Component Administration - User Profile
 

Discovering Components using eG Agents

The AGENT DISCOVERY SETTINGS page depicts how the eG agents discover the components.

Typically, an agent is installed on a host only when an administrator is interested in monitoring one/more applications executing on that host. In large IT environments characterized by tens of components, it is often difficult for administrators to manually track where agents are installed, and manage only the corresponding hosts and applications. In such environments therefore, administrators might prefer to run a discovery procedure that automatically discovers only those components that they are “interested in monitoring” - i.e., an auto-discovery procedure that can discover only those applications which are executing on the hosts where agents are installed; this ensures that the eG administrative interface is not crowded with a wide variety of applications that an administrator might not even be interested in monitoring. This can be achieved only if discovery is performed using the eG agents.

Like manager discovery, agent discovery is also port-based. The agents use a port scanning technique to discover the applications executing on the hosts on which they are installed. Since every agent performs the discovery and communicates the results to the eG manager, the location of the eG manager will not in any way impact the discovery process - i.e., even if the eG manager is behind a firewall and is not able to access the components in the target environment, the eG agent will be able to promptly detect the additions/removals in the environment everytime it rediscovers, and will be able to update the eG manager with this knowledge. However, a key limitation here is that since no agent can be installed on network devices, they cannot be discovered by the eG agents.

To enable the eG agents to perform this discovery instead, do the following:

  1. Follow the menu sequence: Agents -> Settings -> Discovery.

  2. The AGENTS DISCOVERY SETTINGS page then appears. In the AGENT DISCOVERY SETTINGS section of the page, the Enable agent discovery flag is set to No, by default. To allow the eG agents to perform discovery, set this flag to Yes.

  3. Next, in the Agent discovery startup delay (Mins) text box, indicate the duration (in minutes) for which the agent needs to wait before beginning discovery.

  4. To indicate how frequently the agent should rediscover components, set a time period (in minutes) against the Agent rediscovery period (Mins) field.

  5. You can also instruct the eG agent to timeout if no components are discovered from an agent host beyond a specified duration. This duration needs to be mentioned in the Discovery timeout (Millisecs) text box.

  6. As soon as the Enable agent discovery flag is set to Yes, a TOPOLOGY DISCOVERY SETTINGS section will appear in this page. By default, if the eG agent's component discovery capability is enabled (i.e., if the Enable agent discovery flag is set to Yes), then the eG agent automatically acquires the ability to auto-discover the component topology as well! This is why, the Enable topology discovery? flag is set to Yes by default in the TOPOLOGY DISCOVERY SETTINGS section.

  7. Once automatic topology discovery is enabled, the eG agent will run the netstat command on the target host every 1 hour (by default) to determine which applications are operating on the host and which port they listen to. This default frequency can be overridden using the Delay between successive dependency discovery attempts (Mins) parameter in the TOPOLOGY DISCOVERY SETTINGS section. By default, this parameter is set to 45, indicating that the default discovery frequency is 45 minutes. To override this default frequency, specify a different duration (in minutes) against the Delay between successive dependency discovery attempts (Mins) parameter.

  8. Whenever the eG agent on a host runs netstat, it retrieves a list of ports that are operating on that host. While some of these TCP ports may be standard listening ports - i.e., TCP ports at which the applications executing on that host listen for requests from remote hosts/applications - a few other TCP ports may be local ports created dynamically on the host for a temporary purpose. To clearly differentiate between listening ports and local ports, the eG agent does the following:

    • By default, the eG agent compares the ouput of four consecutive executions of the netstat command on a host. If a port number is repeated in all the four netstat outputs by default, then that port number is counted as a ‘server listening port’. This default behavior is governed by the Dependencies must be present and the Number of dependency discovery attempts parameters in the TOPOLOGY DISCOVERY SETTINGS section. Say for example, both these parameters are set to 4 by default. The 4 against the Number of dependency discovery attempts parameter indicates the maximum number of consecutive netstat outputs to be considered for identifying the server listening ports. The 4 against the Dependencies must exist parameter indicates the minimum number of netstat outputs in which a port number should appear for it to be considered as a ‘server listening port’. You can change this if you need. For instance, if you set the Dependencies must exist parameter to 3 and let the Number of dependency discovery attempts parameter to remain at 4, then the eG agent will count the port numbers that appear in at least 3 out of 4 consecutive netstat outputs as active listening ports.

    • Once the listening ports are identified, the agent then closely observes traffic to and from a ‘server listening port’, identifies the remote applications that frequently connect via this port, and thus automatically discovers the inter-relationships that exist between applications in an IT infrastructure. The interdependencies that are so discovered are then sent to the eG manager. On the other hand, all those port numbers that do not conform to the specification governed by the Dependencies must be present and the Number of dependency discovery attempts parameters are counted as local ports. All traffic to local ports are hence disregarded for the purpose of topology auto-discovery.

  9. By default, the whole cycle of operations - beginning with isolating the listening ports to discovering inter-dependencies to reporting the discovery to the eG manager - takes 180 minutes to complete. After which, the eG agent will wait for another 360 minutes (i.e., 6 hours, by default) to rediscover the topology. In other words, all the aforesaid activities will be performed again by the eG agent 6 hours after the first cycle is complete. Like other default settings, you can also override the frequency with which topology is rediscovered by the eG agent. For this, use the Topology rediscovery period (Mins) parameter, which is set to 360 by default.

Like manager discovery, agent discovery too uses the port numbers available in the PORT SETTNGS page to discover applications executing on an agent host. This implies that changes made to PORT SETTINGS will automatically affect both manager and agent-based discovery.

Note:

eG Agents deployed on the following operating systems can alone perform topology discovery:

  • Linux
  • Windows (2000/2003/2008/2012/Vista/XP/7)
  • AIX

Solaris and HPUX agents cannot auto-discover the topology.