Extend the platform,
empower your team.
Enhance Active Directory services monitoring with advanced metrics
ExtensionThis Dynatrace extension is a companion to the Active Directory services monitoring extension and provides an extended set of AD metrics, obtained through dedicated PowerShell cmdlets. This extension is not intended to work alone - it should be activated as a companion to the Active Directory services monitoring extension.
This is intended for users, who: Want to enhance the Active Directory services monitoring already implemented, with additional metrics that characterize:
Enhance Active Directory services monitoring with advanced metrics.
Start with activating the Active Directory services monitoring extension. Then activate this extension, as it is intended to enhance the the Active Directory services monitoring.
When enabling this extension, you will be prompted for
HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters
Settings > Integrations > Access tokens
) and copy-paste this token into the extension configurationThis extension is intended to work locally on the AD server. It executes:
The extension package contains:
Log ingest configured by this extension By default, this extension sets up log ingestion rules on hosts where it is installed. AD services logs are used to generate events and further alert on service anomalies and malfunctions.
You can disable log ingestion with a settings toggle in the extension configuration screen. Note that this setting does not control any other log ingestion rules that might have been configured on hosts where this extension has been activated.
Following log ingestion rules are being set up by this extension:
And the following events from each event provider.
|Event Provider|Event IDs|
|Microsoft-Windows-ADFS|102, 104, 111, 356, 385, 509, 546, 549, 1034, 1036|
|Microsoft-Windows-Directory-Services-SAM|12299, 16643|
|Microsoft-Windows-Time-Service|21, 34, 36|
|DNSAPI|11150, 11162, 11151, 11155, 11163, 11167, 11154, 11166, 11152, 11153, 11164, 11165|
|Microsoft-Windows-Kerberos-Key-Distribution-Center|6, 15, 17|
|Microsoft-Windows-Security-Auditing|1102, 4616, 4621, 4649, 4660, 4675, 4707, 4710, 4712, 4715, 4716, 4730, 4740, 4743, 4764, 4766, 4771, 4866, 4867, 4935, 5025, 5030, 5034, 5035, 5037, 5139, 5141, 5483, 5484, 6008, 6145|
|Microsoft-Windows-CertificationAuthority|0, 3, 5, 9, 16, 17, 19, 20, 21, 22, 23, 28, 33, 34, 35, 38, 39, 40, 42, 43, 44, 48, 49, 51, 59, 60, 63, 65, 74, 75, 78, 82, 83, 86, 87, 90, 92, 94, 95, 96, 98, 99, 100, 102, 106, 107, 130, 132|
|Microsoft-Windows-OnlineResponder|39, 60, 92|
A: The formula for DDU consumption of the extension is:
( 10
+ (17 * number of Domain Controllers)
+ (11 * number of DHCP servers)
+ ( 2 * number of LDAP instances)
) * 525.6 DDUs/year
Typical consumption for a single-domain AD server, hosting one DHCP server and one LDAP instance, amounts to 21,024 DDUs/year
DDU cost above does not include log lines ingested any possible Log events or Custom events triggered by the extension. For more information on this, please visit the DDU log event cost and DDU custom event cost pages.
A: All in all - equivalents of the DCDIAG KPIs are available in Dynatrace:
A: An account with additional permissions is required to run this extension due to the kind of metrics it collects. The LocalService account has the minimum privileges on the local computer which is why the extension requires an account with enough permissions to read a few registry keys and run cmdlets like repadmin
and dcdiag
.
A: KEY_READ permission to HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters
is required to obtain following metrics:
active-directory.database.diskfree
active-directory.database.disk.total
active-directory.database.diskfree.total
active-directory.replication.consistency.status
A: API token is required to enable integration of the AD-related log ingestion and the OS service monitoring with OOTB host-level reporting. No metrics are ingested using the API token. API token is used to allow the services to be seen on the Dynatrace Host UA screen and the logs on the AD Instance UA screen.
A: The extension utilizes the API token to add entries into the OneAgent's OS Service Monitoring. The OneAgent will ingest availibility metrics and alerts so you know when a critical service is down. In some cases log events can refer to the OS Service which emitted the event.
Below is a complete list of the feature sets provided in this version. To ensure a good fit for your needs, individual feature sets can be activated and deactivated by your administrator during configuration.
