Microsoft has sold more than 125 million licenses of its SharePoint collaboration platform to over 65,000 organizations. With SharePoint environments scaling to accommodate more users and more content, IT professionals responsible for managing SharePoint performance are under more pressure than ever to keep things running well. The good news: ExtraHop now offers a free add-on bundle that dramatically simplifies SharePoint monitoring and provides the most comprehensive visibility of any SharePoint monitoring solution.

Why ExtraHop? Doesn’t SharePoint Have Its Own Monitoring Tools?

Microsoft’s SharePoint monitoring recommendations rely heavily on logging, which adds system overhead and requires administrators to spend time configuring servers to get the right data. Moreover, logging is more suited to reactive troubleshooting because it does not provide the real-time metrics and trend-based alerts needed for proactive application performance management (APM). SharePoint monitoring tools from legacy vendors also rely on logs and sometimes add custom performance agents installed on the systems to be monitored, an expensive and ineffective alternative.

ExtraHop approaches this problem in a completely different way. Instead of collecting discrete system health metrics and trying to make sense of all that data after the fact, the ExtraHop platform analyzes the real-time performance of all SharePoint transactions across all tiers. ExtraHop platform accomplishes this by recognizing the built-in global unique identifier (GUID) that SharePoint tags to all web-to-database transactions and then tracing those transactions as they pass back and forth between different servers. This nonintrusive recognize-and-trace method of transaction tracing (as opposed to the intrusive and fragile tag-and-trace method used by legacy vendors) enables ExtraHop to calculate the latency for every SharePoint transaction at the web and database tiers.

ExtraHop’s recognize-and-trace method takes advantage of the SharePoint GUID, enabling transaction tracing across tiers without agents or instrumentation.

Answering the Questions that SharePoint Teams Care About

With real-time transaction analysis from the ExtraHop platform, IT teams responsible for monitoring SharePoint performance have the operational intelligence they need to easily answer questions such as …

• Where is the greatest source of latency—at the web or database tier?
• What is the latency for a specific URI at the web and database tiers?
• If the database tier is slow, is it due to one slow request or many serialized requests?
• Within each tier, is it the network transfer or server processing that is causing latency?

These are the types of answers that SharePoint teams can spend hours or days trying to tease out with legacy monitoring tools but that ExtraHop can provide in real time—without requiring any upfront configuration or agents installed on servers. Consider the following SharePoint metrics and views, which are derived by analyzing SharePoint-tagged transactions on the wire.

Response Times and Latency by Network, Web, and Database

ExtraHop breaks down response time latency by the web tier and database tier, as well as showing network transfer time vs. server processing time for each tier.

Transaction Latency Per URI

ExtraHop details web-tier latency and database-tier latency per URI.

Processing Time for Every Database Method

ExtraHop shows the database-to-HTTP ratio, or the number of database requests generated by a single web request (fan-out factor), as well as processing time for every database method used.

Again, all of the views shown above require no upfront configuration or agents installed on machines. Simply install the ExtraHop SharePoint monitoring bundle, a process that takes minutes, and then sit back and watch the ExtraHop platform capture and display all the metrics you need to manage SharePoint performance.

It’s worth noting that, in addition to transaction tracing across the web and database tiers, the ExtraHop platform also performs real-time analysis for DNS, LDAP, SSL, CIFS/SMB, and other essential components of any SharePoint environment.

Try the ExtraHop Solution for SharePoint Performance Monitoring for Free

Would you like to see the above metrics for your own SharePoint environment? You can do so, for free, with the ExtraHop Discovery Edition. After downloading the 60-day trial, go to our customer forum to get the SharePoint monitoring bundle. While you’re there, take a look around at the other solution bundles that have been added by the community. And, after you have learned more about how they work, you can create and share some of your own.

The Service Level Agreement is always the first casualty in the war to assign blame.

Most IT organizations monitor their applications and infrastructure in an extremely disjointed manner, with each specialist team relying on tools that provide visibility into a specific technology silo: network tools for the network engineers, database profilers for the DBAs, agent-based APM tools for developers, and so forth. This fractured approach to monitoring contributes to high IT costs, poor user experience, wasted capacity, and an IT organization that is responding to issues reactively instead of proactively.

SAN and NAS Performance Visibility

The fractured approach to monitoring truly fails when trying to ascertain the role of networked storage in application performance problems. The teams responsible for storage-area network (SAN) and network-attached storage (NAS) systems frequently have minimal visibility into how those systems interact with applications, the network, or other infrastructure. On the other hand, monitoring tools built for other technology silos provide zero visibility into real-time storage performance. Agent-based application performance monitoring (APM) products, for instance, include storage performance in database response-time metrics, masking the real source of transaction latency.

ExtraHop offers a much-needed new approach that provides holistic visibility across the entire application delivery chain. This cross-tier view enables IT teams to easily understand how applications are impacting the database, network, and storage tiers. With shared operational intelligence, IT teams can collaborate to solve problems faster and identify interrelated issues that would otherwise go undetected.

This month’s Performance Metric of the Month highlights the importance of CIFS, NFS, and iSCSI transaction metrics in the context of other application and infrastructure performance. The three real-world examples below demonstrate the value of this correlated visibility.

