Foglight APM for Real User Experience 5.9.11 - Installation and Setup Guide

Monitoring multiple hosts using local Sniffers

If you do not have permission to install a network tap, the alternative is to install a Sniffer on each ESXi® host you want to monitor. All web traffic to and from the host, including any inter-application web traffic that occurs on a host, is captured by the locally deployed Sniffer.

In an environment where vMotion® is in use, lock the local Sniffers to their hosts so that they do not move when other VMs move. When monitoring HTTP traffic only, vMotion is fully supported.

When monitoring HTTPS traffic, vMotion interrupts the decryption of HTTPS traffic for open SSL connections. When the VMs move, the Sniffer on the new host does not have the SSL session information that was available to the Sniffer on the old host. Therefore, the new Sniffer cannot decrypt the traffic. All open SSL sessions are affected, as well as any future SSL connections for the affected users that reuse the existing SSL state. SSL session states are reused based on a timer with values anywhere from five minutes to hours, so the impact of the vMotion movement varies greatly for each monitored environment. To avoid this issue, ensure that VMs with HTTPS traffic are not moved.

Mixing virtual and physical appliances

In either of these installation scenarios, you can substitute physical appliances for virtual appliances. For example, in a centralized Sniffer scenario, the Sniffer can reside on either a virtual appliance or a physical appliance. When adding Archivers to receive data from the same Sniffer, add all virtual Archivers or all physical Archivers—not a mix—to support efficient load balancing activities and maximize the storage potential of each Archiver. It is okay to mix virtual and physical Sniffers within a capture group.

Scaling out a multiple host configuration

If the network load begins to exceed the Sniffer's monitoring capacity (usually resulting in dropped packets), deploy additional Sniffers. If resources permit, you can deploy more than one Sniffer to the same host and configure them to use the same port groups. To split the load among Sniffers, in Foglight you need to configure monitored IP addresses, configure the Sniffers to enable the Filter by IP Address option, and then assign Sniffers to monitor different sets of endpoints. For more information, see “Defining Sniffers” and “Managing monitored IP addresses” in the Foglight APM Administration and Configuration Guide. Alternatively, in a centralized Sniffer scenario, you can use intelligent filtering in the network tap to split the load.

If two Sniffers on the same host are intended to monitor two distinct networks, instead of reusing the port groups assigned to Sniffer 1, you can create additional Monitoring Network port groups for Sniffer 2 and connect them to the other network. If you expect any overlap in traffic between the networks, use the monitored IP address approach described above to resolve the overlap.

Add as many Archivers as you need to store the volume of captured traffic in your environment. Resources permitting, you can deploy more than one Archiver appliance on a host. A Sniffer can send captured data to up to 32 Archivers.

Because the Management Server is deployed on a dedicated host, the Server accesses additional server resources automatically as the solution is scaled out. If the Server exceeds its partition, you can expand the partition.

Installing virtual appliances to monitor multiple hosts

The installation process includes the following steps, which are described later in this section.

When you finishing installing appliances, see Setting up appliances.