix XenApp 6.0 Citrix XenApp 6.5 TCAM Installation and Configuration from GUI 1. Copy the setup file appropriate for your system, TCAM_setupwin32.exe for 32-bit systems or TCAM_setupwinAMD64.exe for 64-bit systems, from the Tools directory on the Data Center Real User Monitoring installation CD, to the Citrix server. 2. In Windows Explorer, double-click the above setup file, to launch the TCAM installation program. a. On the Welcome screen, click Next. b. Accept the license agreement. c. Specify a custom destination folder for your TCAM installation, or leave the default destination value unchanged and click Next. d. Define AMD receiver for TCAM. Enter at least one destination host IP address and click Add. Once completed, click Next to continue. Optionally, you can skip defining receivers and configure after the installation completes. e. Click Install on the Summary window. 3. When the installation is complete, click Finish and reboot the Citrix server if required. 19

20 Chapter 2 Thin Client Analysis Module TCAM Installation and Configuration from Command Line 1. Copy the setup file to the Citrix server: TCAM_setupwin32.exe for a 32-bit system, TCAM_setupwinAMD64.exe for a 64-bit system. 2. On the Citrix server, launch Command Prompt from the Start menu. 3. Type the appropriate command, depending on the operating system: For 32-bit machines: TCAM_setupwin32.exe -silent -V PAMD=IP_of_performance_amd -V AMD1=IP_of_mapping_amd -V AMD4=IP_of_mapping_amd -V SilentReboot=reboot_option For 64-bit machines: TCAM_setupwinAMD64.exe -silent -V PAMD=IP_of_performance_amd -V AMD1=IP_of_mapping_amd -V AMD4=IP_of_mapping_amd -V SilentReboot=reboot_option Where the reboot_option parameter specifies if the computer is to be re-started immediately after the installation process completes. This is a mandatory option (it cannot be left blank or unspecified) and must be either true or false. For correct operation, your computer must be restarted after the installation process completes. If you select not to restart the computer automatically, you must restart it as soon as possible; otherwise, applications requiring network access might stop functioning correctly. Brand new installations or upgrade installations on systems where the LSP was initially disabled do not require a restart. Note that this syntax enables you to define up to four AMDs as application mapping receivers. For example, the command: TCAM_setupwin32.exe -silent -V PAMD= V AMD1= V AMD2= V SilentReboot=true installs TCAM on a 32-bit system and defines the AMD with the IP address as a performance data receiver and two AMDs ( and ) as application mapping data receivers. If defined, the PAMD parameter must contain the value of one of the AMD parameters. Only the defined AMDs can also be a performance data receiver. NOTE This command will automatically reboot the Citrix server after the TCAM installation. TCAM Administration via Command Line Interface Configuring or reconfiguring TCAM using the command line interface requires a restart of the service. Use the vtcams -restart command to restart the TCAM service once you have completed your configuration. TCAM can be managed from the command line with the following options: vtcams -help It displays the information on the vtcams command syntax. vtcams -version It displays the version number of vtcams. 20

21 Chapter 2 Thin Client Analysis Module vtcams -restart It restarts the vtcams service. vtcams -amd cfg It displays the current vtcams configuration settings. vtcams -amd clear It clears all the session mapping receivers. vtcams -amd perf IP_address[ :port_number ] It defines an AMD as a receiver of the performance data. For example: vtcams -amd perf defines the AMD with the IP address as a performance data receiver. It assumes the default port number, as defined in the rtm.config file on the AMD. vtcams -amd add IP_address[ :port_number ] It defines an AMD as a receiver of the session mapping data. For example: vtcams -amd add defines the AMD with the IP address as a session mapping data receiver. vtcams -amd rm IP_address[ :port_number ] It removes an AMD from the list of a receivers of the session mapping data. For example: vtcams -amd rm removes the AMD with the IP address from the list of the session mapping data receivers. vtcams -dbg [ default all off ] It enables/disables logging activity and defines logging level. NOTE Setting the logging options impacts the server's performance and is should be used only for diagnostic purposes. It should be turned off during normal operation. default Enables information logging collecting basic information required for diagnostics: FATAL ERROR Fatal error condition that causes the TCAM service to terminate. A non-fatal error condition that allows the TCAM service to continue operating. all Enables information logging collecting detailed system information and debug information: FATAL ERROR WARN INFO DEBUG Fatal error condition that causes the TCAM service to terminate. A non-fatal error condition that allows the TCAM service to continue operating. A recognized warning condition. An informational message. Additional information. 21

22 Chapter 2 Thin Client Analysis Module TRACE Internal trace information. off Disables information logging. vtcams -dbg all vtcams -dbg file file_path It sets path to the log file. Note that quotation marks are necessary only if the file name or path contains space characters. For example: vtcams -dbg file "<install_dir>\vtcam.log" vtcams -resolvenat [ on off ] Enables or disables NAT resolving. For example: vtcams -resolvenat on vtcams -mode [ uselsp usepoller ] Sets monitoring mode to LSP or Connection Polling. For example: vtcams -mode usepoller TCAM Administration via GUI TCAM is a Windows service, so it can be started and stopped using the Control Panel applet called Services. It can be launched by selecting Start Control Panel Administrative Tools Services. A graphical configuration tool, TCAM Manager, has been provided to perform all of the configuration actions. 22

23 Chapter 2 Thin Client Analysis Module Figure 7. TCAM Manager GUI You can run the TCAM Manager by selecting All Programs Compuware TCAM on the Start menu. In particular, the configuration tool enables you to enter the following: TCAM IP Address IP address to be used as a server IP. This is an IP where the TCAM is installed, it is especially important if a server has more than one IP address. It is set to default if Citrix uses only one IP address. It is should be set to front-end if more than one IP address is used. Session data receivers with selected performance receiver Mappings receivers address list. An IP address list of the Agentless Monitoring Device and a port number on which the AMD listens to TCAM session mappings data. If the port is not specified, the default port number of 514 is assumed. Once the IP address is specified, use the check box to designate which data receiver becomes a performance data receiver. There can be multiple data receivers and only one performance data receiver. 23

24 Chapter 2 Thin Client Analysis Module Miscellaneous settings Resolve NAT users Enable/disable user names resolution in configuration where there is Network Address Translation (NAT) device between Citrix user and Citrix server.for more information, see SAG or NAT Network Configuration [p. 16]. Logging Default: normal operation when only critical errors are logged during TCAM operation Off: turns off logging completely All: logging is enabled for troubleshooting TCAM by Compuware support NAT resolution setting NAT resolution setting enables correct user name assignment for network configurations where users connect through NAT device.for more information, see SAG or NAT Network Configuration [p. 16]. The following limitations apply: Citrix XenApp 6.0 is not supported Citrix Presentation Server 4.0 and XenApp 4.5, 5.0 require disabling session reliability feature for TCAM NAT resolution to work ( see below ) Windows Remote Desktop access is supported for all Windows versions Disabling session reliability in Citrix server Presentation server 4.0 and Citrix XenApp 4.5 and 5.0 IMPORTANT The following setting is required for TCAM setup but may not be optimal for your configuration. Please consult your Citrix documentation for more details. 1. Log in to the Citrix server. 2. Navigate to and edit the default.ica file. For Citrix 4.5 c:\inetpub\wwwroot\citrix\pnagent\conf c:\inetpub\wwwroot\citrix\accessplatform\conf For Citrix 5.0 c:\inetpub\wwwroot\citrix\pnagent\conf c:\inetpub\wwwroot\citrix\xenapp\conf 3. In the file default.ica in the Application section append the following line: CGPAddress= 24

25 Chapter 2 Thin Client Analysis Module Example 1. [Application] Launcher=WI TransportDriver=TCP/IP DoNotUseDefaultCSL=On BrowserProtocol=HTTPonTCP LocHttpBrowserAddress=! WinStationDriver=ICA 3.0 ProxyTimeout=30000 AutologonAllowed=ON CGPAddress= 4. Save the configuration file. Upgrading TCAM from GUI 1. Copy the setup file appropriate for your system, TCAM_setupwin32.exe for 32-bit systems or TCAM_setupwinAMD64.exe for 64-bit systems, from the Tools directory on the ADS/CAS installation media, to the Citrix server. 2. In Windows Explorer, double-click the above setup file, to launch the TCAM installation program. a. On the Welcome screen, click Next. b. Accept the license agreement. c. Click Next when the message Setup will now upgrade TCAM application... is displayed. d. Specify a custom destination folder for your TCAM installation, or leave the default destination value unchanged and click Next. e. Click Install on the Summary window. 3. When the installation is complete, click Finish to reboot the Citrix server. NOTE If connection polling was enabled before the upgrade, the restart is not necessary and will not occur. Uninstalling TCAM 1. Open Start Settings Control Panel Add/Remove Programs from the Windows Start menu. 2. Locate and select Thin Client Analysis Module. 3. Click the Remove button to uninstall TCAM. 4. Click Yes to uninstall the TCAM. 5. Select Yes, restart my computer and click Finish to restart the system. 25

