Previous Topic: Configure ClustersNext Topic: Monitoring SiteMinder Using SNMP


Using the OneView Monitor

This section contains the following topics:

OneView Monitor Overview

OneView Monitor Overview

The SiteMinder OneView Monitor identifies performance bottlenecks and provides information about resource usage in a SiteMinder deployment. It also displays alerts when certain events, such as component failure, occur. It does this by collecting operational data from the following SiteMinder components:

As these components are added to a SiteMinder deployment, they are automatically registered with OneView Monitor. You do not need to configure OneView to monitor these components.

Each machine that hosts a monitored component includes a OneView agent. The agent sends operational data to the OneView Monitor, which resides on the machine where the Policy Server is installed. The OneView Monitor sends the operational data to a Web browser or (optionally) an SNMP agent. The SNMP agent sends the data to the SNMP manager.

OneView Monitor data can be accessed from a Web browser, or from a third-party SNMP monitoring application.

The following graphic illustrates how the OneView Monitor is integrated in a SiteMinder deployment.

Graphic showing how the OneView Montior Records Information for Retreival by the User

The OneView Monitor collects properties, such as the IP address of the component’s host machine, and counters that reflect a component’s activity, such as how many times users have logged into your site. Counters are reset when the component is restarted.

Using the Web-based OneView viewer, administrators can define tables to view some or all of the data for a specific component. The data is refreshed at configurable intervals.

SNMP support enables monitoring applications to retrieve operational data from the OneView Monitor. SNMP support includes a Management Information Base (MIB) and an SNMP agent.

Note: In an environment that includes a clustered Policy Servers, you can specify a single OneView Monitor to monitor activity on all Policy Servers in a cluster. To configure a central monitor, you must adjust the OneView Monitor settings in the Policy Server Management Console for each Policy Server in the cluster.

More information:

Setting The Data Refresh Rate and Heartbeat

SNMP Monitoring

Policy Server Data

The following lists and describes Policy Server data:

AgentTable

Table of agents that are connected to this server.

Note: AgentTable is not available using SNMP.

AuthAcceptCount

Number of successful authentications.

AuthRejectCount

Number of failed authentication attempts. These attempts failed because of invalid credentials.

AzAcceptCount

Number of successful authorization attempts.

AzRejectCount

Number of rejected authorization attempts. These attempts were rejected because of insufficient access privileges.

CacheFindCount

Number of find operations in the authorization cache. Updated each time an authorization process asks whether a user belongs to a policy.

CacheFindCount/sec

Number of authorization cache find operations occurring per second.

CacheHitCount

Number of hits on the authorization cache. Updated each time the cache answers true when an authorization process asks whether a user belongs to a policy.

CacheHitCount/sec

Number of hits on the authorization cache occurring per second.

CacheTTLMissCount

Number of authorization cache misses because an element is found in the cache but considered too old.

Component Path

Path of the Policy Server, which uniquely identifies the server. The component path includes the following information:

Note: Component Path is not available using SNMP.

Crypto bits

Length of the encryption key used to encrypt/decrypt data sent between the Web Agent and the Policy Server.

HitRate

The ratio of authorization cache hits to authorization find operations. This is an indicator of authorization cache effectiveness.

Host

IP address of the machine where the authentication server is installed.

Note: The Host IP address is included in the Component Path.

IsProtectedCount

Number of IsProtected calls received from an Agent.

Label

Policy Server build number.

LastActivity

Date and time of the Policy Server’s last interaction with the Monitor.

MaxSockets

Maximum number of Web Agent sockets available to submit concurrent requests to a Policy Server.

MaxThreads

Maximum number of worker threads in the thread pool.

MaximumThreadsEverUser

Maximum number of worker threads from the thread pool ever used.

PriorityQueueLength

Number of entries in the priority queue. The priority queue holds entries of high priority. See ServerQueueLength.

Platform

Operating system of the machine where the Policy Server is installed.

PolicyCacheEnabled

Indicates whether the policy cache is enabled.

Port

Policy Server port number.

Product

Policy Server product name.

ServerQueueLength

Number of entries in the normal queue. The normal queue holds entries of normal priority. See PriorityQueueLength.

SocketCount

Number of open sockets, which corresponds to the number of open connections between the Policy Server and Web Agents.

Status

Status of the Policy Server. The status can be Active or Inactive.

Inactive status indicates that there was no interaction between the Policy Server and the monitor for a specified period of time. The period of time is determined by the heartbeat interval.

ThreadsAvailable

Number of a worker threads that are available from within the thread pool. All worker threads, which process requests, are organized into a thread pool. Not all threads are busy immediately--only when enough load is applied. This value shows how many threads are not currently busy.

