Server gauges

Active Cleaner Threads (Percent)

PingDirectory

True

Monitors the percentage of database cleaner threads that are active in a Berkeley DB environment.

The resource identifier for this gauge is a backend ID. Use the list-backends command to see a list of backend IDs. The server creates a separate gauge monitor entry for each monitored backend. You can include or exclude a backend from monitoring by specifying its backend ID in the include-resource or exclude-resource properties.

To keep the database from growing on disk, database cleaner threads copy database information from older, mostly obsolete database files to new database files. At a single point in time, 100% of the cleaner threads might be active, but when averaged over time, the percentage of active cleaner threads should remain relatively low. Even environments that sustain a very high write load don’t typically see an average cleaner percent busy over 50%.

Authentication Failure Rate

PingDirectory, PingDirectoryProxy

False

Rate of Lightweight Directory Access Protocol (LDAP) bind failures per second.

A high rate of failures might indicate a misconfigured client application or a malicious attack.

Available File Descriptors

PingDirectory, PingDirectoryProxy, PingDataSync

True

Monitors the number of file descriptors available to the server process.

By default, the server allows unlimited connections, but the operating system’s file descriptor limit restricts that number. You can configure the number of file descriptors by setting the NUM_FILE_DESCRIPTORS environment variable or creating a config/num-file-descriptors file with a single line value like NUM_FILE_DESCRIPTORS=12345. If these aren’t set, the default of 65535 is used. Running out of available file descriptors can lead to unpredictable behavior and severe system instability.

Certificate Expiration (Days)

PingDirectory, PingDirectoryProxy, PingDataSync

True

Monitors the expiration dates of key server certificates.

A server certificate expiring can cause server unavailability, degradation, or loss of key server functionality. Certificates nearing the end of their validity should be replaced as soon as possible. See the status tool, or Status in the admin console, for more information about server certificates and how they’re managed.

Changelog Database Target Size (Percent)

PingDirectory

True

Monitors the size of a changelog database on disk relative to the configured target-database-size value for the replication server changelog and the LDAP Changelog backend (cn=changelog).

The resource identifier indicates the changelog environment that’s being monitored. The server aims to keep the disk usage of the changelog between 95% and 100% of the target-database-size value. The most common reason that the server exceeds this limit is that there are no more changes that are old enough to purge. This is controlled with the replication-purge-delay setting on the Replication Server configuration object and the changelog-maximum-age setting on the changelog property of the Backend configuration object. If this is the case, the effective-purge-delay monitor attribute matches the configured purge delay. To clear this alarm, reduce the purge delay or increase the target-database-size value.

Disk usage could also exceed this limit when an export-ldif or online backup of the corresponding backend is running, because the server can’t delete database files on disk during these operations. In practice, this won’t occur unless either the purge delay and target-database-size settings are set very low or the --maxMegabytesPerSecond option throttles backups enough to make them run for a long time. The final reason that the limit could be exceeded is that the target-database-size setting is unreasonably small, for example, less than one gigabyte.

Cleaner Backlog (Number Of Files)

PingDirectory

True

Monitors the cleaner backlog in a Berkeley DB environment.

The resource identifier for this gauge is a backend ID. Use the list-backends command to see a list of backend IDs. The server creates a separate gauge monitor entry for each monitored backend. A backend can be included or excluded from monitoring by specifying its backend ID in the include resource and exclude resource properties respectively. The backlog is the number of database files that need to be cleaned to reach the target level of utilization. The value over time should stay close to zero. If it remains high or continues to grow, then consider updating the backend configuration to increase the db-num-cleaner-threads setting or reduce the db-cleaner-min-utilization setting. Temporary spikes in cleaner backlog are common during rebuild-index, export-ldif, and backup operations. The backlog should decrease automatically when these commands complete.

CPU Usage (Percent)

PingDirectory, PingDirectoryProxy, PingDataSync

True

Monitors server CPU use and provides an averaged percentage for the defined interval.

The monitored resource is the host system’s CPU, which doesn’t include a resource identifier. If CPU use is high, check the server’s current workload and other processes on this system and make any needed adjustments. Reducing the load on the system leads to better response times.

Database Cache Full (Percent)

PingDirectory

True

Monitors the percentage capacity of the database cache currently populated with entries, per backend.

The resource identifier for this gauge is a backend ID. Use the list-backends command to see a list of backend IDs. The server creates a separate gauge monitor entry for each monitored backend. Backends can be included or excluded from monitoring by specifying its backend ID in the include-resource and exclude-resource properties respectively. Server performance can drop off significantly when the database cache can no longer hold the entire data set. Most deployments are designed to keep the database cache usage well within the configured limits. If this server is intentionally disk-bound, this gauge should be disabled.

DB on Disk to DB Cache Size Ratio

PingDirectory

True

Monitors the ratio between the sizes of the on-disk database and the in-memory cache database. This gauge relies on the db-on-disk-to-db-cache-size-ratio attribute within database environment monitor entries.

