Ebusiness Infrastructure Monitoring Models

Transcription

1 Turbolinux PowerMonitor Enterprise A Refreshing, New roach for ebusiness Infrastructure Monitoring White Paper

2 PowerMonitor Enterprise White Paper Turbolinux Inc. 2

3 1. Introduction In early 1994, when the World Wide Web emerged, it was more of an information exchange medium. Users could use their browsers to access a variety of static content including homepages, news content, informational sites etc. The infrastructure used to support such content was very simple. Users could connect directly to web servers and download the content served by the servers (see Figure 1). Web server Figure 1: The initial architecture of the Web Over the years, the Web has evolved to support a variety of complex ebusiness applications. On-line auctions, trading, banking, retail, etc., are all supported via web sites. To support these varied applications, the web infrastructure has grown in complexity. The front-end includes firewalls to protect the web sites from malicious attacks, multiple web servers to handle the increased user traffic, and load balancers to distribute traffic amongst all the web servers used for a site. The back-end has grown to be even more complex. The web servers mainly act as HTML gateways that forward user requests to application servers as in Figure 2. The application servers host the business logic components that communicate with database servers, payment gateways, order processing systems, etc. Payment Gateway DNS Firewall Load Balancer Web server DB LDAP Shipping Agencies Figure 2: The new multi-tier architecture of ebusiness applications 3

4 The main complexity in monitoring ebusiness infrastructures arises not just because of the numerous systems that are now involved in supporting ebusiness applications. The complexity of the software components of the web infrastructure has also increased dramatically, with technologies such as CGI, Servlets, JSP, ASP, XML, XSL, JDBC, etc. coming to the fore. To ensure that an ebusiness remains available twenty four hours a day, seven days a week, it essential to monitor all of the application components, in addition to the hardware and system components. In fact, with the advent of a plethora of new application technologies, many of the problems faced by ebusinesses are caused at the application layer. Consequently, ebusinesses need monitoring systems that collect and track a variety of network, system, and application metrics. 2. Existing Monitoring Systems Local and wide area networks existed even before the Internet revolution. The complexity of these environments resulted more from the diversity of network elements that they supported. Most of these environments involved simple, non-mission-critical client-server applications. Hence, many of the early monitoring systems such as HP OpenView s Network Node Manager, CA s Unicenter, Tivoli s monitoring suite, etc., have been optimized over the years to effectively monitor networks and systems. The sudden increase in application complexity resulting from the use of multi-tier environments poses interesting challenges for monitoring. For example, a single ebusiness application requires complex interactions between web servers, SSL servers, application servers, database servers, payment gateways, etc. Moreover, many available application-monitoring tools are point products that focus mainly on monitoring specific applications. For example, the Internet Information (IIS) administration console only monitors the health of Microsoft's IIS. Likewise, the WebLogic console tracks the health of the WebLogic application server alone. Yet another administration tool - Oracle's Enterprise Manager monitors the Oracle database servers alone (see Figure 3). lication Monitoring Solutions Figure 3: Multiple, diverse application monitoring consoles As is evident from Figure 3, most of these application administration and monitoring tools have distinct interfaces. Consequently, ebusiness operators have to contend with multiple diverse tools, each with its distinct usage paradigm and interface. Furthermore, very few of these tools take into account the relationships between the applications being monitored. 4

5 To understand the need for tools that understand the relationships between the application elements, consider the scenario shown in Figure 4. Suppose a problem has occurred with the database server. Say, one of the applications is acquiring database locks but not releasing them. This could result in a slow down of all database accesses. Over a period of time, since the application server uses the database server, a slow down of the database server can impact the application server, causing it to bottleneck. In turn, since the web server relies on the application server, the web server itself will also choke, thereby resulting in overall reduced performance as seen by the user. Payment Gateway DNS Firewall Load Balancer Web server DB LDAP Figure 4: A problem scenario Shipping Agencies Thus, a single problem can result in a zillion alarms - e.g., from the database server, application server, web server, from external probes, etc. Figure 5 depicts a series of alarms showing up at an operator console when a problem occurs. ALARM 31 JAN hrs Too many Login Failures! URL: ALARM 31 JAN hrs Database Connection Failed! URL: ALARM ALARM 31 JAN hrs Access failed from ny1.usa.net URL: 31 JAN hrs Browse Catalog Function Failed! URL: 31 JAN hrs ALARM Access failed from sfo02.usa.net URL: Figure 5: A single problem can generate zillion alarms 5

