1 00:00:00,000 --> 00:00:07,400 Today we're talking with Groundwork Open Source, or as I just like to shorten it, Groundwork. 2 00:00:07,900 --> 00:00:14,240 And we're going to check out some of the features in one of their new product, Groundwork, version 5.2. 3 00:00:14,320 --> 00:00:17,060 And we've got two people joining us. Would you like to introduce yourself? 4 00:00:17,580 --> 00:00:21,280 Sure. My name's Rich Trezor. I'm the Director of Sales Engineering at Groundwork Open Source. 5 00:00:21,700 --> 00:00:28,400 I'll be taking you through a technical overview as well as showing you some of the new features of version 5.2. 6 00:00:28,780 --> 00:00:32,300 I'm David Dennis. I'm Senior Director of Product Marketing here at Groundwork. 7 00:00:32,500 --> 00:00:36,580 And people may remember you from Groundwork the video that we did a little bit. 8 00:00:36,580 --> 00:00:38,140 Perhaps infemously so, yes. 9 00:00:38,540 --> 00:00:40,820 That's right. What are we going to take a look at, Rich? 10 00:00:41,640 --> 00:00:47,160 So we thought we'd just kind of give you a quick overview of the system with some emphasis on some of the new features. 11 00:00:47,500 --> 00:00:50,640 Version 5.2 of the product shipped about three weeks ago. 12 00:00:51,560 --> 00:00:57,560 There were some advances in the product that make it easier for users to use some excellent open source 13 00:00:57,560 --> 00:01:01,500 applications that we've integrated together in a complete enterprise-ready package. 14 00:01:01,580 --> 00:01:03,580 So you're looking at just a basic screen. 15 00:01:04,020 --> 00:01:08,820 One of the ways Groundwork makes open source monitoring easier for end users is by packaging together 16 00:01:08,820 --> 00:01:14,500 different open source tools together in an integrated way that allows you to maintain the moving forward. 17 00:01:15,120 --> 00:01:28,900 So with a single RPM, you've got things like MySQL configured with Apache to run Nagios and SyslogNG and a lot of other common tools that are used by organizations but not really in an integrated way. 18 00:01:29,580 --> 00:01:39,360 So as an example of some of the kind of background stuff that you never really look at in pre-dose are just some basic config things that we make easy. 19 00:01:39,460 --> 00:01:42,260 For example, we've got different open source tools running. 20 00:01:42,800 --> 00:01:46,020 We provide a single sign-on capability between different applications. 21 00:01:46,460 --> 00:01:52,480 So I'm expanding down here both the users that are defined on the system as well as some of the packaging that Groundwork provides. 22 00:01:52,720 --> 00:01:56,860 So you'll see things like performance applications powered by RRD tool. 23 00:01:57,360 --> 00:02:01,500 Customers don't have to worry about compiling from source, open source components. 24 00:02:01,660 --> 00:02:04,560 We're doing that packaging here as illustrated in this package. 25 00:02:04,700 --> 00:02:06,920 Now some of the packaging is also configurable. 26 00:02:07,280 --> 00:02:09,480 So here's an example of a log reporting application. 27 00:02:09,760 --> 00:02:11,920 So that's part of the enterprise version. 28 00:02:12,420 --> 00:02:17,560 It's a reporting engine for the database where we're gathering things like availability as well as performance data. 29 00:02:18,260 --> 00:02:24,000 So in some cases, the packaging, kind of that glue between the tools that Groundwork provides is configurable. 30 00:02:24,420 --> 00:02:28,480 So here's where I can define the logins to my logging database. 31 00:02:29,060 --> 00:02:33,480 The directory where Groundwork is going to aggregate and store traps and syslogs is set here. 32 00:02:33,940 --> 00:02:35,580 I can set up some file types. 33 00:02:35,920 --> 00:02:39,040 So when those messages are coming in, I want to associate them with hosts. 34 00:02:39,320 --> 00:02:45,160 I might do something like this in a configuration to say there's a Windows machine that's sending its logs across. 35 00:02:45,580 --> 00:02:47,500 I'm going to associate them. 36 00:02:47,660 --> 00:02:50,020 That allows me to set up some types and some classes. 