Primer y segundo plan quinquenal

The AMD can automatically discover software services based on traffic content, protocol, and port number.

A software service is a service implemented by a specific piece of software, offered on a TCP or UDP port of one or more servers, and identified by a particular TCP port number. Software services are identified on reports by assigned names.

Software service autodiscovery makes it possible to use packet pattern-matching rules to match sessions that are not assigned to any user-defined software service to automatically created software services.

IMPORTANT

• The Port Finder feature known from DC RUM 12.2 and earlier versions is no longer available. This functionality has been replaced by the Autodiscovery reporting workflow, which provides access to the same information on all servers present on the monitored network, but in an organized form available to every report user, as opposed to the Port Finder's primary use case as an advanced configuration aid for experienced administrators. • Be sure to review all of the Limitations of Autodiscovery section for important notes on

using autodiscovery. For more information, see Limitations of Autodiscovery [p. 53]. • There are important performance considerations related to autodiscovery and multithreaded

decodes. Whether a decode runs in singlethreaded or multithreaded mode affects

performance. For more information, see Autodiscovery and Multithreaded Decodes [p. 55]. • If your AMD is under heavy load, or if you want to use custom settings (such as software

service name, slow threshold, and defined operations), you may want to convert autodiscovered software services to user-defined software services. This will conserve AMD resources (memory and CPU).

• Adobe Flash Player must be installed on the client machine to enable drilldowns from autodiscovered software services on the CAS to the RUM Console to create user-defined software services.

Default Software Services

The AMD handles default software services as follows:

• New installations, by default, have default software service monitoring enabled, so that all traffic visible by the AMD is reported.

IMPORTANT

◦ If you were using default software services in DC RUM release earlier than 12.3, and you then upgrade to DC RUM12.3 and configure DC RUM to use autodiscovered software services, autodiscovery will start but will continue reporting user-defined software services as configured in the earlier release. The new autodiscovery rules and features introduced in 12.3 will not function. This is because your configuration of default software services is preserved rather than overwritten when you configure autodiscovered software services.

Workaround: to enable autodiscovered software services after such an upgrade, you must replace the existing pktmatchconfig.xml and protocols.xml files on your

AMD with the files included in your DC RUM 12.3 distribution files.

◦ Until an autodiscovered software service is manually configured, it uses a generic decode, which for certain types of traffic (such as FTP) may make Application Performance values less precise.

For autodiscovered traffic, you should configure a software service using the correct analyzer to improve Application Performance values.

For Citrix traffic, you should refer to the Citrix Landing Page report.

• Each default software service definition is specified by port number or pattern-matching rules. The precedence of pattern matching rules over port matching rules is configurable on the software service level.

◦ For a new installation, the list of default software services is predefined.

◦ In an upgrade when monitoring of default software services is enabled, the list of ports is not modified.

◦ In an upgrade when monitoring of default software services is disabled, the list of ports is upgraded by a predefined list and monitoring of autodiscovered software services remains disabled.

• The priority of content-based rules is higher by default than the rules based on well-known ports. Even if the given port is almost always used by a single service defined by a well-known port (for example, port 25 and SMTP), the AMD will still apply content-based recognition rules to all new TCP sessions.

For some protocols and content-based rules, it is possible a general rule (transport protocol) will be detected first and then (in a subsequent packet) a more detailed one (application protocol) will be detected. For example, consider HTTP and SOAP. To give the detailed rule a chance, recognition does not stop after detection of the general rule; it continues until a detailed rule is found or until a packet or time limit is exceeded.

• HTTP Express is used to monitor auto-discovered HTTP software services.

Unknown Traffic

Traffic that does not match any of the user-defined or default software service definitions (none of the content-based rules is positive and the port is not listed as a well-known port) is reported as unknown TCP/UDP traffic.

• For IP traffic, bytes and packets are reported.

• For TCP traffic, the Generic No-Trans analyzer is used.

Some analyzers (database analyzers, SMB, LDAP, SAP, OF, XML, and SOAP) work differently depending on whether they are operating in user-defined or default software service mode. In the default software service mode, these analyzers do not report decode-specific operations (such as T-code names or operation names) but do report the number of operations in the summary rows.

