Skip to main content

This documentation does not apply to the most recent version of uberAgent. Click here for the latest version.

Network Metrics

Network Communication

uberAgent collects metrics like source process (process sending/receiving data on the machine uberAgent is running on) as well as IP address and port per network target and sending/receiving process. A network target is a communication endpoint from the point of view of the machine uberAgent is running on. uberAgent distinguishes between different services on the target machine and can show latencies for, say, SMB and SQL Server independently. Of course, uberAgent supports both IPv4 and IPv6! uberAgent optionally only shows new ports and targets never seen before.

Details

  • Source type: uberAgent:Process:NetworkTargetPerformance
  • Used in dashboards: Application Network Issues, Citrix XA/XD Databases, Process Network Communication, Application Network Communication, Machine Network Communication, Single Application Performance, Single Machine Detail, Single User Detail
  • Enabled through configuration setting: NetworkTargetPerformanceProcess
  • Related configuration settings: [NetworkTargetPerformanceProcess_Filter], [NetworkTargetPerformanceProcess_Config]
  • Supported platform: all

List of Fields in the Raw Agent Data

Field Description Data type Unit Example
ProcName Process name. String chrome.exe
ProcUser Process user. String Domain\JohnDoe
NetTargetRemoteAddress Network target remote address. String 138.201.31.60
NetTargetRemoteName Network target remote name. String vastlimits.com
NetTargetRemotePort Network target remote port. Number 443
NetTargetSendCount Count of packets to network target containing payload. Number 15
NetTargetReceiveCount Count of packets from network target containing payload. Number 14
NetTargetConnectCount Count of connects to network target. Number 1
NetTargetSendKBPS Kilobytes per second sent to network target. Number KB/s 1024
NetTargetReceiveKBPS Kilobytes per second received from network target. Number KB/s 1024
NetTargetSendMB Amount of data volume send to network target. Payload only, no protocol overhead. Number MB 1
NetTargetReceiveMB Amount of data volume received from network target. Payload only, no protocol overhead. Number MB 1
NetTargetSendLatencyMs Latency to network target. Number ms 100
NetTargetProtocols Protocols used. String TCP
NetTargetSendLatencyCount Count of events with latency. Number 2
AppId Associated application ID. Used by uberAgent to lookup application names and populate field AppName. String GglChrm
NetTargetReconnectCount Count of reconnects to network target. Number 3
NetTargetRetransmitCount Count of retransmits to network target. Number 3
AppVersion Application version. String 67.0.3396.99
NetTargetSendJitterMs* Jitter to network target. Number ms 5
NetTargetSendJitterCount* Count of events with jitter. Number 1
NetTargetSourceAddress Network source IP. String 127.0.0.1
NetTargetSendLatencyInitialMs* Initial Latency to network target (TCP handshake). Number ms 100
NetTargetSendLatencyInitialCount* Count of events with initial latency. Number 1
NetTargetSourcePort* Network source port. Number 43021

List of Calculated Fields

Field Description Data type Unit Example Where available
NetTargetRemoteNameAddress Content of NetTargetRemoteName. If NetTargetRemoteName is not filled, NetTargetRemoteAddress is used instead. String vastlimits.com Splunk data model
NetTargetRemoteNameAddressPort Concatenation of NetTargetRemoteNameAddress and NetTargetRemotePort. String vastlimits.com:443 Splunk data model
NetTargetSendReceiveMB NetTargetSendMB + NetTargetReceiveMB. Number MB 2 Splunk data model
NetTargetSendReceiveCount Count of sends and receive events combined. Number 29 Splunk data model
NetTargetSendReceiveKBPS NetTargetSendKBPS + NetTargetReceiveKBPS. Number KB/s 2048 Splunk data model
NetTargetSendDurationMs NetTargetSendLatencyMs x NetTargetSendLatencyCount. Number ms 200 Splunk data model
AppName Associated application name. String Google Chrome Splunk data model, Splunk SPL
ProcUser Process user. String Domain\JohnDoe Splunk data model, Splunk SPL
User User name. String Domain\JohnDoe Splunk data model
ProcessName Process name. String chrome.exe Splunk data model

Network Connection Failures

uberAgent collects metrics like source application name as well as protocols used whenever a network connection attempt fails.

Details

  • Source type: uberAgent:Application:NetworkConnectFailure
  • Used in dashboards: Application Network Issues, Machine Network Issues, Process Network Issues
  • Enabled through configuration setting: NetworkTargetPerformanceProcess
  • Related configuration settings: [NetworkTargetPerformanceProcess_Filter], [NetworkTargetPerformanceProcess_Config]
  • Supported platform: all

List of Fields in the Raw Agent Data

Field Description Data type Unit Example
AppId Associated application ID. Used by uberAgent to lookup application names and populate field AppName. String GglChrm
AppVersion Application version. String 67.0.3396.99
ProcessName Process name. String chrome.exe
ProcessId Process ID. Number 456
SessionGUID Unique identifier that is generated by uberAgent when the session is created.
Valid for this session only.
String 00000002-f295-9109-e7c7-c964011dd401
NetTargetRemoteAddress Network target remote address. String 138.201.31.60
NetTargetRemoteName Network target remote name. String vastlimits.com
NetTargetRemotePort Network target remote port. Number 443
NetTargetProtocols Protocols used. The only protocol supported is TCP. String TCP
NetTargetSourceAddress Network source IP. String 127.0.0.1
NetTargetSourcePort* Network source port. Number 43021

List of Calculated Fields

Field Description Data type Unit Example Where available
AppName Associated application name. String Google Chrome Splunk data model, Splunk SPL
ProcName Process name. String chrome.exe Splunk data model
User User name. String Domain\JohnDoe Splunk data model, Splunk SPL
NetTargetRemoteNameAddress Content of NetTargetRemoteName. If NetTargetRemoteName is not filled, NetTargetRemoteAddress is used instead. String vastlimits.com Splunk data model

* Fields only available when NetworkDriverEnabled = true.

Comments

Your email address will not be published. Required fields are marked *