Fax Observer Autograph with airSlate SignNow

Fax observer autograph

let's jump in alright so again I'm going to be walking you through Apex a store in the wards going to be taking you through live so as I talked about earlier right we kind of focus on four key areas deploy manage solve and optimize I'm going to be kind of going into sort of the manage and the solve scenarios and we can talk about optimize and deploy as as interest exists so two real common scenarios of how people enter into our application the first is I know about an application that's having a problem and the second is I know about a particular user that's reporting an issue right which is kind of the user complaint center who walked through earlier so when we come into the initial screen here I've got the ability to enter in a search box and I can type in a user's IP address or an application name a VLAN a subnet right basically it's just straight-up free string searching to be able to come in here and query on just about anything that we track Oh hundreds of different what we call dimensions of the data right and then the resulting data sets or I can just straight up jump into a scenario so if I know that I'm experiencing some application issues I might just come in and just say I want to look at application performance sort of from an all up perspective right and as you can see the dashboard renders we've got location geolocation capability is a default aspect of all of our workflows so location is such a key pivot point for all of our users right because you want to contextually understand if I've got an ERP issue is that refined or reserved to a specific set of users at one or two particular sites or is this widespread and suddenly you can start to operationalize this data and very quickly understand just type of you know scale and scope of the problem that you're dealing with is that location based on geo IP lookup or it is that what if we have large MPLS with private networking behind yes so it's and it's geoip looked up and the user has the ability to input files from any of their IP address managers and label the locations with GPS coordinates okay so you've got the ability to sort of manually define it but there's also some automation behind it as well so you come in here and you see you know in my particular case I've got a lot of green pins at the moment things are running pretty well overall but in this particular scenario and this is a this is a legit real-world scenario this actually came from the via V network we use a product called quote edge and we were experiencing some problems with our quota application as folks were trying to generate quotes for customers at the end of the quarter so if I come into this product with the context of knowing that cordage is experiencing an issue I can scroll through my worst performing applications here and I can see here's quote edge and I can see how it's performing now the cool thing here is that you can see I've got some green periods but I've also got some red and yellow periods so I've clearly got some level of sort of sporadic issue happening within this application so I'm going to click into that application one click context truly drills me down it grabs that application definition as a filter and it takes me into the next step of the workflow where I start to isolate down on just that particular application where it's communicating to and where it's being consumed from that was a one hour that you grabbed yep yeah currently if you see it here up in the upper right corner I'm looking at the trailing hour yep exactly right can you adjust the level of detail from that the same upper right-hand corner like you wanted to get into more in just an hour yep absolutely you can do trailing hours trailing days specify a particular time window if a trouble ticket comes in you know what happened between you know 12:05 and 12:15 yesterday absolutely you can also set this to auto refresh so it'll just keep running at every minute just keep refresh and keep plotting new data on the screen right so very easy to operationalize this data throw it up on a big screen and everybody can kind of see when things start to go awry now you know here's a here's an interesting thing about the NP MD industry right as a whole one of the things that you'll notice is that folks will put up graphs like this and they're great graphs don't get me wrong this this information is fantastic right it's showing a bunch of aggregated pieces of information from a disparate set of data and it's aggravating it together and it's sort of saying generally here's what's happening right and all that red and green it's all based on real time baselines that are being established time of day day of week baselines so you plug the product in and it just starts generating information about what's happening in your environment what your level of user expectation is and how that maps to what's happening at the moment right so time of day day of week baselines and then percentile deviation off of that 10% above is a critical or marginal warning and you know 20% above is is a critical warning the thing is is that you get into a screen like this and you know for anybody who's kind of been doing NP MD analysis you know kind of tier two network engineers it's pretty easy to look at this and go well I can see where I'm having some issues you know kind of looks like Dallas and in New York and it's pretty obvious to me right I've got ten servers here being represented and literally all the traffic is ten 200 1.10 I probably have some kind of a load balancing problem happening here right and it's real easy to just sort of look at the screen and go okay so clearly this is a load balancing issue nice to see you guys I'm done I'm out right and that's that's great but the problem is is that sometimes it's not just a load balancing issue right sometimes it's just the way the data is being distributed based on the different types of applications you've got or the way your servers are configured right it could be regions