Combatting the blind spots in your virtualised data centre

Controlling costs is paramount as data centre managers are expected to continually add more equipment and then maintain it – most often without any additional staff. This has created a challenge that technology has been asked to solve. Fortunately, virtualisation has been up to the task.

Virtualisation has been one of the clear technology success stories. Data centre managers continue to invest in this technology. In fact, IDC states that during 2009, the tipping point was crossed where more virtual machines than physical hosts were deployed.

While virtualisation has many benefits, it has also created some blind spots in the data centre. This comes about because most of the virtualised data centre traffic never makes it to the top of the rack where it can be monitored.

Blind spots can hide malware, virtual machine (VM) performance problems, or other issues that you typically won’t know about until you have an incident. An incident that often takes a while to identify, diagnose, and then remediate. All of this creates additional costs and attention from senior management and other groups—the kind of attention you probably don’t want.

In addition, you may have issues being able to demonstrate compliance to regulatory standards (like SOX, PCI, and HIPAA) because you can’t get proper access to the data. This is another headache you probably don’t want either.

A Visibility Architecture is the way to address these issues. The basis of a visibility architecture starts with creating a plan. Instead of just adding components as you need them at sporadic intervals (i.e. crisis points), step back and take a holistic view of where you are and what you want to achieve. This one simple act will save you time, money, and energy in the long run.

Intelligence is part of a good Visibility Architecture, providing application and session-aware visibility. These are the Layer 7 application oriented components that provide high-value contextual information about what is happening with your network.

And there are also the management components that provide control of the entire Visibility Architecture. This includes everything from global element management, to policy and configuration management, to data centre automation and orchestration management.

5 Steps to Improving Visibility
1. Capacity shouldn’t limit access to information. With all of the tools and functionality that you need nowadays, it’s easy to overload your network. Taps allow you to create access points in your network for more tools and packet brokers.
2. Reduce unnecessary data and cost. Monitoring and security tools can be very expensive, especially when you get about 10 Gigabit Ethernet. So take advantage of filtering capabilities, especially systems that are GUI-based with robust filtering engines.
3. Get the ROI you want from your existing monitoring and security tools. Besides filtering, network packet brokers have the valuable ability to load balance and aggregate monitoring data. A proper packet broker can spread the 10GE data packets across multiple 1GE tools so that you don’t overload as much, if at all, your lower speed tools.
4. Reduce mean time to repair via automation. Automating responses to incident triggers picked up in monitoring traffic is crucial to gaining the most return on monitoring investments. Organisations that are able to optimise real-time reactions to performance issues or security problems tend to reap the most ROI.
5. Trend analysis. Data is necessary to anticipate when additional network capacity will need to be added, performance problems that might become serious problems or outages, and whether or not service-level agreements are being met.

Ultimately, packet data is the core of network monitoring. And the data needs to be accurate or else any business intelligence you derive from the data will be flawed. Using physical monitoring and security tools to monitor east-west traffic in a virtual environment, and virtual taps that are installed directly into the hypervisor at the kernel level provides an integrated, single solution. Such monitoring and security tools are able to obtain a single view of end-to-end data.

By having a Visibility Architecture in place, you can manage the entire solution as a whole - from the access layer, control layer, all the way to the application layer.