ThreadsInUse

Number of worker threads from the thread pool that are in use.

Time Zone

Time zone for the geographical location where the Policy Server is installed.

Type

Type of Policy Server.

Universal Coordinated Time

The startup time of the Policy Server.

UserAzCacheEnabled

Indicates whether the user authorization cache is enabled.

Update

Version number of the most recently applied update.

Version

Version number of the Policy Server.

Web Agent Data

The following lists and describes Web Agent data:

AuthorizeAvgTime

Indicates the average time it takes to authorize a user (in milliseconds).

AuthorizeCount

Number of authorization attempts made by this Agent. An authorization attempt occurs when a user supplies credentials to the Policy Server in order to access a protected resource.

AuthorizeErrors

Number of errors that occurred during authorization attempts made by this Web Agent. An error indicates a communication failure between the Web Agent and Policy Server during an authorization call.

AuthorizeFailures

Number of failed authorization attempts. An authorization attempt fails when a user lacks sufficient privileges to access a resource.

BadCookieHitsCount

Number of cookies that the Web Agent could not decrypt.

BadURLcharsHits

Number of requests that the Agent refuses because of bad URL characters. Bad URL characters are specifically blocked to prevent a Web client from evading SiteMinder rules. These characters are specified in the Web Agent’s configuration.

Component Path

Path of the Web Agent. The component path includes the following information:

Note: Component Path is not available using SNMP.

CrosssiteScriptHits

Number of cross-site scripting hits. A cross-site scripting hit consists of malicious code embedded in pages at your site.

Note: For more information about cross-site scripting, see the Web Agent Configuration Guide.

Crypto bits

Length of the encryption key used to encrypt/decrypt data sent between the Web Agent and the Policy Server.

ExpiredCookieHitsCount

Number of requests that contained an expired cookie.

Host

IP address of the machine where the Web Agent is installed.

Note: The Host IP address is included in the Component Path.

IsProtectedAvgTime

The average amount of time it takes (in milliseconds) for the Web Agent to determine from the Policy Server whether or not a resource is protected.

IsProtectedCount

Number of times the Web Agent has checked the Policy Server to see if a resource is protected.

Note: If the resource cache is set to 0, the OneView Monitor may record two or more IsProtected calls per login attempt. If the Web Agent is not caching information, it must check with the Policy Server to determine whether or not a resource is protected each time a request is made to the Web server.

If the resource cache is not set to 0, the OneView Monitor only records one IsProtected call. In this case, the Web Agent makes one IsProtected call to the Policy Server; subsequent requests to the Web server for the same resource are satisfied against the Web Agent’s resource cache until the resource in the cache expires or the resource cache is flushed.

IsProtectedErrors

Number of times an error has occurred when the Web Agent asks the Policy Server whether or not a resource is protected. An error indicates a communication failure between the Web Agent and the Policy Server.

Label

Web Agent build number.

Last Activity

Date and time of the Web Agent’s last activity.

LoginAvgTime

Average time it takes for a user to log in.

LoginCount

Number of login attempts made from this Web Agent.

LoginErrors

Number of errors that occurred during login attempts. An error indicates a communication failure between the Web Agent and the Policy Server.

LoginFailures

Number of failed login attempts. Login failures occur when users supply invalid credentials.

Name

Name of the Web Agent.

Platform

Operating system of the machine where the Web Agent is installed.

Product

Web Agent product name.

ResourceCacheCount

Number of entries in the resource cache. The resource cache stores information about recently accessed resources to speed up subsequent requests for the same resource.

The number of entries in the resource cache can be 0 to n, where n is the maximum cache size specified in the Web Agent’s configuration.

ResourceCacheHits

Number of times that the Web Agent located a resource in the resource cache. This number indicates how frequently SiteMinder is using cached resources.

ResourceCacheMax

The maximum number of entries the resource cache can contain. This number is specified in the Web Agent’s configuration.

Note: Details on setting the resource cache size exist in the Web Agent Configuration Guide.

ResourceCacheMisses
SocketCount

Number of open sockets, which corresponds to the number of open connections between the Policy Server and the Web Agent.

Note: Because the Web Agent architecture has changed, SocketCount has no value.

Status

Status of the Web Agent. The status can be Active or Inactive.

Inactive status indicates that there was no interaction between the Web Agent and the monitor for a specified period of time. The period of time is determined by the heartbeat interval.

Time Zone

Time zone for the geographical location where the Web Agent is installed.

Type

Type of monitored component. In this case, the Web Agent.

Universal Coordinated Time

The startup time of the Web server where the Web Agent is installed.