26 Chapter 2 Thin Client Analysis Module 26

27 CHAPTER 3 Adding Basic DCRUM Devices In a DCRUM configuration, there are two device types: data collectors and report servers. To start using the product, you need to add and configure at least one AMD data collector and one CAS report server. You manage these devices using a configuration tool called the RUM Console. Adding an AMD to the Devices List Before you can monitor traffic with DCRUM, you have to add and configure an Agentless Monitoring Device using the RUM Console. To add an AMD to the list: Adding an AMD 1. Start and log in to RUM Console. 2. Select Devices and Connections Add device from the top menu. The Add Device pop-up window appears. 3. From the Device type list, select AMD. 4. In the Description box, type a description of the device. TIP It is good practice to include a parent device name in the description of the device you are adding, and to add such names consistently. This enables you to easily find your device in the list. Specifying Connection Information 5. In the Device IP address box, type the device IP address. 6. In the Port number box, type the port number for communication with this device. The standard port number used by AMD when communicating over HTTP is For a device communicating with the report server over HTTPS (secure HTTP), set the port number to

28 Chapter 3 Adding Basic DCRUM Devices 7. Optional: Select the Use secure connection option if communication with this device should occur via a secure HTTP protocol. Providing Authentication Details 8. Type the user name and password of the account that will be used for managing this device. For an AMD, the default user name is compuware with the password vantage. The credentials you enter here will be used by the RUM Configuration to communicate with the device and will also be passed to report servers so that they can collect monitoring data for processing. Note that the values used here for authentication are not the same as the values you use for logging in to the device via SSH or local console. Configuring Advanced Settings 9. Switch to the Advanced options tab. 10. Optional: Under Secondary device connection, provide an alternative IP address for this device. 11. Optional: Enable SNMP connection. You may want to define the SNMP connection parameters so you can obtain more detailed health information about the device. To define SNMP connection parameters: a. Select SNMP Connection check box. b. Type the read community name and port number 12. Enable Guided Configuration. By default, the Guided Configuration connection is enabled when you add an AMD. However, for performance reasons, the number of AMDs with enabled Guided Configuration is limited to 50. Any additional AMDs will not feed data to the Guided Configuration perspective. For the user, this means that monitoring data from the additional AMDs will not be available for generating Web traffic statistics or defining Web software services with a wizard. By default, the port number for communication between the Console Basic Analyzer Agent and the RUM Console Server is set to 9094 and the secure connection is enabled. In most cases, you will not need to modify this setting. If the default port number is already in use by other services, however, you must type your new port number in the Port number box. In this case, you will also have to manually change the port number setting on the Console Basic Analyzer Agent side. For more information, see Modifying Connection Settings for Guided Configuration in the Data Center Real User Monitoring Administration Guide. 13. Click Next to test your connection parameters. If your configuration fails the test, you can go back and adjust your settings. Note that if the device fails to respond correctly, it may take several seconds before the test times out. 14. Click Finish to save the configuration. As a result, your device appears on the Devices list. To view the list, go to Devices and Connections Manage Devices in the top menu of the RUM Console. The Devices screen presents a comprehensive view of all the devices that you add, including their IP Address, Port, Description, Type, Version, Connection, Hardware Health, and Configuration. 28

29 Chapter 3 Adding Basic DCRUM Devices Adding CAS to Devices List To view reports based on data coming from your AMD, use the RUM Console to add and configure a CAS report server. Adding a CAS 1. Start and log in to RUM Console. 2. Select Devices and Connections Add device from the top menu. The Add Device pop-up window appears. 3. From the Device type menu, select CAS. 4. In the Description box, type a description of the device. TIP It is good practice to include a parent device name in the description of the device you are adding, and to add such names consistently. This enables you to easily find your device in the list. Specifying Connection Details 5. In the Device IP address box, type the device IP address. 6. In the Port box, type the port number for communicating with this device. The standard port number used by the CAS when communicating over HTTP is Optional: Select the Use secure connection option if communication with this device should occur via a secure HTTP protocol. Providing Authentication Details 8. Choose whether authentication should occur via CSS. 9. Type the user name and password of the account that will be used for managing this device. Configuring Advanced Settings 10. Switch to the Advanced options tab. 11. Optional: Under Secondary device connection, provide an alternative IP address for this device. 12. Click Next to test your connection parameters. If your configuration fails the test, you can go back and adjust your settings. Note that if the device fails to respond correctly, it may take several seconds before the test times out. 13. Click Finish to save the configuration. Configuring CAS-AMD Connection 14. To display the current device list, select Devices and Connections Manage Devices from the top menu. 15. Select a report server from the list of devices. Click the server once to display the detailed information for the device. 16. Switch to the Data Sources tab. 29

30 Chapter 3 Adding Basic DCRUM Devices 17. Click Add Data Source. 18. Select your AMD from the list and then click the button. 19. Click Finish to save the configuration. As a result, your device appears on the Devices list. To view the list, go to Devices and Connections Manage Devices in the top menu of the RUM Console. The Devices screen presents a comprehensive view of all the devices that you add, including their IP Address, Port, Description, Type, Version, Connection, Hardware Health, and Configuration. What to Do Next It is important to keep the devices synchronized to avoid improper data interpretation. For more information, see Synchronizing Time Using NTP Server in the Data Center Real User Monitoring Agentless Monitoring Device Installation Guide and Time Synchronization Between AMD and Server in the Data Center Real User Monitoring Administration Guide. 30

31 CHAPTER 4 Verification of Traffic Monitoring Quality Use the RUM Console to verify traffic monitoring quality using two tightly connected solutions: Sniffing Point Diagnostics and Application Overview. It is highly recommended that you perform this step at the beginning of your DCRUM deployment to help verify that your hardware is working properly and the applications you intend to monitor are detected. You can verify test results and repeat them as needed at any time and for any network conditions. IMPORTANT All verification is based on a traffic recording, either manual or automatic. The outcome may not be representative if the target traffic is low at the time of recording or you are unable to capture a satisfactory number of complete sessions. Choose automatic or manual traffic recording to capture unfiltered or filtered traffic. Enable automatic recording only during the configuration process and then disable it. It can negatively affect the performance of the AMD during normal operations, especially if you are running a 32-bit AMD in a high-traffic environment or a 64-bit AMD with the native driver. For the most complete and reliable statistics, use the 64-bit customized driver on the AMD. Verification of traffic monitoring quality is possible only for AMD 11.7 or later. Sniffing Point Diagnostics Sniffing Point Diagnostics is a type of hardware state analysis that enables you to perform pre-monitoring tasks without the need to access the AMD terminal. You can employ it as a powerful alternative to a series of UNIX or rcon commands executed to validate the operation of sniffing ports. This step can be performed either at the DCRUM deployment stage or at any later time to see whether AMD performance is affected by malfunctioning hardware or external networking conditions. Typical issues that a Sniffing Point Diagnostics analysis highlights include: No traffic detected on sniffing interfaces. Interface or link overload. 31

32 Chapter 4 Verification of Traffic Monitoring Quality Poor quality of traffic due to mirrored ports on switching hardware configuration. Dropped packets (indicates AMD overload). Network conditions when unidirectional traffic prevails. Rejected packets, invalid packets, wrong check sums for packets. Missing packets (either lost or dropped). Missing bytes (how much traffic is lost in general). Conditions affecting AMD calculations, such as: Duplicate traffic that cannot be handled by the AMD. Incorrect choice of packet deduplication method. Incorrect settings for packet deduplication buffer. Incorrect settings for maximum packet size or huge packet size. Conditions affecting AMD performance, such as: Duplicate traffic handled by the AMD. Large percentage of non-ip traffic (noise). Large percentage of non-tcp or non-udp traffic (noise). Reordered sessions. Miscellaneous SSL problems: Unsuccessful decryption (in general). Uninitialized SSL cards unable to decrypt traffic. The ratio of encrypted and successfully decrypted traffic to encrypted and non-decrypted traffic. Incorrect or missing private keys. No match between the key and server certificate. Dropped or corrupted packets preventing decryption. Unsupported cipher methods (for example, Diffie-Hellman based key infrastructure). Unsupported SSL versions or features. Prerequisites and Best Practices To diagnose application detection and the connections of sniffing points, you first need to ensure that: All cables are connected correctly. The AMD is properly installed and configured. This includes post-installation steps such as interface identification and network configuration. Traffic recording lasts long enough to capture a reasonable amount of traffic volume (for example, 20 to 30 minutes of traffic). 32

33 Chapter 4 Verification of Traffic Monitoring Quality Do not use specific capture profiles when recording traffic. Always use the All available option for capture profiles when you do manual recording. Enable automatic trace recording to have access to regular and fresh snapshots of traffic traveling on your network. This, however, should happen only when you actually need to diagnose traffic or capture port problems. Application Overview The Application Overview screen enables you to answer several questions about your applications at the onset of your monitoring configuration. Are all my applications or servers detected? What applications or servers are detected? Can the detected applications or servers be successfully monitored? How heavy is the traffic for each application or server? What services are detected on each server? How heavy is the traffic for each detected service? Note that incomplete sessions are not analyzed. (If no beginning is recorded for a session, that session is not analyzed.) The Application Overview screen is an optional step towards defining new software services. To access it, navigate to Software Services Add Software Service in the console top menu, and then select By traffic lookup. Figure 9. Example of the Application Overview screen showing detected applications From this screen, you can start configuring software services either manually or using the wizard. If it is possible to go through a step-by-step configuration, a wizard icon ( ) is displayed for the given protocol or service. 33

