This presentation covers: - Definition of APM - Comparison of APM approaches & vendors (scenario, agent and network-based) - Challenges of Cloud & Virtualization for APM vendors - Performance Vision's Virtual Appliance offering For more information, please visit: http://www.securactive.net

1. Performance Vision
March 2012 © 2012 SecurActive. Proprietary and Confidential

2. Agenda
• Corporate presentation
• What’s the use of an APM?
• The different APM approaches
• Challenges raised by virtualization and
cloud
• Two responses from Performance
Vision
• Why a Virtual Appliance?
• Questions / Answers
March 2012 © 2012 SecurActive. Proprietary and Confidential

3. Agenda
• Corporate presentation
• What’s the use of an APM?
• The different APM approaches
• Challenges raised by virtualization and
cloud
• Two responses from Performance
Vision
• Why a virtual Appliance?
• Questions / Answers
March 2012 © 2012 SecurActive. Proprietary and Confidential

4. Corporate profile
Leading European vendor on:
Application Performance
Management (APM)
Network Behavior Analysis (NBA)
Strong footprint in Western Europe
500 customers
30 certified resellers
Based in Paris
Innovative, fast growing
Listed in Deloitte’s Fast50
Red Herring Global Award winner
March 2012 © 2012 SecurActive. Proprietary and Confidential

5. Performance Vision Key References
March 2012 © 2012 SecurActive. Proprietary and Confidential

6. Performance Vision Concept
Show the Performance of applications and
infrastructure as Users Experience it!
IT
Troubleshooting Monitoring
Intelligence
March 2012 © 2012 SecurActive. Proprietary and Confidential

7. Performance Vision Core Functions
• Usage trends • Network Quality Indicators
• Who does what • Congestion & degradations
• Bandwidth • ICMP / TCP / non IP
• Traffic mapping anomalies
• Top reports • Packet capture
Usage Network
Application SIP
• QoE Reporting
• Troubleshooting
workflow • Quality of Service (MOS)
• DNS performance & • Volume reporting
errors • Diagnostic at call level
March 2012 © 2012 SecurActive. Proprietary and Confidential

8. Performance Vision Top Down = Successful & Faster Resolution
• Fast resolution
• Retrospective analysis
• Answers to « where is
the pain coming from? »
• Usable by whole IT team
(Collaborative vs.
Expert)
March 2012 © 2012 SecurActive. Proprietary and Confidential

9. Performance Vision Fast & non-intrusive Implementation
All-in-one Appliance
Capture traffic through
SPAN or TAP (3-16
listening port per
apliance)
100% non intrusive:
• No traffic overhead
• No network change
• No downtime
• Agentless
Distributed capture
support
March 2012 © 2012 SecurActive. Proprietary and Confidential

10. Agenda
• Corporate presentation
• What’s the use of an APM?
• The different APM approaches
• Challenges raised by virtualization and
cloud
• Two responses from Performance
Vision
• Why a virtual Appliance?
• Questions / Answers
March 2012 © 2012 SecurActive. Proprietary and Confidential

11. Performance Vision Before the Cloud…
March 2012 © 2012 SecurActive. Proprietary and Confidential

12. Survey 2011: the issue with application performance…
• 96% of the respondents have experienced « slowdowns »
• For 49%, they are permanent or frequent…
• 78% of the incidents have a significant impact on the end
user productivity.
• Despite traditional monitoring tools, 94% of the network
administrators do NOT have a satifsactory visibility on
network activities.
– (71% have a SNMP monitoring console, 60% a packet analyzer, 64% a WAN optimizer)
March 2012 © 2012 SecurActive. Proprietary and Confidential

13. Performance Vision What are the Challenges around APM?
Performance
is subjective.
March 2012 © 2012 SecurActive. Proprietary and Confidential

14. Performance Vision
March 2012 © 2012 SecurActive. Proprietary and Confidential

15. Performance Vision You don’t Know Where it Comes From
March 2012 © 2012 SecurActive. Proprietary and Confidential

16. Performance Vision What can APM bring?
Measure end user experience
Reduce time to solve performance degradations
Implement collaborative problem solving in IT
Facilitate Continuous Improvement
Manage changes, deployments and migrations with the right info
March 2012 © 2012 SecurActive. Proprietary and Confidential

17. Performance Vision
 You have a performance problem,
 You do not know where it comes from…
 You can…
FIND OUT IN 4 CLICKS!
March 2012 © 2012 SecurActive. Proprietary and Confidential

18. Performance Vision Be Informed!
Some users suffered from a performance degradation
On the application Labo RD1 at 10:44 am this morning.
March 2012 © 2012 SecurActive. Proprietary and Confidential

