Preconfigured metrics in IdP 3.3.1

[Etienne Dysli-Metref]

On 05/07/17 16:00, Cantor, Scott wrote:
> Thanks for playing with it, the lack of feedback so far means I don't
> have a strong amount of insight into where to take it.
Yeah, sorry for trying it so long after you released it...

> Certain objects in the system that have natural names to use and a
> natural start/stop concept have the ability to be referenced at
> runtime to trigger counters and timers. Did you read the section in
> the docs on Per-Profile Instrumentation?

I did read the MetricsConfiguration page and, from the examples, I tried
this script to instrument all profiles and time attribute resolution and
filtering:

metricContext =
input.getSubcontext("org.opensaml.profile.context.MetricContext");
profile = new
String(input.getProfileId()).replace("http://shibboleth.net/ns/profiles/",
"").replace(/\//g, ".");
metricContext.addCounter("idp.profile." + profile, "DecodeMessage");
metricContext.addTimer("idp.attribute.resolution", "ResolveAttributes",
"ResolveAttributes");
metricContext.addTimer("idp.attribute.filter", "FilterAttributes",
"FilterAttributes");

I'm not sure timing attribute filtering is that interesting, but this
script works. ;)

> The hooks are built in, the actual metrics aren't. That way it's not
> hardcoded or taking up a lot of time if you don't use them.
Ok I understand that no metrics are instantiated by default. What's the
connection with DEFAULT_METRIC_NAME then? Does a counter or timer
magically appear if I use "net.shibboleth.idp.something" in the script?

> In practice, one of the major needs is something I already patched in
> myself as an audit field, I added a "start time" for each profile
> request now so the basic timings for a whole request can be obtained
> that way without using this feature.

Does it make sense to time whole profile requests? If they contain user
interaction, that kind of thrashes the measure's value, doesn't it?

Some more things I'd like to measure:
- count usage of each profile (script above), as in "Can I turn off
SAML1 already?"
- time LDAP requests (both authn and attributes)
- count requests per SP: "Which SPs are the most active today/this week?"
- HTTP response time: "Is my IdP slow?"
So if I understand the docs correctly, this is only a matter of finding
the right Actions beans to instrument.

  Etienne

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <http://shibboleth.net/pipermail/users/attachments/20170705/263d1644/attachment.sig>