34 Chapter 4 Verification of Traffic Monitoring Quality Application Detection Mechanism Application detection is a three-stage process: 1. To provide the most accurate results, packet analysis for SSL, HTTP, HTTPS, SOAP, and related protocols is performed as a first step toward application type detection. Application recognition is based on the first matching pattern found. This means that some services may not be properly classified if multiple protocols are used in one session. For example, if your application uses HTTP and SOAP over HTTP protocols, and plain HTTP communication opens a session, the application will be classified as HTTP. 2. Applications are also detected based on discovery of well-known ports. The default protocol definitions are stored on the AMD and can be exported from the RUM Console. For more information, see Exporting AMD Configuration in the Data Center Real User Monitoring Administration Guide. At times your applications may use ports commonly used for other purposes. The AMD is unaware of these circumstances and will report well-known protocol names. For example, if one of your web applications uses port 8080 and uses HTTP for communication, the AMD will still report this as an HTTP proxy. 3. If none of the selected conditions matches, the application is labeled as Unknown TCP or Unknown UDP. Server recognition in application detection is based on heuristic session analysis; results may vary depending on the type of network interface driver used. 34

35 CHAPTER 5 Basic Monitoring Configuration You can define many configuration settings globally for all software services for a given protocol and Data Collector, or locally for specific user-defined software services. If you specify both types of settings, the settings for a user-defined software service take precedence over the corresponding global settings. Monitoring software services For ICA (Citrix) analyzer, there are no default software services defined. To monitor Citrix Presentation or Windows Terminal Services traffic, you have to define your own software services on specified ports and for specified IP addresses. For more information, see Example of Configuring Citrix or Windows Terminal Software Services [p. 48]. To access settings for specific software services, you need to select and open the Rules configuration for that software service. For more information, see Creating a New Rule for Citrix or Windows Terminal Software Service [p. 48]. For the details of specific settings for Citrix Presentation or Windows Terminal Services, see Citrix or Windows Terminal Services Monitoring [p. 43] Monitoring transactions Transactions are sequences of information exchange that represent particular actions or functions performed by a human user or a client program. They are viewed as higher-level units of self-contained functionality and are tied to applications. For example, they may represent the procedure for an online purchase or ticket booking. AMD monitors traffic data and prepares it for transaction monitoring by an ADS and CAS. Some of the relevant configuration and processing is performed on the actual RUM Console and some is performed on the AMD. See Monitoring Sequence Transactions [p. 51] for information on how to configure and use transaction monitoring on the AMD. Configuring General Data Collector Settings For any given data collector device such as the AMD, you can set a variety of options such as time thresholds. The general settings affect monitoring of default and user-defined software 35

36 Chapter 5 Basic Monitoring Configuration services. Some of them can then be overridden by settings for a particular analyzer, software service, or URL. To define general settings for an AMD: 1. Start and log in to RUM Console. 2. To display the current device list, select Devices and Connections Manage Devices from the top menu. 3. Select Open Configuration from the context menu for an AMD. The AMD Configuration window appears. 4. Navigate to Configuration Global General to access the list of general configuration settings. While some of the options control only general AMD behavior, some options in the Advanced group affect more specific configurations in application monitoring. For example, if Inherit from global settings is selected in your other configurations while configuring user-defined software services, the global setting takes precedence over the specific monitoring configuration. Configuration options include: Monitoring interval The monitoring interval in minutes. Increasing this value reduces the number of chunks of data that need to be transferred and processed. Default: 5 minutes. Make sure that the monitoring interval is synchronized between the data collectors. Operation time threshold The number of seconds after which an operation is considered to be slow. The global threshold value depends on the analyzer. This threshold is used by the following analyzers: Cerner Cerner over MQ Epic Generic with transactions HTTP MS Exchange over HTTP MS Exchange over HTTPS Oracle Applications over HTTP Oracle Applications over HTTPS SAP GUI SAP GUI over HTTP SAP GUI over HTTPS SMTP SSL SSL Decrypted Siebel over HTTP Siebel over HTTPS 36

37 Chapter 5 Basic Monitoring Configuration Server time threshold Server time threshold relates to the server time portion of a overall operation time. Server times above the threshold limit are considered to be slow due to poor datacenter performance. This threshold is used by the following analyzers: HTTP Oracle Applications over HTTP Oracle Applications over HTTPS SAP GUI over HTTP SAP GUI over HTTPS IP address of the server authorized to set AMD time The IP address of the report server that has the authority to synchronize the time with this AMD. In an environment with a number of servers sharing the same AMD, it is good practice to use only one of these servers (a designated chosen time synchronization server) to make changes to AMD settings. Otherwise, the server used for time synchronization will change inadvertently every time you save an AMD configuration. Default analyzer The default setting for the TCP analyzer is Generic (with transactions). To change it, select another analyzer from the list. Client RST packet timeout to mark session as CLOSED If the time between the last ACK for data sent by the server and an RST packet sent by the client is greater than this value, the session is treated as closed instead of aborted. Huge packet size The upper size limit, in bytes, of an HTTP request to be processed successfully by the AMD. Maximum packet size The AMD is capable of processing packets of up to bytes, besides the Ethernet standard MTU (Maximum Transmission Unit) of 1536 bytes. Choose one of the predefined values (2048, 4096, 8192, or bytes) to enable the AMD to process non-standard MTU packets. When you have chosen the Maximum packet size value, make sure that you also set the Huge packet size to an applicable value. Enabling theamd to process nonstandard MTU packets without extending RAM on the machine and leaving Packet buffer size (64-bit AMDs only) and Data memory limit unchanged can cause an excessive packet loss. To avoid this, extend RAM and configure its usage as recommended in the tables below. For more information, see Setting Packet Buffer Size in the Data Center Real User Monitoring Agentless Monitoring Device Installation Guide and Setting Data Memory Limit in the Data Center Real User Monitoring Agentless Monitoring Device Installation Guide. 37

38 Chapter 5 Basic Monitoring Configuration Table 1. Recommended RAM configuration for Maximum packet size values for 64-bit AMDs Maximum packet size RAM size 64-bit minimum (recommended) Data memory limit Packet buffer size Packet buffer count 1522 B 4 GB (32 GB) 1024 MB 1832 MB 1,200, B 5 GB (32 GB) 1024 MB 2289 MB 1,500, B 6 GB (32 GB) 1024 MB 3022 MB 1,500, B 12 GB (32 GB) 1024 MB 5951 MB 1,500, B 22 GB (48 GB) 1024 MB MB 1,500, B 32 GB (64 GB) 1024 MB MB 1,000, B 48 GB (64 GB) 1024 MB MB 1,500,000 Sampling enabled Supported in 64-bit customized AMD drivers and all- native drivers. The sampling mechanism is very beneficial when heavy traffic may negatively affect AMD performance and there is a risk of losing IP session consistency. When this option is enabled, the AMD tries to analyze the greatest possible portion of traffic. It drops packets in a controlled manner that preserves complete and consistent sessions. Note that statistics for dropped packets are not shown on the report server. If packets are dropped because of sampling, the CAS shows notification messages. For percentages between 75 and 99, you will see a warning icon; for values below 75, the report server will issue error messages. When this option is disabled and network interface driver performance is degraded, random packets are dropped. Default: enabled. For more information, see Using Network Interfaces with Native Drivers in the Data Center Real User Monitoring Agentless Monitoring Device Installation Guide and Driver, Network and Interface Configuration in the Data Center Real User Monitoring Agentless Monitoring Device Installation Guide. Deduplication method You can choose one of four methods for eliminating duplicate packets: Based on TCP checksum and IP ID Using this method, duplicate packets are detected based on their TCP checksum and IP ID. Based on TCP checksum and IP ID (excluded SEQ and ACK numbers) Using this more complex, two-stage method, duplicate packets are detected based on a modified packet KCP checksum (SEQ and ACK numbers are excluded) and IP ID. This method is useful if the AMD captures packets on various interfaces of the router, rewriting SEQ and ACK numbers. A packet is considered a duplicate when the modified checksum, IP ID, and SEQ and ACK numbers are identical. First, a packet checksum with SEQ and ACK 38

39 Chapter 5 Basic Monitoring Configuration numbers is created and compared to the packets stored in the detection buffer. If the comparison indicates that the packet is not a duplicate, it is checked to determine whether it matches the current session. A packet matches the current session when its SEQ and ACK numbers are different from processed and cached numbers by the value defined in TCP duplicate window. If the difference exceeds the defined value, the AMD assumes the ACK and SEQ numbers were rewritten by the router and the packet is considered a duplicate. TCP checksum, IP ID and MAC address (excluded SEQ and ACK) Similar to TCP checksum and IP ID (excluded SEQ and ACK numbers) Using this method, the deduplication process is similar to the one based on TCP checksum and IP ID (excluded SEQ and ACK numbers), but on top of TCP checksum and IP ID, the MAC address is also taken into account. TCP checksum, IP ID and MAC address Using this method, duplicate packets are detected based on their TCP checksum, IP ID and MAC address. TCP duplicate window This setting is useful only if Deduplication method is set to Based on TCP checksum with excluded SEQ and ACK numbers. It is used for determining whether a packet, based on its SEQ and ACK numbers, belongs in the session. If a packet's SEQ and ACK numbers differ from the current session's SEQ and ACK numbers by a value larger than TCP duplicate window, the packet is considered a duplicate. Default: Packet buffer size The number of packets to keep in the buffer for use as a basis for comparison in duplicate packet detection. Newly captured packets are sequentially compared to the packets in the buffer. A newly captured non-duplicate packet (all packets in the buffer are unique) is placed on the top of the stack and the oldest is removed. Range: 6 to 24 packets. Default: 16. Reset duplicate detection time threshold Time of inactivity (in seconds) after which the duplicate packets elimination mechanism is reset. If Deduplication method is set to Based on TCP checksum with excluded SEQ and ACK numbers, the Reset duplicate detection time threshold should be greater than every response generation time (server time). 5. Save or publish the configuration. Click Save to save your changes and continue with configuration. Click Save and Publish to immediately update the devices configuration. 6. Close the AMD Configuration window. Configuring Operation-Related Global Settings Global settings for operations enable you to define options that can apply to all monitored operations and take precedence over options defined for individual operations. 39

