---
title: "Application Performance Monitoring"
canonical: "https://thoughtdata.refined.site/space/TUD/57672764/Application%20Performance%20Monitoring"
format: markdown
---
**Enterprise360 Application Monitoring Technologies: An Overview**

In today's complex IT landscape, ensuring the health and performance of applications is paramount for business continuity, customer satisfaction, and operational efficiency. Application monitoring plays a crucial role in achieving this, allowing organizations to gain visibility into their systems and quickly identify and resolve issues. While various approaches exist, three prominent technologies stand out: Deep Packet Inspection (DPI)-Based Monitoring, APM (Application Performance Monitoring) using Agents, and Synthetic Testing. Enterprise360 supports all these 3 forms of Application Performance Monitoring.

**Deep Packet Inspection (DPI)-Based Monitoring** This approach focuses on analyzing network traffic at a granular level. It involves tapping network traffic on critical network aggregated links within the customer's IT environment. DPI Technology can be instrumented in both on-premises and cloud-based networks. For on-premises networks, it typically requires hardware-based taps or network packet brokers. In private or public cloud environments, it utilizes virtual machines for monitoring along with packet mirroring functions, which may incur additional costs as cloud providers often charge for network packet mirroring from compute instances or load balancers. By inspecting the actual data packets flowing across the network, DPI provides visibility into application traffic for all applications and servers traversing through that network link. It offers network layer-based application monitoring at Layer 7, providing crucial information about application transactions, including failures and latency. The latency information provided by the DPI method offers a distribution of end-to-end latency, broken down into application, client/user, network, and server-side latencies, which helps pinpoint bottlenecks in slowness. DPI also provides the capability to capture network traffic or packets and intelligently package them into network session based trace files. These files offer information about the flow of exchange of information between the user and the application, helping to understand the point of failures in network communications between the application, server and the end-user. DPI is particularly well-suited for commercial applications, as a single point of instrumentation can provide application monitoring for all applications and deliver critical information related to application transactions, such as failures and latency for each end-user transaction. DPI provides insights into application behavior without requiring any agents or modifications to the application code itself. It's particularly powerful for monitoring third-party, legacy, or "black-box" applications where direct access for instrumentation is not feasible.

**APM (Application Performance Monitoring) using Agents** APM tools with agents involve deploying small software components directly within the application's environment or code. This method is more intrusive in nature, as it requires changes to application startup configurations and often application restarts. APM technology is particularly well-suited for homegrown applications where customers have full knowledge of the application, access to its code, and an understanding of its internal workings and startup processes. This is because APM agents need to be instrumented directly into application startup files, and configuration changes are necessary to run the application with these agents. Furthermore, deploying and configuring APM agents typically requires application services to be restarted and hence requires planned downtime. APM agents need to be deployed on each and every application server where application services need to be monitored, including frontend and middleware layers if they are not running on the same server. However, this intrusiveness is necessary to gain in-depth information about application performance across multiple layers, including the frontend, middleware, backend, databases, and external API integrations. APM technology is highly useful for tracing application latency in depth within these layers to pinpoint bottlenecks. It also provides comprehensive investigation into application exceptions and errors, all the way up to the line of code and mapping transaction failures to specific functional modules that might be causing problems for the applications. This method offers deep, code-level visibility, making it ideal for custom-built or internally developed applications where developers have full control over the codebase.

**Synthetic Testing** Synthetic testing involves setting up synthetic tests on InfraSense sensors either internal to your IT network or external to the IT network. Enterprie360s InfraSense sensors perform simulated transactions (HTTP or HTTPS) for any URL and measure connectivity, DNS resolution, and application availability. Synthetic testing can also provide a breakup of the application latency into user latency, network and DNS latency, as well as server and application transaction latency. These latencies are derived from simulated transactions and do not necessarily reflect the real user experience. Synthetic test agents can also perform network tests to understand the path between the InrfaSense sensor and the application services. This is useful for understanding average latencies experienced by customers across multiple geographical locations, especially in the absence of real end-users in those locations. This technology is well-suited for commercial applications where detailed application transaction level visibility is not required, but overall application availability and high-level performance monitoring is needed, particularly for applications hosted outside the IT environment where customers lack other means to monitor their availability. Unlike real-user monitoring, which observes actual user traffic, synthetic testing proactively checks application availability, performance, and functionality by running predefined tests. This allows organizations to identify issues before they impact real users and establish performance baselines.

