1 00:00:00,000 --> 00:00:08,060 Today we're going to take a look at a fun little screencaster demo of Xenos. 2 00:00:08,620 --> 00:00:10,880 And we've got two special guests with us today. 3 00:00:11,020 --> 00:00:13,360 Would you like to introduce yourself for a special guest? 4 00:00:14,180 --> 00:00:18,900 Hi, I'm Eric Dahl. I'm the CTO of Xenos and one of the founders. 5 00:00:19,800 --> 00:00:21,080 And second special guest? 6 00:00:22,100 --> 00:00:25,980 Hello, I'm Brandon Wichert. I'm the Director of Product Management at Xenos. 7 00:00:26,240 --> 00:00:28,680 Before we actually log into the system that we're seeing here, 8 00:00:28,680 --> 00:00:31,820 you want to give us just like a quick summary of what it is? 9 00:00:32,640 --> 00:00:36,480 Sure. Xenos is a monitoring application. 10 00:00:36,980 --> 00:00:40,420 We feel it kind of unites some of the key elements of monitoring. 11 00:00:42,300 --> 00:00:44,920 Availability, events, performance management. 12 00:00:45,340 --> 00:00:50,500 And we tie that all around a core model that we build through auto-discovery. 13 00:00:50,720 --> 00:00:53,180 Okay, so let's go ahead and log into Xenos. 14 00:00:57,360 --> 00:01:02,920 So after you log in, you are first taken to what we call the dashboard. 15 00:01:03,320 --> 00:01:09,740 So this is a single pane of glass that you can visualize to see everything that's going on within Xenos. 16 00:01:10,460 --> 00:01:14,080 It's portlet-based, so you can see we've got several portlets up here. 17 00:01:14,920 --> 00:01:19,040 And each one is giving you different kinds of information. 18 00:01:19,040 --> 00:01:21,960 So one of the really cool portlets is in the upper left here. 19 00:01:21,960 --> 00:01:25,080 We've actually done a mashup with Google Maps. 20 00:01:25,760 --> 00:01:30,660 And what this is showing you is geographic distribution of assets in the system. 21 00:01:31,520 --> 00:01:36,980 And what you can see here is there's actually links between the different points on the map. 22 00:01:36,980 --> 00:01:44,540 And those are actually displaying the WAN connections between the different data centers that you've shown. 23 00:01:45,220 --> 00:01:50,100 And you can see there's different colors for each location and for the links. 24 00:01:50,360 --> 00:01:52,260 All these links are green, which means they're up. 25 00:01:52,580 --> 00:01:58,300 But if there was to be a failure between data centers, that link would actually go red. 26 00:02:00,620 --> 00:02:12,740 So if we actually hover over Annapolis here, we can quickly pull up kind of an event breakdown of what's in that location. 27 00:02:13,020 --> 00:02:16,080 And it tells you how many devices there and other things like that. 28 00:02:16,080 --> 00:02:20,320 So on the right-hand side here, we have what we call the device issues. 29 00:02:20,500 --> 00:02:28,320 And basically, it's a list of devices in the system that have the highest severity issues going on. 30 00:02:28,620 --> 00:02:31,460 So you can see kind of the red or the orange. 31 00:02:31,600 --> 00:02:34,920 Those are the actual severities of the events behind there. 32 00:02:35,320 --> 00:02:41,020 And then the count is telling you the number of events on that device. 33 00:02:41,760 --> 00:02:44,580 And we're showing the count of the highest level severity. 34 00:02:44,580 --> 00:02:49,620 So there could be other ones below it, other severities underneath. 35 00:02:49,900 --> 00:02:52,460 But we'll just give you a count of the highest ones. 36 00:02:52,860 --> 00:02:57,860 And so is a device sort of the highest conceptual thing that you guys track? 37 00:02:58,080 --> 00:03:04,160 Or, I mean, like, for example, if there was a problem with one of those green lines with the network connection between something, 38 00:03:04,240 --> 00:03:06,280 would that show up as sort of a device over there? 39 00:03:06,420 --> 00:03:09,340 I mean, I'm just trying to figure out the model that exists. 40 00:03:09,840 --> 00:03:10,040 Right. 41 00:03:10,200 --> 00:03:12,320 So, I mean, the model is fairly sophisticated. 42 00:03:13,040 --> 00:03:16,000 At a tracking level, device is very important. 