1 00:00:00,000 --> 00:00:14,380 Now let's talk about the network map. So Brandy was talking about our ability to model the network so that we know what devices are behind what routers. 2 00:00:14,980 --> 00:00:23,620 So where we're starting off here is in our Annapolis office, that's this network right here, and you can see some printers and some other stuff that's within the office. 3 00:00:23,880 --> 00:00:27,540 And we're focused on this gate box, which is our internet gateway. 4 00:00:27,540 --> 00:00:33,100 What I'll do is I'll just move this out here and I'll start to navigate out our internet connection. 5 00:00:33,800 --> 00:00:35,840 So as I do that, I'll turn the repulsion up. 6 00:00:36,100 --> 00:00:39,540 So this is kind of you want to have a big screen for this kind of stuff. 7 00:00:39,740 --> 00:00:40,060 Sure. 8 00:00:41,760 --> 00:00:46,460 So here we're walking out. Here we can see the VPN that's on the network. 9 00:00:47,000 --> 00:00:49,520 And we're coming out to our colo here. 10 00:00:50,640 --> 00:00:56,440 And so you can see we have an understanding of all the path between us and the colo. 11 00:00:56,440 --> 00:01:04,940 So if at any point, for instance, this VPN router went down, we wouldn't get 8 million events about all the boxes in the colo. 12 00:01:05,160 --> 00:01:11,720 We'd actually get events about just that one router. 13 00:01:12,000 --> 00:01:14,820 Is that a mapping that someone manually has to set up? 14 00:01:14,860 --> 00:01:17,160 Or how do you establish that network map? 15 00:01:17,540 --> 00:01:19,100 It's all done through auto-discovery. 16 00:01:19,320 --> 00:01:23,060 So we're discovering the routes on all the devices. 17 00:01:23,220 --> 00:01:25,140 We're discovering the interfaces, things like that. 18 00:01:25,140 --> 00:01:25,580 Okay. 19 00:01:25,700 --> 00:01:31,840 So like if you set up Xenos here, you can just tell it to find the network map and it'll build one for you. 20 00:01:32,060 --> 00:01:34,940 And then, I mean, can you like tweak it afterwards? 21 00:01:35,140 --> 00:01:36,920 Or how does the modifying of it go? 22 00:01:37,460 --> 00:01:37,740 Yeah. 23 00:01:37,960 --> 00:01:43,980 On each device, you can actually, we do auto-discovery, but you can also manually edit different parts of the device. 24 00:01:44,180 --> 00:01:46,240 So here I'm on a particular device. 25 00:01:46,240 --> 00:01:50,660 And I'll show you where we can modify that data we're talking about in one second. 26 00:01:51,160 --> 00:01:55,360 But what we have here is kind of the overall status screen on a device. 27 00:01:55,460 --> 00:02:01,980 It gives you a view of, it's kind of like the dashboard was, but this is specific to a device. 28 00:02:02,160 --> 00:02:05,800 So we have an event breakdown over here. 29 00:02:06,300 --> 00:02:10,400 We have some other components and what their status is. 30 00:02:10,920 --> 00:02:12,900 These are probably Windows services. 31 00:02:13,680 --> 00:02:22,760 And here you've got the availability of that device, how long it's been up, the production state that we talked about, you know, when it was first seen, last change, and all that kind of stuff. 32 00:02:22,860 --> 00:02:26,640 Is this view pretty typical of, like, any device you might look at? 33 00:02:26,740 --> 00:02:33,800 I mean, are there other tabs that come up that are relevant to devices, or is it generally, like, things stored out into these categories? 34 00:02:34,540 --> 00:02:40,640 Yeah, well, let me, so here, so all kind of interface stuff, I'll talk about OS process monitoring in a second. 35 00:02:41,700 --> 00:02:52,540 But if we click here on the hardware, you can see we get the processor information, amount of memory, swap, and even extension cards that are within the system. 