The ratio can help when troubleshooting performance issues caused by excessive thrashing between memory and disk. If the ratio grows to a size eight times larger than what can be stored in memory, which is the default threshold, there is an increased risk of degraded performance, and the gauge raises an alert. To resolve this issue, consider increasing the amount of RAM on the system or using entry-balancing with the PingDirectoryProxy server.

Data Set Availability

PingDirectoryProxy

True

For each data set, indicates whether there is at least one backend server available to fulfill requests. The resource identifier for this gauge is the name of the load-balancing algorithm used to define the set of backend servers fulfilling requests for the data set. Use the dsconfig list-load-balancing-algorithms command to see a list of load-balancing algorithms. A data set can be included or excluded from monitoring by specifying its load-balancing algorithm name in the include resource and exclude resource properties, respectively. A data set’s availability depends upon backend servers that are available to fulfill PingDirectory server requests. The set of backend servers is defined by the set of servers configured in a data set’s load-balancing algorithm. Make sure that backend servers are available to fulfill proxy requests.

Data Set Local Availability

PingDirectoryProxy

True

For each data set, indicates whether there is at least one local backend server available to fulfill requests.

The resource identifier for this gauge is the name of the load-balancing algorithm used to define the set of backend servers fulfilling requests for the data set. Use the dsconfig list-load-balancing-algorithms command to see a list of load-balancing algorithms. A data set can be included or excluded from monitoring by specifying its load-balancing algorithm name in the include resource and exclude resource properties, respectively. A data set’s availability depends upon backend servers that are available to fulfill PingDirectory server requests. The set of backend servers is defined by the set of servers configured in a data set’s load-balancing algorithm. Locations are used to indicate the set of preferred backend servers that should be used to fulfill requests. You can denote that a backend server is local by setting its external server configuration object’s location attribute to be the same as this PingDirectoryProxy instance’s location set in its global configuration. Make sure that backend servers are available to fulfill proxy requests.

Destination Unavailable Seconds

PingDataSync

True

Raises an alarm if the sync destination isn’t available after a configurable number of seconds. The default value is 5 seconds.

Disk Busy (Percent)

PingDirectory, PingDirectoryProxy, PingDataSync

True

Monitors disk busy percentage over the update interval.

This gauge requires that the Host System Monitor Provider be enabled and that any monitored disks be registered using the disk-devices property of that Monitor Provider. The resource identifier for this gauge is the disk device name. Use the iostat command or a similar system utility to see a list of disk device names. The server creates a separate gauge monitor entry for each monitored disk. High disk usage might be indicative of a directory server whose database cache and/or JVM heap size aren’t large enough to contain the entire data set.

HTTP Processing (Percent)

PingDirectory, PingDirectoryProxy, PingDataSync

True

Monitors the percentage of time that request handler threads spend processing HTTP requests. This percentage represents the inverse of the server’s ability to handle new requests without queueing.

JVM Memory Usage (Percent)

PingDirectory, PingDirectoryProxy, PingDataSync

True

Monitors the percentage of Java Virtual Machine memory that’s in use.

Garbage collection causes this value to fluctuate, so the gauge reports the minimum value in each interval to indicate overall memory growth. When the memory usage exceeds 90%, this should be reported to customer support since the server is either misconfigured or has a memory leak. As memory usage approaches 100%, the server is increasingly likely to experience garbage collection pauses, which leave the server unresponsive for a long time. Restarting the server is likely the only remedy for this situation. Before restarting the server, run collect-support-data and capture the output of jmap -histo to provide to customer support. The pid of the server can be found from /logs/server.pid.

LDAP Operation Average Response Time (Milliseconds)

PingDirectory, PingDirectoryProxy

False

Monitors the average response time across all LDAP operations processed by this server since it was started.

This gauge has no resource identifier. The monitored resource is the overall response time of all LDAP operations processed since the server started. High response times can be indicative of several factors including a disk-bound server, network latency, or misconfiguration. Enabling the Stats Logger plugin might help isolate problems. See the administration guide for more information on common problems and solutions.

LDAP Operations Failed (Percent)

PingDirectory, PingDirectoryProxy

False

Monitors the percentage of all LDAP operations processed by this server that have failed since it was started.

This gauge has no resource identifier. The monitored resource is the overall number of failed LDAP operations processed by this server since it was started. A high percentage of failed operations might indicate misconfiguration of a client or server in a topology.

License Expiration (Days)

PingDirectory, PingDirectoryProxy, PingDataSync

True

Monitors the expiration date of the product license.

An expired license causes warnings to appear in the server’s logs and in the status tool output. Request a license key through the Ping Identity licensing website or contact sales@pingidentity.com. Use the dsconfig tool to update the License configuration’s directory-platform-license-key property.

Memory Usage (Percent)

PingDirectory, PingDirectoryProxy, PingDataSync

False

Monitors the percentage of memory use averaged over the update interval defined.

The monitored resource is the host system’s memory use, which doesn’t have a resource identifier. Some operating systems, including Linux, use the majority of memory for file system cache, which is freed as applications need it. If memory use is high, check the applications that are running on the server.

Purge Expired Data Backlog (Number of Entries)

PingDirectory

True

Monitors the backlog of entries that need to be purged by a Purge Expired Data Plugin.

