HP Intelligent Management Center v7.1 Virtualization Monitor Administrator Guide

Transcription

1 HP Intelligent Management Center v7.1 Virtualization Monitor Administrator Guide Abstract This guide describes the Virtualization Monitor (vmon), an add-on service module of the HP Intelligent Management Center. vmon is designed for IMC administrators and other networking specialists who collect and analyze network traffic and user behaviors. It is designed to work with HP IMC Network Traffic Analyzer (NTA) and HP IMC User Behavior Auditor (UBA). Part number: Software version: IMC vmon 7.1 (E0301) Published: September 2014 Edition: 1.0

2 Copyright 2014 Hewlett-Packard Development Company, L.P. No part of this documentation may be reproduced or transmitted in any form or by any means without prior written consent of Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. Confidential computer software. Valid license from HP required for possession, use, or copying. Consistent with FAR and , Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard commercial license. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein. Warranty HEWLETT-PACKARD COMPANY MAKES NO WARRANTY OF ANY KIND WITH REGARD TO THIS MATERIAL, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not be liable for errors contained herein or for incidental or consequential damages in connection with the furnishing, performance, or use of this material. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. i

3 Contents 1 Overview 1 2 Installing vmon 2 Preparing for installation 2 Software requirements 2 Installing the vmon probe 2 Verifying the installation 10 Configuring vmon 10 Setting the Portgroup 10 Configuring the probe gateway 12 Adding the probe to IMC 13 Connecting the vmon probe to IMC 15 3 Operating vmon 19 Starting and suspending the virtual machine 19 Analyzing network traffic 19 Analyzing user behavior and network access 20 Uninstalling vmon 20 4 Managing the environment 22 Adding a NIC 22 5 Acronyms and terms 27 6 Support and other resources 28 Contacting HP 28 Subscription service 28 Related information 28 Documents 28 Websites 29 Typographic conventions 29 Document conventions 29 GUI conventions 30 Symbols 30 7 Documentation feedback 31 Index 32 ii

4 1 Overview IMC offers network professionals many tools with which to monitor and manage networks and devices through the convenience of a single web portal. Service modules expand the capabilities of the base platform with additional features and functionality. The vmon probe enables you to gather information and monitor traffic between various points on your network that cannot otherwise be captured by devices, such as switches. Together with the analytical power of the HP Intelligent Management Center, you can customize the collection of traffic flow data between virtual machines in a portgroup. 1

5 2 Installing vmon The vmon probe provides a data source to IMC that can be used to monitor network traffic between virtual machines. For information about how to install IMC and component modules, see HP Intelligent Management Center Installation Guide or the relevant component documents. Preparing for installation Before you begin the installation, ensure that you have prepared the software environment. The probe requires 4 GB of free memory and 8 GB of disk space to function. You must have sufficient authorization and be logged in with root privileges to install and set up the vmon probe software. Software requirements The following IMC components and versions must be installed prior to using the IMC vmon probe. Other IMC components and modules are optional. IMC PLAT 7.1 HP Intelligent Management Center Base Platform version 7.1 (E0302) or later IMC NTA 7.1 Network Traffic Analyzer version 7.1 or later IMC UBA 7.1 User Behavior Auditor version 7.1 or later IMC APM 7.1 Application Performance Manager version 7.1 or later In addition, install the following resource: VMware vsphere Version 4.x or later Installing the vmon probe Before installing vmon, the administrator must prepare the vmon installation file, *.ova (for example, "IMC_vMon_5.2_E0401.ova"), by placing it in a temporary directory. Each vmon probe acts independently. You must deploy an instance of the vmon probe upon every cluster on which you want to monitor virtual machine traffic. Deploy each vmon probe as an instance, using the VMON.ova file as a template. 1. Log in to vsphere with administrator privileges. 2. From the vsphere left navigation tree, select the cluster on which you want to deploy the vmon probe. 2

6 3. Select File>Deploy OVF Template... to launch the OVF Template wizard, as shown in Figure 1. Figure 1 Launch the OVF Template wizard 4. On the Source screen, browse to and select the vmon.ova file, and then click Open. 5. Click Next, as shown in Figure 2. 3

