Parsing and filtering
All data are parsed and filtered using KaProbe® messages specification text file.
Example:
define bertlv BM055_EMVDATA {
bloc bertlv(01) VSDC_Chip_Data
field bertlv(5F2A) TranCurrency display-hex
field bertlv(9F34) CVR display-hex
field bertlv(5A) PAN display-hex show(+6)
}
Sums and Alerts
Alerts are sent through syslog.
Sums and Alerts are defined using KaProbe® sums and alerts specifications text files.
Example:
sum s1 {
field1 == (val1 or val2)
response_time <= 10s
} during last 3600s
alert a1 {
s1 >= 8
s2 % s3 >= 5%
}
Measures
By default KaProbe® provides the following:
• Pairing request and response
• Response time calculation.
Interface
KaProbe® use a web base interface to display acquired data, stats and past alerts.
Architecture
KaProbe® is connected to a network HUB and capture all TCP packets received or sent by the monitored host.
All KaProbe® remote access and especially the web-interface can use a second IP interface not connected to the monitored network.
Database
All messages are parsed into fields using user defined message specification. The message specification file also specifies filters and masks to apply on each field, and which fields are to be stored in the database.
Past alerts and sums are also stored in the database.
Configurations
User can fully configure the messages, sums and alerts specifications text files.
Data filtering is defined in the message specification text file.
Database server and web server can be deported to other systems.
Customization
Although KaProbe® comes with a full set of standard data analysis, web developers can customize the stats web pages using JBOSS application server and Java language.