The resource identifier for this gauge is the name of the configured plugin. Increasing the max-updates-per-second configuration property on the plugin can increase the rate that the plugin purges expired data. It might also be necessary to refine the search that the plugin performs to be more efficient.

Recent Changes Database-to-JVM Heap Size Ratio (Percent)

PingDirectory

True

The recent changes database keeps several recent changes made by update operations in changelog change entry form.

This database is used by replication and the changelog backends, and unexpected growth affects server start time, memory consumption, and space on disk. The ratio of the recent changes database to the overall heap size is used to track the impact on memory consumption. If you expect large changes and the server isn’t experiencing issues, increase the alarm threshold. After processing large changes the alarm should clear itself, if not, it might be necessary to perform an export and re-import of the data to resolve the issue.

Replication Conflict Growth Rate

PingDirectory

False

Growth rate of the number of unresolved conflicts per second over the update interval.

The resource identifier for this gauge is the base DN of the replica. Use the dsreplication status command to see a list of replicated base DNs. The server creates a separate gauge monitor entry for each monitored replica. Replicas can be included or excluded from monitoring by specifying a replication base DN in the include resource and exclude resource properties respectively. Updates to directory server entries in a replication topology can happen independently, since replication guarantees only eventual consistency, not strong consistency. The eventual consistency model means that conflicting changes can be applied at different directory server instances. In most cases, the directory server is able to resolve these conflicts automatically and in a consistent manner. However, in some scenarios, manual administrative action is required. Attention should be paid to the origin of client write requests to prevent conflicts.

Replication Connection Status

PingDirectory

False

Indicates the connection status of remote replication servers in this server’s replication topology.

The 'cn=schema' backend and the local replication server are excluded using the include-filter property. For all other remote servers in the topology, separate monitor entries get created per server and replication base DN. The resource identifier for this gauge is a concatenated string containing the data set name, the host and port of the replication server, and the replication server ID. A replicated data set depends upon the availability of servers replicating the data. So long as there are other replicas available in a replication topology, a single replica being unavailable shouldn’t affect the overall performance of the replication topology. However, unavailable replicas can increase the likelihood of data loss or performance degradation.

Replication Latency (Milliseconds)

PingDirectory

False

Average amount of time it takes a modification on one replica to propagate and commit on another replica, in milliseconds.

The resource identifier for this gauge is the base DN of the replica. Use the dsreplication status command to see a list of replicated base DNs. A separate gauge monitor entry gets created for each monitored replica. Replicas can be included or excluded from monitoring by specifying its base DN in the include-resource and exclude-resource properties respectively. Replication latency can be reported as high after the server starts, if the global configuration property startup-min-replication-backlog-count isn’t set. That property limits the number of outstanding changes any replica can have before the server completes the startup process and begins accepting connections. This limits how out-of-sync the server is at startup.

Replication Purge Delay (Hours)

PingDirectory

True

For the replication server, indicates the effective purge delay. To protect against missing changes, set the effective purge delay large enough to accommodate servers that have been offline as well as the time needed to restore from backups.

Replication Servers Available

PingDirectory

False

For each replicated data set, indicates the number of available remote replicas for sending replication updates.

The resource identifier for this gauge is the base DN of the data being replicated. Use the dsreplication status command to see a list of replicated base DNs. A separate gauge monitor entry gets created for each monitored base DN. Replicas may be included or excluded from monitoring by specifying its replication base DN in the include resource and exclude resource properties respectively. A replicated data set depends upon the availability of servers replicating the data. To prevent loss of data or performance degradation, make sure there are replicas available, preferably in the same location as this server.

Strong Encryption Available

PingDirectory, PingDirectoryProxy, PingDataSync

True

Monitors whether the JVM supports strong encryption.

If the JVM doesn’t appear to support strong encryption algorithms, like 256-bit AES, the server falls back to using weaker algorithms, like 128-bit AES.

To enable support for strong encryption, do one of the following:

Undeletable Database Files (Percent)

PingDirectory

True

Monitors the percentage of undeletable database files in a Berkeley DB environment.

The resource identifier for this gauge is a backend ID. Use the list-backends command to see a list of backend IDs. The server creates a separate gauge monitor entry for each monitored backend. Backends can be included or excluded from monitoring by specifying its backend ID in the include resource and exclude resource properties respectively. The percentage of undeletable database files tracks the percentage of database files that have been cleaned but can’t be deleted because they’re being used by a database maintenance operation. This could be a separate, offline process such as export-ldif or verify-index, or it could be a task running within the server such as a backup or replication initialization. A small percentage of undeletable files is expected when these commands are running, but a high percentage could indicate that one of these operations is having problems and should be canceled and restarted to avoid the database growing too large on disk.

Work Queue Size (Number Of Requests)

PingDirectory, PingDirectoryProxy

True

Number of requests in the server’s work queue waiting to be processed, averaged over the update interval.

This gauge has no resource identifier. The monitored resource is the server’s work queue. If all worker threads are busy processing other client requests, then new requests that arrive must wait in the work queue until a worker thread becomes available.