Update

Version number of latest software update.

UserSessionCacheCount

Number of entries in the user session cache. The user session cache stores information about users who have recently accessed resources. Storing user information speeds up resource requests.

The number of entries in the user session cache can be 0 to n, where n is the maximum cache size specified in the Web Agent’s configuration. see the Web Agent Configuration Guide for information on setting the user session cache size.

Note: The user session cache count may differ based on the Web server where the session cache is located.

For Web Agents that use multi-thread cache, such as IIS Web Agents, iPlanet 4.x and 6.0 Web Agents (on Windows operating systems), and Domino Web Agents (on Windows and UNIX operating systems), the OneView Monitor increases the user session cache count when a user is successfully authenticated and receives a session cookie from the Web Agent.

Apache and iPlanet 4.x and 6.0 Web Agents running on UNIX operating systems, which use multi-process cache, count sessions differently. A user’s session is not added to the session cache until he presents a session cookie to the Web Agent. The Web Agent creates a session cookie for the user after he is successfully authenticated. SiteMinder uses that cookie to authenticate the user if he makes additional resource requests. This means that the user’s first login is not recorded in the user session cache count. If the user makes another request and SiteMinder authenticates the user using the session cookie, the user session cache count increases.

In all Web Agents, the user session is valid for resources in one realm. If the user accesses a resource in a different realm using a session cookie, he is given another user session, which increases the user session cache count.

UserSessionCacheHits

Number of times that Web Agent accessed the user session cache.

UserSessionCacheMax

The maximum number of entries the user session cache can contain. This number is specified in the Web Agent’s configuration.

Note: Details on setting the user session cache size exist in the Web Agent Configuration Guide.

UserSessionCacheMisses

The number of times the Web Agent could not locate user session information in the user session cache. This occurs when:

ValidationAvgTime

Average amount of time it takes to validate a cookie used to authenticate a user (in milliseconds). Cookies may be used to authenticate a user in a single sign-on environment.

ValidationCount

The number of times a specific Web Agent attempted to validate a session cookie against the Policy Server to authenticate a user, instead of matching that user’s credentials to a user directory entry. (The Web Agent creates a session cookie on the user’s browser when a user is successfully authenticated, and uses that cookie to authenticate the user on subsequent requests for new resources.)

The following conditions affect the ValidationCount:

User Session Cache size

If a Web Agent’s user session cache is set to a value greater than 0, the user’s session information is stored in the cache. The Web Agent validates the session against the session cache instead of the Policy Server, so the ValidationCount does not increase. If the user session cache is set to 0, the ValidationCount increases each time a user requests a protected resource because the Web Agent must validate the session against the Policy Server.

Multi-thread vs. Multi-process cache

Web Agents that use multi-threaded cache, such as IIS Web Agents, iPlanet 4.x and 6.0 Web Agents (on Windows operating systems, and Domino Web Agents (on Windows and UNIX operating systems), add a session to the session cache (if the session cache size is greater than 0) when a user is successfully authenticated. If that user requests additional resources from the same realm, the Web Agent validates the user against the session cache, so the ValidationCount does not increase.

Apache and iPlanet 4.x and 6.0 Web Agents running on UNIX operating systems, which use multi-process cache, do not add the session cookie to the session cache until the user presents the cookie to the Web Agent during a request for another resource in the realm where she was authenticated. The Web Agent validates the first request made with a session cookie against the Policy Server, which increases the ValidationCount. Subsequent requests are validated against the cache.

ValidationErrors

The number of errors that occurred when the Web Agent attempted to validate a user session. Errors indicate a communication failure between the Web Agent and the Policy Server.

ValidationFailures

The number of times the Web Agent has failed to validate a user session because of an invalid session cookie.

Version

Version number of the Web Agent.

Configure the OneView Monitor

Configuring the OneView Monitor includes:

Setting The Data Refresh Rate and Heartbeat

You can change how often data is sent between the OneView Monitor and a monitored component by modifying the following settings:

To modify the default values

  1. Open Policy_Server_installation/monitor/mon.conf.
  2. Change the value paired with the following properties, as necessary:

    Note: The value for these properties is specified in seconds.

  3. Save and close mon.conf.
  4. Restart the OneView Monitor.

More information:

Start and Stop Policy Server Services on Windows Systems

Start and Stop Policy Server Processes on UNIX Systems

Configuring Port Numbers

The One View Monitor uses the following default port numbers:

To change the default port numbers

  1. Open Policy_Server_installation_directory/config/conapi.conf file in a text editor.
  2. Change the values of the following OneView Agent properties, as necessary:
    nete.conapi.service.monagn.port=port_number
    
    nete.conapi.service.monagn.host=fully_qualified_domain_name_of_remote_host
    
  3. Change the value of the following OneView Monitor properties, as necessary:
    nete.conapi.service.mon.port=port_number
    
  4. Save and close the conapi.conf file.

    Note: For more information about the properties in conapi.conf, see the notes in the conapi.conf file.