7 Figure 2 Source screen The OVF Template Details screen lists product information details. 6. Click Next. The Name and Location screen appears, as shown in Figure 3. 4

8 Figure 3 Name and Location screen 7. Optional: On the Name and Location screen, rename vmon in the Name field. 8. Select the location to deploy vmon from the Inventory Location list, and click Next. The Storage screen appears, as shown in Figure 4. 5

9 Figure 4 Storage screen 9. On the Storage screen, select the storage device to put vmon on, and click Next. The Disk Format screen appears, as shown in Figure 5. 6

10 Figure 5 Disk Format screen 10. On the Disk Format screen, select the provisioning format to use, and click Next. The Network Mapping screen appears, as shown in Figure 6. 7

11 Figure 6 Network Mapping screen 11. On the Network Mapping screen, select the network to which you are mapping, and click Next. The Ready to Complete screen appears, as shown in Figure 7. 8

12 Figure 7 Ready to Complete screen 12. On the Ready to Complete screen, verify the summary of your selections. To make changes to any item shown, return to the relevant screen, and change the options selected. When you are done with your deployment selections, click Finish. A dialog appears, confirming that the instance of vmon is being deployed, as shown in Figure 8. 9

13 Figure 8 Deploying the vmon virtual machine Verifying the installation To verify the installation, you must start the vmon virtual machine. The probe processes start automatically. 1. In the vsphere left navigation tree, select the IMC_vMON probe that you deployed in the previous procedure. 2. Navigate to the Getting Started tab. Under Basic Tasks, click Power on the virtual machine. 3. Click the Console tab. The message Starting networking displays to indicate that the virtual machine startup process is in progress. Wait for the startup process to complete. 4. To verify that the virtual machine is starting correctly, you can click the Show Details link. NOTE: The IP information gathering process might fail to obtain IP addresses for eth0 and eth1 from the DHCP server. 5. When the process is complete, you can log in to the probe through the CentOS, The default username is root, and the password is imcimc. Configuring vmon Before using the vmon probe to monitor network traffic, perform the following configuration procedures for each instance of vmon that you have created. Setting the Portgroup To set the vswitch properties for the traffic that you want to collect and analyze: 1. In the vsphere left navigation tree, select IMC_vMON. 10

14 2. Navigate to the Summary tab. In the General pane, note the Host IP on which vmon is installed and the Portgroup that is listed in the Resources pane. 3. In the vsphere left navigation tree, locate and select the previously noted Host IP. 4. Locate the Virtual Machine Port Group settings, and then click Properties to edit the Portgroup properties. 5. In the vswitch Properties screen, select the vswitch from the list of ports, and then click Edit. The View vswitch Properties screen appears, as shown in Figure 9. Figure 9 vswitch Properties screen 6. On the Edit vswitch Properties screen, click the Security tab, as shown in Figure

15 Figure 10 Modify the vswitch Properties 7. Change the Promiscuous Mode setting to Accept. 8. Click OK to save your changes, and then click Close. Configuring the probe gateway In order for the NIC to communicate with IMC, you must configure a gateway as described in this section. Configuring a gateway is not necessary in order to gather traffic information from the NIC. To configure the probe gateway: 1. From the vsphere left navigation tree, select IMC_vMON. Click the Console tab, and then log in to imc-vmon-5 as root. 12

16 2. Enter vmon-config to start the configuration process. Follow the prompts to set up each network interface for the probe. Enter y for yes or n for no, when prompted, and then input the requested information. See Figure 11 for an example of the configuration process. Figure 11 Configure the gateway a. Enter y to configure the first network interface, for example, eth0. When prompted, enter an IP address and a netmask for the first interface. b. Enter y to configure the gateway IP address for the first interface. When prompted, supply a gateway IP address. c. Enter y to add the network interface to the vmon module. This adds the interface to the list of interfaces that vmon monitors. d. Configure the second network interface by following the same steps. 3. You can choose to set a password for the vmon probe. Enter y to set a password or n to skip setting a password. When prompted, enter the password and then re-enter it to confirm. 4. When prompted, enter y to reboot the computer. Configurations do not take effect until after the computer is rebooted. 5. After the reboot has finished, you are prompted to log in. Adding the probe to IMC When you have installed and verified the probe, you can add it to IMC. When the probe has been added, you can use it to gather and correlate information. 13