43 00:03:16,060 --> 00:03:20,820 And we see it as kind of the union of an operating system and a piece of hardware. 44 00:03:21,040 --> 00:03:26,420 So certainly we track devices, and that's a pretty important part of the model. 45 00:03:27,200 --> 00:03:35,980 But we also have events and event rules and services and processes, lots of different elements that make up the system. 46 00:03:36,640 --> 00:03:41,660 Certainly links between devices and interfaces, things like that. 47 00:03:42,180 --> 00:03:44,900 But device is certainly a core aspect of the system. 48 00:03:45,100 --> 00:03:48,600 Yeah, it seems like one of the primary entities that things revolve around. 49 00:03:48,720 --> 00:03:49,800 I mean, that is a good distinction. 50 00:03:49,960 --> 00:03:52,720 It's the combination of an operating system and hardware, right? 51 00:03:52,920 --> 00:03:57,720 And then conceivably those are things that are supporting applications that are running or, you know, 52 00:03:58,180 --> 00:04:00,860 or various other functions that's running around in the data center. 53 00:04:01,500 --> 00:04:02,200 Yeah, exactly. 54 00:04:02,200 --> 00:04:08,920 So down here on the lower left is a breakdown of some groupings that we allow you to have in the system. 55 00:04:09,280 --> 00:04:17,960 This is actually showing business systems, so you can see the impact of your IT infrastructure on your core business functions. 56 00:04:18,740 --> 00:04:24,400 And one cool thing about this is all of our groupings in Xenos can be hierarchical. 57 00:04:24,400 --> 00:04:32,360 And here we're just showing the top-level hierarchy, but you can actually drill down into each of these to see more and more detailed information. 58 00:04:32,600 --> 00:04:36,300 Again, the events are showing up just as they were in the device issues. 59 00:04:36,500 --> 00:04:41,540 We show you the color of the highest severity event plus the count of the events within the system. 60 00:04:42,120 --> 00:04:49,580 One thing I'll point out here is you see there's testing and training actually are shaded a little differently. 61 00:04:49,780 --> 00:04:56,000 And they're muted, that means there's been some acknowledgment of the events, and I'll get into that a little later. 62 00:04:56,000 --> 00:05:09,620 Down here in the lower right is the watch list, and you can actually specify particular entities, either groups or actual devices that you want to watch in the system. 63 00:05:10,140 --> 00:05:11,920 So here I'm just going to add our mail server. 64 00:05:12,760 --> 00:05:19,380 And that could be a group or a device, you know, all the major organization features of Xenos. 65 00:05:19,820 --> 00:05:27,780 All right, so that's sort of like instead of having devices only show up when something's wrong, if there's something you want to see, even if it's in a good state, you can customize. 66 00:05:28,300 --> 00:05:35,440 You're basically saying, I always want to see these things on the watch list rather than waiting for them to automatically pop up in one of the freak-out boxes. 67 00:05:36,100 --> 00:05:37,200 Yep, exactly. 68 00:05:37,260 --> 00:05:39,600 So let's reconfigure the dashboard a little bit. 69 00:05:39,600 --> 00:05:47,140 This is, like I said, it's widget-based or portlet-based, so you can actually move things around and add different portlets. 70 00:05:47,680 --> 00:05:54,720 Here's a list of all the portlets that you can add today, and let's just add production states. 71 00:05:55,880 --> 00:06:04,060 So Xenos has the idea of a production state, and basically it's allowing you to say that this computer, it's kind of the life cycle of a computer. 72 00:06:04,300 --> 00:06:11,960 So it could be, for instance, in pre-production or testing or production or even decommissioned. 73 00:06:12,640 --> 00:06:14,420 But probably the most used one is maintenance. 74 00:06:14,800 --> 00:06:20,440 When you're going to do some work on a computer, you flip it to maintenance mode, and then when you're done, you flip it back. 75 00:06:20,440 --> 00:06:24,500 And the different states allow you to control the monitoring in the system. 