Login test using Taurus - jmeter

Test login action using Taurus
execution:
-
concurrency: 5
ramp-up: 5
hold-for: 1m
scenario: Buyer-logs-in
scenarios:
Buyer-logs-in:
variables:
baseurl: http://localhost:3000
default-address: ${baseurl}
data-sources:
- path: './login.csv'
delimeter: ','
variable-names: userName, password
keepalive: true
retrieve-resources: false
requests:
- url: 'http://localhost:3000/login'
label: login
method: POST
body:
user[email]: {userName}
user[password]: {password}
assert:
- contains:
- 200
subject: http-code
- url: 'http://localhost:3000/action'
label: page1
method: GET
assert:
- contains:
- 200
subject: http-code
This is my sample Taurus code to simulate login and measure peformance.
In my app, only one user can login at a time and my csv file has 2 users. The test still works when I set a concurrency of 5 and Taurus says 5 users logged in. How is that possible. When the same user logs in again he will be kicked out of the first browser where he logged in. So with 2 user logins, how does Tuarus simulate 5 users?
With that asked, does taurus really login using the credentials i give in the csv file? Or should I use selenium/Taurus to simulate it?
What really confused me was when I deleted all users in csv file, the test still did not gave me 200 for the login and page1.
TIA

If you don't specify executor Taurus will use jmeter as default, it means that your YAML config will be translated into Apache JMeter test plan
You can see the generated test plan by running bzt your-test.yaml -gui command
data-sources is translated to CSV Data Set Config which looks like:
it means that each thread (virtual user) will pick up the new value from the CSV file each iteration like:
virtual user 1 - iteration 1 - 1st line
virtual user 2 - iteration 1 - 2nd line
virtual user 3 - iteration 1 - 1st line
virtual user 1 - iteration 2 - 2nd line
etc.
I don't think so, you're reading the credentials from the CSV file but not using it anywhere, the correct syntax for JMeter Variables is ${variable_name_here} so you need to set the login request body to:
user[email]: ${userName}
user[password]: ${password}
as long as you properly configure JMeter to behave like a real browser there is no need to use Selenium
You might be getting false positive results because your Response Assertion doesn't do a lot of useful job, JMeter automatically considers HTTP Status Codes below 400 as successful. So instead of checking status code I would rather recommend verifying that the use is logged in, i.e. "Welcome" message is there or API response has some specific text for successful login and/or doesn't contain errors.

Related

JMeter - Summary Report not displaying correctly

I am new to JMeter so bear with me...
I have a setUp Thread Group where I am grabbing a token and then re-using that in the HTTP Header Manager within the main Thread Group. Within that Thread Group I have the following parameters set...
I run this command to execute the tests:
jmeter -n -t PSC_Token.jmx -l testPsc.jtl -f
When I open the testPsc.jtl file though in Summary Report, I would expect that each request would show 600 for # Samples (200 threads * 3 loop count) but it is showing 1200 for each.
I tried deleting the file entirely and re-running it, just in case it was appending or something strange. That doesn't resolve the issue though.
Any ideas?
You're writing the same data into the same file 2 times, the options are in:
Disable (or better delete) the Summary Report listener, in general Listeners don't add any value, they only consume resources
Or remove -l command line argument and run your test just like:
jmeter -n -t PSC_Token.jmx
Also be aware that according to JMeter Best Practices you should always be using the latest version of JMeter so consider upgrading to JMeter 5.5 (or whatever is the latest stable version available at JMeter Downloads page)

Could not set variable "USER.user_false_counter" as the collection does not exist in ModSecurity logs Apache (Windows OS)

