Using ZICO collector

In order to log into collector, open browser go to http://zico-server:8642. After installation collector has default account admin with password admin that has administrators privileges.

Zorka collector is a single-screen AJAX application. On the left panel there is list of agents sending data to collector. Double click on such host and search panel with list of collected traces will appear (newest ones will appear on top).

There is a bunch of controls in trace search panel, most of them self explanatory. Search expression field (the biggest one) is most interesting of them all: user can use full-text search or regex search (if searchexpression starts with ~ character) or EQL - logical expression similiar to what is used in where clauses in SQL. In order to use EQL expressions, click QL button on the left of search expression field.

Introduction to EQL expressions

EQL expressions can be used either to search through top level trace list in trace search panel or to search method call tree inside a single trace in trace method search dialog.

EQL are logical expressions similiar to SQL logical expressions, for example the following expression:

trace = 'HTTP'

will filter all HTTP traces. Logical operators are also available, for example each of expressions below:

trace = 'HTTP' and STATUS <> '404'
trace = 'HTTP' and not STATUS = '404'

will filter all HTTP traces except requests resulting in 404 errors.

In regard to resolving names, EQL has some predefined set of attributes (listed below) and tries to use attribute names if present. In above examples trace is a built in symbol and STATUS is just attibute attached to trace by zorka agent. If there is no builtin nor attribute matching given symbol, it will be resolved as null, so for example:

trace = 'HTTP' and REDIRECT <> null

will filter all HTTP requests with redirection.

The following names are built in:

  • class, method - class ot method name of recorded method call of a trace (either root method in trace search panel or any recorded method in method search dialog inside a trace);

  • trace - trace type, eg. HTTP, SQL, EJB etc.

  • time - trace execution time (or method execution time); this uses suffixes, eg. 10ms stands for 10 milliseconds, 3s stands for 3 seconds etc.

  • calls, errors - number of registered method calls or errors in trace (or method call tree node);

  • host - host name (as advertised by zorka agent) on which trace has been recorded;