are being routed particularly to given servers or it might simply be that that particular servers not doing the right thing so it's not a load balancing problem necessarily it's simply that that server is hosting up content that maybe it shouldn't be always hosting up and so you know where a lot of NP MD tools kind of stop here and they say we've given you metadata we've given you insights and we're done the VAV solution and where our customers really find value in what we're doing here is that ability to kind of keep drilling down right so I clicked on that one particular server and I just keep drilling down and I apologize the Wi-Fi here is just a little bit slow across my VPN but you can see here right I've got that particular server hosted in Chicago with my user in Dubai and I can see the application that's being run and I can see the sporadic nature of the problems that are occurring right so sometimes you can't even get to this level of depth with an NP MD tool but the problem really is is that you know so many of the problems that you deal with in the networking environments today are sporadic issues you don't have everybody suffering the same problem 24/7 you've got a couple users in a couple different locations that are experiencing a particular problem or a particular issue and so when you've got that type of scenario it is extremely hard to use isolated metadata that's highly refined highly aggregated highly pruned to go in and do a deep dive problem-solving exercise you've really got to have the packets for that right and so many NP MD vendors today say packets are blase right nobody really needs to get down to that level of detail problem is that root cause analysis happens at that level of detail at least it does for our customers right I'm seeing some folks not in their heads in the room so I think you know you probably can relate right so one of the great things about this portfolio is that at any point you can right click and say you want to get into the packets right you can do a straight up trace extraction which I'll show you later or you can do what we call connection dynamics you choose your data source which Giga store do you actually want us to go get the packets from and it's auto selected to be the Giga store that the metadata was produced from it's pretty straightforward right that Giga store saw the events it's the one that produced the metadata and so it has the packets right and as I mentioned capturing data to disk at 40 gig per second storing that information to up to a 1.2 petabytes storage array you got a lot of packets right but having a lot of packets is one thing being able to understand which packets you're interested in is the key right which is why these workflows are so powerful they literally take you from a high-level overview down to the individual client and server that you're interested in and then you can see it ran the job here it extracted those packets when I click on this I actually get a list of all the IP IP conversations along with sockets so port number that was transpiring between that client in the server now this is a table and I know there's a lot of information on it the third column is the one that's that that's the goal here it's the user experience score so we had some really really sharp people working on this for a long time that user experience score is designed to take literally hundreds of unique calculations that would normally be done by a Wireshark expert with a spreadsheet and scratch paper in about six to eight hours of free time and calc all those same metrics in a dependency based model so that we can really understand what's transpiring with the user right so that's the key column that I key off of when I see this you know red yellow green right it's a 1 to 10 scoring scale its proprietary its patent pending from v avi so it's it's pretty unique and it's something we just released earlier this year so it's something we're pretty excited about and it allows you to quickly understand of all these conversations right forget about response time forget about propagation delay forget about fulfillment times are my users experiencing things better or worse than they're accustomed to right and are my users experiencing degraded application performance so is that based on per user so is it learning based on that users activities because you have some users who are me and Dania some users who are in an SSH you have people that are doing web development yep so how is it differentiating those different users it's a great question the score is literally calc tat the IP socket level so it's IP one port IP two port and then that same information is rolled up right and you can consume it at a higher level and our next release coming out at the end of the summer we're actually gonna be putting that scoring information at the very top it's what's going to color the maps right but first you got to plumbing in and you've got to get it to the lowest level of granularity so that to your point if today I'm on VPN and I'm experiencing one level of performance tomorrow I'm my home office the next day I'm in our Minneapolis facility my experience differs vastly from one place to the next one environment to the next if I'm you know looking at a virtual desktop infrastructure versus my local laptop that's a totally different environment so it's at the socket level and that's socket obviously you know is time bounded right so it's very very contextualized we had a couple questions from Twitter from Bruno he was curious about how many applications out of the box does the agent work with and how easy is it customized sure so out of the box the the apex gig is to our portfolio literally has hundreds of different applications if I had to pick a number it's it's you know it's well north of 500 unique applications that exist on the wire that it's going to be able to analyze and and and and troubleshoot against customization is very easy we've got application discovery which does dpi signature analysis of the traffic and says that's HTTP