While working in Rum Console we get the below Warning.
Questions are of course:
- are we in big trouble
- where do all the services defined
- what limitations we need to take in consideration, adjusting the limit.
IPv4 123,456 AMD monitors by default 20,000 services and might not be able to monitor all of them.
Verify your settings or adjust the limit manually in rtm.config
We have one Software Service that is defined as a range of server IPs
and a range of ports possible (a variant to a virtual desktop
infrastructure). There may come some of these services number from?
A range of 600 listening ports over a range of 254 server IPs 152,400 combinations?
Solved! Go to Solution.
Essentially, it's letting you know the AMD may not be able to keep up with monitoring that much traffic. For comparison, I believe in 12.4, the limit was upped to 50k. Edit: The limit is 20k and services higher than the limit will not be monitored. Yes, if you multiply the size of your port range by the ip range, you'll get the # of monitored services. For example, 18.104.22.168-22.214.171.124 : 1000-2000 = 100*1000 = 100,000 monitored services. You should try to limit the range if possible in your largest Software Service.
You aren't in big trouble, but watch your AMD's core 0 CPU and your dropped packet count to make sure it's keeping up.
There's not an easy way to pinpoint which Software Service is taking the most service count. The best manual way is to:
Brett, the limit has not been raised in 12.4. It's still at 20k. Also, if the custom driver is used and autodiscovery is disabled, exceeding the limit has bigger consequences than lowered performance - traffic for all services beyond the limit will be filtered out and not sent to analysis at all.
Thank you for sharing - I was under the wrong impression. Does the AMD just monitor the first 20k chronologically and skip the higher ranges? i.e. monitors 126.96.36.199-188.8.131.52 but skips 184.108.40.206 upwards?
I'll update/edit my answer
Exceeding the limit means that only traffic for 20000 services will be monitored and the rest will be discarded by the driver. In this context, the term "service" means an ip:port pair - so e.g. a single software service having an IP address range spanning 1000 IP addresses and a port range of 10 ports consists of 10000 services (ip:port pairs).
The limit may be raised in rtm.config, but it is not recommended, as it has a negative performance impact. The preferred way of monitoring application with large or unknown IP ranges is using Autodiscovery.
The limit is not applied if the AMD uses the native driver or Autodiscovery is enabled, however the performance cost remains.