WHAT THIS ANSWERS: <e.g. can the portal serve 500 logged-in users browsing documents?> WHAT IT IS NOT: <e.g. not the submission flow - nothing here writes data> HOW TO RUN (LoadLitmus) Load card users / ramp / loops - reads a.users, a.ramp, a.loops Parameter form host, smoke, password, a.csv, thinkMin, thinkMax smoke=true stops after the read-only steps (default) smoke=false runs the steps that write data PLUGINS REQUIRED: none. Add any here, and install on master AND every slave. NOT included on purpose: listeners and a Backend Listener. LoadLitmus writes the JTL and injects its own InfluxDB listener when monitoring is configured, with runId set to the result folder. Keep secrets out of this file. false false true host ${__P(host,app-stg.client.my)} Target host. Staging by default - override in the parameter form for prod. = protocol ${__P(protocol,https)} http or https. = port ${__P(port,)} Leave empty for the protocol default (80/443). Set it when the app runs on another port. = password ${__P(password)} Shared test password. NO DEFAULT ON PURPOSE - type it in the parameter form so it never lives in this file. = smoke ${__P(smoke,true)} true = read-only steps only. false = also run the steps that write data. = thinkMin ${__P(thinkMin,3000)} Shortest pause between pages, ms. A real user reads before clicking. = thinkMax ${__P(thinkMax,8000)} Longest pause between pages, ms. Must be >= thinkMin. = The control panel. Read ONCE at test start and shared by every thread - never put anything per-user here (tokens, ids). Those belong in the CSV or an extractor. ${host} ${protocol} ${port} 10000 60000 false false User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Accept-Language en-US,en;q=0.9 Some WAFs answer a request with no User-Agent with a 401. Keep this row. true false true true false ${__P(a.users,1)} ${__P(a.ramp,1)} startnextloop false false ${__P(a.loops,1)} false ${__P(...)} sits DIRECTLY in the three fields above - that is what makes LoadLitmus's Load card editable. Do not move them behind a UDV variable. Copy this whole group for a second persona and rename a.users/a.ramp/a.loops to b.*. ${__P(user.dir)}/${__P(a.csv,test_data/users.csv)} UTF-8 USERNAME true , false true false shareMode.all user.dir = the folder JMeter starts in. LoadLitmus starts it in the project folder, so this reads data/projects/<slug>/test_data/users.csv; on a slave it reads the slave folder. Never use an absolute path. false true /login GET true true groovy true // Runs once per iteration, before the first request. // Every variable an extractor fills must start here, so a guard below can // tell "never extracted" apart from a value left over from the last loop. ["csrf", "landing_url"].each { vars.put(it, "NOT_FOUND") } false csrf name="_token" value="([^"]+)" $1$ NOT_FOUND 1 200 Assertion.response_code false 8 true _token ${csrf} = true true username ${USERNAME} = true true password ${password} = true /login POST false true follow_redirects is OFF so the 302 itself can be asserted. Turn it on only if you do not care where login lands. ${thinkMin} ${__jexl3(${thinkMax} - ${thinkMin})} true landing_url Location: (.+) $1$ NOT_FOUND 1 /login Assertion.response_headers false 20 test_type 20 = "Substring" + "Not". A failed login usually answers 200 or 302 back to /login, so checking the code alone is not enough. ${__P(user.dir)}/failed_response/02_login/${USERNAME} true false false true Writes the page ONLY when this step fails. Fleet can collect and clear this folder on every slave after a run. ${__jexl3("${landing_url}" != "NOT_FOUND")} false true Without this guard, a user whose login failed keeps firing every later request and fills the error rate with noise. false true /home GET true true Copy this sampler for each page of the journey. Keep the numbering (03, 04, 05...) so the report reads in order. ${thinkMin} ${__jexl3(${thinkMax} - ${thinkMin})} 200 Assertion.response_code false 8 <SOMETHING ONLY THIS PAGE CONTAINS> Assertion.response_data false 16 A 200 carrying an error page is still a 200. Check for text only the real page has. ${__P(user.dir)}/failed_response/03_page/${USERNAME} true false false true ${__jexl3("${smoke}" == "false")} false true Everything that creates, submits or pays sits in here. A smoke run leaves the system untouched; the full run flips smoke to false. false true true _token ${csrf} = true /submit POST true true ${thinkMin} ${__jexl3(${thinkMax} - ${thinkMin})} <TEXT THAT PROVES IT WAS SAVED> Assertion.response_data false 16 ${__P(user.dir)}/failed_response/04_submit/${USERNAME} true false false true