3 Replies Latest reply on Apr 7, 2010 12:32 PM by cperry@mjh.org

    Adding Application and port Monitor

    cperry@mjh.org

      I am runing NTA version 3.6 and having issues adding applications to be monitored. I am trying to add several host based application monitors to NTA. The applications to be monitored use dynamic ports above 1024 as well several lower server ports. After adding three application monitors using multiport settings I am unable to add any more. I have not disable or deleted any of the default monitors. 

       

      Does anyone know if the destination and source IP fields in application monitor use "OR" statement or do you need to create separate monitors for for traffic to a host (Any to Host) and one from a host (Host to Any).

        • Re: Adding Application and port Monitor
          Andy McBride

          It may be that you are trying to add an app monitor with an overlapping port range frrom an existing app definition. This is not supported.

            • Re: Adding Application and port Monitor
              cperry@mjh.org

              Wouldn't destination or source IP make rule more specific and not overlap. Many applications share overlapping ports ranges.

              I have created several IP address groups to use with application monitors, other than Default Private address group 10.0.0.0 - 10.255.255.255, I have made several more specific groups within this range both single host and small range of like servers to track apps.  I have then created Application monitor and have set port range 1025 -10000, application allocates dynamically.

               

              Is there a limit to the number of application rules?

                • Re: Adding Application and port Monitor
                  cperry@mjh.org

                  OK, this seens to be a timeout issue or number of ports.  Not knowing all the dynamic ports that application would use I allocated first all ports. Plan was to removed all unused ports once I was able to caputer data. After clicking on buttion to create, an exteneded period where it seemed Orion was crunch on information before task was complete and no new application monitor was added.

                   

                  I then began narrow port scope until time to create was short and application was added. I ended up with port 135 and 1025-10000 and ip group, instead of all ports and specific ip group.

                  Is there a built-in timeout for request being made in application monitor creation?