Case #1 – Tiered Storage vs. the Rogue Application

The first case features a customer who saw unexplained poor performance with their tiered storage setup. They had NetApp as their primary storage system and DataDomain as their second-tier backup storage. The second-tier storage was performing slowly during some backups, with constrained I/O and TCP connection stalls manifesting as well.

This customer used the ExtraHop system to inspect a list of all transactions hitting the DataDomain system during the periods of slow performance and identified a single system that was aggressively reading from the storage system. As the back-up storage system was optimized for writes and not reads, this activity had a serious impact on overall performance. The ExtraHop system made this diagnosis easy by showing all the read and write transactions on a per-client basis. This capability can also be applied to monitoring OLAP database applications, or data warehouses, which are optimized for reads.

Case #2 – iSCSI Connectivity Issues and the Confused SAN

This second case demonstrates the importance of contextual visibility when troubleshooting storage performance issues. In this case, a prospective customer had tried for months to isolate the root cause of iSCSI connectivity issues between its Compellent SAN, Citrix Xen, and VMware virtual servers.

Figure 1. Mapping iSCSI connections helped identify misconfigured servers.

During a proof-of-concept demonstration, the IT manager at the company and an ExtraHop systems engineer confirmed the iSCSI connectivity issues and then pinpointed the specific servers experiencing these problems out of the entire pool of Xen and VMware servers. By generating an application activity map that visually mapped all devices using the iSCSI protocol (see Figure 1), the IT manager confirmed that the two suspect servers were connecting to the SAN in different ways. These servers were using the Microsoft iSCSI Software Initiator in Windows in addition to host-bus adapters (HBAs). As the SAN tried to load-balance requests across all available interfaces and controllers, it would sometimes send a response from the HBA back to the Microsoft iSCSI Software Initiator on that same server, which would then drop the response.

The ExtraHop system helped to solve this obscure issue by providing the necessary context. With the problem identified, the IT manager turned off the Microsoft iSCSI Software Initiator on those servers, and the iSCSI connectivity issues disappeared.

Case #3 – The Bandwidth-Hog Logging System

This final example demonstrates the importance of correlated storage and network visibility. At one company that uses the ExtraHop system, an Operations team member was investigating database activity with the aim of finding SQL queries that were good candidates for caching. In the course of his investigation, he saw that CIFS traffic comprised 70 percent of network bandwidth. This number seemed odd to him, so he drilled into CIFS transaction details and found some familiar file names in the list—files associated with the company’s homegrown logging system!

Figure 2. The ExtraHop system analyzes L7 application protocols.

A bug in the log archive script caused large files to be copied across the network repeatedly. Five million files were unnecessarily rewritten. The network team was unfamiliar with the logging system and had assumed that this growth was organic. In fact, they were preparing a forklift upgrade of the network infrastructure to handle this increased traffic—a cost of hundreds of thousands of dollars. However, with the archive script fixed, network utilization dropped by an astounding 70 percent, which helped the company defer a significant unnecessary capital expense.

Legacy network-monitoring tools would not have helped in this case. Only the ExtraHop system, with its ability to analyze L7 application-level details, is able to distinguish CIFS traffic (see Figure 2) and list the filenames for each transaction.

What’s Needed: An Operational Intelligence Solution

The three examples above demonstrate the need for correlated, cross-tier visibility. This holistic view has been the goal of IT monitoring for decades but never realized until now. Cobbling together various specialist tools into a solution portfolio or suite will not provide the same visibility—only a system that is built from the ground up with the goal of operational intelligence fits the bill.

If you have your own networked-storage tales to tell, please leave a comment below. Or, if you’re interested in finding out how the capabilities of the ExtraHop system can help you, download the ExtraHop Discovery Edition, a free trial version that provides storage monitoring capabilities.

In order to implement an end-to-end performance management system, organizations need to overcome both internal divisions between IT teams and the old school performance management and monitoring tools that aren’t designed to integrate and share data.”

– Aberdeen Group, “The Need for End-to-End Application Performance Management and Monitoring,” November 2012

End-to-end APM has entered the IT spotlight, as noted in the quote above from a new Aberdeen Group report. Specifically, this latest report finds that with the growth of mobile, cloud, virtualization, and agile development, companies must adopt new, end-to-end approaches to application performance management (APM). The report surveyed 211 IT organizations and found that those teams that take an end-to-end approach to APM realized a number of benefits:

• 43 percent less likely to see applications as too complex
• 22 percent less likely to have application infrastructures that didn’t support growth
• 36 percent less likely to lack the tools needed to resolve critical events
• 75 percent less likely to see overutilization of applications as a challenge

Download the Aberdeen Group report free before December 31, 2012.

Achieving End-to-End APM is Easy with ExtraHop

Clearly, it’s very important for businesses to adopt end-to-end approaches, and with the ExtraHop system, gaining operational intelligence for the entire application delivery chain doesn’t have to be complicated or expensive. Aberdeen’s report outlines four key goals that businesses must focus on to achieve end-to-end APM—all of which are addressed by the ExtraHop system.