If there is no license for an analyzer used in the default software services configuration, the Generic TCP/UDP analyzer is used instead.

Server ranges can be used to filter default software services. This works as follows:

• Detected based on packet content rules – the rule specifies which IP address is the server, and if the address is not in the server ranges the traffic is reported as filtered out.

• Detected based on well-known port – the side with the well-known port is the server, and if the address is not in the server ranges the traffic is reported as filtered out.

• Unknown – see the rules outlined above.

The traffic filtered out due to server ranges is reported as “All Other” on the CAS report.

Aggregation

All autodiscovered clients are aggregated, regardless of any other aggregation settings. If a client IP address is private, it is aggregated by subnet, not by site, for both autodiscovered and user-defined software services. For more information, see Software Services and Autodiscovery

[p. 49].

For more information, see CAS User Aggregation Options in the Data Center Real User Monitoring Administration Guide.

Client IP Ranges and Autodiscovered Software Services

Client ranges can also be used to filter autodiscovered software services. If the client IP address is not in the client range, the traffic is not analyzed. For more information, see CAS User Aggregation Options in the Data Center Real User Monitoring Administration Guide.

Configuration Procedures

In general, the only user configuration needed is to enable or disable the autodiscovery of software services. By default, it is enabled, and this should be a satisfactory setting for most users. For more information, see Enabling or Disabling Software Service Autodiscovery on AMD in the Data Center Real User Monitoring Administration Guide.

To review or change this setting:

1. In the RUM Console, select Devices and Connections ➤ Manage Devices to list the devices managed by this RUM Console.

2. For the AMD you want to configure, open the context menu and select Open configuration. 3. In the Configuration panel, select Software Services ➤ Autodiscovered Software

Services.

4. Review and change (if needed) the setting for Enable monitoring of Autodiscovered Software Services.

5. Click Save and Publish to record and apply your change.

AHS Network Performance Section

The “Network” tile of the Application Health Status (AHS) report shows the total number of software services being monitored and a breakdown chart of autodiscovered and user-defined software services. For more information, see Application Health Status Report [p. 86].

Drilldowns from Reports NOTE

Adobe Flash Player must be installed on the client machine to enable drilldowns from

autodiscovered software services on the CAS to the RUM Console to create user-defined software services.

If there is a in the A (for “Autodiscovered”) column of the Software Services report, the

Configure User-Defined Software Service option is available from the Software service

column. The green check mark indicates that there was at least one server with autodiscovered traffic present for this software service. For more information, see Configuring a User-Defined Software Service on CAS [p. 53].

If there is a in the A (for “Autodiscovered”) column of the Servers report, the Configure

User-Defined Software Service option is available from the Server name column. The green check mark indicates that there was autodiscovered traffic present for this server.

If there is a in the Configured column of the Servers report, this server/port combination

has been configured for the given software service.

Limitations of Autodiscovery

Be sure to review all of the Limitations of Autodiscovery section for important notes on using autodiscovery.

• On the Servers report, the Configured column indicates whether the server has been configured for the particular software service.

If the server is already configured for some other software service and not for this software service, this column will show an “X”. If you try to configure such a server, the configuration dialog will pop up with an empty list of servers.

• In certain circumstances, two kinds of application may be detected and reported on the same server and port. For example, Oracle EBS provides both Web App and Forms App on the same server port. When you turn an autodiscovered service into a monitored service, however, you need to choose one decode or the other to analyze that server:port service. In this case, you would have to choose whether to monitor Oracle EBS Web part with the HTTP decode or monitor the Forms part with the Forms decode, and when you configured one of them for monitoring, the other one would disappear from reports because the AMD would use the configured decode for all traffic on this port.

• When using a 32-bit AMD and the custom driver, the driver, due to performance reasons, truncates all packets not belonging to user-defined software services. As a result, some of the content-based autodiscovery rules might not be able to detect protocols. As a workaround, you can either switch to the native driver or upgrade to a 64-bit AMD. When addressing this issue, be aware that DC RUM 12.3 is the last DC RUM release to support the 32-bit AMD.

• A single address may be counted and listed as two different users on the same CAS report if the software service that the address is using occurs twice on the same report, once as a user-defined software service and once as an autodiscovered software service.