or that's TDS or that's sip or that skinny running on a given port so identify it as such throughout right so it's Auto discovered the user also has the ability to kind of old-school manually go in and say TCP 5002 is actually this application I know it to be such right so you've got the ability to manually definitely define it as well out-of-the-box is good for about 80 85 percent of our customers the other you know 15 20 percent will actually run the autodiscover and then use that to further populate and round out the default list so if you run into customers where they're trying to just to do discovery of their application say going into kind of a micro segmentation type topology and they're using this to discover how their applications are working rather than trying to sit down with their developers and but this is kind of the Express route all the time all that use case sooner I'm literally going to run through it in about three minutes so appreciate you being a good no it's perfect I appreciate it that scenario of I want to be able to change my application architecture or I want to be able to move to the cloud and I have to understand what dependencies exist and how users experience the app today to your point from earlier how do users actually authenticate to applications you know it's not uncommon at all for us to go into big organizations that have these legacy applications and you go how does this thing work and they go I have no clue the guy who knew left about 15 years ago and we just try not to kick it too hard and it seems to keep running right so that's scenario of and now I need to move this thing to the cloud or I need to figure out how to leverage remote storage and I got to not break it in the process that whole migration process of the deploy strategy is a huge piece of what we do and so I'll show you that in just a minute so remote or testing performance traffic yeah how do you your gonna take multiple sources of data like that because it sounds like there's a lot of like packet crunching going on yep at the actual packets the headers figure out what's going on but then you add synthetic user testing we have application definition like how do we correlate all of that because itself had often been a challenge but yes you know packets are great but they do require a lot of interpretation yes and so you're saying we get there but there seems to be a gap there is a little bit of a gap today as on the market as a whole totally totally agree with that and that's actually what I'm gonna show you in just the very end of the presentation today you guys are fantastic I appreciate it you were you're tracking you're paying attention and this is all going to come together and do it in two beauty and and in wonderment at the very end here so I appreciate the question we will absolutely show you some of that you're right though this does require a ton of packet crunching right and so that's one of the challenges is that you know this technology is based on an organization called network instruments that was founded in 1994 right so been around for you know going on 20 five ish years right I've been in the space for 18 years analytics we're always sort of like real rudimentary you know and I talked about this journey from data which is here's your packets do with them what you will to information which is have layered on some base lining of calc so metrics for you maybe I've rolled up all into some you know really define metrics information is good right what customers are really trying to get to is answers because folks that can read trace files and I know we've got some some Wireshark folks in the room here folks that can actually read trace files man those are those are valuable individuals and you can't throw every problem over the wall at the folks that really know how to work Wireshark on a day-to-day basis you've got to be able to empower Tier three engineers that maybe don't know packet detail as much and especially the tier two engineers right that don't even get exposure to packets because packets really are a single source of truth for what's occurring within the environment if you don't know what to do with them they're not very valuable and that's what we're trying to do with things like the user experience score we're trying to refine all that unique very specific calculations that an engineer would normally have to do and present it in such a way that it's highly consumable for a tier two analyst or maybe even a Tier one operator in certain instances and so if we drill into this I'm just gonna click on one of the conversations here right this is a pretty cool display so user experience score two point four quite quite bad right problem domain isolation network client-server an application what are we finding to be at fault here well certainly the network is yellow right there's some stuff to be talked about there but the application is taking too long to respond to requests why because the server data delivery time and total data delivery time are over are about four and a half seconds that's a problem if every request you make to the servers take in four and a half seconds you know that's gonna be a long user wait time to completely fulfill their transaction completely fulfill the page or the request that they've sent in right so this thing's back there turning for a really long time the cool thing is that this display not only allows you to see the top level score and it breaks down for you the problem domain that that score is but most attributable to but on the right hand side you literally have the packets these are the packets that are that are bouncing back and forth in this transaction so if I want to turn off the packets that have to do with network delay cuz let's just say it's not the network and I want to turn off all the packets that have to do with you know the actual data fulfillment and that have no delay I can literally just get a view of Cline server delay right here's my client request on the Left they do an HTTP GET server response on the