Willy Introscope

Here I am giving some input about willy introscope tool
 

SSL Authentication

Its very important to know about the SSL authentication concept in Loadrunner.

What Is SSL?

SSL (Secure Sockets Layer) is a standard security technology for establishing an encrypted link between a server and a client—typically a web server (website) and a browser; or a mail server and a mail client (e.g., Outlook).

SSL allows sensitive information such as credit card numbers, social security numbers, and login credentials to be transmitted securely. Normally, data sent between browsers and web servers is sent in plain text—leaving you vulnerable to eavesdropping. If an attacker is able to intercept all data being sent between a browser and a web server they can see and use that information.

More specifically, SSL is a security protocol. Protocols describe how algorithms should be used; in this case, the SSL protocol determines variables of the encryption for both the link and the data being transmitted.

SSL secures millions of peoples’ data on the Internet every day, especially during online transactions or when transmitting confidential information. Internet users have come to associate their online security with the lock icon that comes with an SSL-secured website or green address bar that comes with an extended validation SSL-secured website. SSL-secured websites also begin with https rather than http.

How Does the SSL Certificate Create a Secure Connection?

When a browser attempts to access a website that is secured by SSL, the browser and the web server establish an SSL connection using a process called an “SSL Handshake” (see diagram below). Note that the SSL Handshake is invisible to the user and happens instantaneously.

Essentially, three keys are used to set up the SSL connection: the public, private, and session keys. Anything encrypted with the public key can only be decrypted with the private key, and vice versa.

Because encrypting and decrypting with private and public key takes a lot of processing power, they are only used during the SSL Handshake to create a symmetric session key. After the secure connection is made, the session key is used to encrypt all transmitted data.

1. Browser connects to a web server (website) secured with SSL (https). Browser requests that the server identify itself.
2. Server sends a copy of its SSL Certificate, including the server’s public key.
3. Browser checks the certificate root against a list of trusted CAs and that the certificate is unexpired, unrevoked, and that its common name is valid for the website that it is connecting to. If the browser trusts the certificate, it creates, encrypts, and sends back a symmetric session key using the server’s public key.
4. Server decrypts the symmetric session key using its private key and sends back an acknowledgement encrypted with the session key to start the encrypted session.
5. Server and Browser now encrypt all transmitted data with the session key.

How do I identify the SSL protocols and certificates used by a website when testing with LoadRunner

Cause -Understanding the SSL Protocols and certificates used by a website.

Solution -To identify the type of SSL and certs used on a web server, type the following commands from a Loadrunner client workstation :

Go to the Loadrunner/bin directory.

Type "openssl", this will then display an >openssl prompt.

Type OpenSSL>s_client - connect test.com:443 where test.com is your web site.

Note: if you are not sure about the port open the developer tool in chrome and hit the URL. It will display IP address, port etc.

This will then return details of the web servers  SSL connections with different ciphers, TLS versions, and SSL server certificate analysis.

Other useful commands to use in LoadRunner Web protocol scripts are as follows:

web_set_sockets_option("SHUTDOWN_MODE", "FAST");Allows the disconnection of the SSL session to be completed quickly.

web_set_sockets_option("SSL_VERSION", "TLS"); 

web_set_sockets_option("SSL_CIPHER_LIST", "RC4-MD5");These options allow the version and cipher for SSL to be specified. Possible versions and ciphers are detailed in the Loadrunner Function Reference.

web_set_sockets_option("TRACE_SSL_IO","1");This option will detail all SSL IO in the normal vuser log.

web_set_sockets_option("PRINT_SSL_INFO","1");This option will detail the version and certificate used in the SSL configuration.

web_set_sockets_option("PROXY_INITIAL_BASIC_AUTH","0");This option disables the initial Basic authentication.

Connections per second:

Number of TCP/IP connections opened

Number of Connections Shutdown. No of connections is fraction of hits/sec

TCP/IP connections are expensive interms of server, router and network resource consumption. So HTTP request should use same connection instead of opening new connection each time of each request.

SSL connections per second:

No of SSL connections opened per second

After TCP/IP connection SSL connection is opened.

SSL connection has heavy resource consumption.

If we select simulate new user at each iteration then there should not be more than one SSL connection per sec

Dynamic Transaction Name in Vugen scripting

Here I am giving code to generate the dynamic transaction name as many time it requires in our scripting.

