In doing some comparisons between monitoring tools TCAM seems to be reporting greater MAX CPU values than those seen in either SCOM or Splunk Windows Agents - up to a 2x difference at times.
This may be entirely possible based on polling interval, maybe TCAM is sampling much more frequently than the other tools and as a result is more sensitive? Just a guess... I'm hoping someone might confirm if this is the case?
Yes, it's all about polling intervals, when exactly would the poll occur, and what would the poller do with results - how to calculate max, avg, etc. TCAM polls WMI counters every 15 sec (if my memory serves me right) and max is imply the highest value returned.
For infrastructure monitoring, consider using Dynatrace OneAgent instead of TCAM. It would tell you lots about vertical stack, CPU handling between threads and in virtual environment, processes, and so on. Spyglass vs. MRI 🙂
~15 second polling interval would definitely explain it, thank you!
@Kris Z. Curious - does OneAgent also map user sessions to Citrix process table on XenApp like TCAM does? Is it a viable alternative to TCAM in that sense, or would we need both in this case?
No, OneAgent doesn't map TCP sessions to user names. However, if AMD listens to the ICA in front of VDA, it will name users by decoding the protocol. If AMD listens behind VDA, it will use app decodes to name traffic originated by VDA on behalf of the user (for those apps for which we have decodes). So there is at least a workaround, if not a complete alternative available.
Theoretically TCAM can be run in parallel to OneAgent, but this way you will have two agents on each server, probably an overkill.
OneAgent has lots of different advantages, infrastructure problem triaging and troubleshooting is possible with OneAgent, as well as dependency mappings. TCAM doesn't really address these use cases. Especially dependency mapping brings completely new perspective, far more impactful than just user names for TCP sessions.