40 Chapter 5 Basic Monitoring Configuration 1. Start and log in to RUM Console. 2. To display the current device list, select Devices and Connections Manage Devices from the top menu. 3. Select Open Configuration from the context menu for an AMD. The AMD Configuration window appears. 4. Select Configuration Global Operations to display general configuration settings. Options include: Operation load time threshold Number of seconds after which an operation is considered slow. You can set this value with a precision of one ten-thousandth of a second. Default: seconds. The threshold is used by following analyzers: IBM over MQ Jolt MS Exchange Oracle Forms over HTTP Oracle Forms over HTTPS Oracle Forms over SSL Oracle Forms over TCP SOAP over HTTP SOAP over HTTPS XML XML over HTTP XML over HTTPS XML over MQ XML over SSL Max. operation duration Maximum number of seconds an operation can take. You can set this value with a precision of one ten-thousandth of a second. Default: 3600 seconds (1 hour). User abort threshold Minimum number of seconds between the beginning of a hit and TCP reset to count it as a user abort. Default: seconds. (You can set this value with a precision of one ten-thousandth of a second.) ADS data generation settings Options in the ADS data generation settings section refer mainly to ways of handling various types of standalone hits, which are hits that cannot be automatically assigned to operations because reference information (such as correlating response, defined or auto-learned URL, no authorization, or orphaned redirects) is missing. By default, most standalone hits are not taken into account when generating operations data. 40

41 Chapter 5 Basic Monitoring Configuration Report data without monitored URL Select this option to report data for hits without a URL that has been explicitly defined in user-defined services or recorded through auto-learning. Report standalone hits without monitored URL Select this option to report data for standalone hits that at the same time do not refer to a monitored URL, as in Report data without monitored URL. Standalone hits are hits without a response header, unauthorized hits, orphaned redirects, or other hits missing the reference context. Report hits without response header Select this option to report data for discarded hits (hits without a correlating response header). Report hits not added to any operation Select this option to report data for other standalone hits caused by factors not covered by other options of this section. Report unauthorized hits Select this option to report data for hits with rejected authentication. Report orphaned redirects Select this option to report data for redirects to sites that are not being monitored or are not visible and therefore appear as orphaned redirects. Report filtered data This is a diagnostics option. When configuring content type monitoring, you can filter out pages based on the content of the URL. For more information, see Monitoring of Non-HTML Objects Based on Content Type in the Data Center Real User Monitoring Web Application Monitoring User Guide. If you select this option, the filtered out pages will not be reported, but will still be saved in the AMD data files. Ignored clients A list of clients for which TCP setup time will always be ignored and all operations will start from the request packet. Right-click the list to open a menu of command options: Add, Edit, or Delete. 5. Save or publish the configuration. Click Save to save your changes and continue with configuration. Click Save and Publish to immediately update the devices configuration. 6. Close the AMD Configuration window. 41

42 Chapter 5 Basic Monitoring Configuration 42

43 CHAPTER 6 Configuring AMD to Monitor User-Defined Software Services If you require detailed analysis of traffic, you need to specify software services to be monitored on specific IP addresses and ports. Citrix or Windows Terminal Services Monitoring After you installed TCAM on a Citrix Presentation Server or Windows Terminal Server, you can monitor software services served via such servers. You can define a software service to be monitored by multiple AMDs or specify it on a single AMD. To monitor a software service that is served via a Citrix Presentation Server or Windows Terminal Server: 1. Configure global settings used by AMD when monitoring traffic with TCAM. Assuming that the AMD Configuration window is open, set the following properties: Open Advanced User-IP mapping General and set Session client name mappings lease time (default value 60 seconds). Open Advanced User-IP mapping Listeningand enable Session client name mappings timeout (default value: 1 second). Open Advanced User-IP mapping Listening and, in the UDP section, select the Enable UDP server listening for packets of syslog with mappings check box to enable retrieving user-to-ip address mappings from the UDP syslog packets. Open the Advanced User-IP mapping Listening and, in the Parser section, select citrixparser. For more information, see User-to-IP Address Mapping in the RUM Console Online Help. 2. Create a new user-defined software service. Enter your service name and select the ICA (Citrix) analyzer. For more information, see Example of Configuring Citrix or Windows Terminal Software Services [p. 48]. 43

44 Chapter 6 Configuring AMD to Monitor User-Defined Software Services 3. Add a monitoring rule for the service. The default port number for Citrix-based software services is 1494 or For more information, see Creating a New Rule for Citrix or Windows Terminal Software Service [p. 48]. 4. Click Save and Publish to apply new settings to your AMDs. Configuring AMD to Monitor ICA Traffic A single configuration option is available to configure ICA monitoring. This option is global for all analyzers used to monitor ICA and applications using ICA. To access the global ICA configuration screen, log in to the RUM Console, select Devices and Connections Manage Devices from the top menu, select Open Configuration from the context menu for an AMD, and navigate to Configuration Global Other Protocols Monitoring ICA. ICA payload analysis method This option specifies how the ICA traffic is decoded. The available options are: disabled No payload analysis is performed. user only full Only user names are extracted; the decoding stops after a user name is encountered. Both user name and channel are extracted. Entire sessions are analyzed. Defining Software Services If you require detailed analysis of traffic or if software services you intend to monitor do not work on well-known ports, you can specify software services to be monitored on specific IP addresses and ports. For such software services, a wide range of metrics is measured and detailed traffic analysis is performed. To add a new software service: 1. Start and log in to RUM Console. 2. In the top menu, go to Software Services Add Software Service. The Add Software Service pop-up window appears, listing all ways of adding a new service. 3. Select Manually as a method of adding a new software service definition. The Add Software Service window appears. 4. Specify basic information for your software service. Provide a software service name. Select appropriate analyzer to monitor the traffic. 44

45 Chapter 6 Configuring AMD to Monitor User-Defined Software Services Using check boxes, select the devices that will monitor the new software service. When you later publish the software service definition, the new configuration will be applied only to the selected devices. 5. Click OK to proceed to monitoring rules configuration. 6. Right-click in the Rules table and select Add from the context menu. The Rule Configuration appears. 7. Proceed with the rules configuration. Follow the steps described in Configuring Rules for User-Defined Software Services [p. 45]. 8. Back on the Software Services screen, click Publish Configuration. Configuring Rules for User-Defined Software Services Each software service can have a number of specific rules that define what is to be monitored and what additional options are in effect. You can also assign each software service to existing or newly created tiers and applications. Before You Begin It is assumed for this task that you are already familiar with the concept of software services and that you know how to create and edit software services and how to open the Rules window. For more information, see Configuring User-Defined Software Services in the RUM Console Online Help. After a user-defined software service is created, you need to create a group of settings that comprise the rules for the software service. It is necessary to specify, at minimum, the IP addresses and port numbers for the software service. To configure rules for a user-defined software service: 1. On the Services tab, select or clear Enabled to activate or de-activate the service definition. 2. In Rule description, type a brief description that will later help to identify the rule. The description you enter at this point will be shown in the Rules table, in the column Rule Name. If no text is entered here, the IP address specified later will be used as a description for this rule. 3. Right-click in the Services table and select Add or Open from the context menu. The Service Details window will pop up when adding or editing rules. 4. In the Service Details window, in the IP address(es) fields, enter the server IP address, or enter a range of IP addresses if you plan to monitor more than one server. 5. In the Port(s) fields, enter the port number of the monitored service. You can provide a range of port numbers if such a range of ports is used in your environment. Some software services may be active on a number of predefined ports or may change ports dynamically. To allow for this, you can specify a range of ports. Note, however, that specifying more than one port for a service prevents the port number from being reported for that service. If you define more than one port for a particular service name and server 45

46 Chapter 6 Configuring AMD to Monitor User-Defined Software Services IP address (by either specifying a range of ports or by creating two or more distinct rules for the same service name and server IP address but with different port numbers), the AMD will report the port number for this service as 0, causing the port number to be ignored in traffic reports. NOTE You can define up to 5000 definitions containing a server and a port. Each association of a server and a port counts as a single definition. Specifying a range of ports counts as providing many individual definitions. On CAS, the number of processed server definitions is limited by the license. For more information, see Per-Measurement Licensing in the Data Center Real User Monitoring Administration Guide. 6. Optional: Select Client port(s) for reversed-direction protocols. This option makes sense only for protocols such as X-Window whose client-server meanings are reversed. If you are uncertain, leave this option cleared. 7. Optional: Select or enter a Group name This option allows to logically group the defined services. NOTE It is important that grouping within the services definition is consistent. Defining services with that same IP address, different ports and assigning them to different groups will result in generation of redundant and irrelevant data. 8. Optional: Enter a virtual IP address if your network uses a pool of virtual IP addresses. For more information, see Virtual IP address [p. 98]. 9. Optional: Enter the IP address of the server masking the addresses of monitored servers. If the servers you intend to monitor reside behind an appliance that masks and replaces the addresses of the target servers, you need to set NLB NAT masking IP address to the IP address of the masking server. Without doing so, the AMD will see two unidirectional conversations instead of one bi-directional conversation between the servers and appliance: The conversation between the client and server is observed and recorded (IP address A talking to IP address B) When a response travels to the client, a different session (IP address C talking to IP address A) is recorded due to the server's IP address being replaced by the load balancer's IP address. Unless you account for this, CAS reports will return reports with ambiguously granulated data. Using the NLB NAT masking IP address option will ensure that the AMD monitors contiguous conversations. 10. Click OK to confirm your changes and close the Service Details window. 11. Go through all available tabs and fine-tune the monitoring conditions. 46