19. Performance Vision
Yellow: Network RT
The blue peak indicates there was Blue: Server RT
a server response time issue Red: Data transfer time
Only one server and one user group
were involved.
March 2012 © 2012 SecurActive. Proprietary and Confidential

20. Performance Vision
We can see that only one user
was impacted.
March 2012 © 2012 SecurActive. Proprietary and Confidential

21. Performance Vision
For that specific conversation
we can see the degraded server response time.
By clicking on « PCAP »…
You can view the exact query
that caused the slowdown.
March 2012 © 2012 SecurActive. Proprietary and Confidential

22. Performance Vision
Now… You can fix your problem!
March 2012 © 2012 SecurActive. Proprietary and Confidential

23. Agenda
• Corporate presentation
• What’s the use of an APM?
• The different APM approaches
• Challenges raised by virtualization and
cloud
• Two responses from Performance
Vision
• Why a virtual Appliance?
• Questions / Answers
March 2012 © 2012 SecurActive. Proprietary and Confidential

24. Performance Vision APM: Three Different Approaches
1. End User Experience Monitoring
2. Network based APM
3. Agent based APM
1. EUE Montiroing 3. Agent Based
Network
2. Network Based
March 2012 © 2012 SecurActive. Proprietary and Confidential

25. Performance Vision APM Working Methods
End User • A robot replays predefined scenarios to evaluate
the overall end user transaction time.
Experience
Agent based • Agents on all servers in the application chain
monitor the execution of the application at code
APM and system resource level.
• A set of probes captures the application traffic
Network over the network (between clients and front
server and eventually within the application
based APM chain).
March 2012 © 2012 SecurActive. Proprietary and Confidential

26. Performance Vision Benefits & Drawbacks
APM Type End User Experience Agent-based Network-based
 Is there a slowdown?
 What part of the application
 What is the evolution of Quality  Which applications and users are
chain is causing the slowdown?
Questions of experience for the standard impacted?
 What transaction is slow?
answered operations of my key  What is causing the slowdown
 What part of the code is
application? (network ,server, data transfer)
executed slowly?
 For which transactions?
 No vision of application delivery
 Not in line with real use on the network  No vision of the root cause when
Limits  Not explanatory (does not tell  No vision of application server led degradation (code,
you why or what is failing) environment (network, other server resources…)
applications…)
 Agent deployed on each server
 Agent deployed on each client or
 Impact on server performance  Traffic capture by SPAN or TAP
Constraints robot
 Pricing per server or application
 Configuration of each scenario
chain
 All applications distributed over
Scope  One or few critical applications  One or few critical applications
the network
 Helpdesk, reporting for
Main Users  Development teams, Q/A.  Infrastructure team, helpdesk
management
March 2012 © 2012 SecurActive. Proprietary and Confidential

27. Agenda
• Corporate presentation
• What’s the use of an APM?
• The different APM approaches
• Challenges raised by virtualization and
cloud
• Two responses from Performance
Vision
• Questions / Answers
March 2012 © 2012 SecurActive. Proprietary and Confidential

28. Virtualisation Challenges
• Which Virtual machine
can talk to which other?
• How can I make sure the
Security policy is applied?
Issues
Virtual
Networks
Dynamic
• Loss of visibility: how to Resource
capture virtual traffic?
• Specific network
Allocation
performance issues
• What’s where and when?
• A data center is not a
physical place anymore…
March 2012 © 2012 SecurActive. Proprietary and Confidential

29. Cloud Challenges
• Variability: where are
my servers now?
• No vision of application
Lack of chain
Visibility
No
Control on
Servers
• No Check/Performance
measurement is
The Impact of
possible on the servers. WAN
Transmission
• Quality of transmission
• Name resolution (DNS)
performance
March 2012 © 2012 SecurActive. Proprietary and Confidential

30. Agenda
• Corporate presentation
• What’s the use of an APM?
• The different APM approaches
• Challenges raised by virtualization and
cloud
• Two responses from Performance
Vision
• Why a virtual Appliance?
• Questions / Answers
March 2012 © 2012 SecurActive. Proprietary and Confidential

31. Performance Vision What’s the Issue with APM
Virtualization?
SRV SRV SRV SRV SRV SRV
ESX
SRV SRV SRV SRV SRV SRV
Servers
SRV SRV SRV SRV SRV SRV
Server
Switches
Core
Switches
Network
March 2012 © 2012 SecurActive. Proprietary and Confidential