36 00:02:53,780 --> 00:02:57,000 And, of course, we also collect the software that's installed on the system. 37 00:02:57,540 --> 00:03:01,660 And so, kind of walking along here, you've got events about that system. 38 00:03:02,640 --> 00:03:14,260 We have, on here, we should see a lot of debug events because they are, we've turned on the collection of the security events from the system. 39 00:03:15,200 --> 00:03:22,420 And just to point out here, we're on a Windows device, and we're actually collecting this event information through WMI. 40 00:03:22,860 --> 00:03:25,380 Getting it from the event log. 41 00:03:25,440 --> 00:03:31,300 And then, finally, if we look at the performance tab, these are general performance statistics that are being collected about the device. 42 00:03:31,880 --> 00:03:36,600 And is there a way to, sort of, like, peer into the application performance on the machines? 43 00:03:36,720 --> 00:03:40,340 Or do you, sort of, just only track the asset and inventory of them? 44 00:03:40,340 --> 00:03:43,660 And, of course, if the applications are sending out events, that would be included. 45 00:03:44,400 --> 00:03:44,600 Right. 46 00:03:45,040 --> 00:03:49,380 But, like, how far into the application layer of things do you guys typically go? 47 00:03:49,720 --> 00:03:52,660 So, let's jump to another device. 48 00:03:52,780 --> 00:03:54,360 So, this is a device that's out on the Internet. 49 00:03:54,600 --> 00:04:03,860 So, as I said before, we have lots of different ways we can collect information through SNMP, through SSH, through WMI, through JMX. 50 00:04:04,240 --> 00:04:11,420 And we're going to actually be adding VMware's proprietary API to collect information from Virtual Center. 51 00:04:11,920 --> 00:04:13,400 But here's the device that's on the Internet. 52 00:04:13,640 --> 00:04:17,060 And we're collecting information through SSH. 53 00:04:17,400 --> 00:04:20,860 And you can see we get pretty much the same information. 54 00:04:21,520 --> 00:04:26,460 Here we're looking at the same OS page as we saw before. 55 00:04:26,600 --> 00:04:31,740 If we drill in, we'll see the same statistics being collected, all of this over SSH. 56 00:04:32,160 --> 00:04:36,480 And I dropped in here to show you some application monitoring that we're doing. 57 00:04:37,080 --> 00:04:40,900 So, here, again, you see, kind of, the OS statistics that we had before. 58 00:04:41,520 --> 00:04:44,680 But if I scroll down, here we're collecting MySQL information. 59 00:04:45,400 --> 00:04:48,720 And we're getting pretty detailed information about the MySQL database. 60 00:04:49,020 --> 00:04:54,060 And then, finally, just kind of walking along the different kinds of application stuff that we can do. 61 00:04:54,480 --> 00:04:56,760 Here's a machine running Tomcat. 62 00:04:57,380 --> 00:05:02,300 And, again, we have the stats, the normal OS stats. 63 00:05:02,460 --> 00:05:07,100 But if we scroll down, we'll see that we have Tomcat information. 64 00:05:07,100 --> 00:05:14,520 So, here we've got the number of threads, the CPU time that it's using, some different kinds of Tomcat stats. 65 00:05:15,400 --> 00:05:21,800 And if we look back at the templates on this device, you'll see that there's two templates. 66 00:05:21,960 --> 00:05:28,980 One for the kind of core metrics that you want to monitor in Tomcat and one for the basic stuff in a device. 67 00:05:29,220 --> 00:05:34,940 And a lot of our Zenpacks are templates for monitoring different kinds of applications. 68 00:05:34,940 --> 00:05:36,940 Like, we have an Exchange ZenPack. 69 00:05:37,260 --> 00:05:38,780 We've got a JBoss ZenPack. 70 00:05:38,840 --> 00:05:46,220 So, let's just look at one of our ZenPacks that's for ESX. 71 00:05:46,620 --> 00:05:49,880 So, here is a VMware ESX server. 