**Detailed comparison table between the technologies**

|  |  |  |  |
| --- | --- | --- | --- |
| **Feature / Technology** | **DPI-Based Application Monitoring** | **APM-Based Application Monitoring** | **Synthetic Testing** |
| **How to Instrument** | - Deploy Enterprise360 NetSense DPI sensors in your IT network and feed the critical traffic to NetSense DPI sensors via Network taps/Network packet brokers or SPAN ports configured on core switches in on-premises networks. In cloud deploy NetSense DPI sensors as virtual machines for monitoring in private or public cloud environments, This requires network packet mirroring to be setup in private or public cloud and traffic feeds to be sent to NetSense virtual DPI sensors. | - Install Enterprise360 APM agents directly on each application server where services need monitoring (e.g., frontend, middleware layers). - Requires modifying application startup configurations to include agents, making it more intrusive. - APM agents need to be instrumented in application startup files, and configuration changes are necessary. - Application services need to be restarted post-deployment and configurations. - Typically deployed first on UAT servers and tested before deploying on production systems. | - Set up InfraSense sensors internal to your IT network or external to the IT network. Configure InfraSense sensors to simulate user transactions from various geographic locations. - Define specific URLs, API endpoints, or user journeys to be tested. - Schedule tests to run at regular intervals. You may also combine this with ping and traceroute tests to same application destination targets. |
| **Advantages** | - **Agentless:** Zero overhead on application servers.
- **Non-intrusive:** No access required to source code or host system.
- **Passive Monitoring:** Only observes network traffic without actively interfering with applications.
- **Broad Visibility:** Covers all applications monitoring running on the link being tapped for monitoring in the IT network.
- **Suitable for Third-Party/Legacy/Commercial /SaaS Apps:** Ideal for vendor-locked systems (e.g., CBS, SWIFT, payment gateways) , SaaS Apps (0365, MS Teams, Salesforce etc) where applications are hosted externally or code access is limited or not available. A single point of instrumentation can provide monitoring for all applications and deliver critical information related to application transaction failures and latency at each end-user transaction.
- **Encrypted Traffic Metadata:** Can monitor metadata (SNI, TLS negotiation time, server info) from encrypted sessions without needing TLS keys.
- **Real-time:** Near real-time incident troubleshooting from network packet analytics.
- **Security Context:** Provides security insights (malware C2, policy violations).
- **Network Session Wire Traces:** Provides capability to capture network traffic into wire trace files for detailed analysis of information flow and pinpointing network communication failures.
- **Flexible Deployment:** Can be instrumented in both on-premises and cloud-based networks. | - **Code-Level Visibility:** Provides deep insights into internal function calls, database queries, and exception traces.
- **Detailed Transaction Tracing:** Offers full-stack visibility for custom-built applications.
- **Root Cause Analysis:** Excellent for debugging and identifying issues within application code.
- **Comprehensive Error Investigation:** Provides in-depth investigation into application exceptions and errors, including line of code and mapping failures to functional modules.
- **Suitable for Homegrown Apps:** Ideal for microservices and custom-built applications where developers have full control and knowledge of the application. | - **Proactive Monitoring:** Identifies issues before real users are affected.
- **Baseline Performance:** Establishes a baseline for application performance from an end-user perspective.
- **Geographic Performance:** Measures performance from different locations, identifying regional issues.
- **Availability Monitoring:** Verifies application uptime and accessibility.
- **SLA Validation:** Helps ensure external APIs and services meet defined SLAs.
- **Connectivity and DNS Resolution:** Measures connectivity and DNS resolution for URLs.
- **Network Path Testing:** Can perform network tests to understand the path between agents and application services.
- **Geographical Latency Insights:** Useful for understanding average latencies across multiple geographical locations in the absence of real users.
- **Suitable for External Commercial Apps:** Well-suited for monitoring overall application availability for external applications where detailed transaction visibility is not required and other access is limited. |
| **Disadvantages** | - **No Code-Level Tracing:** Cannot provide stack traces or internal function call details.
- **Limited to Network Traffic:** Relies solely on network packets, may miss internal application logic issues not reflected on the wire.
- **Limited Internal Transaction Depth:** Cannot provide comprehensive in-depth information about content transactions, middleware transactions, dependent application transactions, or database transactions related to applications, as monitoring is done at a network traffic level and not intrusively within the application layers. Only best-effort application traffic can be monitored at a URL level. -
- **Encrypted Traffic Limitations:** For encrypted web-based application traffic, DPI Technology cannot decrypt the traffic unless additional tools like SSL orchestrators or decryption appliances are put in place. Without decryption, it cannot gain URL-level visibility to understand in-depth application transactions.
- **Complex Protocol Decoding:** Requires expertise to decode complex banking or proprietary protocols. -
- **Cloud Cost Implications:** Additional costs may be incurred for cloud-based applications where cloud providers charge for network packet mirroring from compute instances or load balancers. | - **Resource Consumption:** Agents consume CPU and memory as a part of the application services,
- **Intrusive Nature:** Requires changes to application code/configuration and restarts, which can be disruptive. -
- **Extensive Deployment:** Requires deployment on each application server across all relevant layers, increasing deployment complexity and management overhead.
- **Limited to Instrumented Apps:** Only monitors applications where agents are installed, creating blind spots for un-instrumented systems.
- **Not Suitable for Third-Party Vendors:** Difficult to deploy on commercial applications without vendor support.