17 1. Log in to IMC and navigate to Service>Traffic Analysis And Audit>Settings, as shown in Figure 12. Figure 12 Probe management 2. Click Probe Management to open the Probe List screen. 3. Click Add to open the Add Probe screen, as shown in Figure 13. Figure 13 Basic information for the probe 4. Complete the basic information for the probe: 14

18 Name Specify a unique name for the probe (up to 32 characters). Required field. IP Specify the probe IP address. Required field. Description Describe the probe (up to 108 characters). Enable Layer 7 Application Identification Select whether or not to enable Layer 7 application identification. Probe Password If you have set a password for the probe, enter it in the Probe Password field. For information about how to set the probe password, see "Configuring the probe gateway". 5. Click OK to add the probe with the information you supplied. The message probe name you specified indicates that the probe is added. The probe now appears in the Probe List screen, as shown in Figure 14. Figure 14 Probe Management list with vmon added Connecting the vmon probe to IMC To connect the probe s output to IMC, install an FTP server on the IMC server and create a username and password for the vmon probe. Make a note of the path of the directory to the server where IMC is installed. 1. Navigate to Service>Settings>Traffic Analysis And Audit. The Server Management screen appears, as shown in Figure

19 Figure 15 Server Management 2. Click Server Management. The Server List screen appears, as shown in Figure 16. Figure 16 Modify the probe in the Server List 3. Click Modify. The Server Configuration screen appears, as shown in Figure

20 Figure 17 Server Configuration Basic Information 4. Verify the information listed. 5. Scroll down on the Server Configuration screen, and select the check boxes next to the vmon probe to bind it to the NTA and UBA servers, as shown in Figure

21 Figure 18 Bind the probe output to NTA and UBA modules 6. Click Deploy. The Configure Deployment Result screen appears, with details on the results of your deployment. The data gathered by the probe is now available to the NTA and UBA modules for analysis. 18

22 3 Operating vmon You can analyze the network data you collect with the NTA and UBA modules. Starting and suspending the virtual machine To start the probe: 1. From the vsphere left navigation tree, select vmon. 2. From the right-click menu, select Power>Power On. To suspend information gathering from the probe: 1. From the vsphere left navigation tree, select vmon. 2. From the right-click menu, select Power>Suspend. To shut down the probe: 1. From the vsphere left navigation tree, select vmon. 2. From the right-click menu, select Power>Power Off. Analyzing network traffic Other modules analyze the network traffic data collected by the vmon probes you configure. The NTA module simplifies the task of monitoring bandwidth usage on enterprise networks and provides reports about network traffic and resource usage. The vmon probe allows you to set up additional reporting nodes to collect network traffic in a manner that best suits your needs. Nodes are typically devices that provide data collection capability, such as: IMC servers Database servers Routers Switches However, if you need to monitor traffic from an area where there is not a node, you can create a vmon probe to fill in the gap. For more information about NTA, see Intelligent Management Center Network Traffic Analyzer Administrator Guide. 19

23 Analyzing user behavior and network access The IMC UBA module is an auditing tool that enables you to view user and network access information from log files. The information collected by vmon probes can be analyzed by the UBA module to track trends in user behavior. UBA allows you to view user behavior, including the following functionality: General user behavior NAT audits Website visits FTP site visits usage For more information about UBA, see Intelligent Management Center User Behavior Auditor Administrator Guide. Uninstalling vmon To remove a vmon virtual machine, you must power off the virtual machine and delete it from the disk. 1. On the vcenter server on vsphere, select vmon from the left navigation tree. 2. Right-click and select Power>Power Off to shut down the virtual machine, as shown in Figure 19. Figure 19 Power off the vmon virtual machine 3. From the right-click menu, select Delete from Disk. See Figure