76 00:06:24,680 --> 00:06:35,340 So if something is in maintenance, it will still monitor the device, but events won't actually show up on the dashboard, things like that. 77 00:06:35,780 --> 00:06:41,820 So it's a really good way to control how the system is interacting with a particular device. 78 00:06:41,940 --> 00:06:43,960 So let me just remove this portlet. 79 00:06:44,760 --> 00:06:50,360 Every time I made a change, it gets saved to the database, and each user has their own dashboard. 80 00:06:50,940 --> 00:06:51,280 Okay. 81 00:06:51,920 --> 00:06:57,880 And can you set up sort of, so dashboards are tied to the user, but are they tied to sort of a role or anything like that? 82 00:06:57,940 --> 00:07:03,540 Like, could you have all your, like, DBAs, like, have the same view and the network people have the same view? 83 00:07:03,600 --> 00:07:05,780 Or how does that get configured and personalized? 84 00:07:06,480 --> 00:07:06,760 Right. 85 00:07:06,840 --> 00:07:08,900 No, it's done per user. 86 00:07:09,000 --> 00:07:17,360 And so when the user logs in for the first time, there's a default set up, and they can go ahead and rearrange stuff once they get in. 87 00:07:17,360 --> 00:07:25,080 Oh, one thing, when I pulled up the list of portlets, I talked about our ZenPack system, the kind of extension mechanism within Xenos. 88 00:07:25,540 --> 00:07:29,980 You can actually add new portlets using that extension mechanism. 89 00:07:29,980 --> 00:07:38,860 And we've had people in the community who've done different things like show graphs in a portlet or other stuff like that by using that extension mechanism. 90 00:07:39,300 --> 00:07:39,880 Right, right. 91 00:07:40,020 --> 00:07:52,500 And so, I mean, that is an interesting distinction of ZenPacks versus other sort of, like, throwing together things is they not only extend sort of the things that you can monitor and manage, but they also, like, pull in UI stuff, right? 92 00:07:52,520 --> 00:07:56,300 So you can add pretty much anything you want with a ZenPack into the system, it seems. 93 00:07:57,220 --> 00:07:57,880 Yeah, exactly. 94 00:07:57,880 --> 00:08:00,560 I mean, we could write the rest of Xenos and ZenPacks. 95 00:08:00,700 --> 00:08:01,480 You can add new... 96 00:08:01,480 --> 00:08:04,220 Not that we are. 97 00:08:04,360 --> 00:08:05,160 Not that we're doing that. 98 00:08:06,860 --> 00:08:07,440 That's right. 99 00:08:07,480 --> 00:08:13,900 You can add demons, you can add new screens, you can add subclasses of devices, pretty much anything. 100 00:08:13,900 --> 00:08:26,880 Is there a way to take these, you know, everyone always enjoys having, like, the knock-level view of things where, I mean, do people use this dashboard to sort of configure, like, a big screen they have on a wall somewhere of just stuff that's constantly updating or... 101 00:08:26,880 --> 00:08:27,560 Yeah. 102 00:08:27,560 --> 00:08:30,180 Or, like, can you sort of pull off a portlet on its own? 103 00:08:30,420 --> 00:08:33,060 Or how do people do that sort of scenario? 104 00:08:33,520 --> 00:08:44,040 The way that I've seen, usually, is they'll have maybe one screen showing the dashboard and then another screen showing the event console, which is what we can talk about next. 105 00:08:44,400 --> 00:08:46,260 So this is kind of the high-level view. 106 00:08:46,520 --> 00:08:55,780 And, you know, a knock could use this, but even a manager might look at this to just see the business systems and what their state is or that plus the location, something like that. 107 00:08:55,840 --> 00:09:01,480 But, you know, that kind of high-level manager person probably wouldn't want to see the device issues, for instance. 108 00:09:01,480 --> 00:09:04,460 Why don't we check out the event console that you were just talking about? 109 00:09:05,160 --> 00:09:05,380 Sure. 110 00:09:05,520 --> 00:09:13,940 So the event console is going to be a list of detailed issues within the system. 111 00:09:14,600 --> 00:09:19,420 And the event system is one of the key parts of Xenos. 112 00:09:20,260 --> 00:09:30,720 And basically, it's an aggregation point for all the messages that are being passed by different monitoring daemons within Xenos. 