We are using apache module for our web server(windows OS). We need to prevent unsuccessful authentication attempt by the user. Hence we thought to use Mod Security module. I uses this standard configuration setting in "modsecurity-minimal.conf" as below
SecStatusEngine On
SecRule IP:bf_block "#eq 1"
"id:'2000004',phase:4,deny,
logdata:'Access denied [by IP] IP: #%{REMOTE_ADDR}, user: %{USER.name}'
SecRule USER:bf_block "#eq 1"
"id:'2000005',phase:4,deny,
logdata:'Access denied [by USER] IP: #%{REMOTE_ADDR}, user: %{USER.name}'
SecRule REQUEST_HEADERS:authorization "Basic ([a-zA-Z0-9]+=*)$" "phase:3,nolog,pass,id:2000012,chain,capture"
SecRule TX:1 "^([-a-zA-Z0-9_]+):" "t:base64Decode,chain,capture"
SecAction initcol:USER=%{TX.1},setvar:USER.name=%{TX.1},initcol:IP=%{REMOTE_ADDR}
SecRule RESPONSE_STATUS "401" \
"phase:5,pass,id:2000015,chain,logdata:'basic auth de #%{IP}, var: %{IP.begin}, user: %{USER.name}, ufc: %{USER.user_false_counter}, block: %{USER.bf_block}, IPblock: %{IP.bf_block}, ifc: %{IP.ip_false_counter}'"
SecAction setvar:USER.user_false_counter=+1,setvar:IP.ip_false_counter=+1,expirevar:USER.user_false_counter=300,expirevar:IP.ip_false_counter=300
# Check for too many failures for a single username, blocking 30 seconds after 3 tries
SecRule USER:user_false_counter "#ge 2" \
"id:'2000020',phase:3,t:none,pass,\
setvar:USER.bf_block,\
setvar:!USER.user_false_counter,\
expirevar:USER.bf_block=30"
# Check for too many failures from a single IP address. Block for 5 minutes after 10 tries.
SecRule IP:ip_false_counter "#ge 2" \
"id:'2000021',phase:3,pass,t:none, \
setvar:IP.bf_block,\
setvar:!IP.ip_false_counter,\
expirevar:IP.bf_block=300"
However when I see the modsec_debug.log, I get following error.
Could not set variable "USER.user_false_counter" as the collection does not exist.
Could not set variable "IP.ip_false_counter" as the collection does not exist.
Please help me how to resolve this issue.
This is a very complicated rule set (Is it taken from the ModSec Handbook?) and it may take hours to debug it. So it is not likely you will get the right support here.
What I can see immediately, is that you are not always initializing the collection and there is a chance rule 2000015 hits without the initialization. That is when a browser requests a resource without basic auth, the server responds with 401, then your rule 2000015 hits and only on the subsequent request would the browser request the same URI with the basic auth header.
So it looks to me as if your logic / rule architecture was garbled.
When I write complicated rule sets like this, I log every rule and I write and test them step by step and only if every rule works on its own, then I start to put them together, then I optimize them and then I put most of them to nolog.
This may take some time, so be warned.

Why jmeter generate other requests and put a number for them

I have a script, one of the requests in the script is: redireccion.html, but when I generate the HTML Dashboard report I see:
redireccion.html-0, redireccion.html-1, redireccion.html-2
Why those requests are generated by Jmeter?
HTML Dashboard Report Graph
This happens when your first request i.e. redireccion.html encounters a HTTP Redirect, i.e. gets a Redirection Message
JMeter stores all these redirects as sub-results
If you don't want these sub-results to be present in the HTML Reporting Dashboard - you can run your test providing jmeter.save.saveservice.subresults property with the value of false like:
jmeter -Jjmeter.save.saveservice.subresults=false -n -t test.jmx -l result.jtl -e -o dashboard
In order to make the change permanent - just add the next line to user.properties file:
jmeter.save.saveservice.subresults=false
More information: Apache JMeter Properties Customization Guide

Jmeter - Testing with 100 User while reading Links from CSV file

I just started using Jmeter recently.
What I want:
I want to run a test of 100 users by getting links from CSV file.
How I am doing:
I created a Test-Plan, Added Thread Group, CSV Data Config (Child to Thread group), HTTP Request.
Given Values:
HTTP Request Default: Url Address (Tried with both HTTP & without HTTP in protocol section)
Thread Group: User: 100
Loop: Forever
CSV Data Set Config: File Name (Full Path, the file is not in bin folder)
Variable Name: Path
Recycle on EOF: False
Stop Thread on EOF: True
HTTP Request: IP Address:
Path: ${Path}
CSV File:
Path
Link1
Link2
Link3
What I am getting: Well the test is executing but it executing all link only once (one User), it not going for 100 User
Note: I am running the TestPlan from Command Mode
Thanks for your Time
If you want each user to go through all links in the CSV file you need to amend Sharing Mode setting of the CSV Data Set Config to Current Thread
You can verify the behavior by adding __threadNum() function as request prefix/postfix

Details about which user from csv failed response assertion in Jmeter

I am using JMeter to webUI performance testing. I have a list of users in csv with passwords. I am using response assertion to check failed password scenario.
How to record which user from csv is failed?
I would recommend going for Sample Variables property. For example, if you defined a ${username} which holds the user name from the CSV you can get it added to JMeter .jtl results file by adding the next line to user.properties file:
sample_variables=username
If you need to store more variables - provide them separated by commas:
sample_variables=username,password
Remember that:
JMeter restart is required to pick the property up
You can pass it via -J command line argument as well like:
jmeter -Jsample_variables=username,password -n -t test.jmx -l results.jtl
See Apache JMeter Properties Customization Guide for more information on different JMeter properties types and ways of working with them

Resources