Data Center Real User Monitoring

Transcription

1 Data Center Real User Monitoring Getting Started Release 12.3

2 Please direct questions about Data Center Real User Monitoring or comments on this document to: Customer Support Copyright 2015 Compuware Corporation. All rights reserved. Unpublished rights reserved under the Copyright Laws of the United States. U.S. GOVERNMENT RIGHTS-Use, duplication, or disclosure by the U.S. Government is subject to restrictions as set forth in Compuware Corporation license agreement and as provided in DFARS (a) and (a) (1995), DFARS (c)(1)(ii) (OCT 1988), FAR (a) (1995), FAR , or FAR (ALT III), as applicable. Compuware Corporation. This product contains confidential information and trade secrets of Compuware Corporation. Disclosure is prohibited without the prior express written permission of Compuware Corporation. Use of this product is subject to the terms and conditions of the user's License Agreement with Compuware Corporation. Documentation may only be reproduced by Licensee for internal use. The content of this document may not be altered, modified or changed without the express written consent of Compuware Corporation. Compuware Corporation may change the content specified herein at any time, with or without notice. All current Compuware Corporation product documentation can be found at Compuware, FrontLine, Network Monitoring, Enterprise Synthetic, Server Monitoring, Dynatrace Network Analyzer, Dynatrace, VantageView, Dynatrace, Real-User Monitoring First Mile, and Dynatrace Performance Network are trademarks or registered trademarks of Compuware Corporation. Cisco is a trademark or registered trademark of Cisco Systems, Inc. Internet Explorer, Outlook, SQL Server, Windows, Windows Server, and Windows Vista are trademarks or registered trademarks of Microsoft Corporation. Firefox is a trademark or registered trademark of Mozilla Foundation. Red Hat and Red Hat Enterprise Linux are trademarks or registered trademarks of Red Hat, Inc. J2EE, Java, and JRE are trademarks or registered trademarks of Oracle Corporation. VMware is a trademark or registered trademark of VMware, Inc. SAP and SAP R/3 are trademarks or registered trademarks of SAP AG. Adobe Reader is a registered trademark of Adobe Systems Incorporated in the United States and/or other countries. All other company and product names are trademarks or registered trademarks of their respective owners. Local Build: April 1, 2015, 12:42

3 Contents Contents Introduction Who Should Read This Guide Organization of the Guide Related Publications Customer Support Information Reporting a Problem Chapter 1 Data Center Real User Monitoring Overview Basic Product Architecture Concept of Protocol Analyzers Central Analysis Server Overview Integrating Dynatrace Solutions CAS Reports Advanced Diagnostics Server Overview ADS Scalability Modes ADS Reports Alerts and Traps Data Mining Interface Chapter 2 Purchase Options Chapter 3 System Requirements Recommended Hardware Supported Browsers and Connectivity Internationalization Support Third-Party Software Required and Recommended for Report Server Chapter 4 Designing and Implementing a DC RUM Solution Gather Facts on Application Topology Define and Prioritize Goals, Objectives, and Requirements Solution Instrumentation Design Pre-Installation Checklist Configuration Process System Verification

4 Contents Selecting Reports, Creating Customized DMI Reports and Alerts Chapter 5 Example DC RUM Usage for a Small Site Defining CAS Basic Configuration Settings Configuring AMD with the RUM Console Defining Software Services with a Wizard in RUM Console Connecting AMD to CAS Verify Traffic is Monitored Viewing CAS Reports for Monitored Traffic Defining a Custom DMI Report Chapter 6 Installation Process Media Browser Navigation DC RUM Installation Process Overview Appendix A Protocols Supported by CAS Appendix B Protocols Supported by ADS Index

5 INTRODUCTION Who Should Read This Guide This guide is intended for new users of Data Center Real User Monitoring (DC RUM), including Agentless Monitoring Device, Advanced Diagnostics Server, and Central Analysis Server. It guides you through basic features of DC RUM and explains how to start using the product. Organization of the Guide The Guide is organized as follows: Data Center Real User Monitoring Overview [p. 7] - Describes the Data Center Real User Monitoring product, its architecture, and its basic components. Purchase Options [p. 19] - Lists solutions you can choose from when buying Data Center Real User Monitoring products. System Requirements [p. 21] - Lists the recommended and required hardware and software. Designing and Implementing a DC RUM Solution [p. 27] - Describes designing and implementing a DC RUM solution as a process consisting of many steps, beginning with fact gathering and defining and prioritizing goals. Example DC RUM Usage for a Small Site [p. 39] - Describes monitoring all of the HTTP traffic in general, monitoring traffic to a specific server and reporting all URLs for that server. DC RUM Installation Process Overview [p. 50] - Describes how to install Data Center Real User Monitoring. Licensing Data Center Real User Monitoring Components in the Data Center Real User Monitoring Administration Guide - Describes Compuware licensing options. Multi-Level Hierarchy Reporting in the Data Center Real User Monitoring Central Analysis Server User Guide - Describes the data organization for reports. 5

6 Introduction Applications, Transactions, and Tiers in the Data Center Real User Monitoring SAP Application Monitoring User Guide - Provides definitions and conceptual information for applications, transactions and tiers. Protocols Supported by CAS [p. 53] - Provides reference to protocols supported by CAS. Protocols Supported by ADS [p. 61] - Lists protocols supported by ADS. Related Publications Documentation for your product is distributed on the product media. For Data Center RUM, it is located in the \Documentation directory. It can also be accessed from the Media Browser. Go online ( for fast access to information about your Dynatrace products. You can download documentation and FAQs as well as browse, ask questions and get answers on user forums (requires subscription). The first time you access FrontLine, you are required to register and obtain a password. Registration is free. PDF files can be viewed with Adobe Reader version 7 or later. If you do not have the Reader application installed, you can download the setup file from the Adobe Web site at Customer Support Information Dynatrace Community For product information, go to and click Support. You can review frequently asked questions, access the training resources in the APM University, and post a question or comment to the product forums. You must register and log in to access the Community. Corporate Website To access the corporate website, go to The Dynatrace site provides a variety of product and support information. Reporting a Problem Use these guidelines when contacting APM Customer Support. When submitting a problem, log on to the Dynatrace Support Portal at click the Open Ticket button and select Data Center Real User Monitoring from the Product list. Refer to the DC RUM FAQ article at to learn know how to provide accurate diagnostics data for your DC RUM components. Most of the required data can be retrieved using RUM Console. 6

7 CHAPTER 1 Data Center Real User Monitoring Overview Data Center Real User Monitoring (DC RUM) is an effective, non-intrusive choice for monitoring business applications that are accessed by employees, partners, and customers outside the corporate enterprise or from the corporate network (intranet or extranet). DC RUM passively collects data from a switch port or tap in your data center using an Agentless Monitoring Device (AMD). This approach complements Enterprise Synthetic agent-based monitoring, which measures predictable, predefined transactions from a steady-state client. Together, agentless and agent-based monitoring give you total visibility of the infrastructure so you can see when and where slowdowns occur, respond to them faster, and prevent them from impacting business. DC RUM targets Web-based applications and their supporting middleware and databases, providing an excellent picture of end-user experience, supplemented by analysis of the network and Web server impact on transaction performance. The software highlights the most widely used Web pages to help with the prioritization of problem resolution efforts. Monitoring between server tiers provides response times for database and middleware operations. In a Citrix environment, agentless monitoring ties these back-end performance measurements to the end user who initiated the transaction. For all other enterprise applications, DC RUM can be used to gauge application performance using metrics such as user wait time, server delay, network delay, and throughput. Key features of DC RUM products Excellent visibility DC RUM shows you all users, all applications, all the time for internal and remote workers, business partners, and customers. No network overhead DC RUM introduces no additional load to the application infrastructure. Low administration The AMD enables you to monitor the end-user experience of external Web users and communication between application tiers without the need to modify application code. This lowers the cost of monitoring your application, regardless of its complexity and architecture. 7

8 Chapter 1 Data Center Real User Monitoring Overview Benefits of choosing the DC RUM solution DC RUM: Ensures measuring actual end-user experience for both Web and non-web applications (including Oracle ebusiness, Citrix-hosted, PeopleSoft, SAP and other packaged and homegrown mission critical applications) in a single solution. Helps to identify the root cause of performance issues with detailed client, network, server and application performance analysis. Helps to diagnose application performance problems with deep insight into application tier interaction, including SOAP, XML, Informix, WebSphere MQ, SQL Server, Oracle, and Sybase. Scales with the needs of the largest organizations to manage enterprise applications. Integrates with Dynatrace solutions for Business Service Management and Application Analytics. Basic DC RUM monitoring concepts When working with DC RUM reports, you will come across terms relating to Dynatrace Service Model components, or other basic monitoring concepts: Operation Operations in the context of the particular protocol, and can mean HTTP/HTTPS page loads, database queries, XML (transactional services) operations, Jolt transactions on a Tuxedo server, s, DNS requests, Oracle Forms submissions, MQ operations, VoIP calls, MS Exchange operations, or SAP operations. A collection of operations (sequenced or not) or a single operation may constitute a transaction. Transaction Transaction can mean one of the following: A single operation, such as a web page load. A sequence of operations DC RUM monitors sequences of web page loads and sequences of XML calls, and it reports both on these sequences as transactions and on individual operations within the transactions. Defined collections of non-sequenced operations. Transaction defines a logical, business goal, like registration in an online store. One or more transactions constitute an application. Note that a transaction can only have one parent application. 8

9 Chapter 1 Data Center Real User Monitoring Overview Figure 1. Hierarchy of Applications and Transactions Application Transaction 1 Transaction 2 Transaction n. Operation 1. Operation 2. Operation XML call 1 XML call Operation n. XML call n Application The base measurement unit that end users access: a universal container that accommodates transactions. Each application can contain one or more transactions. Software service A service, implemented by a specific piece of software, offered on a TCP or UDP port of one or more servers and identified by a particular TCP port number. Software services are identified on reports by either port numbers or assigned names. Site It is also possible to configure the report server to define software services as services on particular ports of particular servers. In this case, a software service is identified by a combination of a port number and a server IP addresses. An IP network from which users log in to a monitored network. A site can be a range of IP addresses set manually, referred to as a class-c IP network, or an automatically set class-b network, or it can be a range of addresses defined by a customized network mask, or a set of IP networks which is based on the BGP routing table analysis. Sites can be grouped together into areas, which in turn can be grouped together into regions. Basic Product Architecture The Data Center Real User Monitoring (DC RUM) solution consists of two logical tiers, a configuration component and a security server: Measurement data collector Agentless Monitoring Device (AMD), a network device that analyzes network traffic and feeds the application and network performance data to report servers. This is the basis for the analysis of end-user experience and IT resource usage. There may be one or more, depending on the sizing requirements and monitored application/network topology. Report server Both of the following, or only Central Analysis Server: Central Analysis Server (CAS) CAS is the main reporting component for DC RUM. CAS reads data from one or more AMDs and Network Monitoring Probes, maintains a short-term and long-term 9

10 Chapter 1 Data Center Real User Monitoring Overview database of the measurements data, and provides reports, alerts, and configuration means for the whole DC RUM system. Advanced Diagnostics Server (ADS) ADS provides detailed, graphical analysis of individual, multi-page Web transactions. This is supplemented with tools that help identify the system causes of performance degradation. RUM Console DC RUM component for configuring the monitoring system (both monitoring and reporting devices), traffic monitoring rules and the alert system. Use this to verify the quality of sniffing points traffic detection, record traffic, preview the captured traffic traces, and view top application categories. It offers a step-by-step guide to configuring application traffic monitoring for first-time Dynatrace users and a wizard-based process for creating and editing software service. Central Security Server The Central Security Server (CSS) provides a single point of access for user management and security for RUM Console and Report Servers. One CAS can read performance data from more than one AMD. Multiple AMDs may be necessary to handle all the monitored traffic or to cover all the monitored physical locations (data centers). One AMD can also feed more than one report server (CAS or ADS or both). Figure 2. An example of a simple DC RUM topology Load balancer Web server 1st tier application servers 2nd tier application servers Database and back-end servers Internet/Intranet AMD RUM Console Advanced Diagnostics Server Central Analysis Server Report user Concept of Protocol Analyzers An analyzer (or decode) is a software component that monitors, parses, and analyzes a network protocol detected in the monitored traffic. Some of the analyzers perform transaction monitoring: they can recognize exchanges of information where there is a recognizable question-and-answer dialog. 10