47 Chapter 6 Configuring AMD to Monitor User-Defined Software Services The number of available configuration options depends on the analyzer. See the analyzer-specific section for more information. 12. Optional: On the Options tab, define analyzer-specific options. The following list describes all possible options. Depending on the analyzer, some may be unavailable: Operation load time threshold An operation that takes more than this many seconds is considered slow. When Inherit from global setting is selected, the global setting is used. The global threshold value depends on the analyzer. Operation time threshold An operation that takes more than this many seconds is considered slow. When Inherit from global setting is selected, the global setting is used. To edit the global setting, open the AMD configuration, go to Global General and set the Operation time threshold. Server time threshold Server time threshold relates to the server time portion of a overall operation time. Server times above the threshold limit are considered to be slow due to the poor datacenter performance. When Inherit from global setting is selected, the global setting is used. To edit the global setting, open the AMD configuration, go to Global General and set the Server time threshold. SQL query time threshold A database query that takes more than this many seconds is considered slow. When Inherit from global setting is selected, the global setting is used. To edit the global setting, open the AMD configuration, go to Global Database Monitoring General and set the SQL query time threshold. Enable monitoring of persistent TCP sessions When this is selected, TCP sessions not starting with SYN packets are monitored. By default, this is selected. Persistent TCP sessions, that is TCP sessions for which the start was not recorded, also referred to as non-syn sessions, can be included in the TCP statistics, based on configuration properties you enable in RUM Console. The inclusion of such sessions may render the statistics somewhat inaccurate and must be undertaken with care. Generate transactions and ADS data Select this option to provide data to the report server consisting of, for example, lower-level protocol information: raw HTTP traffic data, enabling you to view the full HTTP request-response dialog. SQL Server uses dynamic ports This is a TDS analyzer specific option. Select this option if the database engine you intend to monitor does not have a static port number assigned (for example, a named instance). In this case SQL Server Browser Service (SSBS) will be used to discover the actual port of the service. The AMD will use additional UDP analysis of the SSBS to discover the actual port number for the service you intend to monitor. 47

48 Chapter 6 Configuring AMD to Monitor User-Defined Software Services If you select this option make sure the connection details set in Services tab identify SQL Server Browser Service (use IP address of the server and the port number of the SSBS). Leave this option unselected if your SQL Server uses static ports. Convert the XML content URL-encoding This check box defines whether the XML URL-encoding content is enabled. When Inherit from global setting is selected, the global XML setting is used. URL parameter name that contains URL encoded XML document Provide the parameter name that contains a URL encoded XML document. If your leave the field empty, the AMD will not analyze XML documents sent in URL parameters. 13. Click OK to save the new configuration. Example of Configuring Citrix or Windows Terminal Software Services This example shows how to add and configure a user-defined software service based on the ICA (Citrix) analyzer. Assuming we have a Citrix server with IP address and port number To create and configure a new software service based on the ICA (Citrix) analyzer: 1. Start and log in to RUM Console. 2. In the top menu, go to Software Services Add Software Service. The Add Software Service pop-up window appears, listing all ways of adding a new service. 3. Select Manually as a method of adding a new software service definition. The Add Software Service window appears. 4. In the Software Service dialog box: Provide the software service name, for example: Citrix. Select the ICA (Citrix) analyzer. 5. Click OK to proceed to defining of monitoring rules for your software service. 6. In the Rules table, right-click to open the context menu and choose Add. For more information, see Creating a New Rule for Citrix or Windows Terminal Software Service [p. 48]. You have to create at least one rule for monitoring of this software service. After the rules are created, they all are displayed in the Rules table. Creating a New Rule for Citrix or Windows Terminal Software Service Rules are mandatory for any software service to be monitored. Here you will define a rule for a ICA (Citrix)-based user-defined software service. 48

49 Chapter 6 Configuring AMD to Monitor User-Defined Software Services Before You Begin It is assumed for this task that you are already familiar with the concept of software services and know how to create and edit software services and how to open the Rules window. For more information, see Configuring Rules for User-Defined Software Services [p. 45]. To create a new rule for a software service based on the ICA (Citrix) analyzer: 1. In the Edit Rule dialog box, enter a rule name. In the Rule description edit box, type Rule 1 or you can type your own rule name. 2. Right-click the Services table and select Add from the context menu. The Service Details window will pop up. 3. In the Services window, type the server IP address, or type a range of IP addresses if you plan monitoring more than one server. We will create a simple rule to monitor one server (one IP address on the default port). In the Start IP address, let's type In the Port(s) fields, type the port number of the monitored service. Type 1494 or the standard Citrix port. 5. Leave the Client port(s) check box cleared. 6. Click OK to confirm your data and close the window. 7. Optional: Click the Options tab to review and modify common options for the ICA (Citrix) analyzer. Managing User-Defined Software Services As a console user you have the ability to add, remove, and edit the properties of any software service defined on any of your AMDs. You can view all user-defined software services on the Software Services screen in the RUM Console. To access this screen, go to Software Services Manage Software Services in the top menu. This screen contains information about user-defined software services created on all devices managed via this console. From here you can add new services, delete existing ones, and copy them across AMDs. Note that the default software services are specific to a single AMD and cannot be managed centrally. To view user-defined software services monitored by a selected device, you need to access the configuration for this device. To do that, select Devices and Connections Manage devices from the top menu, which opens a list of all devices managed by the console. Then select Open configuration from the context menu for you device. Assigning software services to devices Software services mirrored across different AMDs (that is, having the same name and identical rules) are grouped together. The service name is the name for the group. Whenever you change rules on any of the AMDs in the group, the software services will be broken into single entries. After a software service is created on one of the AMDs in your network, you can copy it to another device. To do so, go to Software Services screen and select Copy from the Actions 49

50 Chapter 6 Configuring AMD to Monitor User-Defined Software Services context menu for a given software service. A dialog will appear where you can choose AMDs by selecting the check box beside their IP addresses. After you click OK, the software service definitions will be copied to the selected AMDs. You can modify the list of devices monitoring a given software service with the help of Change Assignment button on the Deployment tab of the Software Services screen. 50

51 CHAPTER 7 Monitoring Sequence Transactions You can manage (add, delete, modify or copy) the sequence transactions (operation sequences) as defined on an individual AMD or each transaction as it is monitored by a group of AMDs. Viewing all defined sequence transactions To view all transactions, go to Reporting Configuration Sequence Transactions in the console top menu. For each transaction the following information is shown: Sequence Transaction Name The name of a transaction. Application The application that includes the listed transaction. Type The protocol used to define the listed transaction: ASYNC-HTTP, CERNER, CERNER-RTMS, HTTP, OF, SAP GUI, SQL or XML. Packaged Applications Whether the listed transaction is a packaged application whose transactions are recognized by the report server automatically. When you select a transaction by clicking it once, you can see the list of AMDs that monitor this transaction. Viewing sequence transactions defined on an individual AMD To view defined transactions monitored by a single AMD, go to Devices and Connections Manage Devices in the console top menu. Then select Open configuration from the context menu for your AMD to access the AMD Configuration screen. Finally, navigate to Configuration Sequence Transactions. The main Sequence Transactions table lists all of the currently defined transactions and their details: Sequence Transaction Name The name of a transaction. 51

52 Chapter 7 Monitoring Sequence Transactions Application Name The application that includes the listed transaction. Type The protocol used to define the listed transaction. Steps The number of individual operations involved in the listed transaction. Priority The priority of the transaction. Possible values are 1, 2, and 3, with 1 being the highest priority. Timeout The maximum time for the transaction to complete. Packaged Applications Whether the listed transaction is a packaged application whose transactions are recognized by the report server automatically. Viewing sequence transaction details On the Sequence Transactions screen, select Edit from the Actions menu for a given transaction to open the Edit Transaction window and examine the steps that make up the transaction. The listed details are as follow: Name, Application, Description: Timeout [s], Slow after [s], Priority URL, Timeout, Repetition. Managing existing sequence transactions To manage all defined transactions use the Sequence Transactions screen. To create new transactions use the Add Sequence Transaction button. It opens the Create Sequence Transaction screen, where you can select the AMD devices that will monitor this new transaction. To delete a transaction, first select it using the provided check boxes and then click Delete. NOTE If the transaction being deleted is monitored by more than one AMD, all of the affected AMDs will have a new draft configuration that will have to be published. To edit a transaction, go to the Actions context menu for this transaction and select Edit. To copy a transaction to another device, go to the Actions context menu for this transaction and select Copy. Adding Transactions You can add a transaction to an individual AMD or for a range of AMDs using the RUM Console. 52

