CA Tuesday Tip: Three Researched APM CE Issues (KB TEC598247)

Discussion created by Hallett_German Employee on Sep 7, 2013
TEC598247 - Approaches to Use for Three common APM CE Situations - Not Seeing Enough Defects, Response Time Too Low/High, Not Seeing All Components

Starting last month, I began to cover recent knowledgebase articles. I'm happy to see that our new content is being actively read. While some KBs are on very specific topics, there are others that provide general approaches to an issue. The above link is one of them. This article provides a framework for the KB:

Among the tens of thousands of APM CE questions that I asked, there have been three that take some time to answer. These are the following:

Why is the transaction defect count too low?
Why is the transaction response time too low/high? (Especially against another third-party monitoring tool)
Why do I not see all the components in a defect?

To answer these questions, you need to look at application logs, TIM/EM logs, packet capture, Client HTTP Sessions (such as through httpwatch and the like) to do event correlation to see what is going on between the client through the web server.

Here are five general suggestions when looking at these issues:

1) Cause Elimination #1 Determine if the network infrastructure (such as quality of network data, response going a different route than request, traffic filtered out, full packet not being captured, high out of sequence packets) is contributing to not seeing all transactions that are expected.

2) Cause Elimination #2 Determine if SSL decoding (cipher suites, network traffic related, TLS version) is contributing to the inconsistencies.

3) If possible is do this in a test environment. (Previously I've talked about the value of a test environment for such situations.) Pouring through lengthy production logs to find one transaction can take unnecessary extra time.

4) If you do not have a test environment, then test off-hours to make it easier to find in the logs.

5) Use other tools at various points between client and the web server to verify APM CE results. However, realize that they may be seeing different components/transactions because of their location point and they may not be measuring the same thing as APM CE (Such as transaction generation that may be measuring three different business transactions instead of just one.)

Questions to discussion:
1. How often do you investigate these three areas?
2. Have you found other general areas to look at in these searches?
3. WHat would you like to see added to the product to make this easier to do?