11 Chapter 1 Data Center Real User Monitoring Overview The analyzers present on your AMD depend on the license you purchased. Even if the AMD monitors a specific protocol and you are able to configure the AMD to monitor that protocol using a particular analyzer, the performance data for that protocol will not be generated by the AMD if you do not have a license for that analyzer. When there is no license present for a protocol, RUM Console displays a warning message stating that the license for that particular analyzer is missing. DC RUM provides the following analyzers: Citrix ICA Citrix ICA over SSL Corba DHCP DNS DRDA (DB2) Epic Exchange Exchange HTTP Exchange HTTPS Generic (Volume) Generic Generic with transactions HTTP HTTP Express IBM MQ IBM MQ over SSL ICMP Informix JBoss RMI Jolt (Tuxedo) Kerberos LDAP LDAP over SSL MySQL Oracle Oracle Forms over HTTP Oracle Forms over HTTPS Oracle Forms over TCP 11

12 Chapter 1 Data Center Real User Monitoring Overview Oracle Forms over SSL SAP GUI SAP GUI over HTTP SAP GUI over HTTPS SAP RFC Simple Parser VoIP SIP over TCP VoIP SIP over TLS VoIP SIP over UDP VoIP H323 over TCP SMB SMTP SOAP over HTTP SOAP over HTTPS SQL Server Resolution Protocol SSL SSL Decrypted SUN RMI TCP TDS Weblogic T3 RMI XML XML over HTTP XML over HTTPS XML over MQ XML over SSL The Analyzer Group is logical group of analyzers based on the type of the analyzed traffic. The list includes: Citrix Corba DHCP Database Datacenter infrastructure Epic Exchange 12

13 Chapter 1 Data Center Real User Monitoring Overview Generic Generic (Volume) IBM MQ Jolt (Tuxedo) LDAP Multiple Oracle Forms RMI RFC SAP SAP RFC SOAP Simple Parser VoIP Web XML Central Analysis Server Overview The Central Analysis Server provides real-time access to information about performance and usage of key business applications. It monitors user session performance, application performance, and server performance in different configurations, with the purpose of identifying when and where problems occur and how to address them. Analysis options give insight into business application performance on the transaction and operation level. The information is aligned with the business structure of the organization (such as branches, working groups, and business units) and is not dependent on the infrastructure components. It is delivered via comprehensive, interactive, service-oriented reports, and via event-driven alerts that inform you about important events such as performance degradation or traffic pattern anomalies. CAS reports enable you to see a complete view of your application performance. The report structure reflects business organization priorities and allows for quick identification of the root causes of problems. The CAS is equipped with powerful data mining and report building tools for creating new or customized reports quickly and easily. The CAS uses the measurement data provided by the passive network monitoring devices referred to as Agentless Monitoring Devices or Network Monitoring Probes, and by synthetic network monitoring agents referred to as Enterprise Synthetic Agents. In real user monitoring, one or more AMDs or Network Monitoring Probes are attached to the monitored network near the core switch of the data center or near VPN access switches. The AMDs and Network Monitoring Probes collect the data from the monitored network, preprocess it, and deliver it to the report server. Each report server can handle a number of AMDs and 13

14 Chapter 1 Data Center Real User Monitoring Overview Network Monitoring Probes. The report server processes the received data further, stores it in a database, and then generates user-friendly reports. The reports can then be viewed and analyzed regularly or only when a network problem occurs. Smart Packet Capture functionality enables you to analyze and diagnose the cause of a known and observed network problem by examining detailed packet trace data. Once a monitoring system has detected a network problem, the Smart Packet Capture process can then take over to drill down to the root cause of the issue. The CAS provides: Web analysis and reporting Decryption and analysis of HTTPS traffic Monitoring of SSL errors Analysis of middleware transactions (XML, SOAP, SAP RFC, and others) Analysis of various database protocols Analysis of the Oracle Forms protocol Analysis of Microsoft Exchange and SMTP protocols Analysis of a selection of SAP protocols Thin client (ICA) protocol analysis VoIP analysis VPN analysis WAN analysis Enterprise applications analysis and reporting Real-time reports, trending reports, and baseline calculations Detection of abnormal application usage and network usage patterns User diagnostics Report access management, publication, and sharing Customizable reports For more information, see Protocols Supported by CAS [p. 53]. Integrating Dynatrace Solutions There are several integration points between Dynatrace and Dynatrace Synthetic Monitoring solutions. Customers using the Data Center Real User Monitoring solution can have Dynatrace Integrated Health View link to Central Analysis Server reports. Customers using the Data Center Real User Monitoring solution can see data from the Central Analysis Server directly in the Dynatrace APMaaS Platform. Customers using Business Service Management solution can use a new script adapter to bring Dynatrace data into their Service Model. 14

15 CAS Reports CAS provides detailed tabular and graphical interactive reports. These reports illustrate near real-time visibility of all user traffic to monitored Web sites and enterprise applications. CAS recognizes and counts all real Web site users and application server users. It also reports on usage, availability, network and server performance, and errors for all Web and non-web applications. CAS reporting includes: Pre-built scorecard and dashboard reports for Web and enterprise applications. These reports drill down to detailed reports for instant diagnosis of performance degradation. Real-time, trending, and baseline reports A rules-based alerting engine with advanced programming capabilities Data Mining Interface (DMI), a powerful report design tool used to create customizable reports Detection of abnormal application and network usage patterns and application performance and error exceptions. Predefined alerts are delivered as SNMP traps and s. Advanced Diagnostics Server Overview The ADS analyzes key transactional application protocols and delivers definite answers to individual user problems regarding the performance and errors of business-critical front-end and back-end applications. ADS measurements have sub-millisecond accuracy for precisely identifying faulty components and operations. The ADS analyzes the following transactional application protocols: HTTP/HTTPS Oracle Forms SAP Oracle MS SQL Sybase DB2 SOAP XML Chapter 1 Data Center Real User Monitoring Overview The ADS also supports sequential transaction monitoring with exact measurements of the transaction sequence path, inter-step timings, and execution flow. This helps you troubleshoot the business processes supported by the monitored applications. The performance, usage, and errors for each application user are mapped to the transactions executed through the website interaction. The ADS builds an analytical model of website performance to find the systemic problems that are causing the HTTP/S-based application performance degradation. Systemic problem occurrences, reasons, and effects are quantified and assigned to network, server, client delays, 15

16 Chapter 1 Data Center Real User Monitoring Overview or content design domains. Effect quantification and severity are presented as the number of slow operations due to a particular domain failure. This helps to focus efforts on addressing the most severe website problems. The ADS provides you with: Detailed analysis of every application user, including every single operation and sub-operation (for example, HTTP page and page component) requested by the user, down to insight into the complete HTTP request header, request content, and response header. Problem-solving reports for sites that find systemic problems caused by HTTP-based application performance degradation (slow operations are categorized due to the operation size, application design, client link speed, or server issues). Detailed reporting on the users' request attributes and response messages communicated to users through HTML pages. These are soft errors, such as information about a requested product that is out of stock or the inability to process a reservation because a partner site did not respond. Transaction troubleshooting with insight into the exact sequence of steps taken by the user and with a drilldown to individual step execution flow and performance influencers. Integration with CAS reporting. This extends the CAS report workflow with detailed reporting on key application protocols. Concurrently, the ADS is capable of filtering out all but the most critical operations, transactions, and users, so the database is not overloaded with unnecessary details. ADS Scalability Modes You can configure the Advanced Diagnostics Server to operate in one of two scalability modes. Large Web site mode Using this scalability mode, the ADS does not record per-http-hit information, reducing the volume of information kept in the SQL database to about 10M page loads per day. Keeping only per-page data, however, results in limited access to the HTTP hit information. When a user requests information on the analyzed page loads, the data is read directly from AMDs. This option makes it possible to view load sequence charts for an individual page load, but does not allow for aggregation of the information for more than one page load. Small Web site mode Using this scalability mode, the ADS records each individual page and each individual page hit in the database, so hit-level information can be used for planning purposes and historical analysis. A disadvantage to this solution is that the hit-level database affects the whole ADS database size. Additionally, because the report response time influences ADS capacity, the capacity drops down and it is affected by the response time of hit-level reports. In practice, it means about 2M pages (approximately 10M hits) per day. ADS Reports The Advanced Diagnostics Server provides detailed insight into Web page and transaction performance, which helps troubleshoot specific Web site problems. 16

17 Chapter 1 Data Center Real User Monitoring Overview ADS provides: A pre-built scorecard and dashboard reports for Web and enterprise applications with drilldown to detailed reports for instant diagnosis of performance degradation. A rules-based alerting engine with advanced programming capabilities. The Data Mining Interface (DMI), which is a powerful tool for creating customizable reports quickly and easily. The detection of abnormal application and network usage patterns and application performance and error exceptions. Includes pre-defined alerts that are delivered as SNMP traps and s. For a detailed description of ADS reports, please refer to the Advanced Diagnostics Server User Guide. Alerts and Traps DC RUM provides a very flexible problem-detection and alert system with multiple levels of filtering. Alerts are sent to recipients based on subscriptions. Users (referred to as alert subscribers) can select which alerts they want to receive, apply additional filtering criteria, and select the delivery mechanism. Alerts can be sent to a specified address or via an SNMP trap. You can also generate alerts without subscribers. These are recorded in the alert logs, which store records of all generated alerts. The alert subsystem caters to various requirements. You can modify the existing alert definitions (those owned by System) or define new alerts. You can send an alert when an error condition is observed for a certain period of time or repeated several times. You can cancel an alert can immediately after the error condition disappears, and has not reappeared for a specified number of minutes or reporting cycles. You can receive an alert when: An alert condition occurs The situation reverts back to normal An alert occurs at regular intervals throughout the duration of the condition that caused it For more information, see Alert System in the Data Center Real User Monitoring Alert System Administration Guide. Data Mining Interface The Data Mining Interface (DMI) is a Web-based, interactive, dynamic report-building module. DMI reports immediately access current data and refresh automatically when new data becomes available. Trending and baseline data is also available for customized reports. Trending data is transparently used when necessary, while baseline data is mixed with current data on the same screen. 17

18 Chapter 1 Data Center Real User Monitoring Overview DMI reports have variable time-range settings, variable resolution settings, and dynamic sorting and filtering mechanisms. Trending and baseline data is also available for DMI reports. Trending data is transparently used when necessary, while baseline data is mixed with current data on the same screen. Use DMI to generate tabular reports and charts and mix multiple report sections on the same page. The reports can have a hierarchical structure with contextual drilldown, sibling, and parent reports. Report definitions are saved in the database and reports are re-run when opened. The DMI is equipped with an integrated persistent report cache that optimizes report re-run requests in the context of real-time data changes in the database. The DMI integrates with a Data Center Real User Monitoring database, providing access restrictions, based on the Data Center Real User Monitoring user identity. Predefined DMI reports are available for various types of users and include high-level scorecards for IT executives, and dedicated planning and monitoring reports for staff responsible for application service delivery. The DMI can also be integrated with VantageView and used as the custom reporting engine. DMI uses product-specific data views. Each data view supports its own set of dimensions and metrics. Refer to the Data Center Real User Monitoring Data Mining Interface (DMI) User Guide. 18