37 00:02:50,720 --> 00:02:52,660 And then you can apply filters on those logs. 38 00:02:53,540 --> 00:02:55,840 And this can produce for you a summary report. 39 00:02:56,400 --> 00:03:04,120 In the default product, we provide some expressions we found useful to monitor over time. 40 00:03:04,120 --> 00:03:06,960 So some failed logins for Windows machines. 41 00:03:07,540 --> 00:03:11,040 There's also some other expressions set up for things like Cisco firewalls. 42 00:03:11,180 --> 00:03:13,400 And you can, of course, also set up your own expressions. 43 00:03:14,080 --> 00:03:18,200 And this is going to power underneath one of the reporting applications, the log reporting engine. 44 00:03:18,220 --> 00:03:20,820 This is kind of more the illustration of the packaging, right? 45 00:03:20,900 --> 00:03:23,860 So Groundwork isn't just giving you a bunch of scripts to go install things. 46 00:03:24,300 --> 00:03:29,560 We're actually packaging these because this is a way that we can ensure a smooth upgrade over time. 47 00:03:29,960 --> 00:03:33,780 As the different components change, this is how we can track versions. 48 00:03:34,120 --> 00:03:41,800 We can, again, avoid the command line setup that's common to a lot of open source applications. 49 00:03:41,800 --> 00:03:48,540 And as you get familiar with the system, one of the new upgrades in the 5.2 was changing the way that we deliver the help applications. 50 00:03:49,120 --> 00:03:52,460 So here I've just gone into the bookshelf application, which can pop out. 51 00:03:52,520 --> 00:03:57,560 Now, as I want to get familiar with, again, the different components, I can go through contents. 52 00:03:57,980 --> 00:04:02,760 Or I may have a specific need where maybe I'm looking for a VMware profile. 53 00:04:03,200 --> 00:04:06,760 And I want to see, well, how does Groundwork set up monitoring of ESX? 54 00:04:07,080 --> 00:04:12,160 So right through here I can start to get familiar with, again, the how-tos. 55 00:04:13,100 --> 00:04:15,320 You'll see it also shows up in ESX 3. 56 00:04:15,680 --> 00:04:22,960 And this was a change in 5.2 because we needed to be able to update the documentation without a whole upgrade of other components. 57 00:04:23,340 --> 00:04:26,100 So we actually created a separate package. 58 00:04:26,460 --> 00:04:30,880 And I believe this component we're using for the help is called RoboHelp. 59 00:04:31,100 --> 00:04:31,660 Oh, right. 60 00:04:32,080 --> 00:04:32,500 It's familiar? 61 00:04:32,940 --> 00:04:33,300 Absolutely. 62 00:04:33,500 --> 00:04:39,460 If I was an admin or someone setting up Groundwork that was going to use it, can I add in my own documentation here for people to look at? 63 00:04:40,420 --> 00:04:42,800 You cannot do that with this at this time. 64 00:04:43,160 --> 00:04:43,400 Okay. 65 00:04:43,620 --> 00:04:53,460 We hear more and more about customers that want to combine like a wiki functionality for them to say, hey, I used this and here were my notes. 66 00:04:54,400 --> 00:04:57,160 So we don't have that in the help message. 67 00:04:57,160 --> 00:05:01,700 But we do have, and I'll just jump over to, so Groundwork Connect is our support portal. 68 00:05:02,340 --> 00:05:07,380 I'm already logged in there, and you'll see that I'm looking at a new plug-in that a customer can download. 69 00:05:08,340 --> 00:05:11,940 And they can also make contact, make comments on certain things. 70 00:05:12,040 --> 00:05:15,980 So, for example, this group status check is a new kind of profile of plug-in. 71 00:05:16,680 --> 00:05:23,620 As customers say, they access that documentation about a particular new feature that's available. 72 00:05:24,140 --> 00:05:31,280 We do have the ability to make things like comments on docs, so maybe I want to add a comment here on having this kind of problem. 73 00:05:31,980 --> 00:05:40,300 And that's how customers, again, can share information both with Groundwork and we can then publish new contributions to others. 74 00:05:40,540 --> 00:05:40,960 All right. 75 00:05:41,100 --> 00:05:41,780 That's great. 