Operations Manager 4.0 updates/polling

[mkerst]

Helo team,

got a question from a customer and I do not know where to begin?

didn't find anything in documentation.

Customer has DFM 4.0 installation in Munich and two controllers located in London being mointored.

Now he is seeing 2 thousand sessions open every half an hour with transfer of 400-500 MB of data?

What can this be?

Must that be this amount of transfers and data?

How can I find out what these transfers are?

can I throttle or limit these transfers?

It is not the Performance Advisor trying to reseive data, cause after disabling Performance Advisor it was nearly the same amount of transactions and data.

Problem the customer is facing is that he got issues with his WAN accelerators cause of the amouint of concurrent transfers.

Any hints on a solution is appreciated. 😉

Turning off the monitoring is no option. 😉

Many thanks,

Regards Michael

[smoot]

Hi Michael --

I do not know what DFM might be doing to require pulling that much data. Do you have FSRM file walks configured? Those can generate substantial amounts of traffic. When you say "2000 sessions", what sort of session are you seeing? SNMP file walks, NDMP connections, ZAPI connections, rsh/ssh sessions? Or something else?

One approach is to disable all the DFM monitors, then turn them back on one at a time, measuring network traffic all the while. You've said this is not acceptable, so let's not persue it.

I'd start a network packet sniffer and trace the traffic. From that, we ought to be able to see what protocol (SNMP, ZAPIs, NDMP) is causing the bulk of the traffic, and from there figure out which monitor is causing the issue.

-- Pete

[mkerst]

Hi Pete,

thanks for your helpful answer and hints on getting rid of this problem.

I'll talk with the customer about the points you mentioned and maybe get back to if you don't mind. 😉

Thanks again,

regards Michael

[mkerst]

Hi again,

the customer already had a sniffer tool on the network to trace the traffic:

most of the traffic are Http-Packets with "get request" demands.

They have FSRM in use.

I told him to set the monitoring intervall differently to see which options are causing the problem.

Can you tell me if you can identify special options to have a look at?

I know that SRM intervall on 10 Minutes is default, maybe this is one option. ?

Any other? Maybe File System monitoring interval?

Options are listed in the attachments.

Thanks for your support.

Regards Michael

[smoot · Accepted solution]

Most of those monitoring intervals look reasonable. You can double check whether any are shorter than the default using the "dfm diag" command. You can point a browser at http://you-dfm-station:8080/dfm/diag to see it graphically.

FSRM could easily be causing a lot of network traffic. Check how many FSRM paths are configured and what file walk schedule they are using.

Since you have a packet trace avaiable, look at the start of the HTTP GET requests. That will tell us which API is being invoked, which will greatly help narrowing down the search. You can also look at the audit.log file on the DFM station as that logs all API requests received by the DFM station.

-- Pete