6 Most ebusinesses typically have different experts monitoring and administering the different ebusiness infrastructure elements. For example, one expert handles all the web servers, another handles all the database servers, yet another expert is responsible for the application servers, etc. The operators who handle 24x7 monitoring of the ebusiness are typically not skilled enough to diagnose and fix problems by themselves. Consequently, when a problem is detected, the different ebusiness experts are called into a physical meeting(s) that involves a series of time-consuming discussions and evaluations before the eventual cause(s) of problem is identified. As the site is exhibiting poor response while all these discussions are happening, users will renege from the site. As the web becomes mission critical, increased downtime directly translates into lost revenues for the ebusiness. This is the exact scenario that Turbolinux PowerMonitor Enterprise aims to prevent. 3. lication Monitoring Tools To assist ebusiness operators in diagnosing and fixing problems, a new generation of application monitoring tools has emerged in the recent past. Two of the popularly used models for application monitoring are: The Dashboard Model: Tools that use this model offer a user interface that models a car dashboard as in Figure 6a. The analogy used is that just like a car's dashboard provides information regarding the fuel availability, the temperature, oil pressure, the operational speed of the car, etc., the monitoring tool s dashboard offers information regarding an application's availability, its performance (in terms of response time), and usage. Figure 6a: The Dashboard Model Figure 6b: The Graph display model While the dashboard model is useful for detecting problems, this model is not sufficient for diagnosing problems (just like a car mechanic is not able to diagnose problems by viewing the dashboard alone - he/she has to open the hood of the car and check various points to provide detailed diagnosis). Moreover, while a dashboard is useful for monitoring a simple, single web site, this model does not scale for more complex web sites involving multiple servers, or for monitoring a larger collection of web sites. All that these tools that support the dashboard model offer is number of dials and gauges to the operator with very little value-addition. Graph Display Model: Many monitoring tools allow a number of metrics to be plotted with time of day as depicted by Figure 6b. Tools such as WebTrends can provide hundreds of graphs for each web site being monitored. Any number of metrics (eg. Number of hits, size of requests, types of requests, types of browsers used, etc) can be plotted with time of day. While with these tools offer tons of data to operators using which detailed problem diagnosis can happen, these tools put the entire burden on the operators to diagnose and identify the cause of problems. No ebusiness operator has the time to analyze and comprehend a hundred graphs per web site. What are required are tools that can provide operators with just the information they need to diagnose, identify, and fix problems. 6

7 4. The Need To operate effectively, ebusiness operators need a monitoring system that: Monitors various network, system, and application elements in an integrated manner. Integrated monitoring allows operators track all the ebusiness components from a single console. Automatically determines the norms of the different collected metrics. This allows operators to monitor ebusiness infrastructures without requiring elaborate configuration. Is capable of differentiating between the cause and effect of problems, so that operators can instantaneously zoom in to the cause of problems and fix them. Offers an easy to use web-based user interface, so that operators can monitor their ebusinesses from wherever they are. Is scalable and can handle both small and large environments with equal felicity. Payment Gateway DNS Firewall Load Balancer Web DB server PowerM onitor Manager egurkha Agent LDAP Shipping Agencies Figure 7: The Turbolinux PowerMonitor Architecture 5. Turbolinux PowerMonitor Enterprise Architecture Turbolinux PowerMonitor Enterprise is an integrated monitoring solution that addresses the unique infrastructure monitoring needs of ebusinesses. Figure 7 shows the high-level architecture of Turbolinux PowerMonitor Enterprise. The core components of Turbolinux PowerMonitor Enterprise are: 7