19 CHAPTER 2 Purchase Options All Data Center Real User Monitoring devices can be delivered as a software or turnkey solution. This means that you can buy Compuware software alone or as part of a ready-to-use hardware and software installation. AMD Software Solution The kickstart file. This is required for installing Red Hat Enterprise Linux, which is the supported operating system for the AMD. Customers must obtain an approved Red Hat Enterprise Linux version from Red Hat. NOTE Red Hat Enterprise Linux is sold on a per-socket-pair basis, so that the prices in the vendor's directory affect every two populated sockets in the server. Choose a subscription based on the target hardware architecture for your AMD. For more information on operating system licensing, refer to the Red Hat Web site ( Except as noted, the AMD has the same functionality and performance on all versions of the supported versions of Red Hat Enterprise Linux operating system. AMD software. Product documentation. All the AMD software and documentation is shipped with the AMD installation media. It enables you to build the AMD on hardware that conforms to the Compuware specifications, rebuild the AMD in case of hardware failure, or upgrade it to the current version. The media contains the AMD software without the operating system. AMD Turnkey Solution Hardware (a rack-mounted, server-grade computer; network adapters; and an optional SSL accelerator card). For a complete list of hardware recommended by Compuware, please refer to Recommended Hardware Configurations. Red Hat Enterprise Linux operating system already installed on the hardware; the installation media is also included. 19

20 Chapter 2 Purchase Options NOTE The Red Hat Enterprise Linux operating system can be obtained and activated either by a customer, or by Compuware on behalf of a customer. AMD software installed on the hardware. Product documentation. All the AMD software and documentation is shipped with the AMD installation media. It enables you to build the AMD on hardware that conforms to the Compuware specifications, rebuild the AMD in case of hardware failure, or upgrade it to the current version. CAS/ADS software solution CAS/ADS software. Product documentation. All Compuware CAS/ADS software and documentation is shipped with the CAS/ADS installation media. Note that CAS software requires a third-party operating system and database software to run, and it should be installed on hardware that meets the Compuware recommendation for processing capacity. CAS/ADS turnkey solution Hardware (a rack-mounted, server-grade computer). For a complete list of hardware recommended by Compuware, please refer to Recommended Hardware Configurations. CAS/ADS software. Product documentation. Third-party software required to run the report server, such as operating system, database server, and other utilities. For a complete list of the recommended software, refer to Report Server General Requirements in the Data Center Real User Monitoring Central Analysis Server Installation Guide. Each of the third-party software packages and its end-user license agreement is delivered on a separate CD or as a downloadable installation program on the hard disk of the server. Compuware delivers the CAS/ADS turnkey solution with five Microsoft SQL Server User CALs, which means that you have five CALs to assign to users accessing CAS reports, and another five if you have purchased both CAS and ADS. All Compuware CAS/ADS software and documentation is shipped with the CAS/ADS installation media. 20

21 CHAPTER 3 System Requirements Ensure that your system meets the requirements to run DC RUM components. NOTE Satisfying the minimum requirements may not ensure optimal usability. Choose the most appropriate hardware and system platform to achieve a successful installation. Recommended Hardware Please refer to Data Center Real User Monitoring - Hardware Recommendations at FrontLine ( for details on hardware configurations that have been tested by Compuware with AMD, CAS, and ADS installations. This document also provides information on add-on cards, network taps (fiber and copper) that can be used as an alternative to the mirrored ports as source of monitored data, and recommended software configurations. Contact your sales support representative for help on choosing the best hardware for running the devices in your environment. Sizing and Scalability Compuware has tested hardware specifications provided for CAS and ADS for performance, to ensure capacity and scalability levels as described in the Data Center Real User Monitoring Capacity Planning and Performance Assessment User Guide. Compuware does not provide CAS/ADS capacity and performance numbers on hardware platforms different from those specified: we cannot guarantee that CAS/ADS installation on hardware other than the hardware tested by us would satisfy your system performance needs. We recognize that there are stronger hardware configurations available than those that we tested, and that CAS/ADS can scale beyond what we specified in the sizing guide if hardware and Microsoft SQL database throughput were increased. Available options include usage of a Storage Area Network (SAN) instead of a local hard disk array and an increased number of CPUs and RAM for Microsoft SQL Server usage. Note that CAS and ADS scalability in 80 to 95 percent of all cases depends on the underlying Microsoft SQL Server database scalability. 21

22 Chapter 3 System Requirements Supported Browsers and Connectivity DC RUM users can access the report servers through the supported web browsers. The following browsers are supported: Microsoft Internet Explorer: versions 9, 10 and 11. JavaScript and HTTP 1.1 must be enabled. IMPORTANT When using Internet Explorer, do not use Compatibility View (MSIE 10 and older) or Document Mode emulating previous releases (MSIE 11). To see if the browser is set to Compatibility View or set to Document Mode other than default, press F12 to access MSIE Developer Tools. Data is handled differently in the HTML. Internet Explorer may experience performance degradation when viewing reports that contain many columns or tooltips. Mozilla Firefox: latest stable release. JavaScript, cookies, and HTTP 1.1 must be enabled. Google Chrome: latest stable release. JavaScript and cookies must be enabled. No tablet or smart phone browsers are supported. Before using the report server, you may have to adjust the Java, JavaScript, and HTTP 1.1 settings in your browser. NOTE Some configuration screens depend on the web browser running a supported release of the Java plug-in. The Java Web Start-based RUM Console requires JRE 8 installed on the desktop, and it will run only on Windows and a 32-bit JRE. If you use 32-bit and 64-bit browsers interchangeably, you need a Java plug-in for each browser. The Windows 64-bit operating system comes with 32-bit and 64-bit Internet Explorer browsers and the 32-bit version runs as a default. If JavaScript is not enabled, the top menu of the report server will not be visible and you will see the following message instead: This product uses JavaScript. Please make sure JavaScript is enabled in your browser settings. Because of Internet Explorer security policy, you may encounter some issues when executing Java applets. You need to modify the default settings for Internet Explorer 9 to run applets. For more information, see Enabling Java Support in Internet Explorer 9 in the Data Center Real User Monitoring Central Analysis Server User Guide. Adobe Flash Player must be installed on the client machine to enable drilldowns from autodiscovered software services on the CAS to the RUM Console to create user-defined software services. ADS and CAS can be accessed using HTTP or, over secured connections using HTTPS. We recommend secure access with a browser that supports TLS v.1 or 1.1.For more information, 22

23 Chapter 3 System Requirements see Configuring Report Server to Use Private Keys and Certificates in the Data Center Real User Monitoring Administration Guide. Enabling JavaScript and Support for HTTP 1.1 in a Browser Internet Explorer To enable JavaScript in Internet Explorer: 1. Select Tools Internet Options from the top menu in your browser. 2. Select the Security tab. 3. Click Custom level to display the Security Settings dialog box. 4. Enable Active scripting in the list of options. To enable HTTP 1.1 in Internet Explorer: 1. Select Tools Internet Options from the top menu in your browser. 2. Select the Advanced tab. 3. Scroll within the Settings list to the section titled HTTP 1.1 settings and ensure that Use HTTP 1.1 is selected. 4. Click OK and restart your browser. To set the browser mode: 1. On the Internet Explorer 10 main menu bar, select Tools F12 developer tools. 2. On the F12 developer tools menu bar, select Browser Mode and click a non-compatibility View option. Mozilla Firefox To enable JavaScript in Firefox: 1. Select Tools Options from the top menu in your browser. 2. Select the Content tab. 3. Select Enable JavaScript. To enable HTTP 1.1 in Firefox: 1. Open the browser and, in the address bar, type about:config and press [Enter]. The browser displays a list of current preferences. 2. Scroll to the network.http.version preference and make sure its value is 1.1. If the value is other than 1.1, double-click that row, change the value to 1.1, click OK, and restart your browser. Google Chrome To enable JavaScript in Chrome: 1. Select Settings from the top menu in your browser. 2. Select Show advanced settings. 3. Select the Content settings tab. 23

24 Chapter 3 System Requirements 4. In the Privacy section, click Content settings. 5. In the Privacy section, select Allow all sites to run JavaScript (recommended). Internationalization Support The Data Center Real User Monitoring supports international environments on both ends: report server and client browser. Localized Server Support The user interface of the report server is rendered in the following languages: English Japanese Korean Chinese simplified English is the default language setting. To support other languages, install the required font set for the target language and customize the regional options accordingly. Character Encoding Support for Monitored Traffic By default, only UTF-8 encoding is supported and support for other encodings is turned off. Turn UTF-8 off selectively for HTTP processing and XML processing through the configuration options in the RUM Console. Data Center Real User Monitoring recognizes the following character encodings: HTTP and XML/SOAP ISO MQ ISO Unicode (UTF-8) UTF-16 (XML/SOAP only) Japanese: EUC-JP, Shift_JIS, Unicode (UTF-8) Korean: EUC-KR, ISO-2022-KR, Unicode (UTF-8) Chinese: Big5, Big5-HKSCS, EUC-TW, GB18030, GB2312, GBK, HZ, ISO-2022-CN, Unicode (UTF-8) Unicode (UTF-8) Database/SQL (Oracle, TDS, DRDA, Informix) UTF-8 (all DB analyzers) UTF-16 (TDS analyzer only) EBCDIC (DRDA analyzer only) 24

25 Chapter 3 System Requirements DB statements that were not sent in a supported encoding are encoded such that all non-ascii characters are replaced with their hexadecimal value in the form %XX, where X is a hexadecimal digit. SMB and Kerberos Character encoding in monitored traffic does not affect SMB and Kerberos analyzer operations. Jolt Character encoding in monitored traffic does not affect Jolt analyzer operations. Generic TCP Character encoding in monitored traffic does not affect generic TCP analyzer operations. In addition to international character support in monitored traffic, locale-specific characters can also be used in the AMD configuration and in the names defined in the protocols.xml file. If you use locale-specific characters in the configuration files, save the files in UTF-8 encoding. Turning on internationalization support will adversely affect AMD performance. Performance degradation will depend on the nature of the monitored traffic. Third-Party Software Required and Recommended for Report Server To operate correctly, the report server must integrate and operate successfully with third-party software. Windows and Microsoft SQL Server are required components. Install these before you install the report server. The following are supported versions: Operating System Select a server capable of running one of the following Windows editions with the latest release, service packs, and 5 Client Access Licenses (CALs). Operating System Microsoft Windows 2003 (SP2) Microsoft Windows 2003 R2 Microsoft Windows 2008 Microsoft Windows 2008 R2 Microsoft Windows 2012 Microsoft Windows 2012 R2 Memory-related Requirements Standard Edition 64 bit (x64) for installations up to 32 GB RAM, or Enterprise Edition 64 bit (x64) for installations exceeding 32 GB RAM. Standard Edition or Datacenter Edition for installations up to 4 TB RAM. SQL Server Only Microsoft SQL Server 2005, SQL Server 2008 R2, Server 2012, and SQL Server 2014 are supported. We recommend that you acquire a Microsoft SQL Server Standard Edition license with 5 Server - User Client Access Licenses (CALs). This recommendation is based on the following assumptions: You need a single database user connection to Microsoft SQL Server. 25

26 Chapter 3 System Requirements Only one server application is connected. All CAS, ADS, and RUM Console users connect through these applications to SQL Server using a web connection (Internet or intranet, depending on the deployment). We assume that you are licensing SQL Server only for this deployment of the Dynatrace software configurations discussed here. If the machine on which you install CAS or ADS also co-hosts other software that uses SQL Server, or if you are connecting CAS or ADS to a SQL Server installation deployed on another machine, you may need a different licensing arrangement. Be sure to examine your total configuration (including Dynatrace software and any other software that uses SQL Server) and acquire appropriate SQL Server licensing. In future releases, data from other Dynatrace modules may be co-hosted on the same SQL Server, expanding on the current single database connection. Default User and Database Ownership Privileges You can install the report server and Microsoft SQL database on separate machines. In such installations, however, where the database server and the report server may be governed by different security policies, be aware that the user which connects to the database has ownership privileges over the databases created for the report server. It is possible to change the default username delta to a more meaningful value, for example you can enter Windows domain user ID. Database space requirements Database space required for the report server greatly depends on the type and amount of traffic that is planned to be monitored and on the report server configuration. For more information, see ADS Basic Configuration Settings in the Data Center Real User Monitoring Administration Guide and CAS Basic Configuration Settings in the Data Center Real User Monitoring Administration Guide. 26