- **Application Framework and Version Specificity:** APM agents are application framework-specific, and there are no unified agents that cater to all frameworks. This leads to changes in deployment for each framework and application type due to different startup methods and framework structures.
- **Compatibility Requirements:** APM technology is also version-specific for various application frameworks and interdependent application layers (like database connections, messaging queue layers and other application services), requiring specific compatibility to function properly.
- **Lengthy Setup Time:** Requires significant implementation time due to the need to understand application workings, startup methods, and planning for application service downtime.
- **No Network or User side latency visibility for application transactions** | - **Simulated Traffic:** Does not reflect actual user behavior or traffic patterns.
- **Limited Granularity:** May not detect subtle performance degradations or intermittent issues that only occur under real user load.
- **Latency Representation:** Synthetic test latencies do not provide real user latency experiences but are derived from simulated transactions.
- **No Real User Transaction Latencies:** Does not provide real user transaction level latencies.
- **No Deep Application Layer Visibility:** Does not provide application layer-by-layer failures or latencies within the application to understand or debug deep problems.
- **False Positives/Negatives:** Can sometimes generate alerts for non-issues or miss real problems if tests are not comprehensive. |
| **Complexities** | - **Network Tapping:** Requires proper configuration of SPAN ports or network taps for on-premises.
- **Cloud Packet Mirroring Setup:** Configuration of packet mirroring in cloud environments.
- **Data Volume:** Handling and processing large volumes of network packet data.
- **Protocol Parsing:** Developing or configuring parsers for various application protocols. | - **Agent Compatibility:** Ensuring agents are compatible with specific application frameworks and versions.
- **Deployment Management:** Managing agent deployments across numerous servers and environments, including different application layers.
- **Resource Management:** Monitoring and managing the overhead introduced by agents.
- **Code Integration:** Requires developers to integrate SDKs or configure agents within the application environment.
- **Framework and Version Management:** Managing compatibility requirements for various frameworks and versions across application layers (databases, messaging queues, etc.) to ensure agents work properly.
- **Implementation Planning:** Requires detailed planning, understanding of application internals and startup methods, and coordination for application service downtime. | - **Test Script Creation:** Developing robust and realistic URLs that accurately mimic user behavior. -
- **Maintenance:** Regularly updating URLs as application features or UI change.
- **Alert Thresholds:** Setting appropriate alert thresholds to avoid alert fatigue. |
| **Pre-requisites** | - Network visibility (SPAN ports, TAPs) at critical aggregation points for on-premises.
- NetSene DPI sensors/appliances deployment(hardware or virtual).
- Knowledge of network topology and cloud networking configurations. | - Access to application servers and code.
- Application framework compatibility with APM agents/SDKs.
- Application restart capabilities. - Developer involvement for instrumentation.
- Full knowledge of application internals and startup processes. - Planning for application service downtime.
- Deployment Enterprise360 APM agents on each relevant application server. | - External monitoring tool/platform.
- Defined user journeys or critical transactions.
- Stable network connectivity to the application.
- Setting up InfraSense Synthetic test sensors (internal or external). |
| **Costing & Licensing** | - License is based on the number of sensors needed to monitor application traffic tapped on critical links and also traffic volume. | - License is per agent per server, based on where they are deployed. | - License based on the number of synthetic transactions/URLs and #locations |
| **Level of Depth of Monitoring** | - **Network Layer (Layer 7):** Deep visibility into network protocols, traffic flows, transaction response times, and encrypted session metadata.
- **Application Behavior (External):** Monitors application behavior as seen on the wire (e.g., transaction success/failure, latency between components). Provides information about application transactions, failures, and latency for all applications and servers traversing the network link. Latency information includes distribution of end-to-end latency broken down into application, client/user, network, and server-side latencies to pinpoint bottlenecks.
- **Network Communication Analysis:** Provides network session wire trace files for detailed analysis of information exchange flow and identification of network communication failures between user and application.
- **Limited Internal Transaction Detail:** Cannot provide comprehensive in-depth information about content transactions, middleware transactions, dependent application transactions, or database transactions. Best-effort application traffic monitoring is at a URL level. | - **Application Layer (Internal - Multi-layer):** Provides code-level metrics, method execution times, database query performance, and detailed transaction traces within the application.
- **Comprehensive Latency Tracing:** Traces application latency in depth across frontend, middleware, backend, database, and external API integrations to pinpoint bottlenecks.
- **Component-Level:** Visibility into individual services, microservices, and their interactions.
- **Code-Level Error Investigation:** Offers comprehensive investigation into application exceptions and errors, including line of code and mapping failures to functional modules. | - **End-User Experience (Simulated):** Measures availability, response time, and functionality from an external, simulated user perspective.
- **High-Level Transaction Flow:** Verifies the successful completion of predefined user actions.
- **Latency Breakup:** Provides breakup of application latency into user latency, network and DNS latency, and server and application transaction latency.
- **Connectivity & Availability:** Measures connectivity, DNS resolution, and availability of the application.
- **Limited Deep Dive:** Does not provide real user transaction level latencies, nor application layer-by-layer failures or latencies within the application for deep problem understanding. |