53 Chapter 7 Monitoring Sequence Transactions To define a new transaction: 1. In the RUM Console, go to Reporting Configuration Sequence Transactions. 2. Click Add Sequence Transaction. It opens Create Sequence Transaction pop-up window. 3. Enter the application and transaction names and a description. If you have configured the Compuware APM connection, you will be able to use the browse button to select a predefined application and a specific transaction within this application. For more information, see Configuring BSM Connection in RUM Console in the Data Center Real User Monitoring Administration Guide. 4. Using provided check boxes select the devices that will monitor your transaction. When you later publish the new configuration, it will only be applied to these devices. 5. Click OK. It opens a screen where you need to specify configuration details for the transaction. 6. Provide the timing and priority values: Timeout [s] The maximum time for the transaction to complete. Transactions must complete in this time to be logged as successful transactions. Slow after [s] The length of transaction execution time above which the transaction is classified as slow. This threshold can be specified as fractions of seconds, for example: 0.5. All transactions that complete in a time longer than the threshold time are classified as slow transactions. Priority Determines the transaction to be recorded if two or more transaction definitions match the transaction detected in the monitored traffic. Available priority values are 1, 2, and 3, with 1 being the highest priority. A multiple transaction match can happen if, for example, you first create a generic transaction definition that can match a number of more specific transactions, and then you create a transaction definition that matches a particular sub-type of that generic transaction type. If an observed transaction is found to match the latter definition, it will of course also match the first (more generic) one, and the system will need to decide under which transaction name to record the observed transaction instance. By increasing the priority of the second, more specific definition, you can count the occurrences of this particular transaction sub-type, which would then not be counted in the statistics for the generic transaction type. In other words, you can use this feature to increase the priority of specific customized transaction definitions that should take precedence over more generic transaction templates. 7. Specify the operations comprising the transaction steps. Depending on the transaction type, enter the following items to define the transaction steps: 53

54 Chapter 7 Monitoring Sequence Transactions HTTP Transaction URL The URL can contain a contain optional wild-card character * or a regular expression. XML Transaction XML Action The XML action can contain a can contain a contain optional wild-card character *. SAP GUI transaction SAP GUI operation Cerner RTMS Transaction Cerner operation The Cerner operation can contain an optional wildcard character *. Oracle Forms Transaction Oracle Forms operation The Oracle Forms operation can contain an optional wildcard character *. SQL Transaction (timer) SQL operation (command) and query type. Both SQL operation and query type can contain a contain optional wild-card character * to signify any number of any characters or a regular expression. You can use either of the two methods in one line. For example you can use the regular expression based pattern for the query type, regex:rp[abc]$ and simple search pattern for the SQL operation, set*. Refer to Reported Database Operation Types in the Data Center Real User Monitoring Database Monitoring User Guide for the details of supported query types. To maintain the sequence of these operations, use the navigation buttons on the right. When using the regular expression in defining the HTTP, Oracle Forms and SQL transaction steps, you have to start the search string with the phrase regex: and follow it a valid regular expression which will be applied to the URL, Oracle Forms, SQL operation or query type, for example: regex: For more information, see Using Wildcards in URLs in the Data Center Real User Monitoring Web Application Monitoring User Guide. Using the wildcard character *, you can signify any number of any characters. For more information, see Using Wildcards in URLs in the Data Center Real User Monitoring Web Application Monitoring User Guide. You can Add, Delete, Move Up, Move Down, or Copy the defined steps by selecting the step and clicking one of these actions. You can also make changes in the table itself: click in any of the column cells to edit the values. Using the table, you can determine whether the selected operation was a request or a response and whether this particular operation may be repeated within this transaction. 8. Click OK to add your transaction definition to a draft configuration. 9. Back on the Sequence Transactions screen, click Publish Configuration. 54

55 Chapter 7 Monitoring Sequence Transactions What to Do Next You can also add a transaction using the Sequence Transaction Inspector. For more information, see Monitoring Sequence Transactions [p. 51]. Adding Transactions for a Range of AMDs Transactions can be added to a number of AMDs at the same time. To add a transaction to several AMDs: 1. In the RUM Console, go to Reporting Configuration Sequence Transactions. 2. Click Add Sequence Transaction. It opens Create Sequence Transaction pop-up window. 3. Enter the transaction and application names. 4. From the Type list, select the analyzer type for the transaction. 5. Specify the AMDs to monitor this transaction by selecting the appropriate check boxes. 6. If you want to use a transaction inspector, select Open with Sequence Transaction Inspector and, from the drop-down list, select the device providing the XML data to the transaction inspector in the transaction editor. 7. Click OK to proceed to the transaction editor. 8. You can change the transaction and application names or you can accept the current names and proceed to the next step. 9. Provide the timing and priority values: Timeout [s] The maximum time for the transaction to complete. Transactions must complete in this time to be logged as successful transactions. Slow after [s] The length of transaction execution time above which the transaction is classified as slow. This threshold can be specified as fractions of seconds, for example: 0.5. All transactions that complete in a time longer than the threshold time are classified as slow transactions. Priority Determines the transaction to be recorded if two or more transaction definitions match the transaction detected in the monitored traffic. Available priority values are 1, 2, and 3, with 1 being the highest priority. A multiple transaction match can happen if, for example, you first create a generic transaction definition that can match a number of more specific transactions, and then you create a transaction definition that matches a particular sub-type of that generic transaction type. If an observed transaction is found to match the latter definition, it will of course also match the first (more generic) one, and the system will need to decide under which transaction name to record the observed transaction instance. By increasing the priority of the second, more specific definition, you can count the occurrences of this particular transaction sub-type, which would then not be counted in the statistics for the generic transaction type. 55

56 Chapter 7 Monitoring Sequence Transactions In other words, you can use this feature to increase the priority of specific customized transaction definitions that should take precedence over more generic transaction templates. 10. Specify the operations comprising the transaction steps. Depending on the transaction type, enter the following items to define the transaction steps: HTTP Transaction URL The URL can contain a contain optional wild-card character * or a regular expression. XML Transaction XML Action The XML action can contain a can contain a contain optional wild-card character *. SAP GUI transaction SAP GUI operation Cerner RTMS Transaction Cerner operation The Cerner operation can contain an optional wildcard character *. Oracle Forms Transaction Oracle Forms operation The Oracle Forms operation can contain an optional wildcard character *. SQL Transaction (timer) SQL operation (command) and query type. Both SQL operation and query type can contain a contain optional wild-card character * to signify any number of any characters or a regular expression. You can use either of the two methods in one line. For example you can use the regular expression based pattern for the query type, regex:rp[abc]$ and simple search pattern for the SQL operation, set*. Refer to Reported Database Operation Types in the Data Center Real User Monitoring Database Monitoring User Guide for the details of supported query types. To maintain the sequence of these operations, use the navigation buttons on the right. When using the regular expression in defining the HTTP, Oracle Forms and SQL transaction steps, you have to start the search string with the phrase regex: and follow it a valid regular expression which will be applied to the URL, Oracle Forms, SQL operation or query type, for example: regex: For more information, see Using Wildcards in URLs in the Data Center Real User Monitoring Web Application Monitoring User Guide. Using the wildcard character *, you can signify any number of any characters. For more information, see Using Wildcards in URLs in the Data Center Real User Monitoring Web Application Monitoring User Guide. You can Add, Delete, Move Up, Move Down, or Copy the defined steps by selecting the step and clicking one of these actions. You can also make changes in the table itself: click 56

57 Chapter 7 Monitoring Sequence Transactions in any of the column cells to edit the values. Using the table, you can determine whether the selected operation was a request or a response and whether this particular operation may be repeated within this transaction. 11. Click OK to add your transaction definition to a draft configuration. 12. Return to the Sequence Transactions screen and click Publish Configuration. The configuration will be sent to all devices. Modifying, Deleting, and Cloning Transactions for a Single AMD Modifying a sequence transaction To modify the definition of an existing transaction: 1. Open AMD configuration and click Edit as Draft to switch to draft mode. 2. In the Configuration tree, navigate to Sequence Transactions. This opens the Sequence Transactions table, listing all of the defined transactions for this AMD. 3. Right-click the transaction that you want to manage and select Open from the context menu. You can modify any of transaction details as described in Adding Transactions [p. 52]. Deleting a sequence transaction To delete selected transactions: 1. Open AMD configuration and click Edit as Draft to switch to draft mode. 2. In the Configuration tree, navigate to Sequence Transactions. 3. Click the transaction that you want to delete. (To delete multiple transactions with one step, hold the [Ctrl] key as you click additional transactions.) 4. Right-click and select Delete to remove the selected transactions from the list. Cloning a sequence transaction To clone selected transactions: 1. Open AMD configuration and click Edit as Draft to switch to draft mode. 2. In the Configuration tree, navigate to Sequence Transactions. 3. Click the transaction that you want to clone. (To clone multiple transactions with one step, hold the [Ctrl] key as you click additional transactions.) 4. Right-click and select Clone to duplicate the selected transactions. 57

58 Chapter 7 Monitoring Sequence Transactions A cloned transaction is indicated by the original transaction name with (Clone) appended to it. The difference between cloning and copying is described in Monitoring Sequence Transactions [p. 51]. 58

59 CHAPTER 8 Citrix Traffic on CAS Reports Several CAS reports enable you to analyze Citrix traffic by viewing various statistics. For a detailed description of the reports and an explanation of dimension and metric definitions, please refer to the Data Center Real User Monitoring Central Analysis Server User Guide or CAS online help. From the Reports menu, view the following reports: Applications: see the performance of applications for which data was detected on network tiers if you have defined Citrix applications and transactions on the CAS. For more information, see Application and Transaction Management in the Data Center Real User Monitoring Administration Guide. Tiers: analyze statistics for the Citrix/WTS (Presentation) tier. Drill down from the Citrix/WTS (Presentation) tier to access Citrix-specific reports, such as the Citrix Landing Page Report [p. 61]. Top N View: view the most problematic software services, operations, and sites. Software Services: analyze statistics for Citrix software services. Network View: analyze your network performance. User Activity: analyze traffic statistics for particular users. 59

