I have setup server monitoring in a JMeter test. The setup is very similar to the one in this stackoverflow answer. When I am collecting CPU or memory without specifying a process, everything works as expected. I see the graphs with correct metrics.
However, when I try to collect CPU per process, for example with metric parameter pid=8948:percent, the graph is empty, no samples are collected and I see the following exception on the monitored server:
ERROR 2018-04-03 13:17:14.607 [kg.apc.p] (): Error getting metric
org.hyperic.sigar.SigarPermissionDeniedException: Access is denied.
: 8948
at org.hyperic.sigar.SigarProxyCache.invoke(SigarProxyCache.java:218)
at com.sun.proxy.$Proxy0.getProcCpu(Unknown Source)
at kg.apc.perfmon.metrics.CPUProcMetric.getValue(CPUProcMetric.java:35)
at kg.apc.perfmon.PerfMonMetricGetter.getMetricsLine(PerfMonMetricGetter
.java:114)
at kg.apc.perfmon.PerfMonWorker.processSenders(PerfMonWorker.java:280)
at kg.apc.perfmon.PerfMonWorker.run(PerfMonWorker.java:243)
at java.lang.Thread.run(Unknown Source)
I tried getting the process by name, but the exception is the same.
I run startAgent.bat --sysinfo and indeed the user has no rights on the process w3wp.exe (8948) that I want to monitor (The user does not "see" this process).
The documentation states explicitly that I do not need admin rights
on the application server (Windows Server 2012 R2). The user already has Performance Monitor Users and Performance Log Users role.
So how can I monitor CPU per process in a JMeter test with user that is not an administrator on the application server?
You can work this around by running Server Agent with elevated privileges, it could be done in 2 ways:
Using psexec tool you can run a process with SYSTEM account rights
Using Task Scheduler you also have possibility to start process with the highest privileges
Given you run Server Agent with elevated rights - you should be able to collect CPU metrics for IIS process.
See How to Monitor Your Server Health & Performance During a JMeter Load Test article for more information on using PerfMon Metrics Collector and Server Agent.
Related
Following parameters should be set for OBIEE Presentation Server only during load testing.
OBIPS\instanceconfig.xml
save and exit file Restart OBIEE processes using OBIEE EM console.
<ServerInstance>
[...]
<Cursors>
<NewCursorWaitSeconds>36000</NewCursorWaitSeconds>
<OldCursorWaitSeconds>36000</OldCursorWaitSeconds>
</Cursors>
[...]
</ServerInstance>
You do know that this represents a value of 10 hours, correct? You are willing to lock resources for that length of time? This is counterintuitive for optimal application performance as you would seek to recover resources as fast as possible to support more sessions versus locking a resource for an extended period of time.
I refer to the following performance "compass rose" as a guiding item (independent of tool)
If you need to amend the file on a remote server you can do this either via OS Process Sampler or via SSH Command Sampler. The first one is a part of JMeter installation, the second one you can install using JMeter Plugins Manager
See How to Run External Commands and Programs Locally and Remotely from JMeter for more information, example configuration and sample commands.
I have installed OEM 13c and deployed a couple of agents and want to test out the Log File Monitoring utility. I have enabled it and added a log file to monitor.
When I go and test it out, it does not show any alerts when they are put into the Log File. On the agent server, I have tailed the file and see the messages coming into the log file.
Does anyone have experience adding log files to OEM? I could have configured it wrong. Or is there any troubleshooting steps that I can follow to see if the server is even contacting the agent for reading the log file. Status of the agent is good with no incidents.
Without access to the system, it would be difficult to tell you the exact cause of this issue. However, I can list a few potential causes of this issue that I have experienced personally:
Permissions. The Oracle Enterprise Manager Agent is very convoluted when it comes to system permissions within a remote server. The agent can be owned and run as any number of users but during metric evaluation, may also need sudo or pam-authentication permissions to access certain entities on the server. Depending on the authentication profiles on that server, this could be the cause of your issue. There are ways to grant the agent access through the PAM stack if that is necessary.
Syntax. The wildcard syntax in the OEM GUI can be a little confusing as well. I would play with the wildcard elements a bit on the "String" component to ensure that it isn't as simple as adding wildcards to the beginning and end of the string. Without diving into the binaries of the agent plugins, it is difficult to assess exactly how the agent is evaluating this particular metric
One suggestion I would have is to go through the agent commands. There are specific commands you can run to manually force an agent to evaluate a particular metric for a particular target. This can allow you to manually trigger the metric collection locally on the server and evaluate what exactly is being performed at the agent level.
On the system I was running (12c) the command was as follows:
emctl control agent runCollection <hostname>:host host_storage
When i run Load test using Vs Load Test i get an exception
The performance counter category 'Process' cannot be accessed on computer;check that the category and computer names are correct. - -
You need to sort out permissions etc to allow the user and computer running the tests to collect the performance counters from the remote machine. The short answer is that if the user running the tests cannot see the counters with Perfmon then Visual Studio will not be able to see them. Hence Perfmon can be used to give confidence that the settings are correct.