76 00:05:41,780 --> 00:05:49,560 And, again, we want to try to drive more of the ability to have living documents rather than, you know, old paper that's got to be updated and redistributed. 77 00:05:50,060 --> 00:05:50,460 Right, right. 78 00:05:50,540 --> 00:05:54,700 You're constantly updating things that go out of date once they've been distributed, right? 79 00:05:55,540 --> 00:05:55,940 Yeah. 80 00:05:55,940 --> 00:06:03,900 As long as we're on Groundwork Connect, maybe we also want to show that in addition to documentation, there's plug-ins and other things you can download from here, too. 81 00:06:04,480 --> 00:06:04,820 Sure. 82 00:06:04,980 --> 00:06:06,180 Yeah, we were just going through this. 83 00:06:06,200 --> 00:06:07,920 So here's some contributed content. 84 00:06:08,180 --> 00:06:12,940 Now, sometimes this is risky for customers, and there might be a warning that says, hey, only try this if you're an expert. 85 00:06:13,540 --> 00:06:18,040 In other cases, you may want to engage with Groundwork's professional services. 86 00:06:18,900 --> 00:06:22,340 But here's the current list of checks and plug-ins. 87 00:06:23,220 --> 00:06:28,960 And, again, any user both can access content with Groundwork Connect, but you can also maintain your cases. 88 00:06:31,120 --> 00:06:32,080 All right. 89 00:06:32,780 --> 00:06:38,720 So you'll see here on my cases, I've got a couple of open cases here where I can actually run through them. 90 00:06:40,480 --> 00:06:50,160 And, again, Groundwork University training is a great way for users to get familiar with some advanced capabilities as well. 91 00:06:50,160 --> 00:06:52,600 So, for example, WMI Exchange is a profile. 92 00:06:52,740 --> 00:07:01,800 Now, this is shipped with the product, but rather than have to wait for a new release, the idea with Groundwork Connect is that profiles can be made available more rapidly. 93 00:07:01,880 --> 00:07:04,660 So applications in the system, again, are based on the permissions. 94 00:07:05,040 --> 00:07:09,900 You would have access to administration, or if you're an operator, you would probably just have status or dashboards. 95 00:07:10,880 --> 00:07:14,500 New to version 5.2 is the idea of auto-discovery. 96 00:07:15,300 --> 00:07:22,180 What we've done there is we've combined a couple of ways to create configurations. 97 00:07:23,220 --> 00:07:27,020 You'll see in this example, we've got NMAP doing the TCP scan. 98 00:07:27,100 --> 00:07:35,640 And then when we find SNMP devices, we'll actually walk the device to try to identify and automatically assign some monitoring statistics to it. 99 00:07:36,040 --> 00:07:36,360 Right. 100 00:07:38,360 --> 00:07:38,800 Configuration. 101 00:07:39,240 --> 00:07:40,440 Again, it's all graphical. 102 00:07:40,700 --> 00:07:43,760 I have to edit some profiles and content. 103 00:07:45,260 --> 00:07:50,440 But first, what we'll do is we'll come down to a status and then kind of see how things kind of can get set up. 104 00:07:50,660 --> 00:08:02,240 When someone sets up Groundwork for the first time, do you guys recommend that they just run discovery, or is there a different sort of initial setting up that they should do? 105 00:08:03,680 --> 00:08:06,700 There's definitely some things that you want to think through first. 106 00:08:07,600 --> 00:08:18,400 One of the considerations is if you're replacing a monitoring tool, you probably have a good sense of the coverage you need to replace it with. 107 00:08:19,000 --> 00:08:19,940 And that gets a little easier. 108 00:08:20,380 --> 00:08:24,580 But we also get a fair number of customers that really haven't been putting attention on monitoring. 109 00:08:24,780 --> 00:08:27,140 So they're using very little, if anything. 110 00:08:27,820 --> 00:08:35,960 And in that case, discovery is a good component because they may not be sure of what devices are out there, as well as what components are running on those devices. 111 00:08:36,340 --> 00:08:36,520 Right. 112 00:08:36,520 --> 00:08:44,740 And is there a way to do, I don't know what you'd call it, sort of manual discovery, like if you have a spreadsheet or something of all the devices you care about and just import those? 