32. Performance Vision Key Success Factors
SRV SRV SRV SRV SRV SRV
ESX
SRV SRV SRV SRV SRV SRV
Servers
SRV SRV SRV SRV SRV SRV
Server
Switches
Core
Switches
Make sure you capture traffic
Make sure you capture traffic Network within the virtualization
whichever network path is chassis.
used: distributed capture.  With no architecture
 Easy to deploy change
 Low impact on network  Limited impact on
 Affordable infrastructure load
March 2012 © 2012 SecurActive. Proprietary and Confidential

33. Performance Vision How does Performance Vision Respond?
SRV SRV SRV SRV SRV SRV
ESX
SRV SRV SRV SRV SRV SRV
Servers
SRV SRV SRV SRV SRV SRV
Server
Switches
Core
0,2-05% reporting flow
Switches
Distributed solution: Network Several options to monitor
 All APS-1000+ appliance virtual traffic with
support external pollers. Performance Vision:
 Only 0,2-0,5% reporting  Virtual pollers
flow  Virtual TAPs support
 A new poller is installed in
< 1 hour.
 You go distributed from
24k€; 2012
March
pollers from <6k€. © 2012 SecurActive. Proprietary and Confidential

34. Performance Vision 3 ways to monitor virtual traffic
SRV SRV SRV
SRV SRV SRV
SRV SRV SRV
PV Virtual
Express PV Virtual Poller
SSH (0,2-0,5%) GRE (100%)
HTTPS
PV (Virtual) APS PV (Virtual) APS
PV Virtual Express: PV Virtual Poller: Virtual TAP:
 Promiscuous mode or  Promiscuous mode or  No promiscuous mode,
SPAN on Virtual switch SPAN on Virtual switch neither SPAN
 HTTP access to the  SSH export to an APS prerequesites
Virtual Express for appliance (0,2-0,5%)  GRE export to an APS
queries appliance (100%)
March 2012 © 2012 SecurActive. Proprietary and Confidential

35. Performance Vision Synopsis - Intra-ESX Capture
Promiscuous Alternative Switch Alternative Switch Configuration
Native Vswitch Virtual TAP
Mode Openvswitch Nexus / Connect Change
VSwitch allows Openswicth is an A Virtual TAP enables You can change the
These Cisco & HP
activation of open-soucre filtered traffic capture VLAN configuration (to
products are
Native vswitch does « promiscuous » alternative to vswitch. (for specific VMs and force the traffic
alternatives to
not offer any port mode. It enables It is used by Xen of ports for example) and between VMs to be
Description Vswitch. They offer
mirroring feature. forwarding all packets Citrix. It offers local to send a copy of the routed through the
extended features of
to all the VM within a and remote port traffic through a GRE physical switches) or
port mirroring (SPAN,
portgroup (including mirroring features Tunnel to the analysis the affinity rules with
RSPAN, ERSPAN).
your analysis device). (SPAN & RSPAN). device. the same objective.
Enables the traffic
analysis through a Enables fine tuned Enables the analysis of
Enables fine tuned Enables fine tuned
virtual poller / traffic capture. inter-VM traffic on the
Benefits None traffic capture. traffic capture.
appliance without any Filtering on traffic physical network.
No license cost.
architecture change. capture. No License cost.
No license cost.
Licence Enterprise Plus
Creation of portgroups Architecture change in License cost.
is necessary.
Prerequisites Native Activation of the the ESX. Support of ESX4 (and Configuration change.
Architecture change in
promiscuous mode not version 5)
the ESX.
The analysis device
has to be inside the
ESX. If the analysis device is
Security consideration The analysis device The analysis device outside of the ESX, Load on the network
Limits -
around the has to be in the ESX. has to be in the ESX. beware of the traffic interfaces of the ESX.
promiscuous mode load on the interfaces.
(even if limited to a
portgroup).
March 2012 © 2012 SecurActive. Proprietary and Confidential

36. Performance Vision What’s the issue with AppPerf in
Cloud Provider DC1
the Cloud?
SRV
Cloud Provider DC2
SRV
SRV
SRV SRV
LAN
SRV
DNS
Questions raised:
• Bandwidth & internet transmission quality are key.
• DNS response times have a stronger impact.
• Cannot recognize a Cloud App per IP addressing  URL based recognition.
• Change in the Cloud architecture impacts distance  latency  EU Experience.
• No vision of Application chains. Agent based is not an option.
March 2012 © 2012 SecurActive. Proprietary and Confidential

37. Performance Vision
Cloud Provider DC1
SRV
Cloud Provider DC2
SRV
SRV
SRV SRV
LAN
SRV
DNS
Performance Vision:
 Network based
 Reports quality of network link to the Internet
 Reports DNS performance
 Recognizes applications based URL Regex
March 2012 © 2012 SecurActive. Proprietary and Confidential

