Foglight Experience Monitor 5.8.1 - Installation and Administration Guide

Verify the network tap configuration

At this point in the troubleshooting process, the appliance should be configured so that it has connectivity to the network. The user can successfully point a web browser at the appliance and log in to the web console.

The next step in the verification process is to check that the Foglight Experience Monitor can actually see some web traffic on one of the default ports, either HTTP or HTTPS.

IMPORTANT: If the appliance cannot see web traffic, then it will never generate any reports or alarms.

Proceed with the following steps to verify that the appliance can indeed see web traffic. If there is a failure, then a series of steps are provided to correct the problem.

These basic steps simply help ensure that all setup information has been entered correctly.

This step confirms whether the appliance can actually see any TCP/IP packets transmitted on the network. Failure to see any packets means that the network tap is not mirroring an active LAN/VLAN.

This section assumes that the Step 1: Check for IP packets has failed. There are several common reasons why the appliance may not be seeing any packets, which are outlined in this section.

After you have found a solution, and see TCP/IP packets, proceed to Step 3: Check for web traffic visibility.

During the installation of the new system, the cable between the appliance, switch and network tap may have been accidentally disconnected.

This would typically only be the case in a test lab environment.

If the link light on the port is not flashing, this is indicative that packets are not being transmitted.

Try generating network traffic with a client on the monitored VLAN. Do IP packets appear?

This step verifies the appliance can actually see TCP/IP packets transmitted on the network that contain either HTTP or HTTPS information.

This section assumes that the outcome of Step 3: Check for web traffic visibility has failed. There are several common reasons for failed web traffic visibility, which are outlined in this section.

After you can see web traffic, proceed to the next section, Verify the server configuration.

This would typically only happen in a test lab environment, or on a production network that has a very small number of active users.

With a client browser, try generating web traffic that will hit the monitored web site. Does web traffic appear?

The standard port for HTTP is 80, and 443 for HTTPS. Port 8080 is also often used for proxy requests.The following URL shows how users might access a site using a different port:

In this example, you would need to add port 7070 to the list of monitored ports on the Configure > Monitoring > Protocols page.

Contact your network administration to confirm which ports are being used for the applications you want to monitor.

The appliance needs to be deployed in a location where it can monitor the network traffic that is being transmitted to and from your applications. he most common deployment location is near the switch that feeds the server farm servicing the monitored applications.

To ensure your application is deployed in the correct location follow these steps:

A common misconception when deploying monitoring devices is that the Foglight Experience Monitor can be plugged directly into a VLAN and see all traffic transmitted on the VLAN. This misconception arises from the fact that VLANs transmit broadcast traffic to all ports on the VLAN. Despite this, the VLAN does not duplicate normal point-to-point traffic on every port, thus every port on a VLAN does not see all traffic to other ports.

Correct appliance deployment involves the configuration of a network tap to copy packets from one of the locations. This is discussed in Network taps.

Many networks will have multiple VLANs (Virtual LANs) configured on the switch. Ideally, the appliance should be monitoring the VLAN that is connected to the Internet. This is usually the connection from the firewall to the switch, or the connection from the load balancer to the switch.

A common mistake occurs when the network tap is configured to mirror traffic from the incorrect location on the network.

Verify the server configuration

The list of servers known by the appliance controls which packets are analyzed. Only packets sent to or from one of these servers are analyzed, and all other packets are discarded. Given this filtering, if the server list is not configured correctly, then the appliance will not show any data in its reports.

At this point in the troubleshooting process, the following should all be true:

IMPORTANT: If all of the above are not true, then not all previous troubleshooting steps have been completed successfully. Restart the troubleshooting process from the beginning of the chapter.

The following sections outline possible reasons behind empty reports, and how to resolve them.

Most networks will probably be using some form of a load balancer in conjunction with the server farm. To external users accessing the web site, the load balancer presents one or more Virtual IPs (VIPs). The web site names (DNS) all resolve to these VIPs.

However, once a request from an end-user arrives at the load balancer, the request is redirected to a server using that server’s physical IP. Assuming, the appliance is deployed between the load-balancer and the server, it is the physical IPs that will be monitored.

In this case you will need to configure the physical IPs in the web console, click Configure > Monitoring > Servers to edit entries on the Servers page. For more information, see Managing monitored servers.

The appliance will only monitor traffic on the servers specified in the server list. It will filter out all other traffic.

Verify the server IP address in question is not missing or mistyped in the server configuration list. In the web console, click Configure > Monitoring > Servers to edit entries on the Servers page. For more information, see Managing monitored servers.

Appliance runtime issues

For more information, see these topics:

Foglight Experience Monitor reports

If your users report that they are interacting with an application that is monitored by the appliance, but reports relating to that application do not show any activity, one of several factors may be causing this behavior.

It is possible that the protocol used by the application has not been configured in the appliance. If this is the case, the appliance will not be listening on all the correct ports for traffic.

In the web console, click Configure > Monitoring > Protocols, and verify the port used by the application is on this list.

If the port is not listed on the Protocols page, and you are not sure which port the application is using, you can have the appliance detect port usage for you. For more information, see Automatically discovering ports.

It is possible that the server is not actually being monitored by the appliance. In the web console, click Configure > Monitoring > Servers, and verify the server from which the application is delivered is on the servers list.

If the server is not on the list, you can add it manually, or have the appliance detect the server for you. For more information, see Automatically discovering servers.

It is possible that the network tap is configured in such a way that the appliance cannot see the application’s traffic.

To confirm this, use the Verify Monitor NIC tool to verify that the appliance is receiving incoming traffic. This tool is found on the Support Tools page, which is accessed by clicking Help > Support Tools in the main menu. For more information, see Monitor NIC activity test.

IMPORTANT: Running a TCP dump will temporarily halt data collection by the appliance, which will result in a gap in your metrics. Use this feature with caution.