  5. Restart the OneView Monitor.

More information:

Start and Stop Policy Server Services on Windows Systems

Start and Stop Policy Server Processes on UNIX Systems

Configure a Policy Server as a Centralized Monitor for a Cluster

Clustered Environment Monitoring

In a non-clustered SiteMinder deployment, a Monitor process is located on the same system as the Policy Server. The Monitor user interface and the SNMP provide information for a single Policy Server. To monitor a cluster, the Policy Servers in the cluster must be configured to point to a single Monitor process. The Policy Server Management Console allows you to specify a Monitor process host.

Consider the following when implementing a monitoring in a clustered environment:

Note: By not enabling clustering, all servers are in the default cluster. Centralized monitoring can be enabled for non-clustered environments.

More information:

Point Clustered Policy Servers to the Centralized Monitor

Access the OneView Viewer

Be sure the OneView Monitor service is running before you access the OneView viewer.

To access the OneView viewer, enter the following URL in a browser:

http://your_server.your_company.org:port/sitemindermonitor

where your_server.your_company.org:port is the host name or IP address, and the port number of the Web server which is configured for the OneView Monitor.

Note: For instructions on configuring a Web server for the OneView Monitor, see the Policy Server Installation Guide.

Protect The OneView Viewer

To protect the OneView viewer, create a SiteMinder policy that protects the resources in sitemindermonitor.

View Monitored Components

OneView Monitor provides the following default tables:

The All Components table is displayed when you open OneView.

Note: A Web Agent installed on an Apache or iPlanet 6.0 Web server will not appear in the OneView viewer until that Web Agent asks the Policy Server if a resource is protected. When the Web Agent requests information from the Policy Server, it is registered with the OneView Monitor.

The OneView viewer displays operational data in configurable tables. A table may contain a Details column. Clicking an icon in the Details column opens a window that displays all the monitored data for a particular component.

How to Customize OneView Displays

Customizing OneView displays includes:

Set Up Tables

To set up tables

  1. Click Configure.

    The Table Configuration dialog box opens.

  2. Complete one of the following options:
  3. Select components to display in the table.
  4. Select the fields to display in the table. Specify the order in which the fields are displayed by selecting a field and using the up or down arrow to position the field. The available fields are determined by the type of component(s) selected for the table.

    Note: The value for some of the fields can be displayed as a continuously increasing number (reset when the component is restarted) or as an average since the last update period. To view the average value, select a field name with /sec appended to it.

  5. Click OK.

    Note: Make sure to save the table after configuring it.

More information:

Save Settings

Configure Alerts

To configure alerts

  1. Click Configure.
  2. Click the Alerts tab.
  3. Select a field from the left list box. This list box contains all of the fields in the currently loaded tables.
  4. Select an operator from the middle list box.
  5. Specify a value for the field that you selected in step 3.
  6. Optionally, select Highlight the table cell to have OneView highlight the specified table cell when the specified criteria is met.
  7. Optionally, select Pop up a warning message to have OneView display a pop-up window when the specified criteria is met.

Display Tables

To display tables, select a table from the View Table list box in the main viewer page. When you select a table from this list, OneView displays the selected table below the existing table.

To hide a table, click the Hide button.

Sort Tables

You can sort the data in each column in a table in ascending or descending order. Sorting columns helps organize a table. For example, sorting a table based on Status enables you to view all inactive components grouped together.

Note: An arrow in the column heading indicates which column is sorted.

Configure Data Updates

By default, OneView updates data every thirty seconds. You can:

To configure data updates

  1. Click Updates.

    SiteMinder opens the Updates dialog box.

  2. Select one of the following:
  3. Click OK.

Save Settings

Saving a setting saves:

To save settings

  1. Click Save Settings.

    SiteMinder displays a dialog box where you can name the settings.

  2. Enter a name in the text box.
  3. Click OK.

Change the Default Display

To change the default display

  1. Rename the defaults file in siteminder_installation\monitor\settings.
  2. In the OneView Monitor console, configure the settings.
  3. Save the settings as defaults.

Load Settings

To load settings

  1. Click Load Settings.

    SiteMinder displays a dialog box where you can select settings to load.

  2. Select a setting from the list box.
  3. Click OK.