Feature request: Low success rate of active name resolution - More options + insights plz!

[Jens_Mander]

Hi @ll,

I experience the spontaneous emergence of the above-mentioned health problem in several customer networks. These appear without the (conscious) change in the environment taking place.

With all the love for the product, I have understood the possible causes listed here, only analyzing these is very time-consuming and challenging. Yes, we opened support calls at Microsoft. Here we have a couple of Wireshark filters suggested to investigate the problems. Now we are not talking about small networks, but about worldwide installations with many DCs, even more servers and tons of clients. I have now burned so much time with packet sniffing, firewall log evaluations and analyzes and would like to see better support in the product itself. E.g., a suitable log level for the sensors (without support tickets). Or clear information in the timeline of the MSDI Health Center!

Please don't get it wrong, I really love MSDI and have been advising / recommending the product range for many years since ATA has been around. Together with my colleagues, I have supplied a large number of customers with the ATP / Defender product line and I am absolutely convinced of the added value and necessity of the products. Nevertheless, I find that the troubleshooting of NNR is disastrous.

Cheers and tia,

Jens...

[#2]

Hi,
You don't have to use packet sniffing.
Ask support to request increase of the log level of the sensor to verbose level for a few h ours during working hours. while you won't be able to see the logs locally , and it might cause a temporary perf hit on the sensor, after collecting this data in our backend for a few hours, support can give you a table that shows you the top IPs for each method that fails resolution...

The manual packet sniffing way is only good for small environments or when it happens on a specific machine.

If you want to see more of this available to the end user, I suggest sending the feedback to AatpFeedback at microsoft.com so product will consider it for future versions if more customers suggest the same.