To put the selector-identifier pair in your action analytics configuration into effect, you must associate the pair with the point in the traffic flow at which you want to collect statistics. You can do so by configuring a default syntax policy and referencing the stream identifier from the policy rule. You can use compression policies, caching policies, rewrite policies, application firewall policies, responder policies, and any other policies whose action is based on a Boolean expression.
The action analytics feature introduces a set of default syntax expressions and functions for collecting and evaluating data. The expression ANALYTICS.STREAM(<identifier_name>) is used for referencing the identifier that you want to use. The expression COLLECT_STATS is used to collect statistical data. Functions such as IS_TOP(<uint>) and IS_TOP_FREQUENTS(<uint>) are used for making automatic, real-time traffic optimization decisions.
IS_TOP(<number>). Finds if a given object is in the top <number> of elements. For example, is the element among the top 10 elements. When multiple elements have the count, they are considered to be similar in nature. The sort function must be turned on to avoid an undef condition.
IS_TOP_FREQUENTS(<frequency>). Finds if a given object is in the top <frequency> of the elements that are in the top elements. For example, is the element among the top 50% of all the top elements maintained. Elements having the same values are considered similar in nature. The sort function must be turned on to avoid an undef condition.
It is your policy configuration that determines whether the NetScaler appliance must only collect data from traffic or also perform an action. If the appliance must only collect statistical data, you can configure a policy with the rule ANALYTICS.STREAM(<identifier_name>).COLLECT_STATS and the action NOOP. The NOOP policy must be the policy with the highest priority at the bind point. This policy is sufficient if you are only collecting statistics. Traffic optimization decisions, such as what to compress or cache, must be based on manual, periodic evaluation of the statistical data.
If, in addition to collecting statistics, the appliance must also perform an action on the traffic, you must configure the gotoPriorityExpression parameter of the NOOP policy such that another policy that has the desired rule and action is evaluated subsequently. This second policy must have a rule that begins with the ANALYTICS.STREAM(<identifier_name>) prefix and a function that evaluates the data.
Following is an example of two responder policies that are configured and bound globally. The policy responder_stat_collection enables the appliance to collect statistics based on the identifier, myidentifier. The policy responder_notify evaluates the data that is collected.
> add responder action send_notification respondwith '"You are in the Top 10 list for bandwidth consumption"' Done > add responder policy responder_stat_collection' ANALYTICS.STREAM("myidentifier").COLLECT_STATS' NOOP Done > add responder policy responder_notify 'ANALYTICS.STREAM("myidentifier").BANDWIDTH.IS_TOP(10)' send_notification Done > bind responder global responder_stat_collection 10 NEXT Done > bind responder global responder_notify 20 END Done