PingDirectory server gauges

The PingDirectory server provides a number of built-in gauges to monitor server performance. These gauges are listed in the following table:

Gauge Name Enabled by default? Description

Gauge Name	Enabled by default?	Description
Authentication Failure Rate	false	Rate of LDAP bind failures per second. A high rate of failures may indicate a misconfigured client application or a malicious attack.
Available File Descriptors	true	Monitors the number of file descriptors available to the server process. The server allows for an unlimited number of connections by default, but is restricted by the file descriptor limit on the operating system. The number of file descriptors that the server will use can be configured by either using a `NUM_FILE_DESCRIPTORS` environment variable, or by creating a `config/num-file-descriptors` file with a single line such as `NUM_FILE_DESCRIPTORS=12345`. If these are not set, the default of 65535 is used. Running out of available file descriptors can lead to unpredictable behavior and severe system instability.
Certificate Expiration (Days)	true	Monitors the expiration dates of key server certificates. A server certificate expiring may cause server unavailability, degradation, or loss of key server functionality. Certificates nearing the end of their validity should be replaced as soon as possible. See the status tool, or Status in the Administrative Console, for more information about server certificates and how they are managed.
CPU Usage (Percent)	true	Monitors server CPU use and provides an averaged percentage for the interval defined. The monitored resource is the host system’s CPU, which does not include a resource identifier. If CPU use is high, check the server’s current workload and other processes on this system and make any needed adjustments. Reducing the load on the system will lead to better response times.
Data Set Availability	true	For each data set, indicates whether there is at least one backend server available to fulfill requests. The resource identifier for this gauge is the name of the load-balancing algorithm used to define the set of backend servers fulfilling requests for the data set. Use the `dsconfig list-load-balancing-algorithms` command to see a list of load balancing algorithms. A data set may be included or excluded from monitoring by specifying its load-balancing algorithm name in the include resource and exclude resource properties respectively. A data set’s availability depends upon the availability of the backend servers available to fulfill the PingDirectory server requests. The set of backend servers is defined by the set of servers configured in a data set’s load-balancing algorithm. Make sure that backend servers are available to fulfill proxy requests.
Data Set Local Availability	true	For each data set, indicates whether there is at least one local backend server available to fulfill requests. The resource identifier for this gauge is the name of the load-balancing algorithm used to define the set of backend servers fulfilling requests for the data set. Use the `dsconfig list-load-balancing-algorithms` command to see a list of load balancing algorithms. A data set may be included or excluded from monitoring by specifying its load-balancing algorithm name in the `include resource` and `exclude resource` properties respectively. A data set’s availability depends upon the availability of the backend servers available to fulfill the PingDirectory server requests. The set of backend servers is defined by the set of servers configured in a data set’s load-balancing algorithm. Locations are used to indicate the set of preferred backend servers that should be used to fulfill requests. You can denote that a backend server is local by setting its external server configuration object’s location attribute to be the same as this Directory Proxy Server instance’s location set in its global configuration. Make sure that backend servers are available to fulfill proxy requests.
Disk Busy (Percent)	true	Monitors the percentage of disk use time averaged over the specified update interval. This gauge requires that the Host System Monitor Provider be enabled and that any monitored disks be registered using the disk-devices property of that configuration object. The resource identifier for this gauge is the disk device name. Use the iostat command or a similar system utility to see a list of disk device names. A separate gauge monitor entry will be created for each monitored disk.
HTTP Processing (Percent)	true	Monitors the percentage of time that request handler threads spend processing HTTP requests. This percentage represents the inverse of the server’s ability to handle new requests without queuing.
JVM Memory Usage (Percent)	true	Monitors the percentage of Java Virtual Machine memory that is in use. This value naturally fluctuates due to garbage collection, so the minimum value within an interval is reported since it is a better indication of overall memory growth. When the memory usage exceeds 90%, this should be reported to customer support since the server is either misconfigured or has a memory leak. As memory usage approaches 100%, the server is more and more likely to experience garbage collection pauses, which leave the server unresponsive for a long time. Restarting the server is likely the only remedy for this situation. Prior to restarting the server, please run `collect-support-data` and capture the output of 'jmap -histo ' to provide to customer support. The pid of the server can be found from `/logs/server.pid`.
LDAP Operation Average Response Time (Milliseconds)	false	Monitors the average response time across all LDAP operations processed by this server since it was started. There is no resource identifier associated with this gauge. The monitored resource is overall response time of all LDAP operations processed by this server since it was started. High response times may be indicative of a number of factors including a disk-bound server, network latency, or misconfiguration. Enabling the Stats Logger plugin may help isolate problems. See the administration guide for more information on common problems and solutions.
LDAP Operations Failed (Percent)	false	Monitors the percentage of all LDAP operations processed by this server that have failed since it was started. There is no resource identifier associated with this gauge. The monitored resource is the overall number of failed LDAP operations processed by this server since it was started. A high percentage of failed operations may indicate misconfiguration of a client or server in a topology.
License Expiration (Days)	true	Monitors the expiration date of the product license. An expired license will cause warnings to appear in the server’s logs and in the status tool output. Request a license key through the Ping Identity licensing website https://www.pingidentity.com/en/account/request-license-key.html or contact sales@pingidentity.com. Use the `dsconfig` tool to update the License configuration’s license key property.
Memory Usage (Percent)	false	Monitors the percentage of memory use averaged over the update interval defined. The monitored resource is the host system’s memory use, which does not have a resource identifier. Some operating systems, including Linux, use the majority of memory for file system cache, which is freed as applications need it. If memory use is high, check the applications that are running on the server.
Strong Encryption Not Available	true	The JVM does not appear to support strong encryption algorithms, like 256-bit AES. The server will fall back to using weaker algorithms, like 128-bit AES. To enable support for strong encryption, update your JVM to a newer version that supports it by default, or install or enable the unlimited encryption strength jurisdiction policy files in your Java installation.
Work Queue Size (Number Of Requests)	true	Number of requests in the server’s work queue waiting to be processed, averaged over the update interval. There is no resource identifier associated with this gauge. The monitored resource is the server’s work queue. If all worker threads are busy processing other client requests, then new requests that arrive will be forced to wait in the work queue until a worker thread becomes available.