1. View Network, Application, Infrastructure, and Transaction Performance Holistically

“If your performance management and monitoring tools are disconnected and unable to work together, it will lead to increased complexity and inability to troubleshoot critical issues.”

Unlike traditional APM approaches that rely on a combination of loosely integrated specialist tools, the ExtraHop system provides value to all IT groups. Practice Fusion’s VP of Technical Operations, John Hluboky, explains, “Every team in our IT organization uses the ExtraHop system. It’s our single pane of glass. Our system engineers and network engineers use it most often, but the application support team and DBAs also use the ExtraHop system to determine authentication failures or tune a database query, for example. This information is available immediately off the wire in terms that everyone can easily understand.” Read how Practice Fusion enables IT collaboration with ExtraHop.

2. Support Dynamic and Scalable Cloud-Based Environments

“Many traditional performance management and monitoring tools have a hard time monitoring and tracking performance issues when applications use virtualized or cloud-based systems.”

A recent article at Datamation highlights how the ExtraHop system helped Concur, a provider of travel and expense reporting solutions, optimize the performance of its IT environment, which is nearly 80 percent virtualized. Seeking greater scalability and speed, Concur used the ExtraHop system to analyze SQL query performance across thousands of databases to identify the best candidates for migration to memcache databases. The team also monitored memcache performance and correlated that performance to activity at other tiers of the application infrastructure. Drew Garner, Concur’s Director of Architecture Services, explains how ExtraHop helped to pinpoint problems that other monitoring tools could not identify:

“We had an abnormally high rate of HTTP aborts for a pool of 60 front-end webservers that host three different sites. We have so much traffic to this pool that it was extremely difficult to isolate the problem server using our user-experience monitoring tool. By customizing the analysis in the ExtraHop system, we could identify a server that was configured to debugging mode. We turned debugging off and immediately saw the HTTP aborts fall by 95 percent in ExtraHop.” Read how Concur optimized database performance with ExtraHop.

3. Reduce the Time Needed to Triage and Troubleshoot Application Performance Problems

“End-to-end performance management systems are able to both increase visibility into application problems and decrease the time needed to identify the root cause of an issue and repair it.”

Chris Grey, Alaska Airlines’ Director of IT Operations, says, “In many cases, ExtraHop can cut our troubleshooting time in half.” IT organizations using the ExtraHop system as the single source of truth can quickly correlate application behavior across the network, web, database, and storage tiers to understand what is happening. Read how Alaska Airlines used ExtraHop to reduce troubleshooting times.

4. Provide Insight to Business Stakeholders for SLA Management and IT Business Intelligence

“End-to-end performance management … means ensuring that all of the key stakeholders in a business can view and understand performance data in order to ensure that applications continue to perform at their highest capabilities.”

The ExtraHop system offers contextual visualization capabilities, including summary performance dashboards, that companies can customize to provide intelligence to business stakeholders. A large, international investment institution uses ExtraHop’s dynamic geomaps in its network operations center (NOC) to show real-time application usage and potential trouble spots around the world. When the marketing team saw the geomaps in action, they gained new insight into how customers actually use their services.

Flex grids provide summary views of key performance indicators and performance-based SLA thresholds.

Geomaps in the ExtraHop system provide geographic context for real-time performance metrics and alerts.

To learn more, download the new Aberdeen Group report, “The Need for End-to-End Application Performance Management and Monitoring.”

To see how the ExtraHop system can work in your environment to provide end-to-end APM visibility and operational intelligence, download the ExtraHop Discovery Edition for a 60-day free trial.

ExtraHop recently announced a method of packet capture that enables network and security teams to capture packets of interest with surgical precision. This capability preserves all the benefits of packet capture—namely, an exact record of what caused a performance slowdown or policy breach—without the downsides of traditional methods.

Scroll down to the bottom of this post to watch a video of ExtraHop Senior Systems Engineer Dan Greer demonstrating this capability. 

Fittingly, ExtraHop’s packet capture announcement coincides with Riverbed’s recently announced acquisition of Opnet. Both of these vendors offer traditional packet capture tools. Riverbed’s tool is called Cascade Shark (acquired through the 2010 purchase of CACE Technologies) and Opnet’s tool is called AppTransaction Xpert. These products are technically sound and often justify their expense compared to open-source alternatives, depending on an organization’s requirements.

That said, the difference between ExtraHop’s approach to packet capture and that of Riverbed and Opnet is telling. With the ExtraHop system, you have a more simple method that arguably works better and costs significantly less. With Riverbed and Opnet, you have entrenched vendors selling a highly refined version of decades-old technology. Please allow us to explain.…

“You’ll Have to Pry It from My Cold, Dead Hands”

It’s been 25 years since Van Jacobson wrote tcpdump. Since then, packet capture and analysis has become an essential tool for network and security professionals, enabling them to obtain a definitive record of application and end-user activity. For many network administrators, “You’ll have to pry it from my cold, dead hands” aptly describes the loyalty inspired by packet-capture tools.