right that one took two milliseconds fantastic right well then I get a kind of a more robust query you see that JDS you calm and they're right like I said this is an actual issue from within our production environment and you see the response time there 3.6 milliseconds still not bad right but as I scroll down through this list you can start to see some of these transactions start to take a very very long time right and as you start getting into some of these transactions there's transactions in here that took four and a half seconds transactions in here that took 10 seconds right and they averaged out to a data fulfilment of about four and a half seconds per query that's a serious problem right the fur collection yes get these packets one of the traditional problems is you know you can place collection in any number of places in your network and so this is this is what also an interpretation is the ideas I'm seeing these transactions from from here in the transaction flow I mean are there multiple collectors is that how does this work to try to get a broader picture rather than just my client requests came here because if I just drop it in the in let's say the data center yep that's where I'm collecting packets right I kind of miss all of the activity that happens between the client until it gets to that collection you do you're absolutely right so that there's a couple different pieces of that right the first is you're absolutely right most customers are deploying this inside of the data center so they're seeing the east-west that's happening within the infrastructure they're using packet brokers to feed the product most frequently although some customers directly tap the traffic and I would say it's about a 85 15 85 percent of our traffic is getting fed to us from packet brokers 15 percent off of taps and spans the rest of the the visibility can come from a multitude of different areas right you can leverage flow based technology to get edge visibility just to understand kind of counts in amounts and general statistics that are happening way out there on the edge you can leverage synthetic test capabilities which emulate real user experience but actually because you are the originator and you also have visibility nation and start to tie that information together and that's part of our long-term strategy and vision that I'm going to get into in just a couple of minutes it's perfect just one quick thing I want to jump through here and then I've got to turn it over to Ward but I do want to walk you through a very common scenario right where you've got a user that's experiencing a problem I've got this pre pre typed in here so IP client 10200 988 this is somebody who called in about a network performance problem or an application performance problem when I click into the dashboard I can see everything that's transpired with that user I can see all the different applications that they're using and so forth I can drill into the different applications that they're leveraging I can see the servers that their most frequently communicating with right so I'm starting to kind of peel that onion and understand where the users start what's their primary application which servers are they most frequently communicating with and then to the point that was made earlier right if through this process I'm going you know this is interesting and you know clearly there's some sporadic issue that's happening here I can see that this particular client is communicating to portal dau PET SHOP comm they're trying a couple different browsers that's kind of interesting you know they're trying to use different browsers thinking maybe I'll get a different experience they're trying to just do basic get requests and their delays are not great right so this user is clearly experiencing some problems maybe the problem has nothing to do with the the petshop comm front-end maybe the issue has to do with their dns resolution time or a back-end dependency like a sequel server or WebSphere or something like that that's in the service delivery chain so what I can do is I can right-click and do an application dependency map and this application dependency map literally Maps out the client highlighted in the blue box here and everything they're communicating to right so here's their green connection to the three web servers that you just saw here's their yellow connection up to DNS right so they're actually experiencing some DNS delay that's above and beyond what they would normally experience that may be why the users perception is that the application is slow or the network is having a problem but in reality it has nothing to do with that the the HTTP application the Apache server the backend database it has everything to do with their initial resolve time what's the duration on this this is really very cool but my concern here is like okay so you're trying to pinpoint a point in time yep having problem is that exactly it new what happens if you have a DNS issue at 11:55 yep but the application issue happens at noon yeah like there's obviously a time gap there that you know queries are gonna happen just slightly off from each other yep DNS queries gonna come before I actually hit the IP address for the web server that I'm trying to hit absolutely so you have to have some sort of give on either in you might have put together what the transaction was pulling all together but if you give too much you could be pulling in ancillary data that isn't part of the transaction that could actually lead you astray yes you're absolutely right so it is time bounded to what your what you're saying and we use quite a bit of analytics to try and understand exactly how much we should grab on either side when the user passes in a time window say 10 minutes we actually try and try and time-bound the transactions into your point we're the the software is smart enough to understand that to your point dns is going to happen before the application transaction so we're gonna slide that window out a little bit we're actually going to look at