24 Figure 20 Delete vmon 21

25 4 Managing the environment Adding a NIC When you change your network configuration or develop a new traffic auditing strategy, you can add a new NIC to vmon monitoring. Multiple NICs provide a method of simultaneously gathering traffic information for several network segments. 1. In the vsphere left navigation tree, select IMC_vMON. 2. From the right-click menu, select Edit Settings... as shown in Figure 21. The Virtual Machine Properties screen appears. Figure 21 Edit settings 3. From the Hardware tab of the Virtual Machine Properties screen, click Add, as shown in Figure

26 Figure 22 Virtual Machine Properties screen 4. From the Add Hardware screen, select Ethernet Adapter as the hardware type to add, as shown in Figure 23, and click Next. 23

27 Figure 23 Add an Ethernet Adapter 5. Select the network adapter type E1000 from the menu. 6. Select the network connection for the NIC that you are adding, as shown in Figure 24, and click Next. 24

28 Figure 24 Select the Network Connection 7. Review your choices, and then click Finish. 8. On the Hardware tab of the Virtual Machine Properties screen, verify that New NIC (adding) appears in the hardware list, as shown in Figure 25, and then click OK to save your changes. 25

29 Figure 25 New NIC 26

30 5 Acronyms and terms The following terms and acronyms are used in this document. IMC Intelligent Management Center. NIC Network interface card. NTA Network Traffic Analyzer. UBA User Behavior Auditor. VM Virtual machine. vmon Virtualization Monitor. 27

31 6 Support and other resources Contacting HP For worldwide technical support information, see the HP support website: Before contacting HP, collect the following information: Technical support registration number (if applicable) Product serial numbers Product model names and number Product identification number Applicable error message Add-on boards or hardware Third-party hardware or software Operating system type and revision level Subscription service HP recommends that you register your product at the Subscriber's Choice for Business website: After registering, you receive notification of product enhancements, new driver versions, firmware updates, and other product resources. Related information Documents To find related documents, browse to the Manuals page of the HP Business Support Center website: For related documentation, navigate to the Networking section, and select a networking category. For a complete list of acronyms and their definitions, see HP FlexNetwork Technology Acronyms. 28

32 Websites HP.com: HP Networking: HP download drivers and software: Typographic conventions This section describes the conventions used in this documentation set. Document conventions Table 1 Document conventions Convention Blue text: Table 1 Blue, underlined text: Description Cross-reference links and addresses Website addresses Bold text Italic text Keys that are pressed Text typed into a GUI element, such as a box GUI elements that are clicked or selected, such as menu and list items, buttons, tabs, and check boxes Text emphasis 29

33 Convention Description Monospace text File and directory names System output Code Commands, their arguments, and argument values Monospace, italic text Monospace, bold text Code variables Command variables Emphasized monospace text GUI conventions Table 2 GUI conventions Convention Boldface Description Window names, button names, field names, and menu items are in bold text. For example, the New User window appears; click OK. > Multi-level menus are separated by angle brackets. For example, File > Create > Folder. Symbols NOTE: An alert that contains additional or supplementary information. 30

34 7 Documentation feedback HP is committed to providing documentation that meets your needs. To help us improve the documentation, send any errors, suggestions, or comments to Documentation Feedback (). Include the document title and part number, version number, or the URL when submitting your feedback. 31

35 Index C D H I N P R S T U V W C Configuration setting a portgroup10 Configuring probe12 contacting HP28 D documentation typographic conventions29 providing feedback on31 H help obtaining28 HP technical support28 I Installation requirements software2 N Network traffic monitoring19 NIC adding22 P Portgroups setting10 probe deploying2 configuration12 Probe adding to IMC13 connecting output15 uninstalling20 Probe maintenance adding a NIC22 Probe operation starting and stopping19 monitoring network traffic19 analyzing user behavior20 R registering product28 subscription service28 Removing uninstalling the probe20 Requirements software2 S Software requirements2 T technical support HP28 typographic conventions documentation29 text GUI conventions30 symbols30 U User behavior analyzing20 V vmon installing2 verifying installation10 W websites29 32

36 33