8 Agents: Agents are software components deployed at various points in the ebusiness system. By running pseudo-periodic tests on the ebusiness system, the agents collect information about various aspects of the system. The test results are referred to as measurements. For example, a Process test reports the following measurements: a. Number of processes of a specific type executing on a system. b. The CPU utilization for these processes. c. The memory utilization for these processes The tests can be executed from locations external to the servers and network components that are responsible for the operation of the ebusiness. Agents that make such tests are called external agents. For example, an Turbolinux PowerMonitor server can be specially installed in an ebusiness system for the purpose of monitoring the system and an external agent on the server can invoke a test that emulates a user accessing a web site. Such a test can provide measurements of the availability of the web site and the performance (in terms of response time) seen by users of the web site. Often external agents alone may not be sufficient to completely gauge the health of an ebusiness and to diagnose problems when they occur. For example, it may not be possible to measure the CPU utilization levels of a web server from an external location. To accommodate such situations, Turbolinux PowerMonitor uses internal agents. While internal agents must be installed by the ebusiness operator on the servers and network elements that are involved in supporting the ebusiness, external agents can be installed on one or more Turbolinux PowerMonitor servers that may be strategically located within or outside the ebusiness system. Manager: An Turbolinux PowerMonitor manager is responsible for receiving and storing measurement results from the agents. Users can access the measurement results from the data repository that an Turbolinux PowerMonitor manager maintains via a web-based graphical user interface. While manager-agent architectures have been extensively used for building monitoring systems in the past, the unique aspects of the Turbolinux PowerMonitor architecture are: HTTP-based authenticated communication between the manager and agents: ebusiness environments typically include multiple demilitarized zones. From a security perspective, most ebusiness operators view SNMP and other proprietary protocols suspiciously, whereas they believe that HTTP traffic is not a serious security threat. Consequently, Turbolinux PowerMonitor Enterprise uses HTTP for all communications between the manager and the agents. Moreover, to ensure that only authentic Turbolinux PowerMonitor agents can report measurements to the manager, Turbolinux PowerMonitor Enterprise uses a proprietary authentication mechanism through which the manager authenticates each agent before accepting the measurements reported by them. Scalable architecture based on web technologies: The Turbolinux PowerMonitor Enterprise architecture itself is built along the lines of multi-tier web architectures. Since scalability issues for multi-tier web architectures are relatively well understood, the use of web architectures and methodologies enables an elegant and natural solution to one of the thorniest problems facing most monitoring systems - namely, scalability to handle hundreds of thousands of network, system, and application elements. Intelligent agents that support monitoring by exception: To further improve its scalability, Turbolinux PowerMonitor Enterprise implements the concept of "monitoring by exception". Unlike a majority of monitoring systems that tend to centralize the monitoring intelligence in a central manager(s), the Turbolinux PowerMonitor Enterprise architecture decentralizes the monitoring intelligence. 8

9 Soon after it makes a measurement, the Turbolinux PowerMonitor agent compares the measurement result with historical thresholds to determine if the measurement is within norms. If it is not, the agent generates an alert to the appropriate manager. Thus the Turbolinux PowerMonitor manager does not have to compute the state of each and every measurement being made by the agents. By correlating among the alerts it receives from the agents, a manager determines the root-cause of problems that occur in the target environment. Customized monitoring for ebusiness components: The Turbolinux PowerMonitor agents have been specially designed keeping in mind the requirements of ebusinesses. Turbolinux PowerMonitor agents incorporate specialized tests for monitoring the health of various ebusiness infrastructure elements such as Web servers, SSL servers, DNS servers, LDAP servers, Web application servers, database servers, payment gateways, order fulfillment systems, WAP gateways, etc. 6. Features of Turbolinux PowerMonitor Enterprise The distinguishing features of Turbolinux PowerMonitor Enterprise include: An integrated monitoring system that allows monitoring of various network, system, and application elements from a single console. Figure 8 summarizes the monitoring capabilities of Turbolinux PowerMonitor Enterprise. Component Type Web servers Web application servers Database servers Network routers Load balancers LDAP servers DNS servers WAP gateways Other ebusiness applications Component Brand / Version Apache 1.x, iplanet 3.6 and higher, Microsoft IIS WebLogic, ColdFusion, ATG, iplanet, Microsoft transaction server Oracle 7 and 8, Microsoft SQL server Cisco routers Local Director Any LDAP server Any DNS server Any WAP gateway MSMQ Figure 8: ebusiness components monitored by Turbolinux PowerMonitor Enterprise Real-time monitoring of real web transactions: The experience that an ebusiness offers to its customers is governed predominantly by how well the application components that support the ebusiness perform. There are two basic approaches that monitoring tools have used for monitoring application components: Using emulated transactions: Many tools such as WhatsUp, BigBrother, Freshwater s SiteSeer etc. use request emulators to generate synthetic requests periodically from one or more locations to different web sites. Based on the responses received from the web sites, these tools compute the availability and response time of different transactions supported by a web site. The main drawback of these tools is that because they generate synthetic requests to the different web sites, these tools can only serve to monitor a 9