the theme of communication to that DNS server and pinpoint exactly when we see interesting events occurring with the DNS server and that's what gets represented on the graph so it's not just simply a we have a time boundary window and that's what we display it's actually very refined there's a lot of analytics behind the scene here so you're trying to identify similar calls that are they all include these different types of services so it's likely that were called to this server it's also going to include DNS it's also going to include yep you know whatever else yep all those back and then of course what those servers are calling right so here's the HTTP servers where are they going back to they're going back to assist file server and three different tds servers this is a fence where they go you this is a really neat yeah quick question related to this I noticed you typed in like the IP client ahead of the IP address do you don't have to do that or you can just put in an IP address you can just type in you can just type in IP you can type in an application name you can type in free string but what you gather the users thought one X credentials yeah I can i type in s Clemmensen yeah get all of my devices and then it's a great questions iPad versus MacBook versus DC's it's a great question weekly report to see what your client exactly how I want to show all of the CEOs device yes that's great yes so not today okay right now today you can't you can't research the CIO yet but a lot of cool things come in there we'll talk about them guys I apologize I'm gonna just if we can hold just a couple questions I just want to show you one quick thing and then I got to get it over to war because I am running way over on time and he is gonna be angry with me so I just want to show you one quick thing here right I'm gonna do connection dynamics on that same conversation stream right and you can see that the extraction occurs and I can run that extraction I can view that information in the same type of a display that we looked at earlier here's the great thing right is that if you do have a traditional tier 3 Engineer that goes guys this is awesome great great visualizations love the Caliph's love the scores but I gotta send that to Cisco or I've got to send it to another vendor I've gotta send it over to another team right at any point you click the button you save the trace file off there's the trace file that data just got extracted and when you click on it boom there's your pcap opened up in whatever your 3 pane decode of choices so you can always always get down to the individual frames the individual pcap in the trace could you just add a button that just makes a cat case I mean when you're when you're storing Pat sorry I know yeah when you're storing packets that you slice the packets after the header and you lose all the applications we don't slice the package unless the customer asks us ok most customers choose to retain the entire frames and that's why some of these storage arrays go from you know 16 terabytes up to 1.2 petabytes most customers choose not to slice the frames cuz you lose so much of the context quick question IP client is usually too thin for me I need to see like if the if the if one clients having a DNS issue there's a good chance that the entire DNS or servers is having an issue so from a broad range can I say this DNS server in my Atlanta datacenter is having an issue and point that out right away is that absolutely rather than trying to you know focus zoom in really close on one client and then zoom out yeah yes so here's a perfect example of that right this is a site based contextual view right so this is showing performance from site to site and at any point you can click on a pin it'll show you this is our Aden Prairie office right I can go into the apps apps delay I can see site to site delays and if I click on any one of these I can just drop down into that and say show me application performance from site to site and this will actually show you there's your slowest applications right in this case is HTTP but it could be DNS so your dimensions could be the application itself the server itself application and server client based site based right it's very very easy to kind of freeform it out all right so apologize for taking up so much time warlord you're up before you run Hawaii IP client and then a name assuming there's different keywords are those documents I'm I'm just I'm thinking about the filters in search inside of Wireshark which can get really really comfy is absolutely so so the hover over gives you access to a few of the most common ones you can click on the link that'll take you to the more specific ones okay at the very nuanced one how long is this list there's like a couple dozen different very specifically so you could also just say IP and and don't give the context of client-server and we'll show you that IP address from both as a server and as a consumer okay thank you yep all right cool this is the fun part about being the second presenter my name is Ward Cobb Lee are there any questions so real quick guys we're gonna do this in about two minutes observer live is a cloud-based multi tenant service that allows operation and support teams to ensure that users are able to access and efficiently utilize the services that they need to do their job there's the one sentence description what's it look like what are the pieces what's it do if your name by the way appears on this screen you may or may not have won a valuable prize report won violate one of the things [Laughter] it's a light day for you yeah it's a light day yeah one of the things what we're doing right now is we're using some of our virtual agents that are deployed in the cloud to monitor websites that are associated with each of the delegates in the room here today so you know we may want to talk later Brian Robert real quick what are the pieces and parts of the thing we talked about the fact that the application is multi-tenant lives in the cloud agents are the things that are doing