27 CHAPTER 4 Designing and Implementing a DC RUM Solution Designing and implementing a DC RUM solution consist of many steps, beginning with fact gathering and defining and prioritizing goals. In practice, we often have an initial instrumentation and configuration setup and use it to conduct application discovery, mirrored port validation, and actual traffic capacity and volume measurement. The process is iterative and is refined with each iteration. After many iterations, you may have numerous custom DMI reports and alerts. As a variation you can start with a small installation, monitoring one application, and then add more applications with each iteration. Start with user-defined software services only. The database will not overfill and the solution progresses controllably. It is not very useful for application discovery, however. You can also start large and monitor all traffic. This is effective in a small environment where there is not too much data. This approach makes application discovery possible. The process of deploying a DC RUM solution is as follows: 27

28 Chapter 4 Designing and Implementing a DC RUM Solution Figure 3. Designing and Implementing a DC RUM Solution Start Gather facts on application topology List all known problems and define goals Design solution instrumentation Install software on AMD and perform system pre-configuration Install report server(s) and perform basic configuration Install RUM Console Configure software services to be monitored Verify report server system status Interpret a system problem Problems found? Yes No Correct mirrored port connection to network Correct monitoring configuration Yes Traffic correctly seen on reports? No Complete TCP sessions present on sniffing ports? No Yes Re-evaluate instrumentation and configuration Deployment complete 1. Gather facts on application topology 2. Goal definition and prioritization - objectives and requirements Decide on the granularity of monitoring, assessing sizing and capacity Establish key performance indicators, baselines, degradation patterns and violation thresholds 28

29 Chapter 4 Designing and Implementing a DC RUM Solution Decide on mode of utilization: making use of DC RUM reporting capabilities or using DC RUM as a data collection tool only, to feed into other report servers 3. Solution instrumentation design Determine the number of AMDs you need Determine the number and type of capture interfaces you need Determine the connection points on either side of the firewall Determine the use of SSL cards for decryption 4. Installation and basic configuration Install software on AMDs and performing system pre-configuration Install report servers: CAS and/or ADS and performing basic configuration Install RUM Configuration server and client (console) 5. Major configuration decisions and system configuration Decide on level of granularity: whether to monitor individual IP addresses/user IDs or if site level granularity is sufficient, and if individual URLs need to be monitored Decide if to monitor all traffic or only user-defined software services 6. System status verification Check the System Status screen for each report server Verify that the traffic expected from each AMD (software services and volume of traffic) is correctly seen on reports Correct port spanning, if there are no complete TCP sessions on AMDs Eliminate duplicate packets Re-evaluate monitoring configuration settings with emphasis on choice of analyzer, if traffic is present on AMDs but not visible on reports 7. Reporting and notification mechanisms design Select the set of ready-made reports to be used Define alerts 8. Continuous service improvement Go over all of the steps and repeating each step as required Create custom DMI reports Decide on target audience for reports Re-evaluate the monitoring granularity, re-assessing sizing and capacity Refine and extend the set of alerts 29

30 Chapter 4 Designing and Implementing a DC RUM Solution Gather Facts on Application Topology Gathering facts on application topology is the first step in implementing a DC RUM solution. Understanding the structure and nature of the network to be monitored and its operating applications help to establish appropriate objectives for your solution. In large enterprises, several servers provide multiple applications. These servers are behind a device that acts as a load balancer (and firewall). External users access the applications via the virtual IP address of the load balancer. In addition, local users access the applications over a fast network, and remote users access the applications over a wide area network with higher latency. Figure 4. A typical IT Structure of an Enterprise TCP session irregularities, such as source/destination IP substitutions. HQ users Individual DB servers IPs Load balancer Remote users Switches Active DB Server Standby DB Server Corporate WAN/Internet Firewall / Load balancer Web Front End Application Middle Tier DB Cluster / Load balancer VIP Individual server IPs VIP and individual server IPs Cluster IP/VIP This structure includes a front end consisting of two separate tiers: A first tier consisting of remote users and ending at the load balancer A second tier consisting of Web servers behind the load balancer NOTE If the firewall is pass-through and this is where TCP sessions terminate, then this is your entire front end. Usually the sessions do not terminate there, and go all the way through to the Web servers. Therefore it is important to understand the topology of the solution at the TCP level. To fully monitor the complete user experience, it is important that monitoring be performed for both of these tiers. Capturing traffic in the data center behind the load balancer enables you to observe your network transfer characteristics and see whether there are any problems with any individual Web servers. 30

31 Chapter 4 Designing and Implementing a DC RUM Solution However, monitoring of the second tier may not be possible. Therefore, in a typical situation with the front-end consisting of the above two tiers, there are two sets of software services: The software services before the load balancer, defined by the names of the applications and the IP of the load balancer. The software services behind the load balancer. Finally, you must know where the users of the applications are (for example, only North America, or also Europe, or Asia-Pacific). Such distance information helps to determine acceptable values of certain metrics such as round trip time. Define and Prioritize Goals, Objectives, and Requirements To define goals and objectives, gather information on all known problems, then extend it and give it structure by defining Key Performance Indicators (KPIs). You must also determine the level of reporting detail, the target audience, and if alerts are necessary. TIP Do not attempt to measure all metrics for all of the traffic all the time. In most cases, this approach will not support your monitoring objectives and will negatively affect system performance, while at the same time obscuring the relevant data. For a discussion on these topics, refer to Data Center Real User Monitoring Capacity Planning and Performance Assessment User Guide. The list of known problems and issues is specific to each enterprise and should be the starting point for defining the goals of the solution. Convert these problem areas into measurable objectives expressed as metrics. There may be specific patterns of network degradation to quantify. In general there are three KPI areas to consider: 1. Application performance and availability 2. Network transport 3. Volume - Business Impact Analysis (BIA) These KPIs can be measured at the enterprise level or at lower levels (such as regions, sites, or even individual users) depending on the required granularity of the solution. Note however that fine granularity will generate large amounts of monitoring data that may affect monitoring capacity. Application Performance and Availability KPIs Application performance and availability are at the highest level of product functionality. Application Availability Application availability is the percentage of successfully established TCP sessions. It reflects the health of the network and server infrastructure. Availability is expected to stay at 100% all the time unless problems occur. 31

32 Chapter 4 Designing and Implementing a DC RUM Solution Network Transport KPIs The most important metrics for network transport are: Round-Trip Time (RTT) Round-trip time between remote sites and the data center hosting business critical applications contributes to the end-user experience. Know the acceptable RTT values. For example, RTT between Europe and USA it is expected to be between 100 and 150 ms. Two-way loss rate The percentage of total packets (client and server) that were lost (due to network congestion, low router queue capacity or other reasons) and needed to be retransmitted. TCP errors The total number of TCP errors. Those errors may indicate server or application problems and therefore measurements of those are critical to understanding the issues that may affect end-user experience. AMDs measure and report on the following types of TCP errors: Connection Refused Errors - Client attempts to open a TCP session with a server, which rejects the request. SYN packet from Client is followed by RESET packet from Server, with matching TCP sequence numbers. This error is typically caused by resource exhaustion on the server, which is unable to accept more concurrent TCP sessions. This may be either a configuration issue (too few resources allocated in the kernel) or lack of memory. SYN flood attacks typically result in servers being unable to accept new connections. Server session termination error - Server is unexpectedly terminating a connection that was successfully opened. The server sends a RESET packet to the Client. Such an error originates at an application using TCP session that is monitored. It does not necessarily mean application failure; usually it means that the application encountered a condition in which it decided to immediately terminate session with the client, for example, because of an application security policy violation by the client. Session Abort - Client is unexpectedly terminating a connection that was successfully opened. The Client sends a RESET packet to the Server. These errors are inspected in the context of the client application and may or may not be reported. For example, the browser running HTTP may terminate the load of a GIF file if it is older than the one that it had previously cached and this is normal behavior. However, if all connections to the server are terminated because the user hits the STOP button, then this is abnormal session termination and is reported as "Aborted operation" or "Stopped Page". Client not responding errors (server timeout errors) - Server networking stack takes an assumption that the network connection to the client exists, but the client remains idle and does not respond. In such a case, the server closes the TCP session with the RESET packet. Such a condition may occur when the client has been silently disconnected from the network, for example, due to a link failure, or the client has crashed. Note that this error will not occur if the client has ended the session gracefully, e.g. by closing the client application. 32

33 Chapter 4 Designing and Implementing a DC RUM Solution Server not responding errors (client timeout errors) - Client networking stack takes an assumption that network connection to the server exists, but the server remains idle and does not respond. In such a case, the client closes the TCP session with the RESET packet. This may occur either during the Session Setup phase (no response to the SYN packet), or during a normal data exchange process. Such a situation may result in the intermittent network problems between the client and the server. In the case the traffic is routed through asymmetric paths across the Internet, which is often the case, the path from the server to the client may be broken. Volume and Business Impact Analysis KPIs The most important metrics for volume analysis are: Number of Operations or Transactions The number of total transactions is a measure of Business Impact at the Volume Level Total bytes The number of all transmitted bytes (client + server). Unique users The number of unique users detected in the monitored traffic. Granularity of Monitoring The required granularity of monitoring directly impacts capacity. User Determine whether you have to provide granularity at the individual user level. You may decide to aggregate users into sites/autonomous Systems instead of breaking them down by individual user. For large enterprises, visibility at the level of individual users may lead to capacity problems. Determine your regions/areas/sites structure and IP address ranges for users and servers. URL Determine whether you need to monitor specific URLs. As with user granularity, there are potential scaling problems inherent in monitoring every URL. Target Audience To determine the required reports and analysis, consider the intended target audience. In general, the audience consists of networking, development and server teams. Mode of Utilization You must consider if you are going to use the solution straight out of the box or with custom reports. The out-of-the-box solution produces reports with many metrics and great detail. Many users decide to use a custom DMI report as an aggregation point. You may also use DC RUM as a simple data collection tool to feed data into other report engines. 33

34 Chapter 4 Designing and Implementing a DC RUM Solution DMIAutomatic Alerts Use automated alerts when particular metrics achieve certain values specified a number of times, or if certain patterns are observed in the monitored traffic. Enterprises and applications measure patterns and performance indicators for a period of a few days to a full year Solution Instrumentation Design When designing solution instrumentation, decide on hardware requirements, placement, and connections. IMPORTANT Capacity and performance considerations play an important part in designing your DC RUM system. You should revise your deployment plans and re-examine your requirements taking into account how they influence system sizing and capacity. For a discussion on these topics, refer to Data Center Real User Monitoring Capacity Planning and Performance Assessment User Guide. Note also that SQL server speed can be benchmarked prior to Data Center Real User Monitoring deployment using the CAS Benchmark Tool. Start with the following: Monitoring requirements Traffic volume and capacity requirements Visibility into the infrastructure (accessibility beyond the firewall) Based on this criteria, determine the number, type, placement, and connection points of the monitoring devices: Number of Probes/AMDs This depends on the required placement and connections and system capacity (see below). DC RUM product documentation provides details capacity and scalability guidelines. Number and Type of Capture Interfaces Traffic is provided to the AMD's capture NICs via network taps or mirrored ports. Connection Points Behind and In Front of Firewall For the monitored application tiers, you must have complete TCP sessions (both request and response) or the AMDs will not assemble packets into complete transactions. Duplicate packets may interfere with proper AMD functioning due to inaccurate VLAN spanning. Use of SSL Cards for Decryption You must have a current network topology map and a diagram of the logical application data flow topology. Note that due to security restrictions, one single-data collecting device may not be able to span the firewall or the load balancer. The AMD is a totally passive device. Its setup does not contaminate, but it may not be permitted due to security restrictions. You may have to install a separate data collector on both sides of the firewall. 34

