• Forums
    • Public Forums
      • Community Connect
      • Dynatrace
        • Dynatrace Open Q&A
      • Application Monitoring & UEM
        • AppMon & UEM Open Q&A
      • Network Application Monitoring
        • NAM Open Q&A
  • Home /
  • Public Forums /
  • Network Application Monitoring /
  • NAM Open Q&A /
avatar image
Question by Paul M. · Mar 17, 2015 at 03:33 PM ·

Converting Client IP Address to User name

Comment

People who like this

0 Show 0
10 |2000000 characters needed characters left characters exceeded
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Viewable by all users

Up to 10 attachments (including images) can be used with a maximum of 50.0 MiB each and 250.0 MiB total.

2 Replies

  • Sort: 
  • Most voted
  • Newest
  • Oldest
avatar image

Answer by Adam P. · Mar 17, 2015 at 11:32 PM

Paul,

AMD does not convert IPs to user names ...

AMD is only capable to detect the user names in the traffic according to configuration rules and report almost every piece of the traffic as a user name. Typically user names are recognized from GET or POST HTTP parameters or cookie values. If AMD fail to recognize the user name base of defined rule it puts empty string in username field in zdata file.

Then CAS reads the zdata file and here is the place where all the magic occurs. You can keep recognized user name phrase, it it's not present you can replace it with client IP or AS/CIDR bloc name/number and many others. Or use MAP_IPUser-map property like you do: if the zdata file provides recognized user name it mapping file is omitted, if it's empty then base on the file content IPs are translated to user names that can be used i.e. in DMI.

The typical DCRUM usage is to try to let AMD recognize all possible users (i.e. HTTP) and TCAM module do the job on the Citrix servers.

Comment

People who like this

0 Show 1 · Share
10 |2000000 characters needed characters left characters exceeded
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Viewable by all users

Up to 10 attachments (including images) can be used with a maximum of 50.0 MiB each and 250.0 MiB total.

avatar image Paul M. · Mar 18, 2015 at 02:45 PM 0
Share

Hi Adam and thks for your reply.

I should have used the term "recognize" and not "convert" :-)

Everything you say makes perfect sense.  Do you know what the duration is between the time AMD updates the zdata file with empty string (ie: no user name present) and the CAS doing the lookup of mapping file?  I'm certain I recall during installation of our APM solution that there was an option to leave the user mapping until a DMI report was run thereby increasing the time to generate reports but improving CAS performance during collation of data.

I have coded a C++ program that runs as a Windows service and updates the MAP_IPUser-map.properties file every 10 min.  I have increased our username versus IP ratio in DMI reports considerably.  My concern is that if the CAS does not do lookup of mapping file immediately then the data I am providing for user mapping (extracted from AD & uploaded to CAS every 10 min) is only going to be looked at when a DMI report is run and therefore mapping of IP to username will be out dated.

thks

Paul

avatar image

Answer by Paul M. · Mar 17, 2015 at 03:34 PM

Can anyone tell me at what point does the AMD convert the Client IP Address to User name.  Is this done in real-time at packet capture or later when the CAS reports are generated?

Reason I'm asking is because I use the "MAP_IPUser-map" property in the Diagnostic Console to reference my uploaded file with IP to User mappings.  However if the AMD does not convert the Client IP to User name at time of capture then the whole process will be out of sync.  Especially for Citrix user's who log in and out of sessions all day and any one user could have a dozen different IP addresses in a day.

Comment

People who like this

0 Show 0 · Share
10 |2000000 characters needed characters left characters exceeded
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Toggle Comment visibility. Current Visibility: Viewable by all users

Up to 10 attachments (including images) can be used with a maximum of 50.0 MiB each and 250.0 MiB total.

How to get started

First steps in the forum
Read Community User Guide
Best practices of using forum

NAM 2019 SP5 is available


Check the RHEL support added in the latest NAM service pack.

Learn more

LIVE WEBINAR

"Performance Clinic - Monitoring as a Self Service with Dynatrace"


JANUARY 15, 3:00 PM GMT / 10:00 AM ET

Register here

Follow this Question

Answers Answers and Comments

2 People are following this question.

avatar image avatar image

Forum Tags

esm siebel Dynatrace Managed license nam probe wan citrix dna rest api configuration mq alerting NAM 2018 dashboard dcrumadvisory reports css nam universal decode database mobileapp RUM ads sap nam console scripting nam server sequence transactions nam 2019 upgrade
  • Forums
  • Public Forums
    • Community Connect
    • Dynatrace
      • Dynatrace Open Q&A
    • Application Monitoring & UEM
      • AppMon & UEM Open Q&A
    • Network Application Monitoring
      • NAM Open Q&A