• Forums
    • Public Forums
      • Community Connect
      • Dynatrace
        • Dynatrace Open Q&A
      • Application Monitoring & UEM
        • AppMon & UEM Open Q&A
      • Network Application Monitoring
        • NAM Open Q&A
  • Home
  • Public Forums
  • Network Application Monitoring
  • NAM Open Q&A
avatar image
Question by Christopher C. · Jan 12, 2015 at 06:31 AM ·

User name recognition: User name captured but not showing expected results

Hi guys,

Basically for this customer the user name parameter only exist in the POST request body during login (https:blabla.gov.sg/porlogin), after that a unique SSID will be generated and further web requests will be tagged with it. Long story short, the user name and the SSID are mutually exclusive and we're using client IP address to correlate the entire user activity for a particular client. See image below:

However, although we already expected that from the exact user name (S8.....9B) we will not see the entire user activity of a particular client, we still expect that there will be at least 1 request (from the login operations: https:blabla.gov.sg/porlogin) but we see zero data (as seen in the image). This happens irregularly as some will have the expected request while some have zero data. Not sure what caused the discrepancy. Would appreciate if anyone can shed light to this.

 

Comment

People who like this

0 Show 0
10 |2000000 characters needed characters left characters exceeded
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Viewable by all users

Up to 10 attachments (including images) can be used with a maximum of 50.0 MiB each and 250.0 MiB total.

4 Replies

  • Sort: 
  • Most voted
  • Newest
  • Oldest
avatar image
Best Answer

Answer by Christopher C. · Jan 17, 2015 at 09:25 AM

Hi guys,

Just an update in case you're facing the same issue in the future:

After turning on "Report URL after redirect" in global settings and "Report redirect as page" in Software Service > Edit Rule > HTTP options, most of the usernames are now correlated with operations. Only a handful of records are still showing zero data, which is normal because those might consists of standalone hits. Standalone hits refers to hits that are not associated with any operation, such as orphaned redirects, unauthorized hits or discarded hits which did not receive a server response.

Comment

People who like this

0 Show 3 · Share
10 |2000000 characters needed characters left characters exceeded
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Viewable by all users

Up to 10 attachments (including images) can be used with a maximum of 50.0 MiB each and 250.0 MiB total.

avatar image Adam P. ♦♦ · Jan 17, 2015 at 02:39 PM 0
Share

Sorry for not getting back to you earlier, but I'm happy to hear that you sorted it out.

For what has left the other possibility is that you have monitoring persistent sessions turned on (do you?) and in case of having duplicated packets in the traffic especially for these that ends TCP session this may create new, one packet "session" that is not assigned with any username by AND and CAS supplements it with client IP. If that is your case we can merge it (under particular conditions) into "usernamed sessions".

avatar image Ulf T. · Jan 18, 2015 at 09:31 PM 0
Share

Very nice - Christopher

Actually I've always wondered what those setting were good for so obviously I've never come across your particular scenario.

What platforms and technologies are in play?

avatar image Christopher C. · Jan 24, 2015 at 06:20 AM 0
Share

Thanks Adam! Yeah we do have monitoring persistent sessions turned on. Great info!

Ulf,

In this case the customer has a particular login method which upon login, it will redirect to  a third party service for authentication before headed back to their web servers. Without those settings turned on CAS will never report them as a page... I was digging through the forum and I found something similar to my situation, expect it's about operations with no metrics at all.

They're actually using .NET IIS for their application.

avatar image

Answer by Christopher C. · Jan 13, 2015 at 08:41 AM

Here's a screenshot:

 The first two user names have the expected operation (https://blabla.gov.sg/porlogin) tagged with it, but the others have zero data.

Comment

People who like this

0 Show 0 · Share
10 |2000000 characters needed characters left characters exceeded
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Viewable by all users

Up to 10 attachments (including images) can be used with a maximum of 50.0 MiB each and 250.0 MiB total.

avatar image

Answer by Christopher C. · Jan 12, 2015 at 09:34 PM

Hi Adam,

Yeah, although I would say it happens fairly frequent. Most of the time (let's say for a 1 day's worth of data) I would see almost half or more of such occurrence.

Comment

People who like this

0 Show 4 · Share
10 |2000000 characters needed characters left characters exceeded
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Viewable by all users

Up to 10 attachments (including images) can be used with a maximum of 50.0 MiB each and 250.0 MiB total.

avatar image Ulf T. · Jan 12, 2015 at 10:27 PM 0
Share

Are you sure that all of the content types are configured?

avatar image Christopher C. · Jan 13, 2015 at 04:28 AM 0
Share

Hi Ulf,

Because of how we capture the user name through a POST request body, we are expecting all user names to show one operation when drill down to user activity DMI report: https://blabla.gov.sg/porlogin (This is the only URL that contains the POST request body). However when we look at the client list, we see that some user name would have the expected operation (We would at least see data in the requests breakdown column) but some would show zero data (0 in requests breakdown column, - for application performance and operation time with breakdown column, no user activity when drill down from user name).

With that being said, we left the content types configuration as it is, because my impression is that since this is just a HTTP/HTTPS type operation. I'm not sure if I'm correct with my assumption?

avatar image Ulf T. Christopher C. · Jan 13, 2015 at 01:19 PM 0
Share

What I was after was the situations where you have data seen but no operations. I would recommend taking a trace and carefully looking at the process and then check that the things going on are also configured to be moniotred (i.e. prtocol & content).

Also - if it is HTTPs - check that the SSL key and the cipher works.  https://community.compuwareapm.com/community/display/DCRUM123/Troubleshooting+SSL+Monitoring+Issues

 

avatar image Christopher C. · Jan 17, 2015 at 09:28 AM 0
Share

Thanks Ulf. I went through your suggestion to check if the SSL traffic is decrypted correctly, and found nothing out of the blue. It happens to be the customer did not turn on "Report URL after redirect" and "Report redirect as page". Now we see most usernames are tied with at least the login operation.

avatar image

Answer by Adam P. · Jan 12, 2015 at 06:54 PM

Christopher,

Let me better understand the situation: do you mean that username recognition generally works and situation like on above image (that there is no operations for recognized username) happens from time to time?

Comment

People who like this

0 Show 0 · Share
10 |2000000 characters needed characters left characters exceeded
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Viewable by all users

Up to 10 attachments (including images) can be used with a maximum of 50.0 MiB each and 250.0 MiB total.

How to get started

First steps in the forum
Read Community User Guide
Best practices of using forum

NAM 2019 SP5 is available


Check the RHEL support added in the latest NAM service pack.

Learn more

LIVE WEBINAR

"Performance Clinic - Monitoring as a Self Service with Dynatrace"


JANUARY 15, 3:00 PM GMT / 10:00 AM ET

Register here

Follow this Question

Answers Answers and Comments

3 People are following this question.

avatar image avatar image avatar image

Forum Tags

esm siebel Dynatrace Managed license nam probe wan citrix dna rest api configuration mq alerting NAM 2018 dashboard dcrumadvisory reports css nam universal decode database mobileapp RUM ads sap nam console scripting nam server sequence transactions nam 2019 upgrade
  • Forums
  • Public Forums
    • Community Connect
    • Dynatrace
      • Dynatrace Open Q&A
    • Application Monitoring & UEM
      • AppMon & UEM Open Q&A
    • Network Application Monitoring
      • NAM Open Q&A