60 Chapter 8 Citrix Traffic on CAS Reports 60

61 CHAPTER 9 Citrix/WTS (Presentation) Tier A tier is a specific point where DCRUM collects performance data. It is a logical application layer, a representation of a fragment of your monitored environment. If you use presentation servers (such as Citrix or Windows Terminal Services) and you have configured software services based on the ICA analyzer, the Citrix/WTS (presentation) tier will automatically be displayed in the Network Tiers section of the Tiers report. The Citrix/WTS (presentation) tier belongs to the Network Tiers section because it is treated as an application delivery channel. For Citrix and Windows Terminal Services, the key metrics are network performance, server RTT, or server loss rate; not operations or operation time as it is for data center tiers. This tier presents traffic related to the ICA analyzer for real users only. Drilldown Reports from Tier Name Click the Citrix/WTS (presentation) tier name to drill down to the Citrix Landing Page report, which shows general, network-related metrics for ICA-based software services. For more information, see Citrix Landing Page Report [p. 61]. If you want to view measurements specific to presentation servers, go to the Citrix Servers and Citrix Published Applications report, which shows performance related metrics for a selected server, also in the context of published applications. For more information, see Citrix Servers Report [p. 62] and Citrix Published Applications [p. 63]. Citrix Landing Page Report The Citrix Landing Page report lists all software services based on the ICA analyzer. How to Access the Report To access this report, click the Citrix/WTS (presentation) tier on the Tiers report. Report Contents and Usage The Citrix Landing Page report is an extension of the Tiers report for the ICA-based traffic. 61

62 Chapter 9 Citrix/WTS (Presentation) Tier You are also presented with the number of TCP errors, which may indicate the cause of your server problems; and with the average Citrix statistics that indicate resource utilization. Drilldown reports Click a software service name to drill down to a report listing all servers for this software service. For more information, see Citrix Servers Report [p. 62]. Using the links in the Software service column, you can also drill down to Citrix Servers and Metric Charts reports. For more information, see Citrix Servers Report [p. 62] and Metric Charts in the Data Center Real User Monitoring Central Analysis Server User Guide. Click a value in the Unique and affected users (network) column to drill down to All users report. For more information, see All Users Report in the Data Center Real User Monitoring Central Analysis Server User Guide. Using the links in the Unique and affected users (network) column, you can also drill down to Network Performance Affected Users and Availability Affected Users reports. Citrix Servers Report The Citrix Servers report shows either all presentation servers that belong to the Citrix/WTS (presentation) tier or all servers on which the specific software service is offered. How to Access the Report To access this report, click a software service name on the Citrix Landing Page report. Report Contents and Usage This report shows detailed measurements for each presentation server, so you can see the number of bytes sent by a specific server and its availability. The set of default metrics is the same as on the Citrix Landing Page report. For more information, see Citrix Landing Page Report [p. 61]. Drilldown Reports Click the server IP address to drill down to Citrix Published Applications Report. For more information, see Metric Charts in the Data Center Real User Monitoring Central Analysis Server User Guide. Using the links in the Server IP address column, you can also drill down to Citrix Channels and Metric Charts reports. For more information, see Citrix Channels [p. 63] and Metric Charts in the Data Center Real User Monitoring Central Analysis Server User Guide. Click a value in the Unique and affected users (network) column to drill down to All users report. For more information, see All Users Report in the Data Center Real User Monitoring Central Analysis Server User Guide. Using the links in the Unique and affected users (network) column, you can also drill down to Network Performance Affected Users and Availability Affected Users reports. 62

63 Citrix Published Applications The Citrix Published Applications report shows the performance of applications available on selected presentation servers. How to Access the Report To access this report, click a server IP address service name on the Servers report, or select the Servers tab in one of the Citrix/WTS (presentation) tier reports Report Contents and Usage This report shows detailed measurements for each published application, so you can observe the performance of the application in terms of bandwidth, network performance and affected users. The report also shows the performance in the context of commands, presenting Commands breakdown and Command delivery time metrics. Drilldown Reports Click the application name to drill down to Citrix Servers to analyze the all the systems serving the particular application. For more information, see Metric Charts in the Data Center Real User Monitoring Central Analysis Server User Guide. Click a value in the Unique and affected users (network) column to drill down to All users report. For more information, see All Users Report in the Data Center Real User Monitoring Central Analysis Server User Guide. Citrix Channels The Citrix Channels report shows the performance of channels available for selected application. How to Access the Report To access this report, click an application name on the Citrix Published Application report, or select the Channels tab in one of the Citrix/WTS (presentation) tier reports Report Contents and Usage This report shows detailed measurements for each channel in the context of application, so you can observe the performance of the channel in terms of bandwidth, network performance and affected users. The report also shows the performance in the context of commands, presenting Commands breakdown and Command delivery time metrics. You can also use the report to analyze the login performance. Citrix Sites Report Chapter 9 Citrix/WTS (Presentation) Tier The Citrix Sites report lists all client sites in which ICA-based traffic was detected during the selected period of time. 63

64 Chapter 9 Citrix/WTS (Presentation) Tier How to Access the Report To access this report, click the Citrix/WTS (presentation) tier on the Tiers report, and then click the Sites tab. Report Contents and Usage This report helps you identify sites in which performance problems occur and analyze how they affect the users. The set of default metrics in the Usage, Performance, and Availability sections of the table is the same as on the Citrix Landing Page report. For more information, see Citrix Landing Page Report [p. 61]. Drilldown Reports You can access more detailed reports from the following columns: Client site Metric Charts report. For more information, see Metric Charts in the Data Center Real User Monitoring Central Analysis Server User Guide. Software Service for Site report. For more information, see Network Status - Software Services View Report in the Data Center Real User Monitoring Network Performance Monitoring User Guide. Unique and affected users (network) All Users report. For more information, see All Users Report in the Data Center Real User Monitoring Central Analysis Server User Guide. Network Performance Affected Users report. For more information, see Network Performance Affected Users Report in the Data Center Real User Monitoring Central Analysis Server User Guide. Availability Affected Users report. For more information, see Availability Affected Users Report in the Data Center Real User Monitoring Central Analysis Server User Guide. 64

65 APPENDIX A Diagnostics and Troubleshooting Report-related Issues Central Analysis Server automatically detects a range of exceptions (anomalies) and notifies report users. Exception notifications are displayed as yellow (warning) or red (error) triangle icons placed in the upper-left corner of the report window. To see the notification message, place the mouse pointer over the triangle icon. Slow Operation Load Sequence report is empty for operation which is part of an XML transaction. Why and how do I fix this? For XML and SOAP, Operation Elements data is identical to Operation Analysis data, so, to avoid unnecessarily keeping the duplicates in the database, a VDATA_FILTER_XMLSOAP filter is set to true by default. Keeping this filter set to true saves disk space but, because the XML and SOAP entries are filtered out, it makes reporting on the Operation Elements level (elements or headers) impossible. To change the value of VDATA_FILTER_XMLSOAP property in userpropertiesadmin, type in the Web browser's Address bar and press [Enter], change the filter's property value, and click Set value to accept the change. To access this screen, you need to have administrative privileges for the report server. The yellow triangle displays AMDs produce no performance data. What do I do? The message AMDs produce no performance data means that AMDs connected to the report server do not produce any new data. To resolve this issue, you have to investigate the configuration of the AMDs and determine why they do not produce the performance data. The yellow triangle displays An AMD produces data stamped with a time from the future. What do I do? The report server has a built-in protection against simple configuration mistakes. One of the problems of that kind is data incorrectly time stamped by AMD. It happens if the AMD runs with the system clock is incorrectly set and is not being synchronized with the report server. If you see such a notification, you have to check the system time on the report server and on the AMD. You have to ensure the time synchronization option is turned on. 65

66 Appendix A Diagnostics and Troubleshooting To check the time synchronization: 1. Launch the RUM Console. 2. Select the AMD, right-click it and choose Open Configuration. The AMD Configuration window will open up. 3. Navigate to Global General. Check the IP address of the server authorized to set the AMD time. It should be the same as the report server IP address. 4. Check the report server time setting. You can do it by reading the time that is displayed at the bottom of the reports. Ensure the report server has the time zone set correctly. Figure 10. An example of the report time stamp The yellow triangle displays A daily maintenance task is in progress. Data processing suspended. What do I do? Once a day the report server has to perform a database maintenance and memory cleanup. For that time, the data processing has to be suspended and you will see delayed data on reports. The daily maintenance is usually performed as the first task after midnight and it takes up to half an hour in installations with a large database. It is normal and expected to see this warning just after midnight. But if you see the message during the day, it can be an symptom of incorrect system configuration (check time settings on the server) or of system overload. The yellow triangle displays No contact with the primary AMD. What do I do? This message means that the report server lost contact with at least one primary AMD. If an AMD is marked as primary and the report server cannot get contact with this AMD, even if the performance data can be downloaded from the other AMDs, the system will wait until the communication with the primary AMD is restored. The yellow triangle displays No contact with any of the AMDs. What do I do? This message means that the communication link cannot be established with any of the attached AMDs. Check the network settings on the report server or the configuration of AMDs. The yellow triangle displays Delay in data processing. What do I do? If the last processed data is significantly behind the current time due to slow data processing or idle periods that occurred in the past, the report server displays the triangle icon with the message Delay in data processing. If the server had a delay, but now it is catching 66