113 00:08:45,500 --> 00:08:46,020 Yes, you can. 114 00:08:47,180 --> 00:08:51,740 So the idea is that at a high level, you can have a status roll-up of an entire environment. 115 00:08:52,480 --> 00:08:59,460 I can create any number of different device groupings, and then the status of those devices is signaled up inside of the internet. 116 00:08:59,460 --> 00:09:08,000 So I always like to demonstrate, again, the real value of why we selected Nagios as a key component in the product. 117 00:09:08,560 --> 00:09:11,780 And that is because you can see different states of hosts and services. 118 00:09:12,980 --> 00:09:23,720 I was an administrator way back, and I remember getting errors or alarm storms where 16, 17, or 30, or 40 things are coming back as failing. 119 00:09:24,060 --> 00:09:24,240 Right. 120 00:09:24,240 --> 00:09:30,380 Well, how can you set up some dependencies, and then how can you boil that up to know which problem should I be working on first? 121 00:09:30,920 --> 00:09:35,260 So here we see we're summarizing, as far as hosts, sorry, they don't have any hosts that are in trouble. 122 00:09:35,480 --> 00:09:37,120 Nothing's down, nothing's unreachable. 123 00:09:37,540 --> 00:09:39,960 But those are two different states that the system will maintain. 124 00:09:40,420 --> 00:09:43,600 Again, think firewall is down instead of 18 web servers. 125 00:09:44,200 --> 00:09:48,620 You know, you've got a Nokia checkpoint cluster running with two firewalls. 126 00:09:48,640 --> 00:09:50,340 If they're down, nobody gets your web servers. 127 00:09:51,000 --> 00:09:58,060 With a proper configuration of network dependencies, Nagios will account for the fact that these firewalls are in my path to those web servers. 128 00:09:58,540 --> 00:10:05,660 And it can make web servers, or replace web servers in an unreachable state, and then the firewalls are found to be down. 129 00:10:06,020 --> 00:10:11,040 That's one way on the host basis, Nagios allows you to find root cause faster. 130 00:10:11,620 --> 00:10:13,260 Same thing can happen with services. 131 00:10:13,260 --> 00:10:18,040 So Nagios breaks it down into critical warning, unknown, and pending is kind of obvious. 132 00:10:18,620 --> 00:10:27,280 But in the case of if I'm doing checks of a website and DNS is down, if I make my website checks dependent on DNS, 133 00:10:27,740 --> 00:10:32,440 well, now I'll be able to see that my websites are unknown because the dependencies failed, 134 00:10:32,920 --> 00:10:36,540 and the only thing down is my DNS service checks. 135 00:10:36,540 --> 00:10:42,800 Right, and like you're saying, the point of all this is to get to the root cause, like the thing that you need to fix, 136 00:10:42,900 --> 00:10:45,920 rather than just knowing what the effects of this broken thing may be. 137 00:10:46,760 --> 00:10:47,900 Exactly, exactly. 138 00:10:48,140 --> 00:10:55,740 And more and more, the operators who are looking at screens like this, they're quite often responsible for two or three areas of IT. 139 00:10:56,000 --> 00:10:59,640 Right, this guy's doing storage, he's doing servers, and he's doing security. 140 00:11:00,780 --> 00:11:08,900 So how can he, again, save time and really prioritize his activities? 141 00:11:09,300 --> 00:11:09,480 Right. 142 00:11:10,160 --> 00:11:16,540 I've seen some very large groundwork deployments where you've got two or three people handling thousands of machines. 143 00:11:17,120 --> 00:11:20,440 And they're also doing, again, things like storage and multiple tasks. 144 00:11:21,500 --> 00:11:26,700 And I've seen those accounts where they have, on any given day, 20 things that could be wrong. 145 00:11:27,740 --> 00:11:32,040 That's a lot of equipment to be able to, say, have only got three or four problems at the moment. 146 00:11:32,720 --> 00:11:41,200 And, again, owing to its NAGI as being a core feature, it's being able to trend and be dealing with warnings as opposed to criticals. 