Defining software services based on universal decode

Settings that are specific to a given software service override the global settings defined for Universal Decode. There are a number of options, including the provision of a script.

To create and configure a new software service based on the Universal Decode:

  1. Start and log on to the NAM Console.
  2. In the top menu, select Software Services ► Add Software Service.
    The Add Software Service pop-up window appears, listing all ways of adding a new service.
  3. In the Add Software Service dialog box, provide the service name, select TCP as the base protocol, and select Universal Decode analyzer.
  4. Click OK to proceed to configuration of monitoring rules.
  5. In the Rules table, right-click to open the context menu and choose Add.
    You have to create at least one rule for monitoring of this software service. After the rules are created, they all are displayed in the Rules table.
  6. Right-click in the Rules table and select Add from the context menu.

Additional steps are described below.

Specifying the services parameters

Specify the IP address
On the Services tab, in the IP address column, enter the server IP address, or enter a range of IP addresses to monitor more than one server.

Specify Ports

In the Ports field, enter the port number of the monitored service. You can provide a range of port numbers if such a range of ports is used in your environment.

Some software services may be active on a number of predefined ports or may change ports dynamically. To allow for this, you can specify a range of ports. However, specifying more than one port for a service prevents the port number from being reported for that service. If you define more than one port for a particular service name and server IP address (by either specifying a range of ports or by creating two or more distinct rules for the same service name and server IP address but with different port numbers), the NAM Probe reports the port number for this service as 0, causing the port number to be ignored in traffic reports.

Note

You can define up to 5000 definitions containing a server and a port. Each association of a server and a port counts as a single definition. Specifying a range of ports counts as providing many individual definitions.

On the NAM Server, the number of processed server definitions is limited by the license.

Optional: Enter the main server IP address.

If the monitored application runs on several servers that are linked together in a farm, you can monitor the farm as one virtual server. Type the IP address that you want to use as your main server IP address.

Optional: Enter the IP address of the server masking the addresses of monitored servers.

If the servers you intend to monitor reside behind an appliance that masks and replaces the addresses of the target servers, you need to set NLB NAT masking IP address to the IP address of the masking server.

If you do not do so, the NAM Probe will see two unidirectional conversations instead of one bi-directional conversation between the servers and appliance:

  • The conversation between the client and server is observed and recorded (IP address A talking to IP address B)
  • When a response travels to the client, a different session (IP address C talking to IP address A) is recorded due to the server's IP address being replaced by the load balancer's IP address.
    Unless you account for this, the NAM Server will return reports with ambiguously granulated data. Using the NLB NAT masking IP address option will ensure that the NAM Probe monitors contiguous conversations.

Optional: Specify Client port.

Configuring auto-learning settings for the universal decode software service

  1. Open the Auto-learning tab for the Universal Decode software service.

  2. Configure the type of auto-learning required, if any.
    Off auto-learning Auto-learning will not be used for this software service

    Inherit from global settings Auto-learning settings for this software service will be inherited from the global settings for this protocol analyzer.

    Custom settings Custom auto-learning value will be configured for this software service.

  3. Optional: Specify the size of reported pool.

    If custom settings have been selected for this software service, you can change the default size of reported operations pool. The pool is shared among all monitored servers. The auto-learning algorithm aggregates the loads of all operations for all servers - the server IP, port or any other attribute of the server is not taken into account by the auto-learning algorithm. Any member of the pool will be reported for all servers, regardless the activity on individual servers.

  4. Optional: Enter the number of reported elements.

    If custom settings have been selected for this software service, you can specify the maximum number of different operations that will be reported and learned.

  5. Optional: Configure advanced auto-learning settings

    Click Advanced settings to show the properties so you can adjust the behavior of the auto-learning algorithm. The design behavior of the auto-learning algorithm for the Universal Decode are directly analogous to those for the auto-learning of URLs and you can adjust these settings accordingly.

Configuring Options for the Universal Decode software service

  1. Optional: Enable monitoring of persistent TCP sessions.
    When this option is selected, the TCP sessions that do not start with SYN packets (TCP sessions for which the start was not recorded) are monitored.

  2. Optional: Configure the operation time threshold.
    An operation that takes more than the time specified, is considered slow. When Inherit from global setting is selected, the global setting is used instead.

  3. Optional: Specify maximum request and response sizes.
    This is an advanced setting. Its purpose is to protect the NAM Probe from badly formulated Universal Decode scripts or from erroneous traffic which would overload the parser. Do not alter this setting unless you have been advised to do so by the provider of the particular Universal Decode script you are going to use. The maximum request and response sizes defined here relate to the particular protocol being analyzed by the Universal Decode. The analyzed protocol can be thought of as stacked above the TCP layer, with TCP being used as its transport layer. Therefore, a single request or response in this context, can consist of many TCP packets.

    You can specify custom values for this software service or you can select Inherit from global setting to use the global values instead.

  4. Specify the script settings and dictionary file, if any.
    The Script tab contains options that allow you to specify .

    Script file name

    The name of the script file to be used by the Universal Decode for this software service. The Universal Decode analyzer relies on the presence of a script file. The file name must be specified together with its extension (suffix) “lua”, and the file must reside on the NAM Probe, in the folder: /usr/adlex/config

    Dictionary file name

    Some script files use a dictionary file. This entry is optional. The file name, if specified, must be given together with its extension (suffix) “dict” and the file should reside on the NAM Probe, in the folder: /usr/adlex/config.

Configuring availability settings for the universal decode software service

  1. Open the Availability tab for the Universal Decode software service.

  2. Optional: Adjust the global measurement settings for calculating availability.

    Availability is measured and presented as the percentage of successful attempts (operations) compared to all attempts. If required, adjust the availability settings. For more information, see Availability in Other Protocols Monitoring - Universal Decode.

Saving and publishing your service definition

  • Publish the draft configuration on the monitoring device.