• Forums
    • Public Forums
      • Community Connect
      • Dynatrace
        • Dynatrace Open Q&A
      • Application Monitoring & UEM
        • AppMon & UEM Open Q&A
      • Network Application Monitoring
        • NAM Open Q&A
  • Home /
  • Public Forums /
  • Network Application Monitoring /
  • NAM Open Q&A /
avatar image
Question by Makda M. · Oct 18, 2013 at 05:49 PM ·

DCRUM - Unique/Weird Trend in Metrics

Hi All,

 

I have been implementing DCRUM for a client, and been doing discovery for the monitored traffic. While doing that, I saw a mismatch in number of requests in two backend servers which the 'application' servers talk to. To get a better picture, I created a chart with 'Number of Requests' for a server, and separated the chart by the client IP.

IPs 172.31.94.220 and 172.31.94.221 have similar load, and talk to this IP 10.4.12.28. In theory, the load should be similar, however I see that for any given 5 minute interval, there is load from either 94.220 or 94.221. I have attached the reports. One of the report, I have separated the charts, and you can see the gaps between them. In another chart, I overlaid the previous two charts with different colors, and it perfectly fills all the gaps.

Bottom line, for any given 5 minute period, DCRUM does not capture traffic from both IP's. It just does either one, and tends to be higher for 94.221.

 

Has anyone seen something like this before or would know why this would be happening? This behavior is consistent for other backend services too.

 

Please help.

 

Thanks,

 

Mohammed

 

Separate Client IPs.PNG

One Chart with Different color.PNG

Comment

People who like this

0 Show 0
10 |2000000 characters needed characters left characters exceeded
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Viewable by all users

Up to 10 attachments (including images) can be used with a maximum of 50.0 MiB each and 250.0 MiB total.

5 Replies

  • Sort: 
  • Most voted
  • Newest
  • Oldest
avatar image

Answer by Ulf T. · Oct 21, 2013 at 11:45 AM

So - without knowing all details I think you might suffer from deduplication running a bit wild.

The deduplication alters between (at it's own preference) the probes and that is why you only see one host at any given time.

You can either do some research and correct the standby mechanism or the AMD config, or log a ticket and the support will help you go through your config.

Comment

People who like this

0 Show 0 · Share
10 |2000000 characters needed characters left characters exceeded
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Viewable by all users

Up to 10 attachments (including images) can be used with a maximum of 50.0 MiB each and 250.0 MiB total.

avatar image

Answer by Makda M. · Oct 21, 2013 at 11:24 AM

I am suspecting that. The second AMD is supposed to be a Stand by one, and it was not supposed to get traffic. We did not monitor that, and it was discovered that the second AMD's link was down.

The link was turned on again, and I can see data going to it, however the network engineer says that the Stand by data from the switches is going to that port.

The answer to your question, I see traffic going to two different AMD's, but in theory it should be Active-Standby, unless there is a mis config with the data feeds.

Comment

People who like this

0 Show 0 · Share
10 |2000000 characters needed characters left characters exceeded
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Viewable by all users

Up to 10 attachments (including images) can be used with a maximum of 50.0 MiB each and 250.0 MiB total.

avatar image

Answer by Ulf T. · Oct 21, 2013 at 11:19 AM

OK - Is that 1 Gigamon?

Do the traffic to the 2 hosts go to different AMD's?

Comment

People who like this

0 Show 0 · Share
10 |2000000 characters needed characters left characters exceeded
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Viewable by all users

Up to 10 attachments (including images) can be used with a maximum of 50.0 MiB each and 250.0 MiB total.

avatar image

Answer by Makda M. · Oct 21, 2013 at 10:48 AM

Hi Ulf,

We are using 12.1.1, and have total 4 AMDs. We have distributed two AMDs in each data center, as Active-Standby.

Customer is using VACL's to span the data from switches to Gigamon, and then to the AMD. The traffic is sent to the Gigamon, and they filter using VLAN's. At the Gigamon, they filter using IPv4, and only allow relevant IPs.

I see this behavior with Generic with Transaction, XML, and HTTP decodes.

I saw the zdata and vdata files, and have the IP addresses, however they do not show up in CAS.

 

-Mohammed

Comment

People who like this

0 Show 0 · Share
10 |2000000 characters needed characters left characters exceeded
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Viewable by all users

Up to 10 attachments (including images) can be used with a maximum of 50.0 MiB each and 250.0 MiB total.

avatar image

Answer by Ulf T. · Oct 21, 2013 at 03:10 AM

Hi Mohammed

What release are you on?

How many AMD's?

How do you feed the AMD's? Is it by Netflow, SPAN port or by a passive TAP?

Do you pass the traffic through any device before arriving at the AMD's?

What decode are you using?

Comment

People who like this

0 Show 0 · Share
10 |2000000 characters needed characters left characters exceeded
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Viewable by all users

Up to 10 attachments (including images) can be used with a maximum of 50.0 MiB each and 250.0 MiB total.

<----
---->

How to get started

First steps in the forum
Read Community User Guide
Best practices of using forum

NAM 2019 SP5 is available


Check the RHEL support added in the latest NAM service pack.

Learn more

LIVE WEBINAR

"Performance Clinic - Monitoring as a Self Service with Dynatrace"


JANUARY 15, 3:00 PM GMT / 10:00 AM ET

Register here

Follow this Question

Answers Answers and Comments

No one has followed this question yet.

Forum Tags

esm siebel Dynatrace Managed license nam probe wan citrix dna rest api configuration mq alerting NAM 2018 dashboard dcrumadvisory reports css nam universal decode database mobileapp RUM ads sap nam console scripting nam server sequence transactions nam 2019 upgrade
  • Forums
  • Public Forums
    • Community Connect
    • Dynatrace
      • Dynatrace Open Q&A
    • Application Monitoring & UEM
      • AppMon & UEM Open Q&A
    • Network Application Monitoring
      • NAM Open Q&A