Authentication Failure Rate

false

Rate of LDAP bind failures per second. A high rate of failures may indicate a misconfigured client application or a malicious attack.

Available File Descriptors

true

Monitors the number of file descriptors available to the server process. The server allows for an unlimited number of connections by default, but is restricted by the file descriptor limit on the operating system. The number of file descriptors that the server will use can be configured by either using a NUM_FILE_DESCRIPTORS environment variable, or by creating a config/num-file-descriptors file with a single line such as NUM_FILE_DESCRIPTORS=12345. If these are not set, the default of 65535 is used. Running out of available file descriptors can lead to unpredictable behavior and severe system instability.

Certificate Expiration (Days)

true

Monitors the expiration dates of key server certificates. A server certificate expiring may cause server unavailability, degradation, or loss of key server functionality. Certificates nearing the end of their validity should be replaced as soon as possible. See the status tool, or Status in the Administrative Console, for more information about server certificates and how they are managed.

CPU Usage (Percent)

true

Monitors server CPU use and provides an averaged percentage for the interval defined. The monitored resource is the host system’s CPU, which does not include a resource identifier. If CPU use is high, check the server’s current workload and other processes on this system and make any needed adjustments. Reducing the load on the system will lead to better response times.

Data Set Availability

true

For each data set, indicates whether there is at least one backend server available to fulfill requests. The resource identifier for this gauge is the name of the load-balancing algorithm used to define the set of backend servers fulfilling requests for the data set. Use the dsconfig list-load-balancing-algorithms command to see a list of load balancing algorithms. A data set may be included or excluded from monitoring by specifying its load-balancing algorithm name in the include resource and exclude resource properties respectively. A data set’s availability depends upon the availability of the backend servers available to fulfill the PingDirectory server requests. The set of backend servers is defined by the set of servers configured in a data set’s load-balancing algorithm. Make sure that backend servers are available to fulfill proxy requests.

