Guest post by Lokesh Chenta, Software Developer for the HP NMC portfolio
Network performance management
The HP Network Node Manager iSPI Performance for Traffic Software (NNM iSPI for Traffic) analyzes IP traffic flows exported by network devices to provide performance management functions such as traffic classification and capacity planning. The exponential growth in the volume of data passing through today’s networks results in an ever-increasing number of exported traffic flows. Therefore, it is imperative that your flow analysis solution be stable, high performing, and scalable to handle the capabilities of this demanding network management.
Scalability of the NNM iSPI for Traffic depends on numerous factors, including:
Patterns of the IP flow traffic being exported
Deployment decisions made while installing the product
The sizing numbers published in the NNM iSPI for Traffic Support Matrix typically result from one or two common test scenarios. The following sections describe recommendations for maximizing throughput of the NNM iSPI for Traffic. Consider these recommendations while deploying and configuring the product.
Influencing factors related to flow exports
The influencing factors for NNM iSPI for Traffic sizing that are related to flow exports include:
Number of flow-reporting interfaces
Fewer flow-reporting interfaces means higher product scalability. The published maximum supported flow rate is specified for a given number of flow reporting interfaces. In environments with fewer flow-reporting interfaces, the NNM iSPI for Traffic can handle higher flow rates.
Percentage of unique flow records per minute
The lower the number of unique flow records, the higher the product throughput. The published flow rate is measured for 80 percent uniqueness of flows. That is, if 100 flows are received in one minute, 80 of them are unique IP flows and the remaining 20 are duplicate IP flow combinations with new performance counters (for example, an FTP session related flow).
The NNM iSPI for Traffic provides the nnmtrafficflowanalysistool.ovpl utility for analyzing the flows being exported to provide information about the traffic flow rate and uniqueness.
Performance of the NNM iSPI for Traffic is better when processing NetFlow version 9 flow exports containing the flow direction flag than NetFlow version 5 flows (that do not export this flag).
NNM iSPI for Traffic supports a scalable, flexible deployment architecture. Each NNM iSPI for Traffic deployment contains:
One or more leaf collectors that process the flows received from the network
One master collector that consolidates the data from the leaf collectors and provides the data to the reporting component (the Network Performance Server (NPS))
Installation time recommendations for improving NNM iSPI for Traffic scale include:
For small or medium deployments, the master collector can be on the same system as NNMi.
For larger deployments and for deployments that include multiple additional NNM iSPIs on the NNMi system, install the master collector on a separate system.
Each leaf collector needs significant system resources; therefore, install each leaf collector on a dedicated system.
Deploy multiple leaf collector systems of the recommended hardware instead of running multiple instances on a single larger system. For example, running two leaf collectors, each on an 8 CPU system, results in better performance than running two leaf instances on a single, 16 CPU system.
The leaf collector does a lot of in-memory processing. Provisioning the leaf collector with higher speed RAM improves the performance of the leaf collector.
The master collector writes a lot of data to disk. Provisioning the master collector with very good I/O improves the performance of the master collector.
The performance of the leaf collector is found to be better on a Linux operating system than on a Windows operating system.
Run-time recommendations for improving NNM iSPI for Traffic scale include:
The NNM iSPI for Traffic provides an option that disables data collection for certain reports (for example, Top Sources for ToS and Top Applications for ToS). Disabling unnecessary data collection saves considerable processing overhead for the collectors, thereby enabling the NNM iSPI for Traffic to support higher flow rates. For information about related configuration options, see the help page for a report in the HP Network Node Manager iSPI Performance for Metrics Software Online Help.
NNM iSPI for Traffic version 9.20 and earlier included TopN reports with 1 minute and 15 minute granularities. To avoid this redundancy while providing data at a useful granularity, NNM iSPI for Traffic version 10.00 introduces a single set of TopN reports with 5 minute granularity.
If you are upgrading from earlier versions, you should adopt this change as a performance improvement. For information about this change, see “Configuring Master Collectors” in the HP Network Node Manager iSPI Performance for Traffic Software Online Help.
NNM iSPI for Traffic version 10.00 introduces application sampling, in which a leaf collector applies sampling on the IP flows received from the network. This feature can be enabled in deployments with very high flow rates when a lower accuracy of reported data is acceptable. For details, see this traffic sampling whitepaper.
When you need to handle additional traffic in an existing deployment, you can provision additional leaf collectors (up to the maximum limit supported) to process the extra traffic.
Suboptimal configurations can adversely impact product performance. Best practices for optimal performance include:
Minimize the number of site configurations based on IP addresses with multiple wildcards (for example, 192.168.*.*).
Create thresholds for a specific interface and application or Type of Service (ToS) combination according to your monitoring requirements rather than creating thresholds at the node level for all applications or all ToS.
Improvements are made to the performance and scalability of the NNM iSPI for Traffic with every new release. For example, version 10.00 supports a 250 percent higher flow rate and higher flow uniqueness than earlier versions. It is always recommended to upgrade to the latest software version to take advantage of the new features and performance improvements.
The HP Network Node Manager i Smart Plug-in Performance for Traffic Software (NNM iSPI for Traffic) is part of the NNMi Ultimate product that provides unified network fault and performance management. Learn more at www.hp.com/go/nnmi
Network Node Manager i (NNMi) unifies fault, availability, and performance monitoring for your network. NNMi software helps you improve network uptime and performance, and increase responsiveness to business needs.
Lokesh is a Software Developer in HP with over 8 years of experience in developing various products in the NMC portfolio. He is part of the R&D team that delivered multiple releases of the NNMi SPI Performance for Traffic that included major features and scalability improvements in the product.