Maximizing Insight From Your Monitoring

Ryan Smith is a network engineer for Cervalis LLC, a premier provider of IT infrastructure and managed services.

Monitoring is critical to any organization’s network. Most organizations have at least one platform keeping an eye on things. Some larger organizations may even have multiple monitoring platforms looking at different sections of the network. While monitoring is a widely accepted best practice, some companies don’t dedicate the time, money and resources required to gain the most insight from a very powerful tool.

Monitoring is a simple game of polling. Among other things, monitoring systems ask devices in your network a wide array of questions. Is the interface up? How much traffic is on the interface? What’s the CPU doing? Where does memory utilization stand? Most monitoring platforms are capable of asking all of these questions and many more. The real differentiator comes down to how often they ask the question.

Out of the box, many of these platforms will be able to poll your devices every five minutes. For most deployments, this seems to fit the bill nicely. However, when it comes to truly understanding what your network and servers are doing, quicker polling periods become mandatory.

The three graphs below were all taken from the same circuit. The first uses a 10-minute polling period, the second a five-minute polling period, and the last, a one-minute polling period. At around 1:15 p.m. the one-minute polling period shows a clear spike in traffic to about 260Mbps. However, the five-minute polling period paints a different picture, catching the spike at around 210Mbps. The 10-minute polling period barely caught the spike at all. If your monitoring system is set to poll every five minutes or longer, you’re missing critical information.

Figure 1 - 10 Minute Polling Period

Figure 2 - FiveMinute Polling Period

Figure 3 - OneMinute Polling Period

Of course, there is a downside to polling more often: the creation of more data points. Let’s suppose you monitor 10 circuits for inbound traffic, outbound traffic, inbound errors and outbound errors. That means every polling period would generate 40 data points that need to be processed and stored in your monitoring system—not to mention the processing power it takes to query them when it comes time to run reports. Assuming a 10-minute polling period would mean that every hour generates 240 data points, while a five-minute polling period would double that number to 480 data points, and a one-minute polling period would grow the number to 2400 data points. And with all that for just 10 circuits, you will quickly see how things can get out of control.

To make matters worse, many companies often fail to dedicate the right amount of computing resources to support their monitoring platforms. Often times, the old company file server gets replaced and repurposed as a monitoring server, or, even more frightening, an old PC gets pulled off the shelf to play the role. Once this happens it becomes impossible to provide the monitoring software the hardware it needs to collect, process, and store all that polling information. What you’re left with is a system that works but doesn’t provide the best information.

When you select a monitoring platform, focus not only on the software you want to run, but also on the hardware on which you’ll run it. Work closely with the software vendor and clearly define how many objects you need to monitor, what values you need to monitor for, and how often you want to poll. Finally, request both the minimum system requirements as well as the hardware requirements that are unique to your deployment.

Industry Perspectives is a content channel at Data Center Knowledge highlighting thought leadership in the data center arena. See our guidelines and submission process for information on participating. View previously published Industry Perspectives in our Knowledge Library.