WHITE PAPER Virtual Cascade Shark Enabling ubiquitous visibility in virtualized enterprises
Executive Summary Enterprises have been using Cascade products from Riverbed Technology for many years to discover, monitor and troubleshoot their physical network and application infrastructure. Cascade network performance management (NPM) solution offers a rich set of functionality to understand network and application performance in the context of end-user experience, and to uncover problems in an organization s physical infrastructure. With enterprises aggressively embracing virtualization, this sea change has brought new visibility gaps in IT infrastructure. Virtual Cascade Shark software is a software version of the Cascade Shark appliance that resides inside a hypervisor to provide visibility into virtual environments. Enterprises now have a solution that addresses the new challenges IT managers, administrators, and operators face with managing application performance within virtual environments. Introduction Over the last few years, maturing virtualization technologies have had a significant impact on enterprise IT environments. According to Gartner, as of mid-2011, at least 40 percent of x86 architecture workloads have been virtualized on servers 1. This installed base is expected to grow five-fold from 2010 through 2015 driven by the expected increase in workloads and a 75 percent lift in market penetration. In the past, many companies embraced virtualization for non-critical business applications. But increasingly, they re beginning to host business-critical applications within a virtual environment. And many are using virtualization to support cloud deployments. Virtualization brings many benefits to an IT organization, including improved resource utilization, improved performance, improved disaster recovery, higher availability, and capital savings. Along with the good, it also introduces management complexity that threatens to diminish the benefits with added operational cost. The challenges include virtual sprawl, lack of visibility into application performance, and new interdependencies. This paper discusses the lack of visibility in the context of monitoring and troubleshooting end-to-end application performance. The Challenge As companies move their business applications critical and non-critical from physical to virtual environments, a shift in traffic occurs. Traffic that once freely moved between one application server to another application server in a fully physical environment is now largely localized within each physical host. That means applications running within a virtual machine (VM) communicate with other applications on the same physical host. The activity between VMs hosted within a physical machine is considerable and goes undetected from a monitoring standpoint. Without proper monitoring and troubleshooting in place, virtualized environments could be compromised by lack of control and security. 1 Magic Quadrant for x86 Server Virtualization Infrastructure, Gartner RAS Core Research Note G00205369, June 30, 2011 2012 Riverbed Technology. All rights reserved. 1
Customers have long benefitted from Riverbed Cascade because of its ability to monitor and rapidly troubleshoot problems within physical environments. Virtual Cascade Shark products extend the same monitoring and troubleshooting capabilities to virtualized environments for complete enterprise-wide visibility. Performance Management in Virtual Environments In physical environments, performance management is accomplished using flow and/or packet technologies. Cascade customers use flow technologies, such as NetFlow and sflow, to monitor bandwidth consumption, traffic composition and other performance management metrics. Additionally, they deploy packet capture appliances for enhanced troubleshooting and richer transactional analysis. This flow and packet combination has been utilized for several years and it is the de facto standard for network performance management. Many of the performance management functions that are available for the physical environment are also necessary for the virtual environment. However, this information is not readily available in many of the virtualization technologies today. To gain visibility in a virtualized infrastructure, customers have to go through great lengths. But most solutions are expensive, cumbersome and non-cohesive for virtual environments. Figure 1 Virtual Cascade Shark A virtualized system consists of one physical host that abstracts processor, memory, storage and networking resources into multiple virtual machines (VM). Each VM can run an unmodified operating system and associated applications. Insight into interactions among various virtual machines on each physical host is necessary for network performance management best practices. Deployed within a virtual machine, Virtual Cascade Shark software is a virtualized implementation of the Cascade Shark appliance. It provides visibility into virtual environments by monitoring all application traffic traversing the hypervisor. Both the Cascade Shark appliance and Virtual Cascade Shark software capture and store packet-level information on the local system for back-in-time analysis in the same manner. They 2012 Riverbed Technology. All rights reserved. 2