To enable collection of performance counters by a Visual Studio load test do the following in each remote computer to be monitored. Perform these steps while logged in to a sufficiently privileged account.
1) Run wf.msc. In the inbound category, enable the Performance Logs & Alerts firewall exception.
2) Run lusrmgr.msc. Add the user to the Performance Log Users, the Performance Monitor Users and the Event Log Readers groups. The user to be added is the user who will be running the tests.
3) Run services.msc. Ensure the Performance Logs & Alerts and the Remote Registry services are set to autorun.
4) Run secpol.msc. Ensure that the Performance Log Users and the Performance Monitor Users groups include the Log on as a Batch User privilege.
5) At a command prompt rebuild all counters on the machine by running lodctr /r. (Have seen this command returning the message Error: Unable to rebuild performance counter setting from system backup store, error code is 5. Have not tracked down the reason but it does not appear to cause any problems.)
These commands are explained in more detail here.
We were trying to deliver a solution to manage a Windows 2012 server for a client using Chef, but unfortunately chef-client run failed with Chef::Exceptions::WindowsNotAdmin: can not get the security information for <some_file> due to missing Administrator privileges exception.
This was a bit weird as we have confirmed that the domain account we used to remotely manage the server is a member of the Administrators group. And we were able to use it to manage other servers within the same domain. Besides, when we connected to the server using the domain account via Remote Desktop, started PowerShell as an administrator and initiated a chef-client run, it failed with the same exception.
Running below commands reveals that the domain account is indeed a member of the Administrators group. This can be verified by the SID of the group.
Get-WmiObject -Class Win32_UserAccount
Get-WmiObject -Class Win32_Group
[System.Security.Principal.WindowsIdentity]::GetCurrent().Groups
Not sure what settings on the server could have caused this.
With insights provided by this thread, further digging into the code of Chef reveals that a win32 function GetNamedSecurityInfoW gets called here to determine the security information of an object (file, folder etc.). This occurs during cookbook installation where some resource files or gems need to be created on the endpoint server.
Firstly an empty file will be created, after that the file content will be updated atomically if that is an option. During file content update, the file’s security access control list needs to be checked by the function GetNamedSecurityInfoW. To call this function, the logged-on user needs to have a privilege SE_SECURITY_NAME. Chef itself also tries to handle this by adding this privilege before calling the function and revert it after the function call, but this is not always guaranteed. System settings seem to prevail.
We hacked Chef code a bit to try to print out the output of the function call on GetNamedSecurityInfoW, and it was a status code 1314, indicating a required privilege is not held by the user.
We tried to run whoami /priv on the server and found that SeSecurityPrivilege privilege is not found in the list. Below is just a sample output on a normal Windows server.
Privilege Name Description State
========================================================================
SeLockMemoryPrivilege Lock pages in memory Disabled
SeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled
SeSecurityPrivilege Manage auditing and security log Disabled
...
Note that the state column only indicates whether a privilege is being used by the user. It's existence indicates whether the user has it or not.
After adding back this privilege to the domain account, i.e. set the security setting of Manage auditing and security log to Administrators group in the Local Securtiy Policy editor, and rebooting the server, chef-client run became successful.
It seems that Chef is heavily using win32 API functions to manage Windows nodes. And these API functions seem to need various privileges to run. It's a bit strange that Chef rescued all win32 API errors and just propagated the Chef::Exceptions::WindowsNotAdmin to chef-client run log, as indicated here. It would be good to actually parse the error a bit and provide some more useful information.
I have a web service that calls some stored procedure on a AS400 via JTOpen.
What I would like to do is that the connections used to call the stored procedures was opened in a specific subsystem with a specific user, instead of qusrwrk/quser as now (default).
I think I can be able to clone the qusrwrk subsystem to make it start with a specific user, but what I cannot figure out is the mechanism to open the connection in the specific subsystem.
I guess there should be a property at connection level to say subsystem=MySubsystem.
But unfortunatly I haven't found that property.
Any hint would be appreciated.
Flavio
Let the system take care of the subsystem the job database server job is started in.
You should just focus on the application (which is what IBM i excels in).
If need be, you can tweak subsystem parameters for QUSRWRK to improve performance by allocating memory, etc.
The system uses a pool of prestarted jobs as described in the FAQ: When I do WRKACTJOB, why is the host server job running under QUSER instead of the profile specified on the AS400 object?
To improve performance, the host server jobs are prestarted jobs running under QUSER. When the Toolbox connects to a host server job in order to perform an API call, run a command, etc, a request is sent from the Toolbox to an available prestarted job. This request includes the user profile specified on the AS400 object that represents the connection. The host server job receives the request and swaps to the specified user profile before it runs the request. The host server itself originally runs under the QUSER profile, so output from the WRKACTJOB command will show the job as being owned by QUSER. However, the job is in fact running under the profile specified on the request. To determine what profile is being used for any given host server job, you can do one of three things:
1. Display the job log for that job and find the message indicating which user profile is used as a result of the swap.
2. Work with the job and display job status attributes to view the current user profile.
3. Use Navigator for i to view all of the server jobs, which will list the current user of each job. You can also use Navigator for i to look at the server jobs being used by a particular user.