35 Pre-Installation Checklist Before proceeding with the installation, be sure you have all of the required information, hardware, software, and network access. All appropriate Dynatrace licenses necessary for the engagement. All required hardware, including cable and fiber connectors. Ability and access rights to perform all the necessary network tasks, such as port mirroring or uplink taps. Provision of static IP addresses for AMDs and CAS and ADS report servers. Provision of IP address ranges for sites, if manual sites should be defined, or for aggregating sites into areas and regions. Provision of the license key for the AMD operating system installation. You must provide the operating system and the license key. Decision on AMD placement and connection. Application information including names, IP addresses of hosting servers, protocols, and port numbers. Application data flow diagrams are useful. Availability of permanent SSL encryption keys. If SSL decryption is part of your implementation, obtain the permanent encryption keys in advance. Key extraction for different environments is explained in Extracting Web Server Private SSL Keys in the Data Center Real User Monitoring SSL Monitoring Administration Guide. Permanent private SSL keys must be provided in PEM format or another format that can be converted, such as pkcs12 keys extracted from IIS. Decision on the placement of the server database. The database can be on a local drive, or attached server drive but configured as a local database. If the database is external, enable BULK INSERT in the report server configuration. For more information, see DC RUM Installation Process Overview [p. 50].. NOTE Chapter 4 Designing and Implementing a DC RUM Solution Install the operating system on the AMD using the kickstart installation method. The configuration file must be provided by Compuware. If the operating system is installed without using the kickstart file, repeat the installation using the kickstart file. Configuration Process There are specific guidelines of how you should configure or expand a DC RUM system in a resource-conscious way, that is in way that would minimize any potential capacity or performance-related issues. For a full discussion of these issues refer to Data Center Real User Monitoring Capacity Planning and Performance Assessment User Guide. During the configuration process you will need to make the following major configuration decisions: 35

36 Chapter 4 Designing and Implementing a DC RUM Solution Aggregation or Granularity Configuration Viewing individual IP addresses/user IDs or providing site-level granularity Specify your preference when setting the basic configuration options the first time you use the Central Analysis Server. For more information, see CAS Basic Configuration Settings in the Data Center Real User Monitoring Administration Guide. Monitoring specific URLs Define URLs in the rules for user-defined software services. For more information, see Configuring URL Monitoring in the Data Center Real User Monitoring SAP Application Monitoring User Guide. You may not have the capacity to monitor all applications at the lowest granularity level. You can monitor in one of the following capacities: One application with every individual IP address and every user All applications but at the site level If you use sites, define your regions/areas/sites hierarchy. For more information, see Configuring Sites, Areas, and Regions in the Data Center Real User Monitoring Administration Guide. User-Defined Software Services or All Traffic Configuration Monitor all traffic, user-defined software services, or both To monitor specific user-defined services, define and configure those services with the RUM Console. For more information, see Basic Monitoring Configuration in the Data Center Real User Monitoring Web Application Monitoring User Guide and Defining Software Services in the Data Center Real User Monitoring Web Application Monitoring User Guide. Develop a useful naming convention for the applications when you are establishing software services. You must know the VIP address of the firewall/load balancer as well as the IP addresses of the individual servers behind the load balancer. Define software services only on the AMDs where you expect relevant traffic and not on all monitoring devices. Determine whether you must analyze HTTP or HTTPS, because they require different protocol analyzers. To define software services in Java environments using different JVMs on one physical server, define separate software services per JVM, each with its own port number for better fault domain isolation. When a problem arises, you can determine which server is affected and which JVM to investigate. System Verification You must check the System Status screen for each report server and AMD to verify that the expected traffic is correct. If reports lack data you may have problems with the monitoring configuration or the hardware connection. 36

37 Chapter 4 Designing and Implementing a DC RUM Solution System Status Screen Access the System Status by clicking Tools Diagnostics System Status. For more information, see System Status in the Data Center Real User Monitoring Administration Guide. Data Display After an AMD starts to gather data, it takes a few minutes (five is the default) until the data is seen on the report servers. If no data is seen on reports after twice that time, check the AMD: At the application level, use the rcon console and the LAPP command to list applications and determine if the required applications are detected in the monitored traffic. If the application is detected determine if the protocol is correct. If not, the analyzer in your monitoring configuration may be incorrect. Use the SHOW IP SESSIONS command, with some IP address filters, to verify that there is traffic. If not, there may be a problem with the network connection. If there is traffic, make and open a TCP dump with tcpdump, Dynatrace Network Analyzer, or another appropriate tool. To use the version of tcpdump provided with the AMD, log on to the AMD as root. On the console command line, type: tcpdump port PORT_NUMBER and udp -I IFC -n -nn PORT_NUMBER is the number of UDP port on which the AMD receives the data and IFC is the name of the communication network interface. Example 1. Type tcpdump port 514 and udp -I eth0 -n -nn. This will dump all the TCP traffic received on the NIC eth0 on port 514. If you are unsure of which Ethernet interface is used for communication purposes, type: grep -^pathfinder.device- /usr/adlex/config/rtm.config This displays the communication NIC system name. In the TCP dump, use the conversation map to verify that the correct nodes are talking and that there are complete TCP sessions. If there are no complete TCP sessions, there is a problem with the traffic mirroring/tap issue and you have to ask the network team to correct it. You must have complete TCP sessions (request and response) of the conversation. If not the AMDs cannot assemble packets into complete transactions. This may be a problem if load balancing is involved and different parts of the session go over different switches, or if a mirrored port is configured as one-way (for example, receive only). Duplicate Packets It is important to eliminate duplicate packets. This usually occurs because of inaccurate VLAN spanning. They may interfere with proper AMD functioning. The AMD resolves duplicates within the same buffer. Duplicates that are far apart are not resolved. To check for duplicate packets perform a trace capture using Dynatrace Network Analyzer. Alternately, look at TCP sequence numbers to check for duplicates. 37

38 Chapter 4 Designing and Implementing a DC RUM Solution SSL encoded sessions Determine if the SSL decryption functions correctly and if the SSL services are being reported. For more information, see SSL-Related rcon Commands in the Data Center Real User Monitoring SSL Monitoring Administration Guide. Auto-Learning Verify that the auto-learning mechanism works correctly. For more information, see URL Auto-Learning in the Data Center Real User Monitoring Web Application Monitoring User Guide. Selecting Reports, Creating Customized DMI Reports and Alerts You can create a service model by using the provided out-of-the-box reports and drilldown in custom reports, or by using custom DMI reports. Reports A generic business flow is built into the standard scorecards, while custom reports provide you only with the data you need. When selecting or creating reports: Put the most important information at the top level of the report tree. Provide drilldowns with a sufficient level of detail. Ensure that reported data includes a sufficient level of detail but not at too fine a granularity, particularly for high-volume traffic. You may get performance and capacity problems if the required granularity is too fine. The report structure provides fault domain isolation. This means that performance problems with the server, network, application, ISP and other areas are attributed to an owner. While focusing on an owner is not equivalent to determining the root cause of a problem, it can lead you to the root cause. Alerts In addition to reports, you can define a set of alerts based on metric threshold values and trends. A useful set of alerts is usually identified over a period of time and can become more vital than the reports. 38

39 CHAPTER 5 Example DC RUM Usage for a Small Site In this example, our objectives are to monitor all HTTP traffic, relate the traffic to a specific server, and report all URLs for that server. 1. Define the CAS Basic Configuration Settings. Configure site and user options. 2. Configure the AMD. Define an HTTP-based service for the server to monitor. Configure the URL reporting for that server using the Entire Configuration or the Guided Configuration perspectives in the RUM Console. New DC RUM users should use Guided ConfigurationGuided Configuration. 3. Connect the AMD to the CAS. Associate the AMD with the CAS server so that the server starts to receive traffic monitoring data from the AMD. 4. Ensure that the AMD can detect traffic to be monitored. Use command line utilities on the AMD to confirm that the traffic monitoring processes are running and applications are recognized. 5. View CAS reports. View the RUM Overview or Software Services reports. 6. Define a custom DMI report and refine it by introducing filters. Defining CAS Basic Configuration Settings The basic CAS configuration settings display automatically when you use the product for the first time. Access and modify these later by selecting Settings Central Analysis Server Server Configuration from the menu. Before You Begin You must have administrative privileges to modify the basic configuration settings. 39

40 Chapter 5 Example DC RUM Usage for a Small Site To modify CAS basic configuration settings follow these steps: 1. Open the configuration screen. To open the configuration screen with the basic configuration settings for CAS, select Settings Central Analysis Server Server Configuration. 2. Set site options. Special site processing is not required in this example, so select No automatic sites in the Site options panel of the configuration screen. 3. Define user options. Special user handling is not required, so select Track users with identifiers, aggregate other users in the User Options panel of the configuration screen. What to Do Next You can also access the server configuration screen from the RUM Console. After you log in, navigate to Devices and Connections Manage Devices to access the Devices screen. Then select Open configuration from the context menu for your server. After the Server configuration screen opens, select the Server Configuration option from the menu. Configuring AMD with the RUM Console Configure the AMD to monitor default software services and one user-defined software service. Optionally, reduce monitoring interval length to one minute. Before You Begin It is assumed that you have the RUM Console installed and connected to a RUM Console Server. For more information, see Installing, Running, and Uninstalling RUM Console Components in the Data Center Real User Monitoring RUM Console Installation Guide. To configure the AMD with the RUM Console follow these steps: 1. Start the RUM Console. 2. Select Devices and Connections Manage Devices from the top menu, to display the current device list. 3. Select Open Configuration from the context menu for an AMD. The AMD Configuration window appears. 4. Click Edit as Draft to set your configuration to draft mode (if you are not in draft mode already). 5. Select Global General. In the navigation tree, display basic settings that affect most AMD functions. 6. Change the monitoring interval to one minute. For this example, shorten the monitoring interval to a convenient length. When you make a change, you should see results reflected in the reports in one minute. After the product is set up and proven to report useful data change this setting back to its original value. 40

41 Chapter 5 Example DC RUM Usage for a Small Site 7. In Software Services Default Software Services, make sure that Enable monitoring of default software services is selected. It is enabled by default. 8. Select Software Services User-Defined Software Services and right-click the software services table to define a new service. Define a user-defined service to monitor HTTP traffic to a specific server. For more information, see Defining Software Services Manually in the Data Center Real User Monitoring Web Application Monitoring User Guide, Configuring URL Monitoring in the Data Center Real User Monitoring SAP Application Monitoring User Guide, and Configuring Rules for User-Defined Software Services in the Data Center Real User Monitoring Citrix/Windows Terminal Services Monitoring User Guide. For this example: a. Right-click the software services table, select Add, and enter the software service name as Main Server. Monitor all of the traffic for a specific server and capture all URLs. b. Specify that the analyzer is HTTP and click OK to save the service definition. The service has no rules associated with it yet. You cannot monitor traffic until you define the rules. c. Select the newly defined service in the Software Services table, then right-click the Rules table and select Add to create a new rule for this service. d. In the rule, enter the IP address and the port number for the server you want to monitor. An essential component of a rule is the IP address and port number of the server for which you want to monitor traffic. For more information, see Configuring Rules for User-Defined Software Services in the Data Center Real User Monitoring Citrix/Windows Terminal Services Monitoring User Guide. e. On the URL Monitoring tab of the rules, selected URL as Regular Expression and enter ( in the URL Definition. This specifies that all URLs should be monitored individually. For more information, see Configuring URL Monitoring in the Data Center Real User Monitoring SAP Application Monitoring User Guide. To define new software services based on the HTTP or decrypted SSL analyzer, you can also use the configuration wizard in the RUM Console. For more information, see Defining Software Services in the Data Center Real User Monitoring Web Application Monitoring User Guide. 9. Click Save and Publish to put your configuration changes into effect. Defining Software Services with a Wizard in RUM Console In the RUM Console, you can quickly and easily configure Web application monitoring with a wizard. This is helpful for new DC RUM users. To create new software service definitions with the wizard, you must have: 41