10 selected few transactions (e.g., they cannot be used to assess the status of the payment transactions of a retail site). Moreover, since they assess only the status of specific (and not all of the) transactions supported by a web site, these tools may not be truly indicative of the customer experience. Log monitoring: Another popular method of monitoring ebusiness web sites is by analyzing log files produced by the web servers. The log analyzers (e.g., WebTrends) periodically process the numerous log file entries and report a number of statistics, including user profiles, access patterns, response times, etc. The need to log each and every transaction to a web site and the subsequent overhead in processing the log files can significantly impact the performance of a web site. Moreover, many large ebusiness sites cannot even support the disk space required to log each and every transaction supported by the sites. Turbolinux PowerMonitor Enterprise overcomes the above drawbacks using its unique web adapter capability. The web adapter is a layer that fits between the TCP/IP stack and a web server. It can be thought off as a passive probe that watches the requests received by the server and the responses produced by the server. By applying a fast, pattern-matching algorithm on the packets that flow by, the web adapter collects and reports a variety of statistics regarding web sites and the transactions executed by users at these sites. The ability to offer real-time monitoring of real (not emulated) transactions of an ebusiness, without the need for explicit, expensive logging is a key feature of Turbolinux PowerMonitor Enterprise. Figure 9: Real-time monitoring of real web transactions by Turbolinux PowerMonitor Enterprise Figure 9 depicts Turbolinux PowerMonitor Enterprise s capability to monitor real transactions in real-time. The scenario shown in this figure demonstrates monitoring of an on-line retail site using Turbolinux PowerMonitor Enterprise. The transactions to be monitored are configured via Turbolinux PowerMonitor Enterprise s administrative interface (not shown in this document). The left hand panel of Figure 9 indicates that at the current instant, three of the transactions are not performing effectively. For any chosen transaction, the right hand panel displays the 10

11 measurements last made by Turbolinux PowerMonitor Enterprise s web adapter. As is evident from the figure, Turbolinux PowerMonitor is able to pinpoint the reason(s) for why a transaction is not performing to expectation. In the scenario of Figure 9, the failure of the transactions is associated with a 100% of requests being aborted by users. Notice that the data transmit rate from the server is 0, indicating that the ebusiness is facing a severe problem. Automatic thresholding of the collected metrics: Many monitoring systems require extensive configuration and set-up. Often operators have to specify the normal values of each and every measurement that is made. This can be very burdensome. To simplify its configuration and use, Turbolinux PowerMonitor Enterprise implements an automatic thresholding capability. As per this approach, for every measurement made, Turbolinux PowerMonitor agents use the past history of the measurements to determine the normal upper and lower bounds of the measurements. If the instantaneous value of a measurement consistently lies outside its norm, the corresponding agent triggers an alarm to the manager. Figure 10 demonstrates the automatic thresholding capability. In this example, the number of connections to a web server is plotted with time of day, for three consecutive days. Notice that there is a periodic pattern in the value of this measurement it is lower during the early morning hours, peaks during the middle of the day, and drops down again towards the end of the day. Figure 10 illustrates that the maximum threshold value computed by Turbolinux PowerMonitor Enterprise for this measurement also varies with time of day and in fact, matches the variation in the actual measurement value. This way, Turbolinux PowerMonitor Enterprise is able to automatically set a lower norm value for the number of connections to the web server during the morning hours compared to the peak periods. Figure 10: Turbolinux PowerMonitor s relative thresholding capability Unique web presentation model: Unlike many existing tools which provide ebusiness operators with a lot of data but very little information, Turbolinux PowerMonitor Enterprise seeks to minimize the human effort involved in monitoring. Towards this end, Turbolinux PowerMonitor Enterprise employs a unique web presentation model that leads users to the cause of problems in their ebusiness infrastructure. For example, for further diagnosis of the problem in Figure 9, Turbolinux PowerMonitor Enterprise allows operators to view a topology graph of the affected web site(s). The topology graph is a data flow graph that includes the different application components involved in supporting a web site, their instantaneous states, and the interdependencies among them. The interdependencies between components in the topology graph represent cause-effect relationships. The color-coding associated with each component denotes the state of the corresponding component. Figure 11(a) depicts the topology graph for the retail web site of Figure 9. In this example, both the web server and the NAS server (i.e., Netscape application server) are not functioning as expected. The direction of the dependency between these two components 11

