Set up agentless Real User Monitoring

Agentless monitoring is meant to be used in cases where you don't have access to your web server and therefore can't install OneAgent. However, before deciding on a third-party library, consider the following points: The full benefits of Real User Monitoring can be obtained only after you’ve installed DESK OneAgent. The installation of DESK OneAgent is highly recommended for the following reasons:

With agentless monitoring, need to manually insert a RUM JavaScript tag into each of your application’s pages, which can be challenging. DESK OneAgent handles the insertion of all JavaScript tags for you.
Unless you use the code snippet option for agentless monitoring, the JavaScript tags embedded into your application’s pages won't be automatically updated when you change application monitoring settings. You’ll have to update the tags manually.

Performance impact

To minimize the impact on page-load time and your users’ first impressions of your application, you might want to load scripts as late as possible. Use blocking script tags to ensure that your JavaScript code will be executed exactly where you place it. If you need a script to run as early as possible, the execution can’t be postponed. One way to avoid these additional blocking requests during page load is to inline the script code. The script code needs to be inlined into each document, thereby propagating the data of a single cached file into every page of your application. By combining both these approaches, you can get an inline JavaScript snippet that performs the required initialization and defers loading of the big bulk of the code to a second script.

Standards and security policies

Certain development standards that are created to make applications more secure and faster also introduce new limitations. For example, the Content Security Policy (CSP) standard was introduced to minimize the chance of becoming a victim of cross-site scripting, thereby disallowing inline JavaScript code. This means that you have to use a simple JavaScript tag to inject the JavaScript code.

Another standard, the AMP project, aims to provide a framework that helps you build applications that are consistently fast across all devices and system platforms. In this case, self-developed and third-party JavaScript code aren’t allowed; only scripts provided by AMP can be used.

To monitor AMP applications with DESK:

In the navigation menu, click Deploy DESK.
Click the Setup agentless or AMP monitoring button.
Turn the My application relies on Accelerated Mobile Pages (AMP) button on.

Maintenance effort

Agentless monitoring requires you to insert tags by yourself, which is why you must ensure that it requires as little manual effort as possible. You don’t want to have to change your code every time your configuration changes or when a new version is released. The code snippet added to your application usually doesn't need to be changed as it takes care of loading the right configuration and version for you.

Insertion methods

The right JavaScript tag insertion method depends upon the application and your requirements. There are 4 options to choose from, Code snippet async being the default option.

Insertion method	Description
RUM JavaScript tag	Requires manual insertion of the RUM JavaScript tag into the HTML head of every application page. This approach is compliant with Content Security Policy. Depending on your configuration, the tag is updated periodically.
Code snippet	Requires manual insertion of the code snippet into the HTML head of every application page. The snippet automatically loads the latest JavaScript code version and configuration and doesn't need to be updated.
Code snippet async	Requires manual insertion of the code snippet into the HTML head of every application page. The snippet automatically loads the latest JavaScript code version and configuration. This approach reduces impact on page load but reduces visibility because certain XHR calls may not be instrumented. The tag need not be updated.
Inline code	Requires manual insertion of the full JavaScript code inline into the HTML head of every application page. The tag must be updated each time the configuration is changed or when new JavaScript code versions become available.

To select an agentless Real User Monitoring approach:

From the navigation menu, select Applications.
Select the application that you want to configure.
Click the Browse[…] button and select Edit.
From Application settings, select Setup.
From the Insert monitoring code dropdown list, select an insertion method.

REST APIs

DESK offers a REST API that allows you to automatically retrieve the latest snippet for your application. You can automatically inject the latest script during the build time of your application.

All JavaScript tags are listed under REST API of the Agentless real user monitoring setup page. Rest API approach

Before you begin

What you'll need:

A custom JavaScript tag generated by DESK.
Access to your application’s HTML source so that you can insert the JavaScript tag.
(Managed deployments only) A CDN to serve the RUM JavaScript tag that will prevent web page performance problems during Managed Server maintenance periods and/or local network outages.

Set up agentless monitoring

DESK SaaS

Select Deploy DESK from the navigation menu and then click Set up agentless or AMP monitoring. You can alternatively select Applications from the navigation menu, click Monitoring settings in the top right corner and select Set up agentless or AMP monitoring.

Type in your application’s domain name and click Add web application. A custom JavaScript snippet for your application is then generated.

Note:
You can switch on My application relies on Accelerated Mobile Pages (AMP) in case your page is an AMP page. This doesn't allow JavaScript to run on a page and aims at making mobile pages faster.

Click Copy code snippet to copy your application’s custom JavaScript snippet to the clipboard.

Paste the JavaScript snippet from the clipboard into each of your application’s HTML pages that you want to monitor. DESK waits for you to modify your pages’ code and then to see traffic on the website.

Note:
If you already have an application set up for agentless monitoring, in step 2 you can click applications currently set up for agentless monitoring instead of typing in your application’s name. Then you will view the list of currently set up applications and corresponding JavaScript snippets. This is useful if you’ve already added the JavaScript tag to some of your pages and want to extend monitoring visibility to other pages.

