AppD Archive

Why would data collector info not be included in snapshot's user data?

CommunityUser
Splunk Employee
Splunk Employee

I've refactored some Java code to expose data that might otherwise be difficult for AppD to capture and to provide a convenient hook for a data collector. The method looks something like this:

private static long duration(long startNanoTime) {
    return (System.nanoTime() - startNanoTime) / 1000;
}

The data collector is configured to use the method's return value. However, even though I know that the method is being executed, the data collector isn't being displayed in the user data section of the snapshot. Does the method have to appear in the call graph for its return value to also appear in user data? Does a full stack have to be captured? It's obviously possible that this is just a configuration error that I've missed, and I'll keep checking, but I'd appreciate any insight into other possibilities - thanks!

0 Karma

Arun_Dasetty
Super Champion

Hi,

To assist you further, please send the following logs:

- screenshot from data collector config and BTs associated from UI?

- screenshot from snapshot and if possible exported snapshot pdf?

- zipped version of agent logs for the same snapshot BT collected above

To answer your query, method does not need to appear in call graph but the method must be part of execution of BT associated for which data collector is configured, hope that clarifies.

Regards,

Arun

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

It does help clarify, thank you. The method should be executed within an async snapshot of the transaction - is it possible for the data to be "dropped" if AppD doesn't properly identify the start of the async activity?

Kris

0 Karma

Arun_Dasetty
Super Champion

Hi Kris,

Your understanding is right, if the async calls are not part of same BT and the api on which collector is defined is part of async calls then the collector data will not be captured.

But we see in ideal cases we should be able to capture async class if the async calls are part of supported apis listed in <fork-config> under <agent-dir>/conf/app-agent-config.xml , Hope that information helps.

Screenshot and logs requested earlier would provide us more insight and clarity here.

Regards,

Arun

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

Thanks again, Arun. Is there any more detailed documentation available regarding <fork-config> than:

Configure Multi-Threaded Transactions for Java

I'm not quite sure I understand the details of what <exclude>, <include> and <job> are really doing and how they impact async snaps.

Kris

0 Karma

Arun_Dasetty
Super Champion

Hi Kris,

Class/packages mentioned in <exclude > section will not be considered for async instrumentation and class/packages stated in <include> under <fork-config> element are considered for async instrumentation and regarding the job elemenet

Say if your class is implementing Thread class or class listed in <job> element in <fork-config> it means they are shown as async exit calls in BT snapshot call graph but if you see that your class is not fallen under any of the <fork-config> -< <job> section in file <agent_install_dir>/conf/app-agent-config.xml  than you can add one addition <job> element to add support for async for your classes that implement different thread class:

<job>
    <match-class type="inherits-from-class"><name filter-type="EQUALS" filter-value="java.lang.Thread"/></match-class>
    <match-method><name filter-type="EQUALS" filter-value="run"/></match-method>
    <name-config operation="" type="4"/>
</job>

Hope that clarifies. Also we see no other specific regarding the description on above elements. To better assist you we request you to provide agent logs folder archive version and screenshot from call graoh hightlight the api that you are referring to.

Regards,

Arun

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...