When networks carried data at 10Mbps or 100Mbps, packet capture worked great as the captures were not too large. Now, with datacenter networks at 10Gbps speeds, even the most ardent defenders of packet capture must admit that the traditional method of recording, storing, and analyzing terabytes of packet data is slow and inefficient. In a typical troubleshooting scenario, the network team makes an educated guess as to where they think errors are occurring, records traffic from those segments, and then sifts through the data with an analysis tool—a reactive and time-consuming process. And sometimes, these teams need to collect multiple packet captures and then correlate the results. An alternative to piecing together packet captures is to invest in an enterprise-grade packet capture solution that continuously captures and indexes packets. However, continuous packet capture seems like an extravagant and expensive solution for everyday use, especially as today’s 10Gbps network links can fill up to 100TB of storage in a day!

Even when the correct packets are captured, it requires skill and effort to decipher the data—a tedious task for even the most competent network engineer. Searching even a couple gigabytes of packet data for the root cause of a performance issue is analogous to scanning the complete works of Charles Dickens to find a single conversation. Fortunately, there is now a better way to do packet capture.

Reimagining Packet Capture

The new policy-based, precision packet-capture feature in the ExtraHop system eliminates the guesswork, the time-consuming analysis, and the expensive storage requirements associated with conventional packet-capture methods. Here’s how it works:

1. Continuous analysis. Using a copy of network traffic, the ExtraHop system reassembles millions of application flows in real time.
2. Automatic triggers. IT teams set policies for anomalous or suspicious events they would like to record using ExtraHop’s Application Inspection Triggers (AI Triggers) technology, such as when a malformed request causes an application error or when a user writes to a sensitive storage partition.
3. Immediate replay. When a policy-defined event occurs, the ExtraHop system automatically extracts the application flow that caused the event from the packet buffer. IT teams will have the pcap file available immediately for analysis, effectively enabling them to look back in time to see the user or application behavior preceding an event. The ExtraHop system can offer this immediate replay without resorting to continuous packet capture because of its real-time, full-stream reassembly of multiple packets into complete flows.

What IT Operations Teams Really Need

Although other vendors offer triggered packet capture, only the ExtraHop system offers unprecedented intelligence and precision with AI Triggers technology and L2—L7 transaction analysis at wire speed, a sustained 10Gbps. No other performance-monitoring vendor offers a similar framework for real-time analysis.

Here’s the kicker: The granularity of detail available is not the problem plaguing IT Operations teams today. Rather, the problem is that disparate tools do not provide holistic visibility or adapt to dynamically changing IT environments. Read about a recent study by TRAC Research on APM data overload.

TRAC Research white papers on APM data usability.

Download the white papers (requires free registration).

The ExtraHop system provides a platform for operational intelligence that spans technology silos. With an elegant, non-intrusive deployment, IT organizations gain correlated, real-time visibility for all their applications in production as well as the supporting infrastructure—the underlying network, desktop and application virtualization, load balancers and firewalls, directory services, domain name services, and storage systems. AI Triggers technology adds incredible flexibility to this platform, enabling IT teams to define and implement new metrics within minutes. With the ability to answer questions about what is happening in real time across the entire environment, IT teams can streamline application rollouts, mitigate risk, manage infrastructure changes, and proactively resolve performance problems.

Interested? You can try out the ExtraHop system for free with our 60-day Discovery Edition download. This is an easy, no-obligation way to see for yourself how the ExtraHop system can quickly gather meaningful data for agile IT operations. If you are already an ExtraHop customer, contact us to get access to version 3.8 and learn about the benefits of precision packet-capture in your environment.

Surgical Precision + Deep, Real-Time Analysis

The ExtraHop system applies recent advances in processing power and storage capacity to perform incredibly sophisticated real-time HTTP transaction analysis than has not been previously possible. In addition to monitoring status codes and methods for all HTTP transactions in real time, the ExtraHop system analyzes HTTP payloads, including structured transactional data passed over HTTP such as REST, JSON, AJAX, JavaScript, SOAP/XML, and HTML5. This depth of analysis enables IT teams to define new metrics based on details contained in the payload. To achieve these results, ExtraHop introduced its unique Application Inspection Triggers (AI Triggers) technology, a framework for real-time analysis based on scriptable event-processing at the application-protocol level.

And what about Splunk?

The resulting ability to target specific transactions based on payload characteristics makes ExtraHop an extremely valuable source of information for Splunk implementations. Although Splunk is a truly amazing platform for making sense of machine data, the output is only as good as the input it receives. With the ExtraHop system, IT teams can capture real-time events across tiers with surgical precision and then immediately send them to Splunk using rsyslog.

Extending the Boundaries of What’s Possible

In the case of web transactions, IT teams can use the ExtraHop system to capture information in the HTTP payload that cannot be logged. This information can’t be logged because web servers such as Apache and Microsoft IIS only log headers, URIs, and server processing time. These are important metrics but do not provide a true picture of performance.

Take, for example, web transactions with status code 200, which indicates that the server responded to a request. At face value, a stream of these status codes would indicate healthy performance.

Click the image to enlarge. The ExtraHop system enables IT teams to export specific metrics to Splunk.

