Application Overview feature of the RUM Console can help you identify whether your AMD is able to see traffic to and from application server that you intend to monitor.
Note that since applications monitored with SAP GUI and SAP GUI over HTTP analyzers use protocols for which port numbers are typically either used by other services or are outside the well-known port numbers, Application Overview will not be able to show correct names for the detected SAP protocols. SAP GUI over HTTP will be labeled as HTTP (if encrypted the either as HTTPS or SSL) and SAP GUI and SAP RFC as Unknown TCP.
Figure 6. Application Overview Screen Showing SAP GUI Server Detected
You can use Application Overview at any stage of your DC RUM deployment process: at the onset of the SAP monitoring configuration or at any time of the monitoring process. Depending on the stage of your deployment (configuration onset versus monitoring in progress) Application Overview will offer you to either configure new services or modify the existing ones. Note that in order to work with up-to-date data you need to either record traffic manually or enable automatic trace recording.
To find SAP GUI or SAP RFC servers on the list of detected services go to Application
Overview and click Unknown TCP to open Servers report where all servers seen during the
traffic recording are listed. If no SAP GUI or SAP RFC based software services are configured you can configure them here using the icon in the Actions column. For existing SAP GUI or SAP RFC services, you can modify the settings.
To find SAP Web GUI servers on the list of detected services go to Application Overview and click HTTP to open Servers report where all servers seen during the traffic recording are listed. If no SAP GUI over HTTP software services are configured you can configure them here using the icon in the Actions column. For existing SAP over HTTP services, you can modify the settings. The Application Overview always classifies SAP Web GUI traffic as HTTP, therefore if you have configured a software service to use SAP GUI over HTTP analyzer, the Servers report shows a warning icon indicating that an analyzer different from HTTP was used for monitoring the given server.
Figure 7. Application Overview Screen Showing SAP Web GUI Server in List of All HTTP Servers
To find SAP Web GUI servers using secure connection on the list of detected services go to
Application Overview.
• If your AMD is capable of traffic decryption and decryption has been deployed, click
HTTPS link to open Servers report where all the servers seen during traffic recording are
listed.
• If there is no traffic decryption deployed on the AMD click SSL link to open Servers report where all the servers seen during traffic recording are listed.
If no SAP GUI over HTTPS software services are configured you can configure them using the icon in the Actions column. For existing SAP over HTTPS services, modify the settings.
Using RUM Console to Identify Problems Related to
Network Hardware Operation
Typical configuration errors related to port mirroring can, at times, severely affect the AMD software traffic analysis capabilities. Faulty hardware configuration may result in no data seen by the AMD, a large number of duplicate packets reaching the AMD, or only a limited portion of traffic visible to the monitoring software.
Use the Application Overview and Sniffing Point Diagnostics sections as tools to solve issues related to the switching hardware configuration. The following list describes several common problems and some possible causes and solutions.
No data seen by the AMD
• The cable is connected to the wrong physical port on the destination switch. This can be checked by physically tracing the cable directly to the switch and confirming the port ID.
• The port mirroring configuration (for example, SPAN on Cisco hardware) has been set or changed to mirror incorrect ports or an incorrect destination. This can be resolved by logging on to the source switch and checking the mirroring ports configuration relevant to the requirements (see the vendor-specific documentation for details).
No data seen on Application Overview but non-TCP/UDP traffic seen in interface statistics
The port mirroring configuration (for example, SPAN on Cisco hardware) has been set or changed to mirror incorrect ports or an incorrect destination. This can be resolved by logging on to the source switch and checking the mirroring ports configuration relevant to the requirements (see the vendor-specific documentation for details).
Application Overview does not show all expected data
• The port mirroring destination may be oversubscribed or dropping packets. Check this by logging on to the switch and checking the SPAN or mirror destination interface. If it is recording many drops, review the configuration of source ports to understand the ratio of source interface bandwidth to destination interface bandwidth. If the ratio is excessive (for example, greater than 4:1), consider reducing the number of source interfaces. If applicable, consider using device-specific filtering to reduce the load on the destination interface (for example, VACL, Rx-only, or Tx-only sources). • By design, port mirroring does not forward faulty frames. Check the source device
interface statistics to ascertain the nature of the drops (see the vendor-specific documentation for details).
• Check the interface-related metrics. If there is a high rate of Errors (bad checksum), consider hard-configuring one end of the AMD–SPAN connection to prevent auto negotiation.
Session-related report shows a high rate of packet duplicates
A SPAN or mirror operates by copying frames from source interfaces and directing them to the destination interface. In effect, configurations often result in two copies of a packet. For example, if the source of a SPAN or mirror is set as a VLAN, any traffic that goes from one switch port to another switch port within the VLAN appears twice on the mirrored port. If the number of duplicates starts to affect AMD performance, consider reducing the number of source interfaces. If applicable, consider using a device-specific filtering control to reduce packet duplication (for example, VACL, receive-only, or transmit-only sources) or consider using tap technology as opposed to port mirroring to collect the data.
Only unidirectional streams are seen on session-related overview
If the AMD is connected via a SPAN or mirror, the configuration has been set incorrectly to send only one side of a receive or transmit stream to the destination. Log on to the local source switch to check the configuration (see the vendor-specific documentation for details).