Observer 14 Introduces Auto-Baselining and NetFlow Enhancements

I recently spoke with Douglas Smith, president of Network Instruments, about his company's release of Observer 14. Developed "in response to customer demand," the upgraded performance-management platform focuses on the most challenging problems IT pros face in quickly identifying and resolving application problems before they affect users.

Says Smith, "Our main goal with the new version is to reduce the mean time to resolution. We want to give users a top-down view of their network so that when things turn red, they can quickly drill down to trouble areas."

Currently, companies are pigeonholed into one investigation pathway completely determined by their analysis tool. The newest Observer release expands these capabilities from a tool-centric to a solution-centric approach, giving network teams the freedom to set the investigation path, find the problem, and fix it.

To that end, the Observer Reporting Server collects data from many data sources—whether they're Network Instruments probes, retrospective-analysis devices, or NetFlow devices such as routers or switches—and aggregates it into a global view from which you can drill down.

A nifty new feature of the Observer reporting Server is its auto-baselining capability. Smith says, "You can set up some criteria to compare today's data with data from the past. You can set criteria by a single day, or a day of the week, or a day of the month, for example. Is it deviating by a lot or a little?" Observer 14's auto-baselining lets you identify and respond to performance problems before they affect users. The platform automatically establishes baselines for all performance and time-based metrics. You can quickly determine whether application delivery or performance is acceptable based on current and past network’s traffic patterns. It allows for a more proactive approach to network management.



Overall, Network Instruments is starting to evolve from a network-centric view to an application-centric view of performance. "We're seeing that networks have different problems than they had a few years ago," Smith says. "Layer 2 or Layer 3 infrastructure has gotten pretty good. We're just not seeing the switching, addressing, and even cabling issues that we saw 10 years ago. The problems are in the higher layers—Layers 5, 6, and 7—so what we're seeing is corporations that want to look at application-level performance data in great depth."

Smith went on to describe the three areas of application analysis at which Observer 14 excels:

Observer 14 brings other benefits, as well, including NetFlow scalability. As you know, Cisco devices keep statistics about the data flowing through them, and they send those statistics to a NetFlow reporting system (Cisco or third-party) in a specific, defined format. "Observer Reporting Server can receive a flow from a router," says Smith, "and the router will report on all the traffic flowing through it. So it turns those Cisco devices into collection tools and they send out this formatted data. We've turned our GigaStor product into a NetFlow agent so it can send out the NetFlow stream to any other reporting system."

The two clear advantages of this update: First, a number of security devices require NetFlows to work, and traditionally, if you don't have Cisco products, you're out of luck. But now you can install a GigaStor and provide that flow to the security products. Second, a limitation of NetFlow is that it shows only routed traffic—the traffic moving from one VLAN to another, not the traffic within a VLAN. GigaStor can now export that dataflow traffic within a VLAN. Smith says he's very interested to see how the marketplace reacts to this functionality.

You can find additional product information about Observer 14 at the company website