Metric name | Metric key | Description | Unit |
---|---|---|---|
Disk Free Space | active-directory.database.diskfree.total | Free disk space of the disk containing the database file. | Byte |
Total Disk Space | active-directory.database.disk.total | Total disk space of the disk containing the AD database file. | Byte |
Disk Free Space Percentage | active-directory.database.diskfree | Percent of free disk space of the disk containing the database file. | Percent |
Metric name | Metric key | Description | Unit |
---|---|---|---|
DHCP Scope Delay v4 | active-directory.dhcp.server.scope.delay | DHCP Scope Delay v4 in milliseconds | MilliSecond |
DHCP Scope Addresses Free v4 | active-directory.dhcp.server.scope.addresses.free | Number of DHCPv4 scope addresses free | Count |
DHCP Scope Addresses Used v4 | active-directory.dhcp.server.scope.addresses.used | Number of DHCPv4 scope addresses used | Count |
DHCP Scope Addresses Reserved v4 | active-directory.dhcp.server.scope.addresses.reserved | Number of DHCPv4 scope addresses reserved | Count |
Percent of DHCP Scope Addresses Used v4 | active-directory.dhcp.server.scope.addresses.used.pct | Percent of DHCPv4 scope addresses used | Percent |
DHCP Scope Pending Offers v4 | active-directory.dhcp.server.scope.pending.offers | Number of DHCPv4 scope pending offers | Count |
Metric name | Metric key | Description | Unit |
---|---|---|---|
ATQ Average Thread Usage | active-directory.atq.server.average.thread.usage | Average usage of threads in Domain Controller ATQ | Percent |
Metric name | Metric key | Description | Unit |
---|---|---|---|
LDAP Bind Time | active-directory.ldap.server.bindtime.millis | Time taken to bind to the fsmo role holder using LDAP | MilliSecond |
LDAP Bind Availability | active-directory.ldap.bind.availability | Whether or not the domain controller can bind to the domain DNS server | Count |
Metric name | Metric key | Description | Unit |
---|---|---|---|
Good Network Adapter Count | active-directory.network.goodadapter.total | The number of enabled network adapters that can ping the Domain DNS Server. | Count |
Bad Network Adapter Count | active-directory.network.badadapter.total | The number of enabled network adapters that cannot ping the Domain DNS Server. | Count |
Total Network Adapter Count | active-directory.network.adapter.total | The total number of enabled network adapters. | Count |
Metric name | Metric key | Description | Unit |
---|---|---|---|
DHCP Scope Addresses Free v6 | active-directory.dhcp.server.v6.scope.addresses.free | Number of DHCPv6 scope addresses free | Count |
DHCP Scope Addresses Used v6 | active-directory.dhcp.server.v6.scope.addresses.used | Number of DHCPv6 scope addresses used | Count |
DHCP Scope Addresses Reserved v6 | active-directory.dhcp.server.v6.scope.addresses.reserved | Number of DHCPv6 scope addresses reserved | Count |
Percent of DHCP Scope Addresses Used v6 | active-directory.dhcp.server.v6.scope.addresses.used.pct | Percent of DHCPv6 scope addresses used | Percent |
DHCP Scope Pending Advertises v6 | active-directory.dhcp.server.v6.scope.pending.advertises | Number of DHCPv6 scope pending advertises | Count |
Metric name | Metric key | Description | Unit |
---|---|---|---|
Kerberos Replication Partner Count | active-directory.replication.partner.count | Kerberos replication partners count in Active Directory domain | Count |
Replication Queue Count | active-directory.replication.queue.count | Count of items in replication queue by Active Directory Domain Controller monitor | Count |
Global Catalog Search Response Time | active-directory.globalcatalog.searchtime.millis | Global catalog search response time of Domain Controller | MilliSecond |
Replication Consistency Status | active-directory.replication.consistency.status | Whether or not strict replication consistency is enabled | Count |
Shared Resource Available | active-directory.replication.shared.available | Percentage of replication shared resources that are available | Percent |
Replication - Destination Delta | active-directory.replication.destination.delta | Replication time delta between this server and the destination server. | Second |
Replication - Source Delta | active-directory.replication.source.delta | Replication time delta between this server and the source server. | Second |
Replication - Destination Errors | active-directory.replication.destination.errors | Replication errors between this server and the destination server. | Count |
Replication - Source Errors | active-directory.replication.source.errors | Replication errors between this server and the source server. | Count |
Time Skew in seconds | active-directory.timeskew.secs | Time difference between the local domain controller and a target domain controller | Second |
Lost and Found Objects | active-directory.lostandfound.object.count.total | Count of lost and found objects by Active Directory Domain monitor | Count |
FSMO Role Holder Consistency | active-directory.fsmoroleholder.consistency | Whether or not the domain controllers agree on who the FSMO role holders are | Count |
FSMO Check | active-directory.fsmo.check | Contains a 'message' dimension about whether or not the correct services can be found from the domain controller | Count |
SYSVOL Health | active-directory.sysvol.health | The SYSVOL share's health | Count |
Patch level changes
Patch level changes:
Enhancements:
Patch level changes:
Patch level changes:
Now the extension supports running it on the AD non-server nodes, e.g. a separate DHCP server.
Fixed irregularities when accessing specific Registry keys required to obtain ReplicationConsistencyMetrics and DatabaseFileDiskSpaceMetrics.
Enhance Active Directory services monitoring with advanced metrics.