72 00:05:50,300 --> 00:05:53,920 And we're collecting information about it similar to what we did before. 73 00:05:54,080 --> 00:06:00,980 But this server is actually, it's a device, but it's actually a subclass of device, which is an ESX server. 74 00:06:01,780 --> 00:06:07,840 And one of the ways that it's different is it has a list of all the guests that are running on that host, the ESX host. 75 00:06:08,600 --> 00:06:10,780 And, again, we've done this all through auto-discovery. 76 00:06:11,400 --> 00:06:22,380 So, here if we look at, if we drill into one of the actual guests, well, you can see we have lots of different stats about the guest just at this kind of summary level. 77 00:06:22,980 --> 00:06:28,660 But you can drill in here and see VMware provided statistics about that guest. 78 00:06:29,080 --> 00:06:30,540 And, again, we have a template system. 79 00:06:30,540 --> 00:06:33,560 So, you can actually, you know, decide for yourself what you want to see. 80 00:06:34,400 --> 00:06:44,900 But this is important because when you look at normal OS stats on a guest, they're typically not that accurate because lots of fancy stuff is happening underneath the guest. 81 00:06:45,140 --> 00:06:47,640 Like, it's changing the amount of CPU time that one has. 82 00:06:47,720 --> 00:06:50,880 So, if you look at CPU utilization, it might not be that accurate. 83 00:06:51,000 --> 00:06:53,260 So, you might look here to find that information. 84 00:06:54,020 --> 00:06:56,520 But we also link to the actual device. 85 00:06:56,600 --> 00:07:00,100 So, you can actually drill in directly to the guest that's running on that server. 86 00:07:00,580 --> 00:07:00,860 Okay. 87 00:07:01,560 --> 00:07:02,420 Yeah, that makes sense. 88 00:07:03,340 --> 00:07:07,040 So, you can peer down all the way into the guest. 89 00:07:07,120 --> 00:07:09,720 You can sort of bridge the virtualization gap there, if you will. 90 00:07:10,260 --> 00:07:10,660 Exactly. 91 00:07:10,660 --> 00:07:16,160 Now, let me drop into our reporting system and we can take a look at that. 92 00:07:16,360 --> 00:07:17,780 We have different kinds of reports. 93 00:07:17,780 --> 00:07:25,440 Some are kind of tabular summary reports and then we have lots of different graph reports. 94 00:07:25,640 --> 00:07:38,120 So, first, if we look at the tabular reports, here's a report that's showing all the software in the system and giving you counts of how many pieces of software we found in the system. 95 00:07:38,380 --> 00:07:45,280 So, this is the high-level description of it over here and then the count that's actually there. 96 00:07:45,440 --> 00:07:57,600 So, we can actually sort in reverse order by count and see, you know, we've got seven different VMware Linux kernels, for instance. 97 00:07:57,600 --> 00:08:05,340 And then, if we drop back up here, we could go into a report that's kind of what people call top ten, usually. 98 00:08:05,960 --> 00:08:09,040 But we usually go across the whole thing. 99 00:08:09,180 --> 00:08:10,040 So, it's top in. 100 00:08:10,480 --> 00:08:15,320 So, here's every file system that we found in the system and the percentage of utilization. 101 00:08:15,320 --> 00:08:22,980 Is there sort of like a reporting API so you could plug other reporting engines in there if you wanted to do just more crazy, wacky, advanced reporting? 102 00:08:23,680 --> 00:08:24,540 Exactly, yeah. 103 00:08:24,680 --> 00:08:29,220 And, you know, I sound like a broken record, but, of course, you can do that through Zenfax. 104 00:08:29,720 --> 00:08:29,980 Right. 105 00:08:30,740 --> 00:08:36,300 We have a UI-based, a couple of different UI-based reporting systems. 106 00:08:36,680 --> 00:08:46,400 One, back there in device reports where I was, you can make different kinds of reports by, you know, filtering on certain kind of devices and showing different kinds of columns. 