Tech Guide. Network Monitoring and Management in a Private Cloud

Transcription

1 pppppp pp ppppppppppp pppp pppppp pp p pppppppppp pppppp Tech Guide pppppp p pppppppp p ppppppppppp pppppppp ppppppppp pppppppppp ppppppppppp ppppp pppppp pppp pppppppp pppppp ppp pppppppppp Monitoring and Management in a Private Cloud This technical guide explores the challenges of discovery reporting in a virtual environment, monitoring applications for the cloud and the complexity of management in the cloud. q Four Infrastructure ing q That See Through Virtualization q in a Virtualized Environment

2 Four Infrastructure ing ing pros must be brought into virtual desktop infrastructure projects during planning in order to implement VDI networking best practices. by Jim Frey A virtual desktop infrastructure is a cross-domain technology; as a result, deployment requires input from across each enterprise IT team. Yet too often, networking pros are left out of the implementation picture and called in only when it s time for monitoring and troubleshooting. If network engineers, managers and operators are going to be held responsible for the ongoing success of virtual desktop infrastructure (VDI) deployments, they must insert themselves into the planning of these projects to ensure appropriate VDI networking from the start. Why Go With Solid-State Storage For VDI? In a recent study of 158 IT pros in enterprises with more than 250 employees, the vast majority of respondents recognized the need for server, storage, desktop and applications groups to work together on VDI planning and implementation. But according to the study (conducted Too often, networking pros are called in by Enterprise Management Associates only when it s time (EMA) for the VDI Impact on s and Management report), many for monitoring and had not brought the network team into troubleshooting. these projects until after implementation. That s a bit late, considering 54% of respondents cited the network operations group as the one most involved in monitoring and troubleshooting VDI in 2 Monitoring and Management In A Private Cloud

3 production. This was even the case in 35% of organizations that had a dedicated VDI team. What s more, the majority of respondents said the network operations team was held primarily responsible for monitoring VDI performance and availability. So how can networking pros best help an IT organization prepare for VDI implementation? In analyzing the responses by companies with the most successful VDI deployments, we have identified four VDI networking best practices: D Understand your VDI latency budget. A mere 35% of the organizations surveyed in the EMA study had defined targets for maximum acceptable VDI session latency as part of their planning efforts. Yet among respondents experiencing the greatest levels of VDI success, 53% While network latency will only be had previously defined latency targets. a part of the total Meanwhile, 100% of those having the least latency budget, it success with their VDI deployment had not defined latency objectives. must be understood While network latency will only be a and minimized part of the total latency budget, it must be however possible. understood and minimized however possible, particularly in cases where VDI users will connect to servers via WAN or Internet access. The best practices group had varying answers here, but responses clustered around 100 milliseconds total/aggregate latency within the VDI infrastructure. D Understand VDI networking bandwidth requirements. Even less common than creating a latency budget are understanding and defining minimum expected bandwidth per VDI session, with only 28% of all respondents having taken the time to do so. This number can vary widely depending on the VDI products chosen, the protocols used for communication and the applications delivered. 3 Monitoring and Management In A Private Cloud

4 VDI vendors claim that in the simplest of cases, you may only need 50 Kbps to support each session, but our research showed that users are more likely to need 250 to 300 Kbps to support each session on average. For high-end, graphicintensive applications, users may need to allot as much as 1 Mbps per session/user. The best way to figure this out is to use an assessment tool such as Liquidware Labs Stratusphere FIT. Folks have issues in just about every corner of the infrastructure. But overall, the most common was network traffic congestion. D Bring on the optimizations. The folks I surveyed were, on average, using two or three out of six network optimization categories to improve VDI deployment success, mostly leaning on WAN optimization, storage network optimization and managed or optimized Internet services. But the most successful shops reported using three to four methods, with additional emphasis placed on using network Quality of Service (QoS) policies and application delivery controllers. In fact, 68% of that successful group embraced network QoS specifically because of their VDI project. D Pay attention to the LAN, not just the WAN. When it comes to root causes of VDI performance issues, the survey results showed the cross-domain nature of the VDI phenomenon. Folks have issues in just about every corner of the infrastructure, from the server tier, to the storage tier, to end devices. But overall, the most common was network traffic congestion, followed by network latency. The catch is that this latency was just as commonly cited in the LAN as it was in the WAN or Internet. n 4 Monitoring and Management In A Private Cloud