42 Chapter 5 Example DC RUM Usage for a Small Site AMD added and configured in the RUM Console. CAS added and configured in the RUM Console and connected to your AMD. Traffic auto-recording enabled or at least one traffic trace recorded manually. For more information, see Capturing Traffic Traces in the Data Center Real User Monitoring Web Application Monitoring User Guide. Then perform the following steps: 1. Optional: Use top Web application traffic statistics to streamline the monitoring configuration process. For more information, see Defining Software Services in the Data Center Real User Monitoring Web Application Monitoring User Guide. 2. Define software service rules. a. Specify the name for the rule. b. Select servers that you plan to monitor. For more information, see Selecting Services for Software Service Definition in the Data Center Real User Monitoring Web Application Monitoring User Guide. c. Define URLs and, optionally, pages under specific URLs. For more information, see Configuring URLs for a Software Service Definition in the Data Center Real User Monitoring Web Application Monitoring User Guide. d. Specify user name identification rules that will define which users are going to be monitored by the software service. For more information, see User Name Recognition Configuration in the Data Center Real User Monitoring Web Application Monitoring User Guide. Note that not all of this information is required for a software service definition; you can skip some steps if, for example, you want to define a software service based only on the analyzer, the server IP, and the port number. 3. Check whether your configuration matches the existing traffic and publish the created definition. For more information, see Reviewing and Publishing a Software Service Definition in the Data Center Real User Monitoring Web Application Monitoring User Guide. What to Do Next For more information, see Defining Software Services in the Data Center Real User Monitoring Web Application Monitoring User Guide. Connecting AMD to CAS The CAS must be configured to use the AMD as its data feed before it can receive data. 1. Open the CAS configuration in the RUM Console. Click Devices and Connections Manage Devices to access the Devices screen. Click a server once to see status information. 42

43 Chapter 5 Example DC RUM Usage for a Small Site 2. Click the Data Sources tab. 3. Click Add Data Source to assign the data feed. In the Add Data Sources pop-up window, select the device that will feed your report server, and assign it to CAS using the provided arrows. 4. Click Next to verify the port number and user credentials for the assigned device. 5. Click Finish. 6. Click Publish Configuration to save and publish the new configuration. Verify Traffic is Monitored After you define the software services to be monitored, verify that traffic is monitored correctly on the AMD. This is not mandatory, but it is helpful to verify the operation of the AMD if, for example, not all of the expected data appears on CAS reports. 1. Issue the ndstat command. Log in to the AMD as root user and, at the operating system command line prompt, type ndstat. Example ndstat output is given below: [root@vantageamd ~]# ndstat === Installed packages adlexrtm-ndw el5.i386 jre-1.6.0_07-fcs adlexv2page el5.i386 adlexpage2trans el5.i386 rtmperf el5.noarch adlexsnmp el5.i386 libadlexpcap el5.i386 adlexcron el5.noarch tomcat-amd el5.noarch cpwrdlm el5.i386 rtmgate el5.noarch avagt el5.i386 Installation type: rtm === No ssh_pfwd process === RTM probe: 1 processes(threads) 3227? S<l 0:06 /usr/adlex/rtm/bin/rtm -I 0 /usr/adlex/rtm/bin/rtm.config === RTM watchdog process: 2049? S 0:02 /usr/bin/perl /usr/adlex/rtm/bin/rtm.run === RTM gate: 1 processes(threads): 3346? Sl 0:10 /usr/java/latest/bin/java -server -Ddelta.root=/usr/adlex -Djava.protocol.handler.pkgs=adlex rtm.gate.vpn -XX:+UseAltSigs -DRTM_TYPE=ndw -Xmx512m -Xss512k -Djava.util.logging.manager=org.apache.juli.ClassLoaderLo Manager -Djava.util.logging.config.file=/usr/tomcat/conf/logging.properties -Djava.endorsed.dirs=/usr/tomcat/common/end rsed -classpath :/usr/tomcat/bin/cpwr_bootstrap.jar:/usr/tomcat/bin/bootstrap.jar:/usr/tomcat/bin/commons-logging-api.j r -Dcatalina.base=/usr/tomcat -Dcatalina.home=/usr/tomcat -Djava.io.tmpdir=/usr/tomcat/temp org.apache.catalina.startup Bootstrap start === No KPA process === v2page watchdog process: 3381? S 0:00 /bin/sh /usr/adlex/rtm/bin/v2page.run === v2page process: 3385? S 0:00 /usr/adlex/rtm/bin/v2page === page2trans watchdog process: 1995? S 0:00 /bin/sh /usr/adlex/rtm/bin/page2trans.run === page2trans process: 1999? S 0:00 /usr/adlex/rtm/bin/page2trans 43

44 Chapter 5 Example DC RUM Usage for a Small Site The first part of the output lists all of the installed AMD traffic monitoring packages. Following this is a list of the traffic monitoring programs. Not all of the processes should be active at all times. You may see the message no xxx process displayed in some rows. However, you should always see the following programs as active: rtm probe rtm watchdog rtm gate 2. Issue the LAPP command. Log in to the AMD as root user and, at the operating system command line prompt, issue the rcon command. In the rcon console, issue the LAPP command to list the monitored software services. This lists the software services found in the monitored traffic during the current monitoring interval These are services you define as user-defined services, as well as default software services. Below is an example of LAPP output. Note the user-defined service Main Server. >$ LAPP "SIP Protocol" s:1 sb:0 cb:0 sp:0 cp:0 ud:0 e:0 dcr:0 pg:0 "Post Office (POP)" s:2 sb:0 cb:0 sp:0 cp:0 ud:0 e:0 dcr:0 pg:0 "Main Server" s:2 sb:0 cb:0 sp:0 cp:0 ud:0 e:0 dcr:0 pg:2 "UDP Port 9876" s:2 sb:0 cb:0 sp:0 cp:0 ud:0 e:0 dcr:0 pg:0 "UNKNOWN UDP Proto" s:6 sb:40 cb:0 sp:2 cp:0 ud:0 e:0 dcr:0 pg:0 "SSH Secure Shell" s:1 sb:144 cb:144 sp:3 cp:3 ud:0 e:0 dcr:0 pg:3 "UNKNOWN TCP Proto" s:4 sb:0 cb:0 sp:0 cp:0 ud:0 e:0 dcr:0 pg:0 "Endpoint Mapper" s:1 sb:0 cb:0 sp:0 cp:0 ud:0 e:0 dcr:0 pg:0 "NetBIOS Datagr Srvc" s:27 sb:0 cb:0 sp:0 cp:0 ud:0 e:0 dcr:0 pg:0 "WWW HTTP" s:3 sb:0 cb:0 sp:0 cp:0 ud:0 e:0 dcr:0 pg:0 "UDP Port 5353" s:13 sb:0 cb:193 sp:0 cp:2 ud:0 e:0 dcr:0 pg:0 "HTTP" s:2 sb:0 cb:0 sp:0 cp:0 ud:0 e:0 dcr:0 pg:0 "SNMP" s:1 sb:0 cb:0 sp:0 cp:0 ud:0 e:0 dcr:0 pg:0 "Server Location" s:2 sb:0 cb:0 sp:0 cp:0 ud:0 e:0 dcr:0 pg:0 "Domain Name Server" s:4 sb:0 cb:0 sp:0 cp:0 ud:0 e:0 dcr:0 pg:0 "UDP Port 2863" s:6 sb:0 cb:0 sp:0 cp:0 ud:0 e:0 dcr:0 pg:0 "MS-DS" s:1 sb:0 cb:0 sp:0 cp:0 ud:0 e:0 dcr:0 pg:0 "BOOTPS" s:3 sb:0 cb:0 sp:0 cp:0 ud:0 e:0 dcr:0 pg:0 "NetBIOS Name Srvc" s:23 sb:0 cb:50 sp:0 cp:1 ud:0 e:0 dcr:0 pg:0 Each line of output consists of the following fields: name of service number of sessions (s) server bytes (sb) client bytes (cb) server packets (sp) client packets (cp) number of unidirectional sessions (ud) number of TCP errors (e) percentage of decrypted sessions (dcr) number of downloaded pages (pg) 44

45 Chapter 5 Example DC RUM Usage for a Small Site The list can be quite long. You can add filtering conditions to make the output display only what you are looking for. For the exact syntax, type LAPP HELP on the rcon command line. 3. Issue the LSESS command. If you are not currently logged in, log in to the AMD as root user and, at the operating system command line prompt, issue the rcon command. In the rcon console, issue the LSESS command to list the monitored sessions. This lists the sessions found in the monitored traffic during the current monitoring interval (those services defined by you as user-defined services, as well as default software services). Below is an example of LSESS output. >$ LSESS : "NetBIOS Name Srvc" "udp" s:1 sb:0 cb:150 sp:0 cp:3 ud:0 e:0 dcr:0 pg: : "Server Location" "udp" s:1 sb:0 cb:0 sp:0 cp:0 ud:0 e:0 dcr:0 pg: : "NetBIOS Datagr Srvc" "udp" s:1 sb:0 cb:2451 sp:0 cp:12 ud:100 e:0 dcr:0 pg: : "Main Server" "http" s:2 sb:62055 cb:2807 sp:53 cp:35 ud:0 e:0 dcr:0 pg: : "UDP Port 2863" "udp" s:1 sb:0 cb:0 sp:0 cp:0 ud:0 e:0 dcr:0 pg: : "ICMP" "icmp" s:0 sb:208 cb:208 sp:3 cp:3 ud:0 e:0 dcr:0 pg: : "UNKNOWN TCP Proto" "generictrans" s:2 sb:2481 cb:6063 sp:11 cp:16 ud:0 e:0 dcr:0 pg: : "NetBIOS Name Srvc" "udp" s:1 sb:0 cb:0 sp:0 cp:0 ud:0 e:0 dcr:0 pg: : "NetBIOS Datagr Srvc" "udp" s:1 sb:0 cb:0 sp:0 cp:0 ud:0 e:0 dcr:0 pg: : "NetBIOS Datagr Srvc" "udp" s:1 sb:0 cb:0 sp:0 cp:0 ud:0 e:0 dcr:0 pg: : "SSH Secure Shell" "generictrans" s:1 sb:3888 cb:768 sp:52 cp:46 ud:0 e:0 dcr:0 pg: : "IGMP" "ipsrc" s:0 sb:0 cb:60 sp:0 cp:1 ud:0 e:0 dcr:0 pg: : "UDP Port 5353" "udp" s:1 sb:0 cb:132 sp:0 cp:2 ud:0 e:0 dcr:0 pg: : "BOOTPS" "udp" s:1 sb:0 cb:302 sp:0 cp:1 ud:0 e:0 dcr:0 pg:0 Each line begins with: IP address and port number of server IP address of client name of the service name of the analyzer (protocol) Other fields are as listed for the LAPP command. Note the Main Server service we have defined. The list is quite long because one line is displayed for each session. You can add filtering conditions to make the output display only what you are looking for. For example, to display only HTTP sessions, type LSESS anlzrtype="http". Type LSESS HELP for syntax help. >$ lsess anlzrtype="http" : "HTTP" "http" s:2 sb:0 cb:0 sp:0 cp:0 ud:0 e:0 dcr:0 pg:0 45