107 00:08:47,240 --> 00:08:51,760 But another kind of report you can do through the UI is these graph reports. 108 00:08:51,760 --> 00:09:00,160 And what they let you do are take the graphs that we've seen throughout the system and put them all into a single page that you can look at. 109 00:09:00,480 --> 00:09:01,900 And, again, we use this. 110 00:09:01,980 --> 00:09:06,940 This is one of the things that I was talking about that we have sent to us every day. 111 00:09:07,560 --> 00:09:18,640 So, if we look here at, like, the gateways report, this is going to be all the graphs from the Annapolis and Austin interface stats. 112 00:09:19,280 --> 00:09:23,580 So, you can see, you know, during the day, there's a lot more activity than there is at night. 113 00:09:24,100 --> 00:09:30,040 And this brown line here is actually a predictive threshold or an automated threshold. 114 00:09:30,500 --> 00:09:34,920 So, when it's actually fired, there's yellow here. 115 00:09:35,380 --> 00:09:38,800 And then, you know, when it comes back in line, that's that. 116 00:09:39,040 --> 00:09:43,220 And we call this, it's an enterprise feature we call predictive thresholding. 117 00:09:43,220 --> 00:09:49,180 Right, so you can get a quick sense of, like, if things are exceeding your baselines of acceptability, if you will. 118 00:09:49,740 --> 00:09:49,980 Right. 119 00:09:50,120 --> 00:09:51,640 And you don't have to manually configure it. 120 00:09:51,760 --> 00:09:56,360 You know, a lot of times you just set a threshold at 95% disk utilization. 121 00:09:56,700 --> 00:09:58,800 And this is a little bit easier to do. 122 00:09:59,040 --> 00:09:59,240 Right. 123 00:09:59,520 --> 00:10:06,860 It's always a nice feature to have that's sort of like the, you can automate the figuring out of your baseline so you can think less, right? 124 00:10:07,240 --> 00:10:07,680 Exactly. 125 00:10:08,120 --> 00:10:12,180 If you sort of, like, assume that the system was running okay over this period of time. 126 00:10:12,280 --> 00:10:14,440 So, if it's like this in the future, everything's cool. 127 00:10:15,180 --> 00:10:17,120 And you just stick to that brown line as it were. 128 00:10:17,120 --> 00:10:21,420 So, now I just want to show real quick some of our fancy graph navigation. 129 00:10:21,680 --> 00:10:25,940 So, you can actually zoom into different parts of the graph. 130 00:10:26,480 --> 00:10:28,120 You can scroll back and forth. 131 00:10:28,580 --> 00:10:32,120 And you see, as I'm changing it, all of the graphs in this report are linked together. 132 00:10:32,240 --> 00:10:36,720 So, there's kind of a correlated view of all the information you're seeing on one page. 133 00:10:36,880 --> 00:10:43,600 Finally, as far as reports go, those are reports that we've grouped together that were defined in different parts of the system. 134 00:10:44,180 --> 00:10:54,060 But we have a different kind of report that actually lets you view all of the stuff, or groups of stuff, from lots of different locations. 135 00:10:54,720 --> 00:10:57,480 Now, it's probably not the most clear explanation. 136 00:10:58,340 --> 00:10:59,560 But here, let me show you. 137 00:10:59,720 --> 00:11:01,000 Let me give you an example of it. 138 00:11:01,320 --> 00:11:02,240 So, here's a switch. 139 00:11:02,320 --> 00:11:04,540 This is our switch in our colo space. 140 00:11:04,740 --> 00:11:10,240 And what I'm showing here are all the interfaces on that switch, all grouped together into one graph. 141 00:11:10,320 --> 00:11:13,920 So, we don't actually have a graph defined this way anywhere else in the system. 142 00:11:14,140 --> 00:11:16,020 You know, there we usually have per interface. 