However, by analyzing the titles of the pages returned by the server, we could see that many of these pages are “Sorry, page not found,” “Sorry, page not available,” or “Sorry, unexpected error.” This is certainly not the same picture of health given by the status codes only! What’s more, application delivery controllers can insert these types of pages en route so that there would be no way to capture these details on the web server itself.

Click the image to enlarge. The ExtraHop system can extract details in the header such as page titles that read “Sorry, unexpected error.”

As interesting as the above scenario may be, it barely begins to plumb the depths of what the ExtraHop system is capable of uncovering. One customer used the ExtraHop system to identify duplicate orders in its payment processing web service with the combination of ExtraHop and Splunk. Akin to identifying a snowflake in an avalanche, this customer’s problem would be nearly impossible to solve using traditional methods because of the sheer volume of data.

In this example, this customer’s payment-processing web service used the XML format. The customer used the ExtraHop system to extract the user name, account number, merchant ID, and order ID from the HTTP payload.

Click the image to enlarge. In addition to header information, the ExtraHop system analyzes the full HTTP payload, including user names and order IDs used in payment processing.

With these transaction events exported to Splunk in real time, the customer could conclusively answer questions that they had pursued for months without resolution. In particular, they could identify that the system was in fact generating duplicate orders and they could also see which accounts were affected.

Click the image to enlarge. With surgical logging, IT teams can quickly answer questions about critical business transactions, such as duplicate orders.

Now that you’ve read the details, check out the video below to see a hands-on demo led by ExtraHop CEO Jesse Rothstein at Splunk .conf2012. Jesse explains the ExtraHop and Splunk integration and shows live examples of how this combination provides incredible IT operational intelligence.

What’s the takeaway? With ExtraHop, now you can surgically export custom-defined, real-time metrics to Splunk, including details contained in the HTTP payload. Get started today with the Splunk for ExtraHop app, available for download on Splunkbase. If you download the app and like it, be sure to give us a rating on Splunkbase!

Practice Fusion Case Study: Seeking the Single Pane of Glass

Web-based electronic medical records (EMR) provider Practice Fusion, with the number of its users growing by triple digits every year, had the foresight to recognize and prepare for this challenge. “We had many point solutions that provided information about discrete components, but nothing that gave us a holistic, correlated view,” explains John Hluboky, VP of Technical Operations at Practice Fusion. “We were looking for a platform that could give us comprehensive visibility and foster greater collaboration across teams.”

Practice Fusion’s web-based EHR system is free to medical providers and supported by contextual ads.

For Practice Fusion, the ExtraHop system proved to be the right solution because of its correlated, real-time view of application performance across the network, web, database, and storage tiers. “Every team in our IT organization uses the ExtraHop system. It’s our single pane of glass,” says Hluboky. “Our system engineers and network engineers use it most often, but the application support team and DBAs also use the ExtraHop system to determine authentication failures or tune a database query, for example. This information is available immediately off the wire in terms that everyone can easily understand.”

Application Development and Testing

The Software Engineering team at Practice Fusion relies on the ExtraHop system to speed application rollouts with reduced risk. “We set up the ExtraHop system in our staging environment so that the Engineering team can see the impact of new code against our baseline performance,” says Hluboky. “With visibility across all tiers of the environment, we can determine whether a performance problem is due to infrastructure, misconfiguration, or possibly a code-level issue. We can see the performance of particular web servers or URLs when using a certain type of transaction, for example. We catch performance issues earlier in the development cycle this way and also monitor the impact of new code releases the next day when users start logging in.”

Practice Fusion uses ExtraHop to deliver industry-leading EMR service.

Download the case study to learn more.

Moving from Reactive to Proactive, the Holy Grail of IT Operations

With the ExtraHop system supporting collaboration across teams, Practice Fusion identifies and resolves application performance issues before they impact users. “We’ve achieved the ‘holy grail’ of IT Operations where we’re not just remediating problems faster, but preventing problems from occurring in the first place,” says Hluboky.

Practice Fusion is just one example of how the ExtraHop system is transforming IT Operations. Other companies similarly use the ExtraHop system to facilitate greater collaboration among IT teams, reaping a range of benefits:

• Web application optimization – An online brokerage uses the ExtraHop system to optimize application response times and is now listed among the top three in industry rankings for that critical metric.
• Continual service improvement – A leading provider of electronic discovery services uses the ExtraHop system to produce a weekly report distributed across its IT organization that lists tuning and optimization opportunities in the IT environment.
• SLA management – One of the largest U.S. healthcare systems providers uses the ExtraHop system to track key performance metrics that underlie service-level agreements (SLAs) and is able to proactively fix issues and avoid paying penalties.

These types of benefits are only possible with a modern APM solution that provides correlated visibility across tiers and doesn’t rely on legacy technology that suits the needs of just one specialist team. When organizations adopt ExtraHop, developers still keep their agent-based tools and profilers for use in preproduction, network engineers still have Wireshark for forensics and NetFlow analyzers for infrastructure monitoring, and DBAs can still run traces if they need to. ExtraHop works differently, providing real-time visibility across tiers and a unified platform that all IT teams can share. This correlated, cross-tier visibility facilitates a collaborative and proactive approach to managing application performance.