46 Chapter 5 Example DC RUM Usage for a Small Site : "Main Server" "http" s:4 sb: cb:14509 sp:274 cp:143 ud:0 e:0 dcr:0 pg:2 4. Issue the LANLZR command. If you are not currently logged in, log in to the AMD as root user and, at the operating system command line prompt, issue the rcon command. In the rcon console, issue the LANLZR command to list those analyzers (protocols) for which data was detected in the last monitored interval. Below is an example of LANLZR output: >$ lanlzr "generictrans" s:16 sb:8011 cb:13157 sp:64 cp:69 ud:0 e:0 dcr:0 pg:24 "http" s:4 sb:62055 cb:2807 sp:51 cp:33 ud:0 e:0 dcr:0 pg:2 "udp" s:96 sb:821 cb:2229 sp:10 cp:32 ud:100 e:0 dcr:0 pg:0 "icmp" s:0 sb:208 cb:306 sp:3 cp:4 ud:0 e:0 dcr:0 pg:0 "ipsrc" s:0 sb:0 cb:600 sp:0 cp:10 ud:0 e:0 dcr:0 pg:0 "smb" s:2 sb:1120 cb:5448 sp:10 cp:13 ud:0 e:0 dcr:0 pg:0 "kerberos" s:3 sb:7240 cb:5718 sp:18 cp:18 ud:0 e:3 dcr:0 pg:0 The first field is the name of the analyzer. Other fields are as listed for the LAPP command. 5. Ensure that traffic monitoring data is being written to data files. If you are not currently logged in, log in to the AMD as root user and, at the operating system command line prompt, change the current working directory to /var/spool/adlex/rtm: cd /var/spool/adlex/rtm Examine the sizes and date stamps of the files with names beginning with zdata_. In the following example, the command displays the most recent data files first, so that you can see when data was last generated (note the -t switch for the ls command). [root@vantageamd rtm]# ls -alt zdata* more -rw-r--r-- 1 root root Jan 5 08:33 zdata_4b433f8c_1_b -rw-r--r-- 1 root root Jan 5 08:32 zdata_4b433f50_1_b -rw-r--r-- 1 root root Jan 5 08:31 zdata_4b433f14_1_b -rw-r--r-- 1 root root Jan 5 08:30 zdata_4b433ed8_1_b -rw-r--r-- 1 root root Jan 5 08:29 zdata_4b433e9c_1_b -rw-r--r-- 1 root root Jan 5 08:28 zdata_4b433e60_1_b -rw-r--r-- 1 root root Jan 5 08:27 zdata_4b433e24_1_b -rw-r--r-- 1 root root Jan 5 08:26 zdata_4b433de8_1_b -rw-r--r-- 1 root root Jan 5 08:25 zdata_4b433dac_1_b -rw-r--r-- 1 root root Jan 5 08:24 zdata_4b433d70_1_b -rw-r--r-- 1 root root Jan 5 08:23 zdata_4b433d34_1_b -rw-r--r-- 1 root root Jan 5 08:22 zdata_4b433cf8_1_b -rw-r--r-- 1 root root Jan 5 08:21 zdata_4b433cbc_1_b -rw-r--r-- 1 root root Jan 5 08:20 zdata_4b433c80_1_b -rw-r--r-- 1 root root Jan 5 08:19 zdata_4b433c44_1_b -rw-r--r-- 1 root root Jan 5 08:18 zdata_4b433c08_1_b -rw-r--r-- 1 root root Jan 5 08:17 zdata_4b433bcc_1_b -rw-r--r-- 1 root root Jan 5 08:16 zdata_4b433b90_1_b -rw-r--r-- 1 root root Jan 5 08:15 zdata_4b433b54_1_b -rw-r--r-- 1 root root Jan 5 08:14 zdata_4b433b18_1_b -rw-r--r-- 1 root root Jan 5 08:13 zdata_4b433adc_1_b Viewing CAS Reports for Monitored Traffic If you configured the CAS and AMD and connected the AMD as a CAS data feed, you should see data appearing on your CAS reports after one monitoring interval. This interval was earlier configured as one minute. To view the data on reports: 46

47 Chapter 5 Example DC RUM Usage for a Small Site 1. Select Reports RUM Analysis Software Services to display the Software Services report. You should see all of the software services being monitored. In this example, it is the user-defined service Main Server and default services HTTP and HTTPS. If you do not define your user-defined Main Server service immediately, and use the default HTTP software service monitor the traffic, the traffic for your server is displayed as part of all HTTP traffic. After you define the user-defined service, only new traffic for that service is shown separately from the default HTTP software service. Traffic that is classified previously as HTTP remains so on reports. This includes traffic to and from the server subsequently used in the user-defined service definition. NOTE Traffic is not reported twice. After you define a user-defined service, the traffic for that service is not part of the default HTTP service. 2. Click the HTTP software service and select the Operations tab to display the URLs detected in the traffic for the selected server. In this example, we monitor all URLs. If you first monitor the traffic without any URLs defined, and add the URL definition later, you see only the URLs detected after the URL information is added. The default HTTP service does not allow you to monitor individual URLs. Defining a Custom DMI Report A customize a DMI report to display a selective amount of monitored traffic. This example displays a simple DMI report created to show the traffic to and from a monitored server, and in particular to show URLs. Refer to the Data Center Real User Monitoring Data Mining Interface (DMI) User Guide. To define the DMI report follow these steps: 1. Select Reports DMI Define Simple Report to open the DMI report definition screen. 2. Note the accessed URLs and how they were accessed in time by selecting two report dimensions: Time and Operation. You can also select Server IP Address to see for which servers the pages were loaded. You can display the report at this stage, without defining any metrics. If you do you will see all of the URLs and when they were loaded. You will not see the number of page loads, because the number of loads is a metric. 3. Add the Hits metric to see the actual number of times different pages are accessed. 4. Click Display Report to view the report. 5. Add an IP address filter. If there is more than one IP address on the list of IP addresses, you can further refine your report by adding a filter for the IP address of a server you want to analyze. a. Click Edit report in the Actions list to refine the report definition. 47

48 Chapter 5 Example DC RUM Usage for a Small Site b. In the Server IP Address row, select Filter and click the filter icon to define your filter condition. c. Specify a server IP address as your filter condition. For more information, see Dimension Filter in the Data Center Real User Monitoring Data Mining Interface (DMI) User Guide. d. Click Display Report to view the modified report. 48

49 CHAPTER 6 Installation Process Media Browser Navigation Use the media browser as the starting point for installing or upgrading a Dynatrace product and for accessing related documentation. 1. Download the installation package from the Downloads section of the Dynatrace Community. 2. Extract the installation package into a temporary directory. 3. Double-click setup.exe in the installation package to open the installation browser. What to Do Next Locate the following links at the bottom of the media browser screen: Read Dynatrace APM Documentation Includes links to open Microsoft Windows Explorer for browsing documentation files on the current installation disc. Data Center Real User Monitoring Enterprise Synthetic Business Service Management Server Monitoring VantageView Check online ( for the latest versions of all product documentation, including last-minute revisions to product release notes. Documentation on the installation discs may be superseded by information online. Compuware License Server (optional) Installs Distributed License Management, an application for installing and managing your licenses. Adobe Reader Installs Adobe Reader, an application for displaying and printing PDF files. 49

50 Chapter 6 Installation Process Explore this media Opens Microsoft Windows Explorer for browsing the file directory structure of the current installation disc. DC RUM Installation Process Overview To install DC RUM, install one or more report servers and connect one or more AMDs or other data collectors. DC RUM consists of the following main components: The primary data collector is the AMD. You can use more than one AMD in a configuration. Also, other devices can be linked to DC RUM report servers. A report server installation consists of a CAS or an ADS or both. Start using DC RUM by performing some or all of the following steps, depending on your configuration: 1. Install the RUM Console (including RUM Console Server) and CSS. Use the RUM Console to configure and manage data collectors and report servers. Refer to the Data Center Real User Monitoring RUM Console Installation Guide. NOTE If you need to install the CSS separately, see Installing the CSS on Windows in the Data Center Real User Monitoring Administration Guide for instructions. See User Access and Security in the Data Center Real User Monitoring Administration Guide for an overview of DC RUM security. 2. Install software on one or more AMDs or other data collectors. This step is not necessary if your data collectors have all the software installed. The DC RUM report servers rely on data supplied by one or more AMDs or other data collectors. Before using the report server, ensure that the data collectors are properly configured and connected to the network. For more information, see Setting Up AMD Hardware and Connecting AMD to Network in the Data Center Real User Monitoring Agentless Monitoring Device Installation Guide and WAN Optimization Adjustment in DC RUM in the RUM Console Online Help. 3. Install one or more report servers. A CAS is required. An ADS is optional. Refer to the Data Center Real User Monitoring Central Analysis Server Installation Guide and the Data Center Real User Monitoring Advanced Diagnostics Server Installation Guide. 4. Log in to a report server. For more information, see Logging in to the Report Server in the Data Center Real User Monitoring Central Analysis Server User Guide. 50

51 Chapter 6 Installation Process 5. Configure the report servers. When you use the report server for the first time, you must select some basic configuration options. For Central Analysis Server select sites, user aggregation, and user tracking. For Advanced Diagnostics Server select a scalability mode. These options are fundamental to the servers' operation and must be specified before the report servers start to function. You must configure monitoring options for the data collectors and distribute them to all of the connected data collectors. For more information, see Basic Configuration Settings in the Data Center Real User Monitoring Administration Guide. 6. Use the RUM Console to attach AMDs and other data sources to the report server. For more information, see Managing Devices in the Data Center Real User Monitoring Administration Guide. NOTE The RUM Console, CAS, and ADS are components of the DC RUM product. For production environments, we highly recommend that the CAS and ADS be installed on separate servers to ensure a solid level of performance. We support installation of the CAS and ADS on the same server for non-performance testing and demonstration purposes only. Refer to the Data Center Real User Monitoring Hardware Recommendations. 7. In the report server, navigate to Tools Diagnostics System Status to check the system status. In the Status column, look for red or orange items that indicate problems. For more information, see System Status in the Data Center Real User Monitoring Administration Guide. 8. Verify that performance data is being collected. If you created a software service to be monitored using the RUM Console, allow time for the AMD to collect data and forward it to the report server. For example, if you purchased an option to monitor Oracle database traffic, create a software service based on the Oracle analyzer. Additionally, you must define monitoring rules, write settings to the AMD, and wait until data is collected and reports are generated. For more information, see Minimal Configuration of Data Center Real User Monitoring in the Data Center Real User Monitoring Administration Guide and Minimal Configuration of Data Center Real User Monitoring in the Data Center Real User Monitoring Administration Guide. 9. Display a sample report. For example, in the CAS, navigate to Reports RUM Analysis Software Services. If the AMD detects traffic and sends performance data to the report server, you will see your software service in the report table. You can click the software service name and view the database servers that comply with the monitoring rule you defined for the software service. 51

52 Chapter 6 Installation Process 52

53 APPENDIX A Protocols Supported by CAS Table 1. Protocols Supported by CAS Analyzer Protocol Version Limitations Example application Cerner over TCP Cerner Cerner 2005, Cerner over TCP 2007 Cerner Millennium Cerner over MQ Cerner over MQ Cerner 2007 MQ: WebSphere 6.0 MQ: WebSphere V7.0 MQ 6.0 Limitations: Traffic for channels with encryption is not monitored. Traffic for channels with header compression is not monitored. MQGET message segmentation is not supported. Additional MQ v7.0 Limitations: For the new v7.0 GET-GET_REPLY operations, only TSH and Message Descriptor headers are processed. No correlation is extracted from the new v7.0 MQ_GET segments. Bytes 8-15 of the TSHM header are not processed. Cerner Millennium Corba Epic Corba Epic over TCP Summer 2010 EpicCare EMR DNS DNS RFC 1035 UDP-based DNS only. 53

54 Appendix A Protocols Supported by CAS Table 1. Protocols Supported by CAS (continued) Analyzer Protocol Version Limitations Example application No support for multi-query requests. DRDA (DB2) DRDA (DB2) DRDA version 2 IBM DB2 Universal Database 8.1 Exchange/RPC over HTTP Exchange/RPC over HTTPS Exchange MS Exchange 2003, 2007, 2010 Encryption at application level is reported as Encrypted transaction. Microsoft Exchange Server 2003 Generic TCP RFC 793 Generic (with transactions) TCP RFC 793 HTTP HTTP 1.1, 1.0 (RFC 2616) Advanced analysis for GET/POST methods by default. For all other methods, such as PUT, every hit is reported separately. These methods require manual configuration change to enable advanced analysis No pipelining. IBM MQ IBM MQ over SSL IBM MQ WebSphere 6.0 MQ 6.0 Limitations: WebSphere WebSphere MQ V7.0 Traffic for channels with encryption is not monitored. Traffic for channels with header compression is not monitored. Traffic between MQ servers, (Manager to Manager) and between MQ clients and MQ MQGET message segmentation is not supported. Additional MQ v7.0 Limitations: servers can be analyzed. Dynamic queue names are recognized. For the new v7.0 GET-GET_REPLY operations, Persistent TCP sessions are supported. only TSH and Message Descriptor headers are processed. No correlation is extracted from the new v7.0 MQ_GET segments. Bytes 8-15 of the TSHM header are not processed. 54