5 Diagnostics That See Through Virtualization Running network diagnostics for virtualization requires a new set of strategies that involve virtual switches, virtual network probes and rerouting traffic for analysis. by Michael Brandenburg Troubleshooting slow network performance is difficult enough in a physical environment, but virtualization requires engineers to run even more complex network diagnostics. After all, in a bare metal data center, network administrators have lots of tools at their disposal to follow packets from end to end, but in a virtualized data center, east-west network traffic between virtual machines on the same physical server is invisible to physical network infrastructure. Fortunately, there are ways for the network team to peer into the black box of the virtualized environment using a patchwork of tools and strategies. Using Virtual Switches To Manage Virtualization Traffic Hypervisors on virtualized servers use built-in virtual switches (vswitches) to manage traffic among virtual machines. These software vswitches are designed to replicate the functions of a physical network switch, including support for port monitoring. However, they typically lack the deep functionality of a traditional hardware-based network switch. Cisco Systems virtual Nexus 1000v switch and the open source Open vswitch offer more features and functionality than hypervisor-embedded virtual switches, and they more closely resemble their physical counterparts. As a result, they offer network administrators centralized management and visibil- 5 Monitoring and Management In A Private Cloud

6 Diagnostics ity of both physical and virtual network infrastructure. But virtual switches also have some downsides. Every function they offer adds additional workloads and saps CPU cycles from the virtual server environment. administrators need to balance the need for port monitoring and network troubleshooting with the overhead that such monitoring will pose to compute resources. Integrating Management Tools With Hypervisors For Some vendors offer data center network management platforms that can simply gather information about virtual machine activity from the hypervisor. VMware offers an application programming interface (API) on its management Every function virtual switches offer platform that allows third-party management tools to track virtual machines. However, network administrators generally adds additional workloads and saps depend on their management tool vendors to do this integration. What s more, this CPU cycles from approach does not necessarily provide the virtual server the depth of information that pure packet environment. captures provide. Integrating with the virtualized environment, however, does contextualize the impact that virtual machines are having in the network and helps define the path that an application is taking through the environment. Deploying Probes Inside The Virtual Environment diagnostic and forensic vendors are developing virtual probe software that can provide instrumentation within a virtualized environment. WildPackets OmniPeek analysis solution, for instance, now features OmniVirtual, a virtual network probe that installs on each virtual machine as it 6 Monitoring and Management In A Private Cloud

7 Diagnostics communicates with both virtual and physical elements of the network. Omni- Virtual transmits data to a centralized network analysis appliance. Combining virtual and physical network probes delivers complete network visibility. These virtual services, however, are specific to each network analysis product and will only provide visibility to the vendor s network management products. The network team will also have to work closely with the server team to ensure that virtual network probes are deployed on every virtual machine in the environment. Any workloads running without a probe will remain invisible to the network management tool. Forcing Virtual Machine Traffic Back Into Hardware A new set of standards pending with IEEE offers administrators virtual network visibility without the CPU overhead associated with virtual switches or virtual probes. Edge Virtual Bridging (EVB), also known as 802.1Qbh, brings A new set of standards pending with together hardware, software and protocol standards to simplify and automate the links between physical and virtual Layer 2 IEEE offers administrators virtual networks in the data center. The standard will allow physical and virtual switches to network visibility talk to one another and share configuration without the CPU information. overhead associated The EVB standard will also include a with virtual switches technology called Virtual Ethernet Port or virtual probes. Aggregation (VEPA), which instructs virtual switches to send all traffic from virtual machines upstream to the nearest physical network switch. This exposure of the virtual machines to the physical network allows network administrators to apply traditional network analysis and management. VEPA also includes provisions for communications between virtual ma- 7 Monitoring and Management In A Private Cloud

8 Diagnostics chines on the same physical server and network hardware, known as a reflective relay or a hairpin turn. In addition, VEPA allows a physical switch to send data back across the same network port it came from. Administrators can deploy VEPA either through upgraded virtual switch software or within hardware Enterprise infrastructure can no on supported network interface cards. Depending on the workloads and utilization on a given server, most enterprises longer be siloed. will deploy VEPA as a mix of software and It must function hardware. as an ecosystem. Edge Virtual Bridging can also help automate network configuration and policy management through the Virtual Station Interface Discovery Protocol (VDP). VDP allows the network to know of the movement of a virtual machine in advance of the move and automate network configuration for the destination hypervisor host. Pulling It All Together For Each of these solutions gives the networking and server teams the ability to focus on their own domains, but they all require collaboration between the two teams for implementation. Enterprise infrastructure can no longer be siloed. It must function as an ecosystem. Efforts to automate the virtual environment will have to be matched with automation on the data center and edge networks. Likewise, silos of IT management will have to be broken down and collaboration between network, server and storage teams will have to be just as agile as the infrastructure they hope to build. n 8 Monitoring and Management In A Private Cloud