Data Set Local Availability

true

For each data set, indicates whether there is at least one local backend server available to fulfill requests. The resource identifier for this gauge is the name of the load-balancing algorithm used to define the set of backend servers fulfilling requests for the data set. Use the dsconfig list-load-balancing-algorithms command to see a list of load balancing algorithms. A data set may be included or excluded from monitoring by specifying its load-balancing algorithm name in the include resource and exclude resource properties respectively. A data set’s availability depends upon the availability of the backend servers available to fulfill the PingDirectory server requests. The set of backend servers is defined by the set of servers configured in a data set’s load-balancing algorithm. Locations are used to indicate the set of preferred backend servers that should be used to fulfill requests. You can denote that a backend server is local by setting its external server configuration object’s location attribute to be the same as this Directory Proxy Server instance’s location set in its global configuration. Make sure that backend servers are available to fulfill proxy requests.

Disk Busy (Percent)

true

Monitors the percentage of disk use time averaged over the specified update interval. This gauge requires that the Host System Monitor Provider be enabled and that any monitored disks be registered using the disk-devices property of that configuration object. The resource identifier for this gauge is the disk device name. Use the iostat command or a similar system utility to see a list of disk device names. A separate gauge monitor entry will be created for each monitored disk.

HTTP Processing (Percent)

true

Monitors the percentage of time that request handler threads spend processing HTTP requests. This percentage represents the inverse of the server’s ability to handle new requests without queuing.

JVM Memory Usage (Percent)

true

Monitors the percentage of Java Virtual Machine memory that is in use. This value naturally fluctuates due to garbage collection, so the minimum value within an interval is reported since it is a better indication of overall memory growth. When the memory usage exceeds 90%, this should be reported to customer support since the server is either misconfigured or has a memory leak. As memory usage approaches 100%, the server is more and more likely to experience garbage collection pauses, which leave the server unresponsive for a long time. Restarting the server is likely the only remedy for this situation. Prior to restarting the server, please run collect-support-data and capture the output of 'jmap -histo ' to provide to customer support. The pid of the server can be found from /logs/server.pid.

LDAP Operation Average Response Time (Milliseconds)

false

Monitors the average response time across all LDAP operations processed by this server since it was started. There is no resource identifier associated with this gauge. The monitored resource is overall response time of all LDAP operations processed by this server since it was started. High response times may be indicative of a number of factors including a disk-bound server, network latency, or misconfiguration. Enabling the Stats Logger plugin may help isolate problems. See the administration guide for more information on common problems and solutions.

LDAP Operations Failed (Percent)

false

Monitors the percentage of all LDAP operations processed by this server that have failed since it was started. There is no resource identifier associated with this gauge. The monitored resource is the overall number of failed LDAP operations processed by this server since it was started. A high percentage of failed operations may indicate misconfiguration of a client or server in a topology.

License Expiration (Days)

true

Monitors the expiration date of the product license. An expired license will cause warnings to appear in the server’s logs and in the status tool output. Request a license key through the Ping Identity licensing website https://www.pingidentity.com/en/account/request-license-key.html or contact sales@pingidentity.com. Use the dsconfig tool to update the License configuration’s license key property.

Memory Usage (Percent)

false

Monitors the percentage of memory use averaged over the update interval defined. The monitored resource is the host system’s memory use, which does not have a resource identifier. Some operating systems, including Linux, use the majority of memory for file system cache, which is freed as applications need it. If memory use is high, check the applications that are running on the server.

Strong Encryption Not Available

true

The JVM does not appear to support strong encryption algorithms, like 256-bit AES. The server will fall back to using weaker algorithms, like 128-bit AES. To enable support for strong encryption, update your JVM to a newer version that supports it by default, or install or enable the unlimited encryption strength jurisdiction policy files in your Java installation.

Work Queue Size (Number Of Requests)

true

Number of requests in the server’s work queue waiting to be processed, averaged over the update interval. There is no resource identifier associated with this gauge. The monitored resource is the server’s work queue. If all worker threads are busy processing other client requests, then new requests that arrive will be forced to wait in the work queue until a worker thread becomes available.