Network trending and its effect on ORS data

Any data collected by Observer’s Network Trending tool serves as information available to Observer Reporting Server. The data you see in ORS greatly depends on how you configure the relationship between the two applications. This section explains some of that information and a few best practices to follow.

Determine what type of data will be most useful for tracking and resolving your particular network and performance problems. Although completely acceptable, collecting data that you never use is an inefficient practice. For example, if you are interested in performance data, you should set up Application Performance Analysis and/or Application Transaction Analysis, and turn off all other data collections. Or, if you are interested in TCP applications just from the packet, byte and load count perspective, all you should enable in Observer’s Network Trending tool is IP Trending - Protocols by IP Address.

In Observer, only Application Performance Analysis and Application Transaction Analysis are enabled by default. We recommend enabling more from Trending/Analysis > Network Trending because some Observer Reporting Server reports require additional types be enabled, such as IP or MAC trending.

Even though Observer employs extremely powerful parallel processing technology, the benefit of collecting only the trending data you need is noticeable. First, there will be less load on the system; this is most important when multiple probe instances are sharing the system. Second, there will be less data written to disk during data collection. Third, there will be less data to transfer to ORS across the network. Fourth, the data processing will be faster both for Observer reports and for ORS reports, due to smaller per-day database files. Accordingly, turn on or off the trending data types in Observer’s Network Trending tool.

Ensure the Network Trending tool’s “Statistics Collection Interval” setting matches the “Data Transfer Schedule” in Observer Reporting Server. The default value for both is 60 minutes; it matches by default. If you need higher resolution, set both values to 10 minutes. This retains a matching value in Observer and Observer Reporting Server, and the transfer of data will be most efficient.

If you intend to “drill down” into more granular Observer trending data, you can set the '”Statistics Collection Interval” to 1 minute. However, the amount of the disk space consumed on the Observer system becomes significantly higher. These are also set in network trending settings. Also be sure to select an appropriate sampling divider.

Application Transaction Analysis only trends on purposely defined servers. As such, no additional setup is typically needed. However, when using Application Performance Analysis (a different yet similar tool within network trending), here are some items to consider:

Keep the “Track only new connections in every collection interval” setting enabled. This way you will have the most accurate information about network delay and server response time while tracking only connections that start within each collection interval.

If you want to track only specific servers, add these servers to the TCP Protocol Definitions list for the TCP application of interest. Then enable the setting “Track only servers using IP addresses and ports defined in 'Protocol Definitions and Server Application Discovery'.” Now Application Performance Analysis collects information only for the specified servers. (This practice is suitable only if the server list you are interested in is small.)

For larger server lists or for tracking interaction between local clients and remote servers (or vice versa), configure the subnet ranges in Observer’s network trending settings.

Limit the list of tracked applications, but remember if you have servers that use custom ports, you should specify them in Protocol Definitions and Server Application Discovery for the instance that has visibility on the server(s) of interest.

Concerning VoIP trending data, it is important to configure the VoIP trending settings in Observer. Specifically, be sure to specify the device IP addresses for correct identification of the device roles on your VoIP network. This ensures the data is being collected. Additionally, adjust the order of selections in the “Caller ID Determination” tab if necessary, so caller names are human-readable. You can also narrow the VoIP traffic flow by defining IP range filters.