Application Permissions to reduce "traffic" - SOLUTION!!!

[tony]

Hi Everyone!

I've got a Routing StatServer (7.6.100.12) that is not playing very nicely...  It seems to be falling over when too many updates are being applied (from config), whilst dealing with stat requests from our URS...

Rather than looking at the number of requests, I am considering what I can do to reduce the number of updates being applied through the config.  From what I understand, if the StatServer Application Permissions are updated in CME, then the Application is restarted, you can reduce the config updates being sent to it.  So - when updates are being applied to other Solutions (such as WfM or Outbound or Reporting) the Application is excluded from receiving those updates and concentrates solely on the updates it requires (Stats and Routing Objects only) and it can then better fulfill it's primary role of dealing with stat requests from the URS...

This is just a theory - does anyone have any experience in applying this, to any degree of success?

Thanks!

Tony

[aakarach]

I seemed to have the same issue with Stat server 7.6 ( dont remeber the exact version any more) it was fialing ie randlomly stopping once we changed users in Config server or made changes to the object we upgraded to the following hot fix 7.6.100.37 [12/11/2009] – Hot Fix seemed to resolve the issue try it

thanks

[alistairt]

Hi,

I've used a similar approach (CME permissions) to reduce load on StatServers used for realtime reporting (with CCPulse) where there was a dedicated StatServer for each geographic site (with a "central" switch i.e. common T-Server).

I considered it very successful, but CME permissions can become a headache to manage when they get complex.

We also found a number of defects in Configuration Server  (7.6) most of which were fixed by 7.6.000.36 related to permissions changes.

Also, making CME permissions changes when applications are under load (i.e. during business hours) can cause problems (particularly to Genesys Desktop) in my experience.

Regards,
Alistair

[tony]

OK - I'll take a look at the possibility of an upgrade (the version mentioned in actually a Hot Fix and I am not keen on that..) and I will continue to look at permissions as a way forwards...

Thanks for the input so far guys!

Tony

[borkokrz]

I'm using permissions to reduce network traffic and avoid some problems (per example with Symon Genesys Collector performance). From my point of view it's quite simple. If you are using geographically distributed environments with CSProxy is even simpler and permissions you can set up only at CSProxy level (no need to distribute this to all applications). Till now I've found one big challenge - DataSourcer. It's quite obvious if it collects data only for agents, groups, routing points and queues, but if it collects also calling list and campaign groups data you must be very careful, especially if after setting permissions DataSourcer is seeing less objects. For other applications like StatServer or URS I didn't notice any problems.

[borkokrz]

Hi Tony.

I see your reply by e-mail notification, but I don't see it in topic tree. To answer your questions I wouldn't recommend modifying SYSTEM account permissions. It's one possible way, but I think very dangerous. I can recommend to create new account, propagate No Access permission at Tenant level, then give access to specific and needed objects and start applications with this specific, newly created account (App Security\Log On As). I think it's the best and secure way to achieve your goals.

[tony]

Excellent responses - I understand them implicitly - thank you!

I think I am going to have a bit of a task on my hands, though - I am looking at the Permissions for our Network URS and it seems as if it needs Permissions to just about everything, anyway...  I wanted to exclude Service Numbers or perhaps some of the Site/Premise Objects but it seems to use those too.

Has anyone any specific advice relating to the Permissions for a Network URS - perhaps some Do's and Dont's...?

Great stuff so far everyone - thank you!

T

[tony]

Sort of nearly answering my own question...

The Routing Stat Servers serve the Inbound Call Routing being served by the Network URS's.  We also have MCR, WfM, CCA and a few other Solutions which have nothing to do with our ICR Solution.  I can use an Access Group and a new User to exclude access for the Routing Stat Servers to those Applications and components in CME.

In this way, I should be able to reduce the amount of config updates and general "traffic" being sent to the Routing Stat Server.

Is anyone able to confirm that this a "Best Practice" approach?

Thanks!

T

[tony]

Almost done with this - all you Dev/Planning and Implementation guys out there might want to consider the following...

If you create Solution Sub-Folders in the Resources Section within CME, you can restrict access to for your Server Applications much more easily - thereby reducing the load on them.

For example;

Your Resources>Persons Folder (...and >Place Groups and >DN Groups and >Agent Groups... etc.) could contain 2 sub-Folders at the top level, to enable you to split your Resources into Multimedia and Voice.  You would also need to create a User who has Permissions to access the Multimedia Folders (and not the Voice Folders) and another User who has Permissions to access the Voice Folders (and not the Multimedia Folders).  Applying these Users as the Account you use to (re-)start your Server Applications means (for example); when you restart your Mutlimedia Routing Stat Server it will only accept/receive updates regarding Mutlimedia Resources - and not Voice Resources (which it doesn't need), cutting down the configuration messaging traffic dramatically in both Solutions.

If you already knew this - well done! If you didn't and your Platform is "struggling" it might be time to give it a closer look....

Tony

[cavagnaro]

Hey Tony,
Nice tip, but for a better understanding do you think you can attach a network diagram of how many servers were impacted by this and which components were on each one? In that way we can have a better idea on how to deploy it and if needed...
Thanks!

[borkokrz]

Hi Tony,

Beside subfolders, you can also use Configuration Units. Then managing permissions is even simpler.

[tony]

Configuration Units...?  Please tell me more... lol

Tony

[quote author=borkokrz link=topic=5486.msg24038#msg24038 date=1272661555]
Hi Tony,

Beside subfolders, you can also use Configuration Units. Then managing permissions is even simpler.
[/quote]

[tony]

Hi cav

I still can't seem to attach anything to my posts, so I'll take a look at the build at the next opportunity and write them out... I'm not clear on how that will help anyone, though..?

Tony

[quote author=cavagnaro link=topic=5486.msg24036#msg24036 date=1272650882]
Hey Tony,
Nice tip, but for a better understanding do you think you can attach a network diagram of how many servers were impacted by this and which components were on each one? In that way we can have a better idea on how to deploy it and if needed...
Thanks!
[/quote]

[borkokrz]

Really ?? ;-)

[quote author=Tony Tillyer link=topic=5486.msg24046#msg24046 date=1272788730]
Configuration Units...?  Please tell me more... lol

Tony
[/quote]

[tony]

Yes please - so far, I have been segregating my Resource Folders into "Voice" and "Multimedia", so that I can use Permissions to separate the Assets...  [i]Configuration Units[/i] - that sounds like something where you can dump everything in another Folder somewhere, making the job much much easier...

TT

[quote author=borkokrz link=topic=5486.msg24050#msg24050 date=1272879072]
Really ?? ;-)

[quote author=Tony Tillyer link=topic=5486.msg24046#msg24046 date=1272788730]
Configuration Units...?  Please tell me more... lol

Tony
[/quote]
[/quote]