Read about ExtraHop application performance monitoring solutions for healthcare.

Want to try the ExtraHop system for free? You can download ExtraHop Discovery Edition and gain cross-tier visibility for up to 50 VMs or servers. There’s no cost and no obligation. Let us know what you think! Do you agree that many IT organizations need a unified view of application performance?

That’s the message we heard repeatedly at Oracle OpenWorld 2012 last week in San Francisco. We met a lot of DBAs and IT pros who need a better approach to application performance management (APM). And when it comes to application performance, no part of the application environment is more vital than the database.

Scroll down to the end of this post to watch our ExtraHop for DBAs webinar. No registration required!

Poor database performance affects all the applications using that resource. When troubleshooting database performance, DBAs need to understand how applications and clients are using the database so they can protect it from poorly written queries, for example. When optimizing database performance, DBAs need to know what the heaviest workloads are across database clusters so they can move those workloads to cache.

Top 10 Capabilities DBAs Gain with ExtraHop

For DBAs managing major databases, including Oracle, the ExtraHop system offers a number of must-have capabilities that complement vendor-supplied tools, such as Oracle Enterprise Manager (OEM).

1. Profiler alternative. With a zero-overhead, non-invasive deployment, the ExtraHop system enables DBAs to continuously monitor the performance of production databases without adding overhead burden. According to an MSDN paper on Microsoft SQL Server 2008 auditing, running a SQL trace added 19% and 147% overhead to two example workloads! Moreover, profilers are not an option for packaged applications from Oracle such as Siebel and Hyperion. Read how Alaska Airlines uses ExtraHop to monitor the performance of the IBM Informix database underlying its weight and balance application.
2. Drill-down analysis. DBAs and other IT team members can start at summary views of database performance, zoom in on specific time periods, and then investigate specific query metrics by client IP, database instance, method, table, and user.
3. Transaction details. The ExtraHop system provides specific information needed to take action, including database methods, stored procedures, count and processing times, SQL calls, and internal Oracle-specific calls. Read more about ExtraHop database capabilities.
4. Storage visibility. While other APM tools do not measure storage latency separate from database response times, the ExtraHop system offers transaction-level metrics for the SAN and NAS systems that underlie databases. Read more about ExtraHop storage capabilities.
5. Network visibility. The network ties everything together, and the ExtraHop system helps DBAs and other IT team members correlate network performance with database performance using advanced TCP analysis.
6. Early warning. The ExtraHop system is always on and monitoring all database queries. Concur, for instance, uses ExtraHop to monitor more than 2 billion SQL queries each day. With trend-based alerts, IT teams can address small issues before they affect users.
7. Policy compliance and audit. Because the ExtraHop system tracks database metrics by table and user, IT teams can easily ensure compliance with security or privacy policies by monitoring usage and setting alerts for prohibited actions.
8. Cache optimization. When implementing a 1.4TB memcache caching system, Concur used the ExtraHop system to determine the total weight of every SQL query by calculating the number of times the query was run by the time required to return the data. The ExtraHop system also monitors memcache performance for ongoing optimization with transaction rates, error details, and methods used.
9. Broad support. In addition to supporting Oracle databases, the ExtraHop system offers database analysis for IBM DB2, IBM Informix, Microsoft SQL Server, MySQL, PostgreSQL, Sybase ASE, and Sybase IQ. Read more about ExtraHop database modules.
10. Easy deployment. The ExtraHop system deploys in 15 minutes with a simple plug-and-play setup, requiring no agents, host-based instrumentation, or manual configuration.

Want to learn more about database monitoring capabilities in the ExtraHop system? Here are three easy ways to do so:

1. Download the ExtraHop Discovery Edition for free. It’s a 60-day trial version of the ExtraHop system and includes real-time visibility across the network, web, database, and storage tiers of your environment. Experience ExtraHop’s cross-tier visibility firsthand!
2. Read our Concur case study to learn how the world’s largest SaaS ERP provider uses the ExtraHop system to optimize database performance.
3. Watch the Application Performance Monitoring for DBAs webinar. This 30-minute webinar explains how the ExtraHop system’s network-based approach works, how customers are using the solution, and includes a walk-through demonstration of the ExtraHop system’s database monitoring capabilities.

Watch this 30-minute webinar to learn how Alaska Airlines and Concur use ExtraHop database monitoring capabilities and watch a demo (at 15:00 mark).

The new Splunk App for ExtraHop captures real-time metrics that are otherwise difficult or impossible to log.

Splunk has made headlines over the past few months for its successful IPO and powerful Big Data approach to log file analysis. IT Operations teams all over the world use Splunk Enterprise software to free them from the drudgery of having to manually inspect server logs. With Splunk’s solution, these IT Operations teams can more easily manage, visualize, and analyze massive amounts of machine data generated in their datacenter.

Operational intelligence from Splunk complements the real-time application performance monitoring from ExtraHop. Both ExtraHop and Splunk represent new and better ways of solving difficult challenges. That’s why Gartner listed both companies in their December 2011 APM Innovators report.