38. Agenda
• Corporate presentation
• What’s the use of an APM?
• The different APM approaches
• Challenges raised by virtualization and
cloud
• Two responses from Performance
Vision
• Why a Virtual Appliance?
• Questions / Answers
March 2012 © 2012 SecurActive. Proprietary and Confidential

39. Performance Vision Why a Virtual Appliance offering?
Virtual Appliance ≠ Virtual traffic capture
3 benefits in Virtual appliances:
1. TCO
2. Deployment
3. Virtual Traffic
March 2012 © 2012 SecurActive. Proprietary and Confidential

40. Performance Vision What’s a Virtual Appliance?
Exact copy of the physical appliance
• Product
• Features
In a software appliance
March 2012 © 2012 SecurActive. Proprietary and Confidential

41. Performance Vision 3 main use cases
Easier test drives
• No logistics
• Anyone will be able to download from the web
Entry level product
• Low TCO probe
• Low cost
• No logistics
• Fast & remote deployment
Virtual network capture
March 2012 © 2012 SecurActive. Proprietary and Confidential

42. Performance Vision How does it work?
Capture modes
• Physical interfaces in promiscuous mode
• Virtual machines in promiscous mode
• Receive traffic through a GRE tunnel (Virtual TAP)
Supported platforms
• VMWare ESX, ESXi (VMPlayer with restrictions)
• Supported configurations:
• RAM: 500Mb, 4Gb, 6Gb, 8Gb, 12Gb or 16Gb;
• CPU: 1, 4 or 8
Deployment methods
• Stand alone appliance
• Poller for an external collector (physical or virtual)
• Collector for other poller appliances (physical or virtual)
March 2012 © 2012 SecurActive. Proprietary and Confidential

43. Performance Vision Benefits and limits
Benefits Limits
• Reduced acquisition cost • VMWare configuration
• No logistics for remote installation prerequesites
• Virtual traffic capture • Performance for high volume
• Backup facility collectors due to I/O performance
March 2012 © 2012 SecurActive. Proprietary and Confidential

44. Performance Vision Product set
Trial Virtual Virtual Virtual
Express Appliance Poller Appliance
Supported APS NPS | APS APP NPS | APS
modules
Interfaces 3 3 3 - 10 3 – 10
Retention time 15 days 15 days N/A 360 days
Reporting No No No Yes | Yes
Collector for No No No No | Yes
distributed
poller
Telephone No Option| Option Yes Yes | Yes
support included
in maintenance
Listprice Free for 15 days 3 900€ | 6 900€ 5 900€ 9 900€ | 17 900€
March 2012 © 2012 SecurActive. Proprietary and Confidential

45. Performance Vision
Possible
implementations
March 2012 © 2012 SecurActive. Proprietary and Confidential

46. Performance Vision Single Node
Performance Vision Appliance
Central Site
Local
Performance Vision
March 2012 © 2012 SecurActive. Proprietary and Confidential

47. Performance Vision Single Node
Performance Vision Appliance
Internet
Firewall
Admin Port
Core Switches Monitoring Port(s)
Performance Vision
Applications, Databases,
Intranet, Files, Mails... Users Users
March 2012 © 2012 SecurActive. Proprietary and Confidential

48. Performance Vision Single Node
Virtual Performance Vision
Internet
VMWare ESX
Firewall
Virtual Switch
Admin Port Virtual
Performance
Monitoring Port(s) Vision
Core Switches
Physical Virtual
NIC NIC
Applications, Databases,
Intranet, Files, Mails... Users Users
March 2012 © 2012 SecurActive. Proprietary and Confidential

49. Performance Vision Virtual Poller
Remote Site Remote Site Remote Site
Virtual Poller Appliance Poller Appliance Poller
Network
Central Site
Local
Appliance Collector
March 2012 © 2012 SecurActive. Proprietary and Confidential

50. Performance Vision Distributed Environment
Performance Vision Mix
Remote Site
Switches
Internet WAN
SPV Virtual
Pollers or
Firewall Appliances
Admin Port
Core Switches Monitoring Port(s)
Appliance Collector
Applications, Databases,
Intranet, Files, Mails... Users Users
March 2012 © 2012 SecurActive. Proprietary and Confidential

51. Agenda
• Corporate presentation
• What’s the use of an APM?
• The different APM approaches
• Challenges raised by virtualization and
cloud
• Two responses from Performance
Vision
• Why a Virtual Appliance?
• Questions / Answers
March 2012 © 2012 SecurActive. Proprietary and Confidential