143 00:11:16,160 --> 00:11:22,340 But here we have one graph that's a stack graph of everything, every interface on this switch that's active. 144 00:11:22,420 --> 00:11:22,560 Yeah. 145 00:11:22,700 --> 00:11:25,560 And I don't know, Coté, maybe it's, you know, coming through or maybe it's more obvious. 146 00:11:25,620 --> 00:11:32,280 But these are really the reports that I think we think that management usually wants to see, you know, sort of like, hey, show me all my Unix servers. 147 00:11:32,420 --> 00:11:33,860 Where's, you know, what's being utilized? 148 00:11:33,960 --> 00:11:34,800 What isn't being utilized? 149 00:11:34,980 --> 00:11:35,680 What's going on? 150 00:11:35,760 --> 00:11:39,200 So, I think it's sort of like, you know, trying to cater to both, you know, kind of audiences, right? 151 00:11:39,220 --> 00:11:40,880 The IT guys are going to be in the alerts, right? 152 00:11:40,960 --> 00:11:43,520 The management guys are kind of looking at this global view. 153 00:11:43,580 --> 00:11:46,720 And that's kind of what these reports kind of are always trying to reinforce. 154 00:11:46,920 --> 00:11:48,980 Like, here's your whole, you know, whatever it is. 155 00:11:49,040 --> 00:11:50,900 Here's X and here's how it's being utilized. 156 00:11:51,460 --> 00:11:51,560 Right. 157 00:11:51,680 --> 00:11:53,640 It's just a user is logged into this, right? 158 00:11:53,700 --> 00:11:59,620 So, if a user came in and, like, made a report, like, is there a way to sort of share that report with other people? 159 00:11:59,780 --> 00:12:01,640 Or is it already assumed? 160 00:12:01,800 --> 00:12:07,580 Like, how does, when you create something like that, how does it get spread out to the rest of the users in the system? 161 00:12:08,160 --> 00:12:12,820 Well, people can, you know, everybody who has the permission can see that report. 162 00:12:13,220 --> 00:12:14,640 And it's a static URL. 163 00:12:14,640 --> 00:12:18,340 So, they can, you could, you know, pass them a URL and they could go view the report. 164 00:12:19,040 --> 00:12:20,540 You can print reports out. 165 00:12:20,680 --> 00:12:22,760 We have a print view of all the reports. 166 00:12:22,860 --> 00:12:24,880 And, again, you can email reports to people. 167 00:12:25,220 --> 00:12:32,840 So, if you wanted everybody to see it that way, you could, you know, generate an email and send it to the people that you wanted to see it. 168 00:12:32,860 --> 00:12:41,880 I just wanted to show you another interesting part of visualization of the fact that we have this distributed monitor system. 169 00:12:41,880 --> 00:12:45,220 So, here we are in enterprise. 170 00:12:45,420 --> 00:12:52,700 We have this way of, from the central GUI, managing collectors that are in lots of different locations. 171 00:12:53,440 --> 00:12:56,900 So, here's a collector that's local to this Xeno server. 172 00:12:57,060 --> 00:13:00,920 But, here we have one that's actually out in a different location. 173 00:13:02,580 --> 00:13:13,940 And it allows you to do things like get a list of the demons that are running, what their status is, and you can stop and start them, things like that. 174 00:13:14,980 --> 00:13:17,180 So, it's a pretty powerful tool. 175 00:13:17,320 --> 00:13:21,800 You can actually deploy a collector through this screen as well. 176 00:13:21,820 --> 00:13:25,180 Once you have that collector out there, what are the other sort of management things you can do? 177 00:13:25,180 --> 00:13:29,720 Like, do you only manage the collector itself, or can you actually, like, make things happen on the machine with it? 178 00:13:30,560 --> 00:13:33,980 So, mostly it's for managing the machine. 179 00:13:34,120 --> 00:13:35,620 But, you know, you can do some troubleshooting. 180 00:13:35,780 --> 00:13:38,800 Like, here's the log file for one of the demons. 