also send network and application metrics to the Cascade Profiler appliance for real-time monitoring, analysis, and reporting. Virtual Cascade Shark software must be deployed on each physical host for complete visibility into virtual environments. Figure 1 (above) shows a single physical host with several virtualized server applications and an instance of Virtual Cascade Shark software. Virtual Cascade Shark software captures interactions among server applications and reports them to the Cascade Profiler appliance for correlation with data that is aggregated from various data sources from physical and virtual environments. This provides an end-to-end view into application performance as it traverses both the physical and virtual network. Furthermore, interactions among server applications can be stored as packets on the local disk or to a storage area network (SAN). The stored packets can be used for retrospective troubleshooting using the Cascade Pilot packet analysis console. Users can drill down from the Cascade Profiler analysis console into the Cascade Pilot console using the integrated drill-down feature in Cascade Profiler. By using Virtual Cascade Shark software, customers can realize several benefits of restoring visibility in their virtualized environments: Continuous monitoring of interactions between server applications within the same physical host Accurate end-user experience metrics enabled by response time measurement Deep retrospective analysis of server interactions using stored packets Baseline virtual environment traffic analysis to identify abnormal changes to the environment Monitoring for security threats Visibility Everywhere Moving beyond physical and virtual environments, there are several other scenarios where visibility is needed, but a dedicated continuous packet capture appliance may not be viable due to business restrictions or cost, for example, in a small regional office or in branch locations. Or, for local visibility within the branch or inter-branch visibility in the case of peer-to-peer traffic such as VoIP. When a full-fledged appliance cannot be justified, organizations can take advantage of the hardware independence of Virtual Cascade Shark software. Organizations can deploy Virtual Cascade Shark software on a commodity server running VMware ESXi that can be used to capture packets via a SPAN port on a physical switch (or a packet source). Virtual Cascade Shark software reports network and application metrics to the Cascade Profiler appliance and can also store packets locally for retrospective analysis using the Cascade Pilot analysis console. 2012 Riverbed Technology. All rights reserved. 3
Figure 2 Full visibility Physical Virtual Branch Physical or Virtual, Cascade Shark Products are the Right Choice For enterprise-wide visibility, a mix of Cascade Shark appliances and Virtual Cascade Shark software provide the broadest coverage. Before making the choice, customers must determine where visibility is needed, what type of performance is needed, and the volume of traffic to be processed. Due to high performance and guaranteed packet capture, Cascade Shark appliances are ideal for data center environments where the volume of traffic is significant. In a virtualized data center, Virtual Cascade Shark software is required in each physical host to gain visibility. In a hybrid environment where physical and virtual infrastructures co-exist, physical and virtual Cascade Shark products operate in a complementary manner. Small regional offices and branch locations that may have constraints for deploying a physical appliance could instead deploy Virtual Cascade Shark software on a commodity server. Cascade Visibility Ecosystem As discussed, Virtual Cascade Shark software and Cascade Shark appliances together provide deep insight into virtual and non-virtualized environments. When combined with other products in the Cascade portfolio, such as Cascade Profiler, the result is broader visibility and end-to-end monitoring capabilities for enterprises of all sizes. In addition, the analytics package powers the Cascade solution to greater heights by enabling low-touch proactive monitoring by base-lining enterprise network behavior. Together, the products in the Cascade ecosystem provide multi-dimensional visibility for enterprise environments that continue to be dynamic and complex with new and emerging technologies and trends. 2012 Riverbed Technology. All rights reserved. 4
Figure 3 shows the Cascade product ecosystem and its applicability to different parts of the enterprise infrastructure for full visibility. Figure 3 Cascade ecosystem Conclusion Enterprises are rapidly adopting virtualization for dynamic service delivery and service management agility. IT challenges already exist in virtual environments and will only be exacerbated with the higher adoption of virtualization. The ability to proactively monitor traffic within these environments is critical for enabling predictable and reliable delivery of applications and for troubleshooting diverse IT infrastructures. Riverbed Virtual Cascade Shark software provides a simple yet complete solution for gaining visibility into virtual environments. When used in conjunction with Cascade Shark appliances, Cascade Profiler, and Cascade Pilot, organizations can gain full visibility into their dynamic hybrid IT infrastructures. About Riverbed Riverbed delivers performance for the globally connected enterprise. With Riverbed, enterprises can successfully and intelligently implement strategic initiatives such as virtualization, consolidation, cloud computing, and disaster recovery without fear of compromising performance. By giving enterprises the platform they need to understand, optimize and consolidate their IT, Riverbed helps enterprises to build a fast, fluid and dynamic IT architecture that aligns with the business needs of the organization. Additional information about Riverbed (NASDAQ: RVBD) is available at www.riverbed.com. Riverbed Technology, Inc. 199 Fremont Street San Francisco, CA 94105 Tel: (415) 247-8800 www.riverbed.com Riverbed Technology Ltd. One Thames Valley Wokingham Road, Level 2 Bracknell. RG42 1NG United Kingdom Tel: +44 1344 31 7100 Riverbed Technology Pte. Ltd. 391A Orchard Road #22-06/10 Ngee Ann City Tower A Singapore 238873 Tel: +65 6508-7400 Riverbed Technology K.K. Shiba-Koen Plaza Building 9F 3-6-9, Shiba, Minato-ku Tokyo, Japan 105-0014 Tel: +81 3 5419 1990 2012 Riverbed Technology. All rights reserved. 5