**Conclusion**

The selection of an application monitoring technology and its methodology largely depends on a customer's specific requirements for application monitoring. This includes considering whether the applications are homegrown, commercial, or external, and the desired level of visibility within the application.

- **DPI (Deep Packet Inspection) technology** is generally preferred for commercial applications, especially those from third-party vendors or legacy systems where internal access is limited. It offers agentless, non-intrusive monitoring at the network layer, providing critical insights into application transaction failures and end-to-end latency breakdowns. Its ability to capture wire traces and provide broad visibility makes it invaluable for "black-box" scenarios and security context. While it offers flexible deployment in both on-premises and cloud environments, potential cloud costs for packet mirroring and limitations with encrypted traffic (without additional tools) should be considered. Licensing is typically based on the number of sensors and volume of traffic monitored.
- **APM (Application Performance Monitoring) technology with agents** is best suited for homegrown applications where customers have full control over the application's code and internal workings. Its intrusive nature allows for deep, code-level visibility across multiple application layers (frontend, middleware, backend, databases, external APIs), enabling comprehensive latency tracing and detailed error investigation down to the line of code. However, its deployment requires significant implementation time, understanding of application internals, restarts, and is framework/version specific, with licensing typically per agent. It also demands deployment on each relevant application server, adding to management overhead.
- **Synthetic testing**, while offering minimal visibility at a lower cost, is valuable for proactively monitoring the availability and high-level performance of commercial and external applications, particularly those hosted outside the IT environment where other monitoring access is limited. It provides insights into connectivity, DNS resolution, and a breakup of simulated latencies, but it does not reflect real user experience or offer deep application layer-by-layer failure/latency analysis. Licensing is usually based on transactions, locations, or test frequency.

Ultimately, a robust application monitoring strategy often involves a combination of these technologies, leveraging their respective strengths to achieve comprehensive visibility across diverse application portfolios and operational needs. **Entreprise360 offers all these technologies in its portfolio for customers to achieve correlated observability of application performance end to end **. The decision of deploying the right technologies should balance the need for deep internal insights with the ease of deployment, cost implications, and the nature of the applications being monitored.