Since 1996 Identify Software has been leading the software industry for supporting applications and optimizing the support chain process throughout the organization. Every person can identify the potential of the recorded information, after seeing the first traced log from AppSight, for troubleshooting problems faster and in more efficient methods, but it is extremely important to understand how this powerful Black Box technology should be used in order to exploit its full potential in the most efficient way for your organization. This book attempts to bridge that gap in knowledge by providing solid advice, backed up with experience. This advice is what we at Identify like to call “best practices”.

1. I
D
E
N
T
I
F
Y
S
O
F
T
W
A
R
E
AppSight 5.0
Advanced Concepts Training
Damian Rochman
Sr. Software Engineer and Consultant
drochman@us.identify.com

2. I
D
E
N
T
I
F
Y
S
O
F
T
W
A
R
E
The Application

3. What is an Application?
The term application is a shorter form of application program.
An application program is a program designed to perform a
specific function directly for the user or, in some cases, for
another application program.
Applications use the services of the computer's operating
system and other supporting applications.
The formal requests and means of communicating with other
programs that an application program uses is called the
application program interface (API).
Source: www.whatis.com

4. The Application Layers
User Interface
Application Configuration
System Operations
COM Calls
Code

5. User Interface Layer for Client Applications
Visual Playback

6. User Interface Layer for Client Applications
GUI Operations

7. “User Interface Layer” for Server Applications
Performance Counters

8. “User Interface Layer” for Server Applications
IIS Sessions View
Client IP
ASP Session ID
Pages visited in
the session

9. Application Configuration
System Configuration (static snapshot)

10. Application Configuration
File Configuration (dynamic scan)

11. Application Configuration
Registry Configuration (dynamic scan)

12. Application Configuration
Modules Configuration (dynamic scan)

13. Application Configuration
COM/COM+ Configuration (dynamic scan)

14. Application Configuration
IIS Configuration (static snapshot)

15. Application Configuration
.NET Configuration (dynamic scan)

16. Application Configuration
Internet Explorer Configuration (static snapshot)

17. System Operations Layer
.NET Remoting
Files
Web Services
Registry
Process Operations
myApp.exe
Database
Notifications
IIS
Networking
Library

18. COM Calls Layer
myCOMObject
WriteFile
myApp.exe
ExecuteQuery
SendMessage
EncryptData

19. Code Layer
Calc.exe
Add(int a, int b)
Subtract(int a, int b)
Divide(int a, int b)
Multiply(int a, int b)
Int Add (int a, int b)
{
return a+b;
}

20. I
D
E
N
T
I
F
Y
S
O
F
T
W
A
R
E
The Recording Profile

21. What is a Good Recording Profile?
A good recording profile is designed to
capture all the required information with an
acceptable performance impact

22. Think Like a Black Box
Three questions the Black Box needs to know:
1.
2.
3.
Who do I need to trace?
What information should I capture?
How should I operate?

23. Who?
•
Add the required process (es) to the list
•
ADD the process do not ATTACH (!)

24. Who? (cont.)
•
•
•
•
What if you do not have the process in your
computer?
The Black Box only checks for a process name.
Take any process in your computer and rename
it to the name of the process you wish to trace
on the target computer.
Add the “dummy” application to the list.

25. What?
•
•
•
•
Select the Operations to trace.
Select the Performance counters to
trace.
Select the COM/COM+ functions to
trace.
Define Alerts to process.

26. What? (cont.)
Select to modify operations
for all processes
Select a process to modify the
operations for that process only
This process has different
settings than the default

27. To Trace Or Not To Trace?
Full Trace
Operation
Called?
No
Yes
Remove From
Recording Profile
No
Information
Useful?
Yes
Yes
Repetitive?
Include in Recording
Profile
No
Yes
Can I get the
Information in a
different way?
No

28. What? : Creating Alerts
Right Click on the operation
 Add Alert
Select the operation
 Add Alert

29. What? : Creating Alerts (cont.)
Operation includes/
excludes substring
Operation result
•Record Alert
•Stack Dump
•Add Comment
•Send Mail
•Net Send
•Run Application
•Create New Session
•Set Recording Profile
•Call Function

30. What? : Creating Alerts (cont.)
•
Record Alert
–
•
Stack Dump
–
•
Archive/manage your sessions with meaningful definitions
Set Recording Profile
–
•
Rerun application if crashes
Trigger your custom application on event
Create New Session
–
•
Send a network message to another computer
Run Application
–
–
•
Send e-mail with alert information
Net Send
–
•
Add your comments into the execution log
Send Mail
–
•
Escalation to code level
Add Comment
–
•
Useful for sending traced information to the AppSight Server
Change recording profile automatically on any event
Call Function
–
Execute a function in the address space of your application

31. What? : User & Resources

32. What? : File Attachments

33. How? : General Recording Settings

34. How? : Process Attachment Settings

35. I
D
E
N
T
I
F
Y
S
O
F
T
W
A
R
E
Troubleshooting Applications

36. AppSight Architecture
What is the most important component in the
AppSight Solution? (and why?)
AppSight
Console
AppSight
Black Box
AppSight
Server

37. AppSight Architecture
1. The Black Box does not have any artificial
intelligence.
2. The Black Box will not fix your problem.

38. The Optimistic vs. The Pessimistic
Optimistic
Pessimistic
What is right?
What is wrong?
Methodology
Experience
Slower resolution
Faster resolution

39. Troubleshooting Process
•
•
Analyze the different Application Layers.
– Always from the top one down.
Divide and conquer
– Use the synchronization between the different
layers.
– Use the filters to divide and trim down the execution
activity of the application.

40. Typical Troubleshooting Scenario
Defect
Tracking
System
User
Check
Compatibility
Visual Log
Analysis
View /
Compare
Configuration
Advanced
System
Troubleshooting
Code
Get
AppSight
Log
System
User
Advanced Code
Level
Troubleshooting
Escalation to
Code Level
Level 1
Level 2
Level 3

41. The Three Troubleshooting Qs
•
90% of the
effort
Questions that need to be answered to identify the root
cause of a problem:
– What?
Understand what is the problem that you need to
troubleshoot.
– Where?
Narrow down to the tier/module where the
problem occurs (or does not).
– Why?
Understand why the problem occurs in order to
fix it.

42. What?
•
•
•
Watch Visual Playback
Look for Performance problems
– Use Performance Counters
– Use the Application Performance
– Use the Performance Timeline
– Use the start time of each operation
Look for failures
– Use the Summary tab
– Use the IIS Sessions view

43. Where?
•
Filter the system log using the synchronization of the:
– Visual playback
– Performance graph
– IIS sessions view
– Summary tab
– Advanced filters

44. Why?
• Exception/Crash in your application/module?
– Escalate to code level
• DB problem?
– Wrong connection string?
– Database is down?
– Malformed SP?
• Network problem?
– Network “busy”?
• Etc.

45. I
D
E
N
T
I
F
Y
S
O
F
T
W
A
R
E
Analyzing AppSight Log Files

46. Visual Playback Analysis
Jump to next GUI theJump to nextRewind visual
Play
visual
Zoom in/out
Jump to previous Operation playback
frame
playback playback
visual
GUI Operation
Stop the visual
playback Jump to
previous frame

47. System Tab

48. Summary Tab Analysis

49. Summary Definitions

50. Modules Tab Analysis
Select process
instance
Statically loaded module
Dynamically loaded module

51. Connections Tab Analysis
Process name
PID
IP +
Port +
Socket

52. XML Viewer

53. Filtering the Log File

54. Canceling the Filters
Cancel advanced
filters
Filter in processes / threads
Filter in operations