We have a customer that are facing long times for printing (from time to time), but it's hard to document the frequency and times. Users claim it might take up to 10min from clicking print until it starts printing.
The Print is spooled by a dedicated print server (TCP:445) and future sent to printers (TCP:9100). There are too many printers to be manually added one by one and there is a limitation of 5000 combinations per software definition line so we cannot define print server with random port numbers either.
Our goal is to both look at the time from user to print server as well as print server to printer. With this we can document if and how much time is caused by network, server etc.
How can DCRUM help us here?
I imagine this may be possible to create two Software Serivces (client->server and sever->printer), but I'm not sure if I correctly understand your the problem. I'm not sure what port you describe as random. Print server's client port or printer's one?
Base on this information we would be able to decide if monitoring communication between server and printers is possible.
Doing this between users and print server should be possible just by creating Software Service with print server's IP and 445 port. Analyzer "generic with transactions" should be used.
The problem is they have hundreds of printers and the limitations in how to configure software services makes it impossible without defining each printer address manually...
Each printer is listening at TCP:9100 - client port number,
Print server is using random TCP port numbers when communicating with the printers.
The customer has two IP B net ranges and I can't define the complete range in comination with TCP:9100 since you are not allowed to define more than 5000 combinations... I can not define all traffic to/ from the print server since the port range will be 1-65535: Again more than 5000 combinations...
Would you suggest I use Generic with transactions as decode for the User-> Print Server as well? What are the drawback compared to using SMB decode (since it is using TCP:445)?
That's not the problem as long as random ports are client ports. In software Service we define only server side of monitored traffic (the port where the device/service is listening for new connections), not client. Big number of printers we could workaround by defining port 9100 as Default Software Service so any server IP that is active on port 9100 will be recognized as printer.
So this would end up in defining one SS for print server's IP:445 and one SS (in Default Software Services section) called "Printers" where we define only port 9100.
As we all know enabling Default Software Services may increase the load for the AMD, so (if Default Software Services have not been used so far) it would be recommended to backup AMD configuration and remove all Default Software Services and then insert this one responsible for printers.
About SMB decode - I admit I don;t know if it has not changed since I was working with it last time. Initially SMB decode was developed only to detect SMB users. In fact it was generic with transactions that is capable to find SMB users. I will check what changes (if any) have been made to this code and let you know ASAP.
Thank's Adam this sounds like a good path to follow
Can you state what file(s)/ folder(s) I should start searching for the Default Software Services to back it up before I start playing around with it.....?
If the application is built using .NET and/or java, dynaTrace (a sister product to DCRUM) would be able to show you the transaction execution path and timings from the "print click" in the client/browser, across the network, into the web server, into the .NET/java app server(s), and down to the Print() method in the code.
It's basically sees everything from the user perspective (click) and the application perspective (print method) that executes.