113 00:09:31,480 --> 00:09:44,920 But it's also a place where you can aggregate external events that come in through syslog or SNMP traps or Windows event log or really any other data source that you want to bring into the system. 114 00:09:44,920 --> 00:09:50,120 You can even use our Web Services API to bring events into the system. 115 00:09:50,240 --> 00:09:54,740 So you could sort of create synthetic events or whatever that you're just inserting into the system. 116 00:09:55,120 --> 00:09:55,460 Right. 117 00:09:55,460 --> 00:10:00,200 Not even so much that they're synthetic, but you can just make up an event, a format on your own. 118 00:10:00,240 --> 00:10:04,420 As long as you can write it to the web service, it'll become an event in Xenos. 119 00:10:05,180 --> 00:10:05,440 Yeah. 120 00:10:05,580 --> 00:10:08,760 I mean, you can even add an event through the web UI. 121 00:10:08,900 --> 00:10:16,120 So if an administrator kind of wanted to show overall status or something like that about what was going on, they could actually add an event. 122 00:10:16,120 --> 00:10:19,660 Why wait for your data center to create problems when you could create them on your own? 123 00:10:20,260 --> 00:10:20,660 Exactly. 124 00:10:21,060 --> 00:10:21,460 Exactly. 125 00:10:22,860 --> 00:10:26,960 So this is the event console, as I said. 126 00:10:27,180 --> 00:10:29,160 I'll just show you one feature of Xenos. 127 00:10:29,160 --> 00:10:43,660 If this is on, as you're saying, like on a knock, a top-level screen or something, you might move aside the left nav just so you could see more information while you're in the event list. 128 00:10:43,880 --> 00:10:44,000 Right. 129 00:10:44,520 --> 00:10:51,020 And do you have sort of like filtering stuff you can set up in the UI to kind of like narrow down to only the events you're interested in? 130 00:10:51,240 --> 00:10:51,960 Yeah, exactly. 131 00:10:52,120 --> 00:10:54,640 So here is kind of a first level of filtering. 132 00:10:54,940 --> 00:11:00,060 So we're seeing these are the different potential states that events could be in. 133 00:11:00,480 --> 00:11:02,920 And we're looking at basically info and above. 134 00:11:02,920 --> 00:11:10,000 If we take it down to just critical, the top-level events, you see it swiped away everything that wasn't read, essentially. 135 00:11:10,780 --> 00:11:14,260 So now we've got just the most important things going on in the system. 136 00:11:14,680 --> 00:11:20,020 But you can also, if you see these events towards the bottom, they're all pale because they've been acknowledged. 137 00:11:20,660 --> 00:11:22,180 And we're showing acknowledged events. 138 00:11:22,260 --> 00:11:24,660 But you can also take away acknowledged events. 139 00:11:24,660 --> 00:11:31,920 So you're just looking at the things that are current or hot in the system that nobody's actually done anything about. 140 00:11:32,380 --> 00:11:32,660 All right. 141 00:11:32,660 --> 00:11:35,040 So we've kind of scoped down stuff through those pop-ups. 142 00:11:35,200 --> 00:11:38,100 But now you can actually filter kind of like in iTunes. 143 00:11:38,880 --> 00:11:39,800 And let's see. 144 00:11:39,900 --> 00:11:41,380 We'll type in RRD here. 145 00:11:41,640 --> 00:11:41,800 Oops. 146 00:11:42,620 --> 00:11:45,840 And it just live searched it down to just that one event. 147 00:11:46,020 --> 00:11:46,260 Right. 148 00:11:46,400 --> 00:11:50,860 So lots of different ways that you can actually filter the event console. 149 00:11:50,920 --> 00:11:52,480 So let me open it back up again. 150 00:11:52,620 --> 00:11:54,940 And let's just walk through the lifecycle. 151 00:11:55,280 --> 00:11:56,820 So an event comes in. 152 00:11:56,900 --> 00:11:57,720 It's in state new. 153 00:11:57,820 --> 00:12:00,320 And that's what you see here at the top of the list. 154 00:12:00,980 --> 00:12:06,160 And the first thing that an administrator would probably do is they'd acknowledge the event. 155 00:12:06,280 --> 00:12:08,980 So let's go ahead and acknowledge one of these events. 156 00:12:10,400 --> 00:12:11,200 Okay. 157 00:12:11,660 --> 00:12:13,660 Now it's in the acknowledged state. 