Skip to main content

IBM DataPower

IBM DataPower is a gateway that sits in front of your APIs: clients send their requests to DataPower first, and DataPower forwards them on to your actual backend services. DataPower doesn't need a dedicated Levo plugin or policy — you install a standard Levo sensor (eBPF or PCAP) on a machine that sees this traffic, and it captures the REST and SOAP/XML API calls passing through, the same way it would for any other application.

Prerequisites​

  • A Levo Satellite is already installed and reachable. See Install Satellite if you haven't set one up yet.
  • Access to the node / VM / container running DataPower, or access to a host elsewhere on the network path (the application servers behind DataPower, or the systems calling into it) — see Deployment Topology below if you don't have direct access to DataPower's own host.
  • Your organization ID and workspace ID, from the settings page (click your profile picture in Levo's dashboard, then User Settings -> Organizations).

Choosing a Sensor​

eBPF Sensor (Recommended)PCAP Sensor
Plain HTTP trafficSupportedSupported
HTTPS traffic terminated by DataPowerSupportedNot supported
Use whenYou have access to the node/VM/container running DataPowerYour DataPower deployment runs on infrastructure where only packet-level capture is available

If any of your DataPower-fronted APIs are served over HTTPS, use the eBPF Sensor — it can decrypt that traffic.

Installation​

You can install the sensor using any of the supported methods below — Docker, Kubernetes, apt/yum package, or systemd service. Install it on DataPower's own host/VM/container, or elsewhere on the network path (see Deployment Topology).

Pick the install method that matches where DataPower (or the rest of the network path you're targeting) runs:

Connect your sensor to your Satellite using --satellite-url (or the equivalent config field) — use port 4317, for example <satellite-host>:4317, or https://collector.levo.ai if Levo is hosting the Satellite for you.

Verify Connectivity​

eBPF Sensor — a healthy Sensor logs a line like:

INFO [ebpf_sensor.cpp->VerifyCollectorConnectivity:141] Initial connection with Collector was successful.

PCAP Sensor — a healthy Sensor logs lines like:

[INFO] sensor-health: request successful, status 200
[INFO] Running learn mode on interfaces lo, eth0, ...
[INFO] N traces captured on interface eth0
[INFO] Successfully exported spans to satellite

Deployment Topology: Where to Run the Sensor​

Every API call that goes through DataPower actually happens in two steps:

  1. A client sends the request to DataPower.
  2. DataPower forwards that request on to your backend service.

The sensor only sees traffic on whichever machine it's installed on — so where you install it decides which of these two steps you capture. You do not need to install it directly on DataPower's own appliance to get useful results, which matters because some DataPower deployments (a sealed physical appliance, for example) don't allow installing any extra software on the gateway itself.

You only need to pick one of the following — whichever matches a machine you actually have access to:

  • On DataPower's own host — if DataPower runs on a Linux host you're able to install software on (containerized or otherwise), this is the best option: it captures both steps above.
  • On your backend servers — if DataPower itself is off-limits but you control the backend services it forwards to, install the sensor there instead. You'll capture step 2 (DataPower → backend), but not the original request as DataPower first received it.
  • Near whatever is calling into DataPower — if you don't have access to DataPower or the backend, but you do control the calling application, install the sensor there instead. You'll capture step 1 (client → DataPower).

Not sure which machines these are in your setup? Your DataPower administrator can find both in the DataPower WebGUI, under the Multi-Protocol Gateway (MPGW) configuration for the service in question: the Front Side Handler shows the URL/port clients call into, and the Backend URL field shows where DataPower forwards those requests on to.

Wherever you install the sensor, point its --satellite-url at your Satellite; the Satellite doesn't need to be physically near DataPower either — it just needs to be reachable over the network.

Was this page helpful?