9 Traffic in a Virtualized Environment There s no need to toss out SNMP, NetFlow and packet analysis when doing network traffic analysis in a virtualized environment. by DAVID DAVIS Over the years, network administrators have come up with tried-and-true methods for analyzing and troubleshooting the physical network, using SNMP and NetFlow for data collection or protocol analyzers to look at raw network frames and packets. But what happens now that we ve moved into the era of virtual networks? The good news is that existing network traffic analysis strategies can be used in virtual networks with just a few small differences. Virtual s Are Not So Different Virtual networks work very much the same as physical networks. In many cases, only the names of network devices have changed. For example: D A network interface card (NIC) is now a virtual NIC (vnic). D A switch is now a virtual switch (vswitch). vswitches work very similarly to physical switches but don t have the config ability commonly found in traditional switches (such as showing the MAC addresses). D Multiple vswitches can be created on each host, and ports on a vswitch are usually broken down into port groups for specific purposes, such as production or management. D VLANs are fully supported, and a switch port can be either an access port or a trunk port, just like the in world of physical switches. 9 Monitoring and Management In A Private Cloud

10 Traffic D Physical hosts that house the virtual switches are connected to the physical network with real physical server NICs and cables, which are called uplinks in a virtual infrastructure. D Features like promiscuous mode, NIC teaming and load balancing all exist in a virtual environment. These features have changed: D Spanning-tree protocol is not needed. D traffic cannot flow from one switch to another on the same host. D Port groups exist in the virtual network but not in the physical network (they may be similar to Cisco SmartPort). D You can t see the virtual switches or physical cables connecting to the vnics (and there are no more flashing lights to look at in the wiring closet for most of the servers). Virtual Using SNMP and Netflow Just as in the physical network infrastructure, to analyze network traffic in the virtual world you ll use SNMP or NetFlow to collect data across multiple points of the infrastructure and then analyze it with a network performance management and monitoring tool. Examples of more general network performance monitoring tools include What s Prior to vsphere 5, utilizing NetFlow to Up Gold and Solarwinds Orion. More monitor the virtual specific NetFlow collectors and analyzers include Plixer Scrutinizer and Solarwinds NetFlow Traffic Analyzer. not an option. infrastructure was Of course, you can still do a generic Internet Control Message Protocol (ICMP) monitoring with an element manager like HP OpenView, but it s preferable to do that in addition to some level of utilization and error checking. Prior to vsphere 5, utilizing NetFlow to monitor the virtual infrastructure 10 Monitoring and Management In A Private Cloud

11 Traffic was not an option. However, once you implement vsphere 5 (assuming you have the edition with the vsphere Distributed Switch) you can enable NetFlow v5 at the port-group level on an individual dvport or on an uplink. By doing so, you ll be able to monitor the following: D IntRA-host virtual machine traffic (virtual machine-to-virtual machine traffic on the same host) D IntER-host virtual machine traffic (virtual machine-to-virtual machine traffic on different hosts) D Virtual machine-to-physical infrastructure traffic While SNMP will only give you basic statistics about the network traffic sent, traffic received and errors, NetFlow goes much further by providing IP pairings and protocols. In other words, you can see who the top talkers are and who is talking to whom. For example, with SNMP you might see that a network interface has reached its throughput capacity, but that s all. With While SNMP will NetFlow, you would see that HTTP is only give you basic taking up 95% of the interface utilization, and that a specific user s PC (looked up by statistics about the DNS) is talking to an Internet website that network traffic sent, streams rock concerts, for example. None traffic received and of these options will show you inside the errors, NetFlow goes packets or allow you to decode any data. much further by providing IP pairings In this blog, you ll find more detailed information on VMware s vsphere 5 Net- Flow implementation. and protocols. One of the best vsphere network performance monitoring and troubleshooting tools is Xangati for vsphere (which is free) and the Xangati management dashboard. Both versions use NetFlow to collect data about the virtual infrastructure but combine it with other traditional performance metrics from vcenter to provide a very powerful perfor- 11 Monitoring and Management In A Private Cloud

