In the out of the box Location Health report in CAS 12.3.6, we have locations (regions, areas & sites) with several users at each level. The issue is that when I select a particular Location, the data in the other two sections does not seem to accurately represent the # of users.
In this example, there are 53 users in the Metro South Cluster, and the User Performance section does show 53 rows, but the majority of those users are showing zero requests and zero failures. (Note: I have added the Failures & requests metrics to illustrate my point) So how can they be considered a user if they are not using anything?
Additionally, in the Application Performance section, i would expect to see the sum of the users for each application to add up to at least the total number of users at that location, if not more (allowing for users to use multiple applications). As you can see here, this is not the case:
This is an issue across all levels of Locations, and I have seen it manifest itself in other reports in the CAS (Users with no operations), making me think it is not an issue directly related to the Location Health DMI report. All of these images are off the same out of the box DMI report, I just cropped them for clarity's sake. Also note the only data feeds we have are AMD (no 'autodiscovered software services'), and TCAM agents for Citrix traffic. No netflow.
Any insight would be appreciated.
Site reporting is purely based on IP address so if there is any traffic see from an IP then it is assigned to the site. It doesn't require operations to be seen to be assigned. For example if i monitor a proxy server on port 8080 and i choose the HTTP decode, if the traffic to that server on port 8080 could be HTTP or SSL I would only see operations for the HTTP traffic as SSL traffic doesn't match the software service analyzer. So if a user acced that and only sent SSL traffic I would see their IP in the CAS with traffic volumes and network statistics but 0 operations. There are many other ways for this behavior such as when the SSL keys don't match. As such we saw a user but not an operation.
What i can't match though is the fact that your operations don't add up to the total as they should. I have checked in my system and they do. The only thing i can think of is there is an additional filter applied somewhere. Can you check that there are no additional filters applied to the User performance section by hovering over the filter icon beside the section name?
As for the application performance, well this section has an additional filter above the other 2 sections which is Application name. So the first 2 sections can show any traffic the CAS has monitored the application section can only show traffic that is assigned to an application. Applications can be configured in the CAS to group traffic but they are not required. In normal circumstances lots of traffic is not assigned to an application so that traffic is excluded from the section. You would need to check your application configuration.