181 00:13:40,440 --> 00:13:41,960 You can view its configuration. 182 00:13:42,320 --> 00:13:43,860 You can actually modify its configuration. 183 00:13:44,320 --> 00:13:48,360 So, different parameters that you need to set could be set through there. 184 00:13:49,940 --> 00:13:57,480 But, as far as, like, executing a command remotely, that's not something we do, we allow through the UI. 185 00:13:58,040 --> 00:14:04,540 But, we are doing things like, when we do auto discovery, we connect to that remote collector to perform the auto discovery. 186 00:14:04,540 --> 00:14:12,400 So, it's not, again, it's not something you have to do from the central box, and you have to do some fancy networking to get to that remote location. 187 00:14:13,240 --> 00:14:16,080 But, the auto discovery actually happens on the remote location. 188 00:14:16,340 --> 00:14:16,560 Okay. 189 00:14:16,680 --> 00:14:19,720 But, there's not, like, service restarting and things like that? 190 00:14:20,160 --> 00:14:22,720 And, you know, like, generalized commands. 191 00:14:22,720 --> 00:14:23,280 Yeah, yeah. 192 00:14:23,920 --> 00:14:24,880 No, no. 193 00:14:25,120 --> 00:14:35,000 I mean, we've focused, a lot of the emphasis is on monitoring and not more on, kind of, changing configurations. 194 00:14:35,000 --> 00:14:40,400 There's other tools that are, you know, that do that, like Parrot and CFEngine. 195 00:14:42,160 --> 00:14:51,080 But, we do allow you to take corrective action through, you know, an event that happens that kicks off a command line process. 196 00:14:51,760 --> 00:14:52,240 Oh, right, right. 197 00:14:52,300 --> 00:14:57,620 So, you could actually script, like, automating, fixing things, if you were comfortable with that. 198 00:14:58,120 --> 00:14:58,360 Yeah. 199 00:14:58,480 --> 00:14:59,140 Based on events. 200 00:14:59,220 --> 00:14:59,920 Yeah, that makes sense. 201 00:15:00,680 --> 00:15:04,140 And, you can also run commands from the UI. 202 00:15:04,340 --> 00:15:08,580 So, here, I'll just run a host command from the UI. 203 00:15:08,580 --> 00:15:18,300 So, you can, you could, you know, you could actually, you could do a restart of a remote computer just using a command that you've configured within Xenos. 204 00:15:18,600 --> 00:15:18,900 Okay. 205 00:15:19,440 --> 00:15:19,980 That's interesting. 206 00:15:20,180 --> 00:15:23,820 So, that's a kind of an overview of Xenos. 207 00:15:24,000 --> 00:15:30,980 I could talk about some more things, but that kind of gives you a sense of what the system does and the real, the power that it has. 208 00:15:31,220 --> 00:15:31,640 Yeah, no. 209 00:15:31,740 --> 00:15:34,980 It was a good overview of, like, the primary interfaces there. 210 00:15:35,220 --> 00:15:35,960 That's good stuff. 211 00:15:36,480 --> 00:15:39,620 Well, was there anything else either of you wanted to add while we're here? 212 00:15:40,320 --> 00:15:48,520 I think just to let everybody know, you know, out there that, you know, Xenos Core is available for free download and a very active community out there. 213 00:15:48,600 --> 00:15:52,840 So, people that want to, you know, get up and running definitely should go take it out and get involved in the community. 214 00:15:53,020 --> 00:15:57,620 I know Eric and, really, the whole Xenos team, we're always looking at that for feedback and how people are doing. 215 00:15:57,800 --> 00:16:00,460 So, we definitely want, you know, the more users, the better for us. 216 00:16:02,380 --> 00:16:02,740 Absolutely. 217 00:16:03,220 --> 00:16:03,920 Well, that sounds good. 218 00:16:03,960 --> 00:16:06,260 Well, thanks for taking all this time to show this to us. 219 00:16:07,140 --> 00:16:07,800 Well, thank you. 220 00:16:08,460 --> 00:16:09,460 Thank you, Kotei. 221 00:16:10,320 --> 00:16:40,300 Thank you.