67 Appendix A Diagnostics and Troubleshooting up, this message will not appear anymore. To confirm that delay is decreasing, you have to inspect server.log and search for messages similar to this: T REC :10: zdata_43f47e58_5_t is being processed. Sample begin ts = :25. Sample delay 17 min. If the delay becomes smaller, it means the server is catching up. If the delay values are growing, it can indicate the system overload. The yellow triangle displays The AMD has not yet generated performance data. What do I do? This message indicates that some data files have already been generated on some AMDs, but not on the others. This may not be an indication of a problem and, when you refresh the reports after 30 to 60 seconds, this message may disappear. All you can do is to verify the time synchronization among all the AMD s. See The yellow triangle displays Delay in data processing. What do I do? [p. 66]. The yellow triangle displays Data processing is being performed in the debug mode. What do I do? Data processing can be manually suspended and controlled by so-called debug mode, which can be enabled using Control Panel. Open Control Panel by typing: in the Address bar of your Web browser and clicking Go, then select Controlled data processing from the Configuration Management section. The red triangle displays Data loading is in progress. Reports may be incomplete. What do I do? This message indicates that the report server is currently starting up. Because of this the information presented on reports may be incomplete. Depending on the database size, the startup process may take up to several minutes. If the server restart was not done manually or was not planned, please inspect server.log or contact Customer Support. The red triangle displays Low memory. The real-time cache will only be updated. What do I do? This message indicates that the report server has no free memory to process new entities such as software services, servers, and URLs. This message will be cleared when some resources are freed, what usually happens at midnight during the scheduled database maintenance (see The yellow triangle displays A daily maintenance task is in progress. Data processing suspended. What do I do? [p. 66]). All the metric values presented on reports (except user/client counters) will show correct values. The only problem is that predefined tabular reports may not show all the entities they are intended to show. All the charts and DMI reports show correct data. The mechanism of updating the real-time cache, as described above, is a protection that allows the report server to continue the operation instead of closing down due to lack of memory resources. The red triangle displays The number of servers has reached the defined limit. What do I do? The report server has a built-in limit of the number of monitored servers. If the number of observed servers reaches a defined limit, the report server will not accept any new servers and will drop the collected data for those servers. 67

68 Appendix A Diagnostics and Troubleshooting The predefined value of the limit can be customized. However, the report server can automatically adjust the limit in low-resources situations. The red triangle displays The number of clients has reached the defined limit. What do I do? The report server has a built-in limit of the number of monitored clients. If the number of registered clients (which also includes aggregated virtual clients such as Client from... ) reaches a defined limit, the report server will not accept any new clients and will drop the collected data for those clients. The predefined value of the limit can be customized. However, the report server can automatically adjust the limit in low-resources situations. The red triangle displays The number of sites has reached the defined limit. What do I do? The report server has a built-in limit of the number of automatically created sites. If the number of observed automatic sites reaches a defined limit, the report server will not create any new automatic sites and such traffic will be allocated to All Other. The predefined value of the limit can be customized. However, the report server can automatically adjust the limit in low-resources situations. The Sites report for a selected application is empty. Why? If the Sites report for a selected application is filtered for a client tier, such as Synthetic or RUM sequence transactions, it will not show any data. To see statistics for sites, drill down from the Applications report as follows: 1. Click the application name on the Applications report. 2. Click the client tier name on the Tiers report for a selected application. For the Synthetic tier, you will see the Overview Application Status report; for the RUM sequence transactions tier, the Sequence Transactions Log report. 3. Depending on the type of report, click the Overview Site Status or the Sites tab. I see gaps on the chart reports. Why are the charts incomplete? Gaps in reports mean that the report server missed some data and was not able to get it into the database on time. Your reports may resemble the example below. Figure 11. Gaps in a Central Analysis Server graphical report 68

69 Appendix A Diagnostics and Troubleshooting Figure 12. Gaps in an Advanced Diagnostics Server DMI-based graphical report There are several reasons why the graphical reports may have incomplete data: The AMD was not able to detect any traffic from the monitored network, thus it was not able to produce any valid data for the report server. To confirm that this was the reason, you have to connect to the AMD using an SSH client and check whether the files named zdata_xxxxx_x_x are located in the /var/spool/adlex/rtm directory. Similar symptoms can be observed if the AMD has been down for some time and data files were not produced for that time. If data files are present and the viewed chart displays only a fragment of the monitored traffic, for example, for a specific server or site, it may mean that a part of traffic, which was indented to be monitored, is missing. In such a situation, the data files are much smaller than usually for the corresponding period of the day. Similar situations, that is, gaps only on some reports, may occur in a multi-amd installation when some AMD s were down or disconnected from the network. In the case when only one AMD is connected to the report server, communication problems do not cause data gaps. If the report server cannot communicate with the AMD, it will wait until the communication is restored and then will process all the data from the past. When there are multiple AMD s connected to the report server and there is a break in communication with only some of them, the report server processes the data from the available AMDs, so in this case, gaps can appear on some reports. If it is a critical issue and your network (or its parts) need to be monitored continually and you cannot miss the data from some AMDs, you have to mark the AMDs as primary. In such a case, the report server will wait until the communication with primary AMDs is restored, even if other AMDs are available. Gaps in charts on some reports in multi-amd installations may be caused by unsynchronized AMDs. The reason for that may be that if the report server sees a data file for a specific time period on one of the AMDs, it will wait only 30 seconds for data files covering the same period of time from other AMDs. These 30 seconds is a server's tolerance for time synchronization issues. To verify that such a situation took place, compare the clock readings from AMDs and then check the time synchronization settings (see The yellow triangle displays An AMD produces data stamped with a time from the future. What do I do? [p. 65]). It may happen that a part of data will be missing. This will result in a significant decrease of the aggregated data, used to render the chart bars, as shown below: 69

70 Appendix A Diagnostics and Troubleshooting Figure 13. An example of partial lack of the performance data Note that such an effect relates to metrics that are calculated as sums, for example, number of operations, number of errors, number of users, or bandwidth utilization. Charts showing the averages (RTT, loss rate, operation time) will not be affected. I see gaps on the log-term data chart reports. Why are the charts incomplete? The report server aggregates the data collected during the day into daily (and monthly) rollups. This is a scheduled process. If this process is not triggered, you will see gaps in the daily rollups as in the following example: Figure 14. An example of gaps in long-term graphical reports The most frequent reasons for missing rollups are: The report server was down in the night; report data generation starts at 12:10 AM local time and if the report server was down at that time, no aggregate data for long-term reports will be generated. The report server was overloaded and it took too much time for other crucial tasks; report data generation for long-term reports was canceled. You can always re-generate data for long-term reports. Open Control Panel by typing: in the Address bar of your Web browser and clicking Go, then select Regenerate Reports from the System Management section. I created a report that consists of several charts but it loads very slowly. How can I improve its performance? If you are using exactly the same set of dimensions and filters for every chart but would like to show different metrics on separate charts, there are two ways of improving such a report. 70

71 Appendix A Diagnostics and Troubleshooting Let's assume, you want a report that shows Client bytes, Server bytes, and Total bytes on separate charts for the HTTP analyzer. First, the simplest and recommended method, is to create one section that contains all these three metrics. Figure 15. Creating one section with three metrics Then open the Chart settings panel and from the single chart per list select Metric. If you are using metrics with different units, you can select the Metric unit option instead. For more information, see Displaying Multiple Charts in the Data Center Real User Monitoring Data Mining Interface (DMI) User Guide. The second method requires changes on the Subject Data and Result Display tabs. 1. For each report section (chart), create the same set of metrics. To do this, for each chart add metrics that are displayed on the other charts. Note that the order of metrics must be the same in every section. For example, each section must contain the Client bytes, Server bytes, and Total bytes metrics listed exactly in the same order. 2. Disable showing unnecessary metrics for each chart. Go to the Result Display tab and disable showing the redundant metrics. For example, for chart that is going to show only the Client bytes metric, disable showing the Server bytes and Total bytes metrics. 71

72 Appendix A Diagnostics and Troubleshooting Figure 16. Selecting metrics to display on a chart Application performance and availability data is missing from the tabular reports. How can I fix this? The missing data manifests itself as shown below. Figure 17. Missing application performance and availability data The most frequent reason for such a situation is incorrect setting of business hours and holidays. Inspect the business hours and holiday settings by selecting the menu item Settings Report Settings Business Hours. The following configuration screen shows the current settings. Figure 18. The Business Hours Configuration screen 72

73 Appendix A Diagnostics and Troubleshooting If you want to collect performance data seven days per week, including non-business days and holidays, clear the Holidays check box and select the check boxes for weekend days. In addition, you may want to collect performance data in 24/7 mode, but be aware that this results in a higher database growth rate and a larger database. If you want to enable collecting data all the time, open the Control Panel by opening the following page: In the Control Panel, click Advanced Properties Editor from the Configuration Management section. Find ONLY_BUSS_HOUR_REPORTING and set it to OFF. To see whether your holiday definition is correct, click View Holidays. Figure 19. The Defined Holidays screen The list of holidays is hard-coded, and the default set is for the USA. To select a set, click the Choose holiday definition list. To see the content of the selected set, click Preview. To store the newly selected set, click Save. 73