Read more about the importance of innovation when choosing an application performance management (APM) solution.

Adding Policy-Based and Precision Logging to Big Data Operational Intelligence

Many thought-leading ExtraHop customers, such as Concur Technologies, use ExtraHop and Splunk in conjunction. In these scenarios, the ExtraHop system provides proactive early warning and cross-tier correlation for monitoring and troubleshooting application performance issues, while Splunk provides the historical analysis, trending, and reporting for the infrastructure.

Following the suggestions of our joint customers, ExtraHop and Splunk collaborated to integrate our products. The new Splunk App for ExtraHop enables IT teams to record important real-time information and metrics in Splunk that would otherwise be difficult or impossible to log.

• Network health and performance metrics. IT teams can use the ExtraHop system to capture holistic TCP metrics—spanning both the applications and network—that are timely and relevant for real-time troubleshooting. Without this precision logging, Splunk users are dependent on the quality and scale of logging provided by network device vendors.
• Web servers. With the ExtraHop system, IT teams gain visibility into HTTP/S payloads without having to change the application code and can correlate web tier performance with network behaviors. Application payload information cannot be logged, and only ExtraHop can extract elements like Order ID, Merchant ID, Title, and Transaction ID and forward that on to Splunk with no performance impact. This approach also provides visibility into related infrastructure components, such as application delivery controllers and caches that can obscure web server performance.
• Application servers. The ExtraHop system helps IT teams avoid problems with inconsistent and inflexible logging options available on application servers including Apache Tomcat, ASP.NET, and Ruby on Rails. Obtaining the right log data normally requires scripted inputs using JMS/JMX. In contrast, ExtraHop sends precise application server metrics, as well as payload information, to Splunk that take network performance into account as well.
• Database servers. The ExtraHop system deploys non-intrusively and imposes zero overhead. In contrast, turning on database profiling to obtain log data adds too much overhead for that method to be used in production. Running an SQL trace added 19% and 147% overhead for two example workloads, respectively, according to an MSDN paper on Microsoft SQL Server 2008 auditing.

Depending on the workload, running an SQL trace to gather database server log data can add significant overhead.

• Storage devices. With the ExtraHop system, IT teams gain access to real-time storage performance metrics, including details that are difficult or impossible to derive from logs or storage APIs, such as file access times for specific clients.
• Transaction metrics. Perhaps most importantly, the ExtraHop system correlates health and performance metrics from discrete components in the application delivery chain to determine end-to-end response times, cross-tier metrics, and end-user metrics.

The ExtraHop system correlates performance metrics from throughout the application delivery chain to provide application response time metrics.

The Splunk App for ExtraHop is now available for download from Splunkbase. The 3-minute video below demonstrates how the integration between ExtraHop and Splunk works. If you use Splunk Enterprise in your environment and would like to add real-time application performance monitoring and troubleshooting capabilities, contact us today. Or, download the ExtraHop Discovery Edition, a free 60-day trial version of our solution.

This post is written by Cal Jewell, a Senior Technical Trainer at ExtraHop.

In June, Microsoft announced that it would release an update blocking the use of RSA keys using less than 1024-bit encryption. While the update has been available for testing, the October 9 “Patch Tuesday” will make the update widely available via Windows Update. The update effects all supported versions of Windows, going back to Windows XP SP3. If servers or clients continue to use sub-standard key encryption after October 9, then a range of potential problems could result, including blocked access to SSL-encrypted websites from Internet Explorer, problems installing ActiveX controls and Windows-based applications, and the inability to encrypt or digitally sign e-mail using Microsoft Exchange and Microsoft Outlook. As security experts at the SANS Internet Storm Center point out, this update will not only affect certificates from Microsoft and other well-known authorities, but internal certificate authorities, too.

Find All the Certs … Before Patch Tuesday

System administrators have one month to find all the servers and clients using too-small cryptographic key sizes and update the certificates. To discover the use of RSA keys under 1024 bits, Microsoft recommends turning on verbose (CAPI2) logging on the relevant computers and then checking back after a period of time. They also recommend checking certificates manually(!). Sound like a pain? It is.

To find sub-standard certificates, Microsoft recommends turning on verbose logging on relevant computers.

Thankfully, the ExtraHop system offers an easy way to track the usage of all SSL certificates used in your environment in just a few clicks. First, go to the SSL Server or SSL Client Activity Group and adjust the time interval to something reasonable, say the last seven days. Now click Certificates at the top to view all the SSL certificates used. Filter the results by entering “512” and you have a list of sub-1024-bit certificates for the time interval.

The ExtraHop system automatically analyzes the SSL envelope for all network traffic, including key sizes.

Alleviating the Compliance Burden

The SSL-envelope analysis capability in the ExtraHop system also tracks expiration dates for SSL certificates and protocol versions for both servers and clients. This is helpful for administrators that must accommodate government or industry regulations. For example, the U.S. National Institute of Standards and Technology (NIST) is drafting new guidelines for federal agencies to stop using TLSv1. The ExtraHop system gathers this information passively off the wire, as shown in the screen capture below.

The ExtraHop system tracks the versions of cryptographic protocols used in enterprise networks.