55 Appendix A Protocols Supported by CAS Table 1. Protocols Supported by CAS (continued) Analyzer Protocol Version Limitations Example application ICA (Citrix) Citrix 4 and 4.5 Username extraction and counting is limited to ICA traffic with Basic or None encryption levels. Citrix Metaframe Presentation Server When enhanced encryption is enabled, traffic will be considered an encrypted operation. ICA (Citrix) Citrix 5.0, 6.0, 6.5, 7.0, 7.1, and 7.5 Username extraction and counting is limited to ICA traffic with Basic or None encryption levels. Citrix XenApp When enhanced encryption is enabled, traffic will be considered an encrypted operation. ICMP ICMP RFC 792 Informix Informix IDS 7.31, IDS 9.40 Informix Dynamic Server IP IP RFC 791 Jolt (Tuxedo) Jolt 8.1 BEA Tuxedo Kerberos SMB Microsoft Kerberos 5 All Microsoft Windows systems that use the SMB 1.0 protocol. (Tested on Windows 2000 and Windows XP.) LDAP LDAPS LDAP RFC 4511 Applications using LDAP All Java applications services in which Kerberos using LDAP services encryption is used are not where plain text supported. authentication is used. MySQL MySQL 4.x and 5.x NetFlow NetFlow version 5, version 9, IPFIX Supported excluding flexible NetFlow: You should configure NetFlow to export only a subset of fields and only for ingress traffic. Cisco router Oracle Net8 9i, 10g R1, 10g R2, 11g No support for TDE R1, 11g R2, and 12c R1 encryption. If TDE encryption is enabled, the Oracle 9i, 10g, 11g 55

56 Appendix A Protocols Supported by CAS Table 1. Protocols Supported by CAS (continued) Analyzer Protocol Version Limitations Example application Oracle analyzer stops reporting performance data. Oracle T3/TS3 is not supported. Oracle Forms over HTTP Oracle Forms over TCP Oracle Forms 6i, 9i, 10.1, 11g Oracle Forms 6i Oracle Application Server 9i, 10i, 10g R2, 11g Oracle Forms over SSL SSL support. Oracle Forms over HTTPS RMI BEA T3 JBoss RMI SUN RMI SAP GUI SAP GUI protocol (DIAG) 6.40, 7.10 SAP GUI for Java 7.10rev8, SAP GUI for Windows 7.10, SAP GUI for Windows 7.30, SAP GUI Console, Net weaver Business Client 4.0. SAP GUI over HTTP HTTP 1.1, 1.0 (RFC 2616) Support for SAP 7.01 SP3 and SAP GUI for HTML SAP GUI over HTTPS HTTPS HTTP 1.1 encapsulated Support for SAP 7.01 SP3 in SSL, SSL 3.0, and TLS1.0 (RFC 2246), TLS1.1 (RFC 4346) and TLS1.2 (RFC 5246) SAP GUI for HTML SAP RFC SAP RFC SAP PI, SAP BW, Excel plugin for SAP Siebel HTTP HTTP 1.1, 1.0 (RFC 2616) A special parameter configuration is Siebel CRM SSL support. HTTP 1.1 encapsulated recommended for analyzing in SSL, SSL 3.0, Siebel applications. For TLS1.0 (RFC 2246), more information, see TLS1.1 (RFC 4346) and Global Settings for TLS1.2 (RFC 5246) Recognition and Parsing of URLs in the Data Center Real User Monitoring Web 56

57 Appendix A Protocols Supported by CAS Table 1. Protocols Supported by CAS (continued) Analyzer Protocol Version Limitations Example application Application Monitoring User Guide. SMB SMB SMB 1.0, 2.0 All Microsoft Windows systems that use the SMB protocol. SMTP SMTP, ESMTP RFC 821, RFC1891 Supported commands: HELO/EHLO, MAIL FROM, RCPT TO, DATA, QUIT, RSET, VRFY, HELP, EXPN, NOOP (no support for SEND, SOML, SAML, TURN Multi-part attachments are always saved in one piece (no segmentation is preserved). MS Exchange Server native RPC protocol and POP3 ( download) are not supported. SOAP over HTTP SOAP over HTTPS SOAP SOAP 1.1 and 1.2 Support for Remote Procedures Calls only. Any business application that uses SOAP for data exchange over the network. SSL support. SSL SSL Decrypted HTTPS HTTP 1.1 encapsulated Advanced analysis for in SSL GET/POST methods by SSL 3.0, default. TLS1.0 (RFC 2246) For all other methods, such as PUT, every hit is reported TLS1.1 (RFC 4346) separately. These methods TLS1.2 (RFC 5246) require manual configuration change to enable advanced analysis No pipelining. 56-bit DES is not supported. Only RSA Key Exchange Algorithm is supported. Only a 1024-bit SSL key is supported on CryptoSwift SSL cards. SSL support. 57

58 Appendix A Protocols Supported by CAS Table 1. Protocols Supported by CAS (continued) Analyzer Protocol Version Limitations Example application Open SSL supports 1024-bit, 2048-bit, 4096-bit and 8192-bit keys. ncipher cards support 1024-bit, 2048-bit, 4096-bit and 8192-bit keys. Cavium NITROX XL FIPS cards support 1024-bit and 2048-bit keys. TCP TCP RFC 793 TDS TDS 5.0, 7.0, 8.0 MS SQL Server 7.0, 2000, 2005, 2008, 2008R2, and Sybase 10.0, Sybase Adaptive Server Enterprise (ASE) 15 UDP UDP RFC 768 VoIP RTP, RTCP, SIP, H323 G.726, GSM, G , Conference calls, secure G.729, G.711 (PCMA), protocols, and forked calls G.711(PCMU), G (multiple phones ringing at (ACELP), G the same time) are not (MP-MLQ), LPS supported. The AMD must see both signaling and media on the same AMD. XML XML over SSL XML W3C recommendation 1.0 and 1.1 Encapsulated in TCP, in HTTP, and in HTTPS. SSL support. XML over HTTP XML over HTTPS XML over MQ XML over MQ over SSL XML MQ XML: W3C recommendation 1.0 and 1.1 MQ: WebSphere 6.0 MQ: WebSphere V7.0 XML encapsulated in MQ. MQ 6.0 Limitations: Traffic for channels with encryption is not monitored. Traffic for channels with header compression is not monitored. MQGET message segmentation is not supported. 58

59 Appendix A Protocols Supported by CAS Table 1. Protocols Supported by CAS (continued) Analyzer Protocol Version Limitations Example application Additional MQ v7.0 Limitations: For the new v7.0 GET-GET_REPLY operations, only TSH and Message Descriptor headers are processed. No correlation is extracted from the new v7.0 MQ_GET segments. Bytes 8-15 of the TSHM header are not processed. 59

60 Appendix A Protocols Supported by CAS 60

61 APPENDIX B Protocols Supported by ADS Table 2. Protocols Supported in This Release Analyzer Protocol Version Limitations / example application HTTP HTTP 1.0, 1.1 (RFC 2616) Advanced analysis for GET/POST methods. For all other methods, including WebDAV, every hit is reported separately. WebDAV monitoring requires additional URL definition per software service. No pipelining. Oracle Forms (over HTTP) Oracle Forms (over TCP) Oracle Forms 6i, 9i, 10.1, 11g Oracle Forms 6i Oracle Application Server 9i, 10i, 10g R2, 11g SSL support. Oracle Forms (over SSL) Oracle Forms (over HTTPS) SAP GUI SAP GUI protocol (DIAG) 6.40, 7.10 No errors detection. SAP GUI for Java 7.10rev8, SAP GUI for Windows 7.10, SAP GUI for Windows 7.30, SAP GUI Console, Net weaver Business Client 4.0. SAP RFC SAP RFC SAP PI, SAP BW, Excel plugin for SAP SSL Decrypted HTTPS HTTP 1.1 encapsulated in 56-bit DES is not supported. SSL, SSL 3.0, TLS1.0 Only RSA Key Exchange Algorithm supported. (RFC 2246), TLS 1.1 GET/POST methods only; no pipelining. (RFC 4507, 4680), TLS 1.2 (RFC 5878) DRDA (DB2) DRDA (DB2) DRDA version 2 No support for transactions. IBM DB2 Universal Database

62 Appendix B Protocols Supported by ADS Table 2. Protocols Supported in This Release (continued) Analyzer Protocol Version Limitations / example application Informix Informix IDS 7.31, IDS 9.40 No support for transactions. Informix Dynamic Server TDS TDS 5.0, 7.0, 8.0 No support for transactions. MS SQL Server 7.0, 2000, 2005, 2008 Sybase 10.0, Sybase Adaptive Server Enterprise (ASE) 15 Oracle SQL *Net 9i, 10g R1, 10g R2, 11g R1 No support for transactions. Oracle 9i, 10g, 11g XML XML over SSL XML over HTTP XML over HTTPS XML W3C recommendation 1.0 and 1.1 Encapsulated in TCP, in HTTP, and in HTTPS XML over MQ XML MQ XML: W3C recommendation 1.0 and 1.1 MQ: WebSphere 6.0 MQ: WebSphere 7.0 XML encapsulated in MQ. MQ 6.0 Limitations: Traffic for channels with encryption is not monitored. Traffic for channels with header compression is not monitored. MQGET message segmentation is not supported. Additional MQ 7.0 Limitations: For the new 7.0 GET-GET_REPLY operations, only TSH and Message Descriptor headers are processed. No correlation extracted from the new v7.0 MQ_GET segments. Bytes 8-15 of the TSHM header are not processed. 62

63 Index Index A ADS 15 16, 61 large Web site mode 16 reports 16 scalability modes 16 small Web site mode 16 supported protocols 61 alert 17 analyzer 10, 53, 61 supported by ADS 61 supported by CAS 53 architecture 7, 9 B browsers 22, 24 configuring 22 localization 24 versions supported 22 C CAS 13, 15, 53 reports 15 supported protocols 53 Central Analysis Server, See CAS Cerner 53 concepts 35 configuration 22 browser 22 contact information 6 Customer Support 6 D Data Center Real User Monitoring, See DC RUM Data Mining Interface, See DMI DB2 (DRDA) 53 CAS 53 DC RUM 7, 9, 19, 21, 27, 30 31, 34 35, 39 components 7 defining goals 31 designing a solution 27 designing instrumentation 34 example usage 39 HTTP 39 fact gathering 30 pre-installation checklist 35 purchase options 19 system requirements 21 topology 9 DC RUM configuration 35 concepts 35 decode 10, 53, 61 supported by ADS 61 supported by CAS 53 DMI 17 DNS 53 DRDA (DB2) 53 CAS 53 Dynatrace 14 integrating IHV and DMI reports 14 E Epic 53 ESMTP 53 63

64 Index Exchange/RPC 53 H hardware 21 recommendations 21 HTTP 53, 61 I IBM WebSphere MQ 53 ICA (Citrix) 53 ICMP 53 Informix 53 installation 50 international features support 24 character encoding 24 localized browser 24 localized server 24 IP 53 J Jolt 53 K Kerberos 53 L localization 24 browser 24 character encoding 24 server 24 M media browser 49 N NetFlow 53 O online support site 6 Oracle 53 Oracle E-Business Suite 61 Oracle Forms 61 P protocol 53, 61 protocol (continued) analyzer 53, 61 supported by ADS 61 supported by CAS 53 R report ADS 16 DMI 17 report server 22, 25 database 25 default user 25 space requirements 25 recommended software 25 supported browsers 22 third-party software 25 reports 15 CAS 15 S SAP GUI 53 SAP RFC 53 scalability 16 ADS 16 large Web site mode 16 small Web site mode 16 SMB 53 SMTP 53 SOAP 53 software service 41 creating 41 rules 41 software solution 19 AMD 19 report server 19 SSL 53, 61 system requirement 22 supported browsers 22 system requirements 21, 25 recommended hardware 21 third-party software 25 T TCP 53 TDS 53 topology 7 traps 17 64

65 Index turnkey solution 19 AMD 19 report server 19 U UDP 53 V VoIP 53 W wizard 41 defining software services 41 X XML 53 65

66 Index 66