Copyright 2014 Splunk Inc. Splunk for VMware. Architecture & Design. Michael Donnelly, Sr. Sales Engineer

Transcription

1 Copyright 2014 Splunk Inc. Splunk for VMware Architecture & Design Michael Donnelly, Sr. Sales Engineer

2 Disclaimer During the course of this presentaeon, we may make forward looking statements regarding future events or the expected performance of the company. We caueon you that such statements reflect our current expectaeons and esemates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward- looking statements, please review our filings with the SEC. The forward- looking statements made in the this presentaeon are being made as of the Eme and date of its live presentaeon. If reviewed aqer its live presentaeon, this presentaeon may not contain current or accurate informaeon. We do not assume any obligaeon to update any forward looking statements we may make. In addieon, any informaeon about our roadmap outlines our general product direceon and is subject to change at any Eme without noece. It is for informaeonal purposes only and shall not, be incorporated into any contract or other commitment. Splunk undertakes no obligaeon either to develop the features or funceonality described or to include any such feature or funceonality in a future release. 2

3 Splunk for VirtualizaEon Prep queseons for today s discussion: Your Physical VMware environment: ESXi servers, vcenter servers Storage solueons Eed to VMware Network devices What are the problems you are hoping to solve? Which groups are affected? Are you familiar with Splunk already? What do you use Splunk for today? 3

4 Splunk Enterprise 6 Indexes Any Data from Any Source Log Files ConfiguraEons Messages Alerts Metrics Scripts Changes Tickets Sensors Security Custom ApplicaEons Networks Databases Servers Smartphones and Devices Virtual Machines Web Server 4

5 Splunk Enterprise 6 App Developers IT users Data Analysts Security Analysts Business Users VMware Admins Security Custom ApplicaEons Networks Databases Servers Any Machine Data Smartphones and Devices Web Services 5

6 Industry Leading Placorm for Machine Data Any Machine Data Opera9onal Intelligence Servers Online Services Security Web Services Networks GPS LocaEon Packaged ApplicaEons Search and Inves9ga9on Proac9ve Monitoring Opera9onal Visibility Real- 9me Business Insights Storage Desktops Messaging Custom ApplicaEons Online Shopping Cart Smartphones and Devices Telecoms Web Clickstreams RFID Call Detail Records Databases Energy Meters HA Indexes and Storage Commodity Servers 6

7 OpEmal VirtualizaEon At Splunk, we know that our customers want to maximize the usability of their investment into their virtualized environments. In order to get the best return on your investments, you need to your available resources To do this, one must know which servers are overtaxed, which are One must be about the known and hidden risks that are ocen present when virtualizing the environment. 7

8 Key Benefits Reduce MTTR Maximize ROI Reduce Costs Eliminate silos gain visibility into virtualizaeon health in relaeon to applicaeons, storage, operaeng systems, networks and other infrastructure components Improve infrastructure uelizaeon efficiencies and avoid over- provisioning with granular insights into resource consumpeon Reclaim and reuse unused resources aqer they are no longer needed avoiding a virtual sprawl with detailed analysis on your virtual assets I now have built- in visibility into latencies caused by my storage and impact to the applicaeon performance I can see how my workloads are using my vcpus and RAM, thus avoiding high CPU wait Emes and opemized resource uelizaeon. We ve recycled inaceve and abandoned VMs and avoided capital expenditure. 8

9 Virtual Datacenter Point SoluEons Too much complexity, too limle visibility Performance data and summaries are not enough VM tools keep summarized metrics, make it hard to idenefy specific problems VM Tools look at performance, but ignore log events VMware environment data alone isn t enough Solving end- user or applicaeon- level problems requires visibility across technology Eers, including OS and ApplicaEon data Point solueons offer only one piece of the puzzle Maintaining OperaEonal Health includes other dependencies: Storage, Network, DNS, DHCP, Firewall, Routers, etc. Maintaining muleple point solueons: increased costs, correlaeons by hand 9

10 Typical Splunk Deployment Network Infrastructure Splunk Environment SAN & NAS Networking CriEcal Infrastructure Servers AcEve Directory 10

11 Your Physical VMware Environment VMware environment Network Infrastructure Splunk Environment vcenter Server ESXi Hosts SAN & NAS Networking CriEcal Infrastructure Servers AcEve Directory 11

12 Your Actual Physical VMware Environment VMware environment Network Infrastructure Splunk Environment vcenter Server ESXi Hosts SAN & NAS Networking CriEcal Infrastructure Servers AcEve Directory 12

13 Your Full VMware Environment VMware environment Network Infrastructure Splunk Environment vcenter Server ESXi Hosts SAN & NAS Networking CriEcal Infrastructure Servers AcEve Directory 13

14 Demo 14

15 Integrated Insights Into Your VMware Environment Proac9ve Monitoring insights into problem spots and health issues Comprehensive Analy9cs and historical insights into performance, security, capacity, outlier and change tracking VMware vcenter Server(VC) APP APP OS OS VMware vsphere VM VM Explore Monitor Report End- to- end Visibility Scalable big data for visibility across all Storage Network Devices Physical Layer Servers Correlate 15

16 Splunk for VMware Architecture Physical VMware environment Network Infrastructure Splunk Environment vcenter Server Performance (API) vcenter Logs Splunk DCN ESXi logs ESXi Hosts SAN & NAS Networking CriEcal Infrastructure Servers AcEve Directory 16

17 THANK YOU Thank You

18 Deployment Details

19 Splunk for VMware Required ConnecEvity Physical VMware environment API: TCP 443 TCP 443 DCN TCP 8089 & 8008 Splunk Environment vcenter Server vcenter Logs: TCP 9997 TCP 9997 ESXi Hosts Syslog: TCP 1514 UDP 514 Syslog Server TCP 9997 SAN & NAS Networking 19

20 Deployment notes All of the ports meneoned in the previous slide are the default ports; Splunk can be adapted to use alternates. If you re using search head pooling there are addieonal details covered in the installaeon guide. You must use a dedicated search head (not pooled) to act as the Data CollecEon Scheduler. During installaeon, the DCN will be configured either by SSH or remote console access; addieonal configuraeon is done via the Splunk web UI on TCP port Ensure that access by SSH/8000 or by CLI via console will be possible. 20