Another strong example is federal agencies that must transition internal client applications and enterprise networks to operationally native IPv6 and then prove compliance. The DNS Client and DNS Server Activity Groups in the ExtraHop system track all hosts (and IPs) that have made or answered IPv6 DNS lookups. Federal IT managers responsible for IPv6 transition can schedule automatically generated PDF reports based on these lists to show compliance. And, with the Splunk App for ExtraHop, they can also forward every IPv6 DNS lookup and response to Splunk for historical analysis and storage.

ExtraHop Helps Make IT Management Easier

Certificate management and standards compliance are two examples of the mundane but necessary burdens weighing on the shoulders of today’s IT organizations. And yes, these issues can affect application performance as experienced by users—the Microsoft update amply demonstrates that. Agent-based application performance management (APM) tools offer no answer for these types of systemic application performance problems, but a network-based view of application health and performance does. This is one more reason why network-based APM is a must-have for today’s IT Operations teams.

You can try out the ExtraHop system for yourself with a free, 60-day trial download. This version does not include SSL-envelope analysis, but our paid offering supporting up to 50 servers starts at just under $7,500—roughly one-tenth of what you would pay for the first year with an agent-based solution.

At ExtraHop Networks, we’re doing our part to speed the development of the industry both in terms of functionality and pricing. This month, we announced subscription-based pricing for the EH1000v, the fastest virtual appliance for network-based APM, capable of handling up to 1Gbps of traffic. The subscription-based pricing starts at $8,148 for the base system with Premium Support in North America, which supports to 50 hosts or virtual machines (VMs) for one year. Adding a Microsoft SQL Server database module and NAS module brings the total price to $13,644 for complete visibility across the network, web, database, and storage tiers of the application environment.

For comparison, consider that contemporary agent-based APM tools often charge $2,000 per Java Virtual Machine (JVM) for a two-year license. Amortized over two years, the annual cost of that agent-based deployment for 50 hosts or VMs would come to $50,000—or $100,000 paid in the first year. And that’s for a product that offers limited visibility into critical network services like DNS and LDAP, and no visibility into networked storage performance! Read a more detailed APM cost comparison.

Low Cost of Entry for APM

Subscription-based pricing significantly lowers the cost of entry for enterprise-grade APM capabilities. IT organizations spend dramatically less upfront—as little as $7,428 for 50 servers or VMs. This lowers the risk for companies that are exploring application performance monitoring. Additionally, the monthly cost per host or VM comes to roughly $13, making it one of the most cost-effective ways to continuously monitor cross-tier application performance in real time.

Easy to Add Capacity

A subscription-based pricing model also makes it easy for IT organizations to scale their APM deployment as needed. Expanding coverage to another 50 devices simply requires teams to download another virtual appliance and spin up a new VM. The EH1000v connects to the vSwitch in a VMware cluster and does not require any agents, probes, or other invasive host-based instrumentation.

Industry-Leading Functionality and Benefits

While subscription-based pricing makes the ExtraHop system easier to deploy, it has always been one of the best APM solutions in the industry based on the effectiveness of dollars spent.

• Comprehensive visibility across tiers. No other APM solution offers the same real-time, L2-L7 visibility as the ExtraHop system. Having correlated visibility across the network, web, VDI, database, and storage tiers is crucial in identifying the root cause of problems quickly no matter where they occur in the application delivery chain.
• Non-intrusive deployment. Unlike other legacy APM tools that rely on agents, probes, and other invasive instrumentation, the ExtraHop system does not add any system overhead and will never perturb applications.
• Sustained 10Gbps throughput. In our discussions with prospective customers, we’ve encountered healthy skepticism about technical capabilities. “If you can do half of what you claim, then I’m interested” is what one IT director said. This skepticism is brought on by false and excessive vendor claims. In particular, competitors make scalability claims that may have been true in the pristine lab environment, but just don’t hold up in deployment. The ExtraHop system truly scales to 10Gbps analysis at sustained rates, not just in bursts. Read more about how the ExtraHop system accommodates real-world traffic patterns and packet loss.
• Customized metrics. Agent-based APM tools can be configured to do interesting things, but these adjustments often require special expertise and can be difficult to maintain as the application changes. In contrast, Application Inspection Triggers enable IT teams to define and implement custom metrics within minutes. How IT teams use this technology is limited only by imagination, but one favorite use is for “spot and trace” transaction analysis across tiers where the ExtraHop system passively tracks unique identifiers such as session IDs across the application delivery chain.
• Automatic discovery and classification. The status quo in the APM industry is long and complicated deployments requiring outside consultants to set things up. In contrast, the ExtraHop system is truly plug-and-play and begins analyzing traffic immediately upon installation to discover and classify devices and applications within minutes.

These are just a few of the industry-leading features in the ExtraHop system. More features are coming (very soon!), so stay tuned by subscribing to our RSS feed or following us on Twitter and on LinkedIn. In the meantime, if you haven’t seen it already, watch the video below where Customer Support Director Kurt Shubert and Support Engineer Jason Epstein demonstrate how the ExtraHop system can be deployed in just 10 minutes.