 For example, if I am searching for a document with a different set of properties every time, like – approved, withdrawn, submitted etc., its better I have a prefix transaction name like “T01_SearchDocWithStatus_” and then append to it the parameterized value chosen.


char transactionName[100];

char* temp[50];

strcpy(temp,” T01_SearchDocWithStatus_”);

strcat(temp,lr_eval_string(“{DocStatus}”));

strcpy(transactionName,temp);

lr_start_transaction(transactionName);

web_url{


This way, when you run the scenario, you can look at the response times of individual status fetches

Note: that you cannot declare the transactionName as a pointer variable.

AWR Report

I think as a performance tester we should know about the basic analysis of AWR report. In this post I am going to explain about basic analysis of AWR report.

AWR: Automatic Workload Repository

Very crucial part of AWR report is SQL Statistics. Which has all sql query details executed during report time interval.  

• We can genaerte AWR report on hourly basis. It will not generate less than an hour.So we can say this is the limitation of Oracle database. Instead of having one report for long time like one report for 4hrs. it's is better to have four reports each for one hour.  Reason is that  if we take long durtion report it will give Average of all counters during that period of time. That would not be much useful.

• It's always good to have two AWR Reports, one for good time (when database was performing well), second when performance is poor. This way we can easily compare good and bad report to find out the culprit.
• After getting an AWR Report This is first and Top part of the report. In this part cross check for database and instance and and database version with the Database having performance issue.This report also show RAC=YES if it's an RAC database.

• "DB CPU(s)" per second:   Before that let's understand how DB CUP's work. Suppose you have 12 cores into the system. So, per wall clock second you have 12 seconds to work on CPU.

       So, if "DB CPU(s)" per second in this report > cores in (Host Configuration ) means env is CPU bound      and either need more CPU's or need to further check is this happening all the time or just for a fraction of time. As per my experience there are very few cases, when system is CPU bound.

Ex: machine has 12 cores and DB CPU(s) per second is 6.8. So, this is not a CPU bound case

•  Parses and Hard parses: If the ratio of hard parse to parse is high, this means Database is performing more hard parse. So, needs to look at parameters like cursor_sharing and application level for bind variables etc.

 

• Instance Efficiency percentage:
  

  In these statistics, you have to look at "% Non-Parse CPU". If this value is near 100% means most of the CPU resources are used into operations other than parsing, which is good for database health.
• Top 5 Timed Foreground Events: First of all check for wait class if wait class is  User I/O , System I/O,  Others etc this could be fine but if wait class has value "Concurrency" then there could be some serious problem. Next to look at is Time (s) which show how many times DB was waiting in this class and then Avg Wait (ms). If Time(s) are high but  Avg Wait (ms) is low then you can ignore this. If both are high or Avg Wait (ms) is high then this has to further investigate.
  
• Sql Ordered by Elapsed Time: Look for query has low executions and high Elapsed time per Exec (s) and this query could be a candidate for troubleshooting or optimizations. Ex: you can have query as maximum Elapsed time but no execution. So you have to investigate this.                                                 In Important point, if executions is 0, it doesn't means query is not executing, this might be the case when query was still executing and you took AWR report. That's why query completion was not covered in Report.
   
• This link is very useful:http://prezi.com/glqm9zemzhup/interpreting-awr-report-straight-to-the-goal/

You can get the AWR report in .txt format from oracle, and input the file in the following link. It will analyse and suggest you the bottlenecks.

http://burleson-dba.com/SP/
http://www.spviewer.com/spanlz.html
 

 

 

 

Random function code

Here I am giving the random function code. This code is very useful in selection of random number out of a pool. Ex selection of 1 value from drop down, click on a link out of 10 link etc..

  web_reg_save_param("soc","LB=option value=\"","RB=\"","ORD=ALL",LAST);

TotalMatchesCount=atoi(lr_eval_string("{soc_count}"));

    if(TotalMatchesCount>0)
    {
        srand(time(NULL));
         random=rand()%TotalMatchesCount+1;
        
         sprintf(sRandomURL,"{soc_%d}",random);
        
         lr_save_string(lr_eval_string(sRandomURL),"soc_value");
         lr_output_message("Parameter value = %s",lr_eval_string(sRandomURL));

           lr_start_transaction("ABC");
           -------------
     Body=searchParamTxt=Search+Pol&gcDirectoryIn=First+name&pt1:r3:0:soc1={soc_value}
           -------------
          lr_end_transaction("ABC",LR_AUTO);
}
else
       
    {
        lr_output_message("%s","Not Found  link");
    }

Note: Suppose TotalMatchesCount is 5. Then random=rand()%TotalMatchesCount generates value between 0 to 4 so we add 1 so that it become 1 to 5. Now we can use soc_1..... soc_5.

 

SiteScope

                                                             SiteScope

Here I am going to post how to monitor using sitescope.

Web and Click Protocol