the work agents come in four different flavors you have virtual agents that you can deploy on-premises on an ESXi server Oracle VirtualBox whatever makes you happy we have hardware agents you've seen those we have the cloud agents that live out in the Amazon AWS environment we're expanding to Azure and Google Cloud and then the fourth type of agent is an on-demand ad hoc troubleshooting agent where I can actually push a virtual agent out to a Windows sorry Windows only for today PC it will run a test that it's pre-configured to execute and report the results of that test back up to the cloud so four types of agents cloud virtual hardware and troubleshooting what do agents do agents run monitors what are monitors a monitor is a series of synthetic tests this consistent repeatable active test that's going to go out and talk to from the agent of your choice to the destination of your choice it could be another agent could be a service let's see what it looks like if it's a service because we're only going to have time to look at one example here today you noticed by the way the screen is constantly reorienting itself what we're trying to do is bring the things that we think require the most urgent attention up to the top basically it's the things that are getting worse the things that move down the list are things that are getting better based on the last test versus the current test if it's improving it moves down the list if it's getting worse it moves up the list so I'm actually going to go look at something that we started monitoring yesterday just because I thought it was a really cool example and it's not currently on the top of the list so I'm going to go down and find it it's an application you may be familiar with it's called workday and so workday at the moment is behaving itself quite well we're glad to see that we're testing workday from two different places now we're testing it from a cloud agent in Toronto and we're testing it from a cloud agent in Portland and we're able to see that right now they're both doing quite nicely however if we look at our trend over the last 24 hours now we do see something here that could be concerning quickly we're gonna grab that chunk of time we're gonna go look at it and we see that we were over some preset thresholds of performance those can be set by the user or after 28 days of data collection they become dynamic right now we see that we have thresholds exceeded if I click on my breakout I can see the components that make up the end-user response time total so we're saying for instance the total end-user response time at this moment I have highlighted is 537 milliseconds of that network is 468 so in this case it looks like the network is taking up the majority of the time as opposed to server response client response or DNS resolution we also notice down here an interesting a little stair step going on in our route analysis so as we're testing the performance of this particular site or service we're also looking at the route between the agent and the service itself if I pin this moment in time when things are going well I can see if you've got really good eyes that the destination the workday service is being hosted on a server it's an Amazon server in Montreal the test originates in Toronto so I'm going from Toronto to Montreal a life is pretty good at this point but look at this little stair step function that takes place if I click here and I look at my destination I'm now going from Toronto to Minneapolis and so I'm going a bit farther to get where I want to go well what happens here at the top of the ladder if I click up here on this top plateau and I come down and look I'm now going to Phoenix Arizona yesterday is we were watching this from the show floor we were going to Western Australia from Toronto to get to a service that should be in Montreal right so we look at the story and we say it's a network problem is it the networks working just fine it just so happens you're using pieces of the network you shouldn't be using I'm not gonna blame the network right every piece of this network is doing exactly what it should do it's a speed of light issue and if it's a routing issue but think about it now if this were an application I owned and controlled it was on-premises I owned all this and I can control these variables but I subscribe to this as a service what do I do I call work day and I say hey my users are experiencing degradation your routing me all over the world what do they do it just speaks to the challenge that we have as we move from an on-premises world to a cloud world and the kind of information we want to be able to arm ourselves with so that we can have educated conversations with our service providers and help them get better at what they do and with that I think I'm like officially out of time am I not I got a minute 38 left Charles beautiful enjoy real quick question one of the things that I've got to be so I've got to say I'm really impressed with is how responsive the app is you're pulling a whole lot of data real fast is this is this what a normal customer is gonna see I mean yes so what what words showing you here is actually the production observer live.com so if a customer goes out signs up for observer live.com they're gonna use the exact same environment that war is using here in fact it's actually a little bit more because when we do our demo systems we restrict some of the micro services in a customer environment they can spin up dynamically as as needed so this is truly a hyper scale application that's hosted in the cloud and is designed for major major customer loads okay and what about what about the first demonstration we saw so the first demonstration we saw is Observer apex that's on Prem self-managed so most customers have half a dozen people accessing it simultaneously and for the most part they experience the the performance that you just saw there that environment that I was running was actually being fed by by three different Giga store appliances which is pretty typical for most customers