158 00:12:14,600 --> 00:12:18,000 You know, this is a person's taken responsibility for it. 159 00:12:18,120 --> 00:12:20,440 And they can proceed to work on it. 160 00:12:20,720 --> 00:12:23,120 So let's look at the event detail screen. 161 00:12:23,960 --> 00:12:29,420 And what you see here is at first is all the detailed information that we're tracking about an event. 162 00:12:30,420 --> 00:12:37,060 But also you actually have a log, which is going to be everything that's happening on that event as it goes through the lifecycle. 163 00:12:37,780 --> 00:12:41,700 So here you can see E-Doll, that's me, and I've acknowledged the event. 164 00:12:42,280 --> 00:12:46,980 But you can also continue to have a dialogue about the event within the event log. 165 00:12:47,380 --> 00:12:48,620 Just in case there's any doubt. 166 00:12:49,340 --> 00:12:49,780 Exactly. 167 00:12:52,820 --> 00:12:56,200 So that would kind of be the next thing that would happen. 168 00:12:56,200 --> 00:13:00,660 Now there's two kind of possible ways that we could go into the next stage. 169 00:13:01,440 --> 00:13:04,140 What we're looking at here are the current events in the system. 170 00:13:04,840 --> 00:13:10,440 And the lifecycle, the next part of the lifecycle, is that an event moves into the history. 171 00:13:10,800 --> 00:13:12,460 So it's actually not current anymore. 172 00:13:13,440 --> 00:13:17,460 It's moved into just an archive, so you can reference it later on. 173 00:13:18,200 --> 00:13:19,760 And that can happen by the user. 174 00:13:19,760 --> 00:13:27,560 So here the user can select the event and then go to the menu and say, move to history. 175 00:13:28,240 --> 00:13:32,640 But a lot of times, events will just clear themselves. 176 00:13:32,860 --> 00:13:35,480 So we have a correlation system within Xenos. 177 00:13:35,900 --> 00:13:40,620 And like if you have a ping down, or here we have a Windows service browser is down. 178 00:13:41,020 --> 00:13:44,740 When that comes back up again, it'll actually clear the event. 179 00:13:45,160 --> 00:13:45,860 So automatically. 180 00:13:46,120 --> 00:13:46,620 That's interesting. 181 00:13:47,080 --> 00:13:47,240 Yeah. 182 00:13:47,460 --> 00:13:49,520 So up-down correlation is what we call that. 183 00:13:49,520 --> 00:13:52,900 Another cool thing about the event system is we have deduplication. 184 00:13:53,420 --> 00:13:57,280 So what that means is, see, this event has happened several times. 185 00:13:57,920 --> 00:14:01,640 This, you know, a thousand times in the event window. 186 00:14:02,100 --> 00:14:05,840 We break it down so you just see a count of how many times it's actually happened. 187 00:14:06,360 --> 00:14:06,620 Okay. 188 00:14:06,760 --> 00:14:11,240 And so are there integrations you have with, like, help desks or service desks for this kind of thing 189 00:14:11,240 --> 00:14:15,400 to sort of move these events off and do other process workflows? 190 00:14:16,120 --> 00:14:16,360 Right. 191 00:14:16,360 --> 00:14:22,980 So we have an integration with Remedy, which when an event comes in, it can generate an email 192 00:14:22,980 --> 00:14:26,460 that goes and gets entered into Remedy as a ticket. 193 00:14:27,340 --> 00:14:27,440 Right. 194 00:14:27,440 --> 00:14:32,540 But another cool thing we have in the event system is basically you can make any where clause against the events, 195 00:14:32,940 --> 00:14:38,500 and a command will be executed when that where clause is matched. 196 00:14:39,060 --> 00:14:45,360 So with that, you can really do lots of different kinds of integrations from the event system into external systems. 197 00:14:45,460 --> 00:14:50,920 And while we're on that, I'll just show you real quick, very similar to that, we have alerting rules, 198 00:14:50,920 --> 00:14:56,500 which will, you know, instead of just sending an arbitrary event or kicking an arbitrary event, 199 00:14:56,820 --> 00:15:00,820 an alerting rule will actually send out a page or an email when an event matches. 200 00:15:01,120 --> 00:15:04,340 You can set delays so it doesn't do it right away, things like that. 201 00:15:04,520 --> 00:15:04,620 Right.