147 00:11:41,420 --> 00:11:46,180 So the illustration and the demonstration, what we show is, here I want to see what are the two warnings that I have. 148 00:11:46,820 --> 00:11:52,300 Well, here I can see that I've got a disk problem on a specific host, and I've got another problem with a web check. 149 00:11:53,000 --> 00:11:56,660 Because that's in a warning state, I'm able to handle it before there's an outage. 150 00:11:57,400 --> 00:12:00,000 All right, tell me that the disk is almost out of space. 151 00:12:00,140 --> 00:12:02,540 Don't tell me that the host is down because it's out of space. 152 00:12:03,220 --> 00:12:03,620 Exactly. 153 00:12:04,580 --> 00:12:08,560 And then further, as part of the workflow, here I can see that this problem has been acknowledged. 154 00:12:09,260 --> 00:12:12,140 So a key component is escalations for our customers. 155 00:12:12,380 --> 00:12:17,600 They want to be able to know that particular problems, if they haven't been addressed within four hours or ten hours, 156 00:12:18,120 --> 00:12:22,400 if they've got an SLA on that particular component, they've got to respond within a certain period of time. 157 00:12:23,360 --> 00:12:29,900 NAGIOS can escalate, so we make that easier and, again, allow the workflow for somebody to acknowledge. 158 00:12:30,080 --> 00:12:32,480 For an example, let's go in and now acknowledge this problem. 159 00:12:33,060 --> 00:12:38,040 So I can see that I've been in a warning since March 26th. 160 00:12:38,300 --> 00:12:45,140 Now I want to acknowledge this problem, and it will automatically grab my name, and I can report what I'm doing. 161 00:12:46,260 --> 00:12:47,720 And this will all be part of the record. 162 00:12:48,240 --> 00:12:49,580 I'm checking this now. 163 00:12:50,580 --> 00:12:54,680 For me to go back and show that I did my SLA if I needed to. 164 00:12:54,960 --> 00:12:55,260 Right. 165 00:12:55,420 --> 00:12:56,080 That makes sense. 166 00:12:57,080 --> 00:12:59,820 That would be a three-week SLA in this case. 167 00:13:01,040 --> 00:13:01,680 That's right. 168 00:13:02,600 --> 00:13:07,760 It's a very low-priority thing, like the fax machine server or something like that. 169 00:13:07,880 --> 00:13:12,560 We were talking about the difference between a host and a service and so forth and so on. 170 00:13:12,560 --> 00:13:15,860 And where can people build those services? 171 00:13:17,220 --> 00:13:19,600 So that's a good segue into the configuration. 172 00:13:20,720 --> 00:13:25,560 So you were asked earlier, should somebody begin, as soon as they get the product, should they run a discovery? 173 00:13:26,840 --> 00:13:28,860 This technician would say, no. 174 00:13:28,960 --> 00:13:35,800 You want to think through, almost from a standards-based, what it is that you want to monitor and what it is that we're looking for. 175 00:13:35,900 --> 00:13:45,100 For example, my switches, do we know what data we really need to have when we monitor a switch versus a firewall or versus a router? 176 00:13:45,580 --> 00:13:51,620 Or if we're running a Windows operating system, what are the basics that we need to be monitoring? 177 00:13:52,040 --> 00:13:53,360 And find the variations. 178 00:13:54,360 --> 00:13:56,780 With profiles, you can layer them together. 179 00:13:58,040 --> 00:14:05,360 But the idea is to kind of know what you're looking for rather than trying to turn on everything. 180 00:14:06,340 --> 00:14:13,600 So, again, the company name Groundwork kind of comes from the opposite of what a lot of the more expensive proprietary tools will do. 181 00:14:14,080 --> 00:14:16,700 And that is they'll very quickly create mountains of data. 182 00:14:17,180 --> 00:14:23,240 So now you need lots of personnel to go through that data and try to correlate lots of events and see, well, what's really wrong? 183 00:14:23,700 --> 00:14:24,940 So we're taking the opposite approach. 184 00:14:24,940 --> 00:14:32,060 We're saying, look, we've got to get CPU disk and memory on any server that we have for good, effective, general-purpose monitoring. 185 00:14:32,660 --> 00:14:43,380 Rather than try to get every last possible metric that's there, let's start with the basics and then add on top what we need rather than strip it out from the beginning.