Multi-level hierarchy reporting

Business-critical applications and advanced Web applications that support core business processes typically have complex multi-level structures of business-related transactions, tasks, steps, processes, and operations.

NAM provides data organization for reports that reflect the business structure of the monitored application. The service/module/task/operation hierarchy provides technical performance information.


For some analyzers (such as SOAP), the hierarchy of operations is inherent. NAM Server reports organize data in a clear manner making fault domain isolation easy. The hierarchy levels are automatically reported by the NAM Probe (for example, for HTTP or SOAP), or configured on the NAM Server (for example, for SAP).

Operations performed by monitored applications are grouped and presented according to a certain pattern. Hierarchy levels above single operations are containers for the lower-level entities. You can group smaller (but numerous) items and limit the data you observe on reports. You can use this hierarchy model, with a business perspective (applications and transactions), to create greater logical compounds that reflect part or all of your monitored environment.

The analyzer type determines if the NAM Server can provide data for hierarchy levels. Some analyzers provide only one or two levels or none at all. The NAM Server can report on up to four levels for the following traffic types:

  • HTTP
  • SAP
  • SOAP
  • Database
  • SMB

Each level is reported independently or combined with the other levels. You can use DMI to create reports with entries from arbitrarily chosen hierarchy levels like display metrics for level-one entries paired with their level-three entries.

Hierarchy levels

The following hierarchy levels are supported:

Operation (id: pUrl)

For HTTP, this is the URL of the base page to which the hit belongs. For other analyzers this can be a query, operation type or an operation status. Operation is ascertained by the NAM Probe, based on referrer, timing relations between hits and per-transaction monitoring configured on the NAM Probe. This dimension can assume values of a particular operation - if this operation is monitored. Note: The visibility of this dimension on reports depends on whether another dimension, related to servers - e.g. server IP or server DNS - has been used when formulating the query.

The All other operations record serves a catch-all net for al the traffic that has been seen to-from a server, but was not classified as belonging to a specific monitored-by-name operation. It accounts for statistics of:

  • operations which were not reported in per specific operation records (for example those that fall out of topN reported operations for a specific analyzer) - in such case the number of operations and slow operations, as well as operation time and other transactional statistics will be reported as an aggregate/average;
  • traffic which was not classified to any operations (for example, idle TCP session closure, TCP handshake without any operation, etc) - in such case only volumetric statistics (bytes, packets) will be reported for this specific traffic.

Task (id: pUrlURLHierarchyLvl1)

Task is the second level in the reporting hierarchy. For example, in HTTP monitoring this is the page name; in database monitoring this is the operation name (may contain regular expression if configured on the NAM Probe) or operation type prefix, and in SOAP monitoring this is the SOAP method. This entity can be broken to smaller bits such as operations or operation types.

Module (id: pUrlURLHierarchyLvl2)

Module is the third level in the reporting hierarchy. For example, in database monitoring this is the database name, and in SOAP monitoring this is the SOAP service. This entity can be broken to smaller bits such as tasks.

Service (id: pUrlURLHierarchyLvl3)

Service is the highest level of multi-level reporting hierarchy. For example, in SAP GUI monitoring this is the business process. This entity can be broken to smaller bits such as modules.

“All Other” aggregate

The “All other” aggregate appears on reports in places where no named entity for the given level is found. This information is either derived from the NAM Probe configuration or reflects the specifics of monitored protocols. For example, in HTTP monitoring all levels above task are aggregated as “All other” module and service, because they do not exist within the current model.

Hierarchy levels for database monitoring

There are three levels of reporting hierarchy for database monitoring:

  • Operations: Queries or procedure calls
  • Tasks: Query names, query names plus regular expression set on the NAM Probe, or operation type prefixes.
  • Module: The database name is reported as module.

Some hierarchy levels may not be reported because of database monitoring configuration settings. You may see missing database name, operation name, or query. The following are scenarios:

  • Missing database name: (Module) *All other* (Task) *Operation name + regex* (Operation) *SQL command* Occurs when the database name monitoring is not configured or the NAM Probe is unable to report the database name because it cannot detect the beginning of the session.
  • Missing operation name (with regular expression): (Module) *Database name* (Task) *SQL command* (Operation) *SQL command* Occurs when you configure the NAM Probe to monitor individual queries, and you choose exact queries as a configuration rule but do not set names for queries.
  • Missing database name and missing operation name (with regular expression): (Module) *All other* (Task) *All other* (Operation) *SQL command* Occurs when the NAM Probe does not report the database name and the operation name reporting is not configured.
  • Missing operation name (with regular expression) and missing query: (Module) *Database name* (Task) *Operation type prefix* (Operation) – Occurs when an operation other than query or RPC (for example, login or logout) is recorded by the NAM Probe.
  • Missing operation name (with regular expression), missing query and missing database: (Module) *All other* (Task) *Operation type prefix* (Operation) – Occurs when database name recognition is not configured or it is not seen in the traffic; plus the operation is not a query or an RPC.

If you want to remove these limitations, fine-tune the monitoring settings using the NAM Console.

Hierarchy levels for SAP monitoring

The SAP reporting hierarchy is imported from a configuration file that is generated on SAP Solution Manager. Use this file to couple the NAM reporting hierarchy tightly with the SAP application business hierarchy.

Hierarchy levels for SMB monitoring

There are four levels of reporting hierarchy for SMB monitoring. Levels of the hierarchy are mapped as following:

  • Services: Server name
  • Module: Share name
  • Task: Folder path
  • Operations: limited to Read, Write and Control The Operation name is identified by the SMB action performed, Service, module and task (performed action: \\Service\Module\Task). For example: Read \\files-server-host\myshare\mypath\*.txt