TxExpo help - Transaction Detection

 


Transaction Detection Gate

This page displays two lists:
Running Processes: lists the detection processes that are currently running. For each running process the start time and progress status are displayed, and it is possible to stop the process or delete it.
Completed Processes: lists the detection processes that have been completed. For each completed process the start and end times are displayed, and it is possible to view the detection results or delete the process.

In order to start a new transaction detection process, click the 'New Process' link in the top-right of the page.

New Transaction Detection Process

Before starting the transaction detection process, you should specify the following details:
Process Name: the name of the process.
Time Frame: you can specify the time frame from which events should be processed. Only events that match the time frame will be included in the processing.
Search Terms: you can specify a list of terms that are contained in the events that should be processed. Only events that match one of the search terms will be included in the processing.
Transaction Logs: you should specify the logs that are candidates to participate in the transaction(s). The logs tree is arranged by hosts -> applications -> folders -> logs.

Click the 'Start Detection Process' link to start the processing. A page displaying the progress of the processing will be displayed. You can stop the processing at any time by clicking the 'stop' link in the processing page.
Once the processing is over you will be redirected to the results page.

Transaction Detection Results

The transaction detection results page lists the transactions that were detected by TransactionExpo.
You can view the details of the process that lead to the current results by clicking the 'show process details' link. From this section it is possible to edit the name of the process and save it by a different name.

For each result, the following details are listed:
Transactions: the number of transactions that were detected and the percentage out of the total number of transactions that were detected.
Events: the number of events that participate in the transactions that were detected and the percentage out of the total number of events that participate in all the transactions that were detected.
Average Duration: the average time of all the transactions.
Permutations: the number of sub transactions that were detected. During the transaction detection process, transactions that have similar structure are merged into the same result.
Hosts: the number of hosts that participate in the transactions that were detected. You can toggle between logs view and hosts view by clicking the relevant tab in the right side of each result.
Logs: the number of logs that participate in the transactions that were detected. You can toggle between logs view and hosts view by clicking the relevant tab in the right side of each result.
Above Average: the number, percentage and time range displayed are controlled by the Time Distance control of the results page, as explained below.
Below Average: the number, percentage and time range displayed are controlled by the Time Distance control of the results page, as explained below.
Average Edge Time: the time displayed on each edge in the graph is the average time of an edge, in all the transactions that were detected.

For each result, it is possible to drill down to its permutations by clicking the 'Permutations' link.
For each permutation, it is possible to drill down to its instances by clicking the 'Instances' link.

When the results page is viewed, a control panel is opened in the left-hand side of the screen:

The available controls are:
ID: this control can be used to filter the results by the given ID, for example an IP address or a session id.
Min-Max Time: this control can be used to filter the results by time range.
Tx Percentage: this control can be used to filter the results by the percentage of the transaction's result.
Time Distance: this control can be used to update the 'Above Avg.' and 'Below Avg.' fields of the results. The time distance percentage range is the percentage of the time between the average transaction duration and the longest/shortest transaction duration. For example, in the first result shown above the average duration is 21.71 minutes, the minimal duration is 10.42 minutes and the maximal duration is 29.95 minutes. If we change the time distance value to be 10% - 100%, the 'Above Avg.' field will show 6 transactions in range 22.53 min - 29.95 min (the minimal time is now 22.53 minutes which are equal to 21.71 minutes, the previous minimal value, to which we add 10% of the difference between 29.95 minutes, the maximal duration, and 21.71 minutes, the average duration, which are 0.82 seconds). In the same way, the 'Below Avg.' field will show 4 transactions in range 10.42 min - 20.58 min (the maximal time is now 20.58 minutes which are equal to 21.71 minutes, the previous maximal value, from which we subtract 10% of the difference between 21.71 minutes, the average duration, and 10.42 minutes, the minimal duration, which are 1.13 seconds).

In order to activate the controls you should set the desired values of the controls and press the 'Go' button.

If you wish to save one of the results as a transaction definition in TransactionExpo, click the 'Save as transaction' link (you will be prompted to specify the name of the transaction definition).
If you wish to save one of the results as a transaction definition in TransactionExpo and immediately create a result set, click the 'Save as transaction and execute' link (you will be prompted to attach the new transaction definition to an existing/new workspace and project, and specify the name of the transaction definition).

 

 

Additional links
     Transactions
     Projects