Manual injection options

To view all the available manual injection options supported for agentless monitoring:

Select Applications from the navigation menu and then click an application for which the Injection type is Manually Injected (see filters in the left).

Click the Browse button (...) and select Edit.

In Setup, click Agentless Real User Monitoring setup.

Click the drop list under Insert monitoring code. The available manual injection options are the following:

Click Download to download the selected option.

Notes:

The above listed features are available for environments that have a minimum OneAgent version of v1.127 and above.
You can use the DESK API to fetch the latest JavaScript code for injection.

Example

The following example shows a simple page code before and after the JavaScript tag insertion.

Before injection

<html>
<head>
    <title>MyApp</title>
    <script type="text/javascript" src="myapp.js"></script>
</head>

<body>

<form>
    Username: <input type="text name="username"/><br/>
    Password: <input type="password" name="password"/><br/>
    <input type="submit" value="Login">
</form>

After injection

<html>
<head>
    <title>MyApp</title>
    <script type="text/javascript" src="//js-cdn.desk.com/jstag/145e12d594f/ruxitagentjs_2nr_1006400120011129.js" data-dtconfig="tp=500,50,0,0,10"></script>
    <script type="text/javascript" src="myapp.js"></script>
</head>

<body>

<form>
    Username: <input type="text name="username"/><br/>
    Password: <input type="password" name="password"/><br/>
    <input type="submit" value="Login">
</form>

DESK Managed

Install a Cluster ActiveGate.
Go to Settings > Public endpoints. In the ActiveGate URL text field, type the URL where your new ActiveGate can be reached. The URL must be publicly accessible and able to accept HTTPS requests.

Note: By default, Cluster ActiveGate listens on port 9999. If this isn't desired, it's possible to change the port in the ActiveGate configuration file. Alternatively, you can use the port of your choice and then redirect the traffic to port 9999 using firewall settings.

Make your cluster production ready

For production monitoring with higher load and strict fail-over requirements, it's required that you use multiple load-balanced Cluster ActiveGates and that you add a caching proxy or CDN to serve the JavaScript code.

Load balance multiple ActiveGates

If you take this approach, you'll need to provide your load balancer URL in the activeGate URL text field, as explained above. Requests that your load balancer forwards to Cluster ActiveGates appear as follows:

GET and POST requests for transmitting session information to DESK Managed:

<http|https>://<SecurityGatewayHostname>/bf/<InternalEnvironmentID>?<internalQueryParameters>

GET requests for the JavaScript tag:

http[s]://<SecurityGatewayHostname>/jstag/<internalRuxitClusterID>/<InternalEnvironmentID>/<InternalApplicationID>/bs.js
http[s]://<SecurityGatewayHostname>/jstag/<internalRuxitClusterID>/ruxitagent<configInfo>_<version>.js

Note: Be sure to configure the load balancer to set the x-forwarded-for parameter for all forwarded requests. This parameter contains the IP address of the original request. DESK needs this parameter to determine where the request originated from.

Load balancer should terminate SSL as this is very expensive on Cluster ActiveGate. For a higher performance and if security constraints allow it, traffic can be forwarded via plain HTTP from load balancer to Cluster ActiveGate.

JavaScript code caching

To support higher load scenarios when using a load balancer, we recommend that you cache the JavaScript tag that is loaded from the Cluster ActiveGate using a caching proxy or a CDN.

CDN or caching proxy should forward all requests to <cdnurl>/jstag/** to http[s]://<SecurityGatewayHostname>/jstag/ to be prepared for configuration changes and updates. There are multiple variants and versions of the JavaScript tag. URLs can change depending on the application settings.

The CDN/caching proxy should respect the "expires" header. There are JavaScript tag variants that can be cached forever (1year) and others that can change more often.

Note: If you use the inline JavaScript tag, you don't need the CDN part, as in such cases the entire JavaScript tag is inserted into your application’s HTML source.

Serving the JavaScript tag via CDN

In addition to the obvious benefits of serving the JavaScript tag from your CDN, with this approach the GET requests for the JavaScript tag are directed to your CDN.

To serve the JavaScript tag from your own CDN:

Go to Settings > Public endpoints.
Type the root path of your CDN into the CDN for JavaScript tag field (click the little pencil icon).

Update

To simplify updates and configuration changes, you can use the DESK API to get the current JavaSript tag.

Troubleshooting

To investigate problems that you may encounter with agentless real user monitoring, confirm the following:

The pages to be monitored contain the JavaScript tag.
The JavaScript tag is correctly downloaded by the browser (assuming you're not using inline injection). Use browser dev tools to check if the response for the JavaScript tag is 200 and the response body contains the JavaScript code.
The JavaScript tag is loaded from the correct location (i.e., <cdnlocation>/jstag/<tag filename>).
The JavaScript tag sends beacons to <beaconendpoint>/bf.
The response of the beacon endpoint starts with OK(BF).
The application in the DESK web UI shows data.