12 indicates that the existing problem is probably attributable to the NAS server component. Figure 11(b) indicates the details of the NAS server component, and indicates that the problem in this case is attributed to one of the application processes. Turbolinux PowerMonitor Enterprise s ability to greatly simplify the problem diagnosis process through its unique web presentation model is another key differentiator compared to the competition. Figure 11a: Topology graph that leads users to the problem components Figure 11b: States of the tests corresponding to the APP_PROCESSES layer and the measurements reported Single-click problem diagnosis: To further simplify the task of monitoring and management of ebusinesses, Turbolinux PowerMonitor Enterprise includes a novel, patent-pending single click diagnosis capability. To implement this capability, the Turbolinux PowerMonitor manager incorporates a series of heuristics that take into account the configured site topologies and pre-built models of different network and application components. By automatically correlating across the network, system, and application layers, Turbolinux PowerMonitor Enterprise is able to accurately identify the root-cause of problems in an ebusiness environment. Figure 12 depicts the alarm window displayed by Turbolinux PowerMonitor Enterprise for the problem scenario in Figures 9 and 11b. Notice that the Turbolinux PowerMonitor manager has prioritized alarms into High, Medium, and Low categories, and in this example, it has indicated that the highest priority alarm is with the NAS server. With a single mouse click, the user can obtain details of the alarm including the affected web site(s) and the exact measurement that is causing the problem. This powerful diagnosis capability can dramatically simplify the task of monitoring complex ebusiness infrastructures. 12

13 Figure 12: Turbolinux PowerMonitor Enterprise s alarm window, which depicts the root-cause of an alarm at a single mouse click While tools such as HP OpenView s Event Correlation Service and Micromuse s NetCool do offer alarm correlation capability, these tools require elaborate set-up, which usually involves configuration of complex correlation circuits, typically by a set of domain experts. Furthermore, configuring these correlation tools for effective operation is a time consuming process. Turbolinux PowerMonitor Enterprise offers powerful correlation capabilities out-of-the-box, with minimum setup. Any time, anywhe re reporting: Turbolinux PowerMonitor Enterprise can alert operators over the Web, via (see Figure 13), and even generate alarms to SNMP management consoles such as HP OpenView. Figure 13: Turbolinux PowerMonitor Enterprise's alert Location-specific knowledge management capability: A problem often faced in ebusiness environments is lack of knowledge sharing. The domain expertise regarding how common problems should be fixed is vested in a few individuals. Hence, when a problem is encountered, ebusiness operators often waste precious time in figuring out how the problem should be fixed. Turbolinux PowerMonitor Enterprise aims to equip ebusinesses with a novel knowledge management capability through which domain experts can provide inputs regarding how problems have been fixed in the past. When a problem occurs subsequently, operators can query the knowledge-base to instantly figure out similar problems that have happened in the past and learn from their fixes. Figure 14 (a) demonstrates how a domain expert can enter information regarding the cause of a problem and how it can be fixed. Figure 14 (b) illustrates how an ebusiness operator can search the knowledge base to get hints in terms of how a current problem has been fixed in the past. 13

14 Figure 14a: Feedback form to enter the details pertaining to a problem Figure 14b: History of problems in the environment Centralized administration and update via a centralized web console: The distributed operation of the Turbolinux PowerMonitor agents can be controlled from a web-based administrative interface. Auto-discovery of servers, configuration of the server topology, turning on and off individual tests, changing the frequency of a test and the test's parameters, updating the thresholds for every individual measurement, changing alarm policies, can all be made from an administrative interface (see Figure 15). Figure 15: Administrative interface of Turbolinux PowerMonitor Enterprise 14

15 Scalable architecture: As explained earlier, since it relies entirely on web based mechanisms for all communications and reporting, Turbolinux PowerMonitor Enterprise is able to scale in much the same way that web sites have scaled to handle increased load. 7. Conclusions Turbolinux PowerMonitor Enterprise is applicable in different domains - IDCs, B2C, B2B, enterprises, ebanking sites, etc. For more information regarding Turbolinux PowerMonitor Enterprise and to see an online demo, please visit our website at To obtain an evaluation version of the software, please contact sales@turbolinux.com.cn. 15