12 Traffic mance monitoring and troubleshooting tool for vsphere infrastructures. The free version monitors a single host, while the management dashboard allows you to monitor many hosts and virtual networks from a single interface. Note that if you are using Hyper-V instead of vsphere, Microsoft has announced that in Windows Server 2012 Hyper-V, the extensible virtual switch will support the addition of the open source Hyper-V sflow agent that could then be monitored by sflow collectors, such as the InMon sflowtrend Tool. Virtual With Packet Decode What if you want to do a packet decode from the virtual network? In order to do Deep Packet Inspection (DPI) on a physical network, you would connect your protocol analyzer (which would be running on a laptop, for example) to Now that most of a switch port and then configure SPAN our data centers (or RSPAN if the traffic is on a diff-erent servers are virtualized, switch) to mirror traffic from a single much of the traffic switch port, multiple ports or an entire VLAN. does not even hit the Now that most of our data centers physical network. servers are virtualized, much of the traffic does not even hit the physical network so the traditional packet capture method is only useful in certain instances, such as analyzing your Internet connection or a connection to an iscsi SAN. Prior to vsphere 5, to use a protocol analyzer on the virtual infrastructure you took a VM running a protocol analyzer, created a new port group, configured it for promiscuous mode (so that all packets are sent to all ports), and then moved the VM that you wanted to analyze to that port group (for security reasons you don t want to enable promiscuous mode on a production port group). For details on that, see my post titled Using a Packet Analyzer on a VMware vsphere Virtual (which you would follow if you are still using vsphere 4.x or if you have vsphere 5 but don t have the distributed vir- 12 Monitoring and Management In A Private Cloud

13 Traffic tual switch running). In the vsphere 5 Enterprise Plus, however, the port-mirroring functionality allows you to quickly and easily mirror any dvport to another port, or you can choose a VLAN to encapsulate these mirrored packets by selecting the Encapsulations VLAN box when configuring distributed virtual switch port mirroring. Once enabled, port mirroring provides visibility into: D IntRA-host virtual machine traffic (virtual machine-to-virtual machine traffic on the same host) D IntER-host virtual machine traffic (virtual machine-to-virtual machine traffic on different hosts) To see how to configure vsphere port mirroring, read this VMware blog post on port mirroring features. If you are a Hyper-V user, note that in Hyper-V 3 port mirroring is a new feature of the extensible switch. Analyzing and troubleshooting the network once your servers are virtualized really isn t that different from performing these same tasks with physical servers in the physical network. You have two different paths to get this done depending on the level of detail you need. Using NetFlow is the best choice for high-level traffic analysis and bottleneck identification, where port mirroring with a protocol analyzer is what you would do to perform deep-packet analysis in the virtual infrastructure. n 13 Monitoring and Management In A Private Cloud

14 about the authors Jim Frey has 24 years of experience in the computing industry, developing, deploying, managing and marketing software and hardware products. At Enterprise Management Associates, Frey is managing research director and is responsible for the Management practice area. Michael Brandenburg is an industry analyst with Frost & Sullivan, covering infrastructure and unified communications and collaboration in the Information and Communications Technologies group. David Davis is the author of the best-selling VMware vsphere video training library from Train Signal. He is a vexpert, VCP, VCAP-DCA and CCIE #9369, with more than 18 years of enterprise IT experience. His personal website is VMwareVideos.com. Monitoring and Management in a Private Cloud is a Searching.com e-publication. Kate Gerwig Editorial Director Rivka Gewirtz Little Executive Editor Shamus McGillicuddy Director of News and Features Kara Gattine Senior Managing Editor Linda Koury Director of Online Design Doug Olender Vice President/Group Publisher dolender@techtarget.com Scott Kelly Associate Publisher skelly@techtarget.com TechTarget 275 Grove Street, Newton, MA TechTarget Inc. No part of this publication may be transmitted or reproduced in any form or by any means without written permission from the publisher. TechTarget reprints are available through The YGS Group. About TechTarget: TechTarget publishes media for information technology professionals. More than 100 focused websites enable quick access to a deep store of news, advice and analysis about the technologies, products and processes crucial to your job. Our live and virtual events give you direct access to independent expert commentary and advice. At IT Knowledge Exchange, our social community, you can get advice and share solutions with peers and experts. 14 Monitoring and Management In A Private Cloud