NAKIVO Blog > VMware Administration and Backup > All You Should Know About IT Infrastructure Monitoring

All You Should Know About IT Infrastructure Monitoring

At small companies with few servers and workstations, system administrators can quickly identify issues that occur without any special tools. As a company grows, so does the number of servers and other network devices. And if something goes wrong, a system administrator must still be able to identify the problem quickly to prevent serious issues. Looking for an issue manually in a medium or large infrastructure can be difficult and time-consuming. Fortunately, automated IT infrastructure monitoring is widely available today to help administrators identify the type and source of issues as fast as possible. This blog post explains IT infrastructure monitoring, and why you should use monitoring tools for your servers and other network devices.

What Is IT Infrastructure Monitoring?

Infrastructure monitoring is the process of collecting data related to hardware and software in your physical or virtual environment. This data is collected and measured based on specific parameters or metrics. The collected data can be sorted and represented in a user-friendly view. Infrastructure monitoring is a recommended practice for all organizations, but it is particularly crucial for medium and large companies.

Why Is IT Monitoring Important?

Infrastructure monitoring is important for many reasons. Generally, monitoring improves the operation of servers by improving availability and reliability. Let’s look at what tasks you can perform with IT monitoring tools.

Identify an issue and find the source of the issue. It is easier to find the source of an issue when you have information provided about it instead of checking all suspected machines manually to identify what has gone wrong. For example, a website goes down. If you can see which database server is offline or database is down in the monitoring report , you know what you should fix without the need to check all possible machines and components manually. In this case, you may be able to fix the issue quickly before users even notice it. You can also identify unwanted traffic that loads your network (and find the machine that may be infected to fix that).

Be aware of an issue immediately. You can use IT monitoring tools to detect issues as soon as they occur, configure notifications, etc. Troubleshooting is more effective if you are notified about the issue in the shortest time and if you know what and where you should fix.

Prevent issues. IT monitoring helps IT specialists track how elements of the IT infrastructure are functioning. If you see unusual CPU activity, some applications might be working incorrectly. If, in addition to CPU overload, you notice high disk load, be careful because ransomware may have encrypted files and caused this behavior. If you see unusually high network activity on the gateway, be aware that probably someone is stealing data from your network. If you see that SMART parameters (Self-Monitoring, Analysis and Reporting Technology) are bad for a disk (for example, Current Pending Sector Count and Reallocated Sector Count values are high), replace the disk as soon as possible to prevent performance degradation and data loss.

Monitoring network speed helps you identify whether bandwidth is enough, whether an internet service provider (ISP) meets the service level agreement (SLA) for the provided services, etc. If some segments of your local area network are overloaded, you can have a bottleneck, consider hardware upgrade, and install switches, routers, and network cards with faster network interfaces (1 Gbit/s instead of 100 Mbit/s, for example).

Monitoring the temperature of hardware components (CPU, HDD) helps you prevent failure and hardware damage. Overheating reduces the MTTF (mean time to failure) and can cause hardware failure and damage. If you see that the temperature is too high, check the cooling system on the monitored device.

Predictive analytics. Modern software can help you predict resource usage, such as storage space usage. As a result, you can plan when to buy new disks and insert them into servers. After increasing workloads, you may need to upgrade hardware. It is better when such events are predictable before the issue happens and becomes critical.

Intelligent algorithms used in infrastructure monitoring tools can predict high-probability dangerous events based on the historical data and failures in the past. Software analyzes logs and other data, learns the patterns (for example, what event occurred before application failure), and then uses these patterns for failure predictions. The accuracy of error prediction is set to improve as machine learning and artificial intelligence improve. Predictive analytics and prediction of failure have big potential.

Optimize workloads. You can check CPU and network activity statistics on different servers and schedule data backup when the hardware is not loaded for user convenience and better application performance. Modern tools provide real-time monitoring capabilities and display historical data previously collected.

Save money and time. If you can prevent and resolve data loss, server failure, or other issues in a short time, operation in your data center is more efficient. As a result, you minimize downtime, optimize costs, and save time spent on maintenance. IT monitoring tools also help organizations meet the SLA for provided services. This is especially important for managed service providers (MSPs).

Alerts and Notifications

IT monitoring software usually collects data and displays information in an optimized view in the web interface. A system administrator and authorized users can open the web interface and check the summary information, graphs, statistics, and other data for the entire infrastructure and for particular servers, devices, and applications. Administrators and users can check this information on-demand. This is a useful option, but how can you be informed about the issue immediately? Administrators cannot spend the whole day monitoring statistics. For this reason, most IT monitoring tools allow administrators to configure automatic notifications that are sent via email, Skype, SMS, etc. Administrators can configure triggers based on specific events to send notifications to the chosen destination. Alerts can be prioritized: the most critical alerts should have the minimum delay, while other alerts can be sent with a delay of a few minutes.

For example, if a host goes offline, a notification message is sent in two minutes to an email group or to a Skype group whose members are administrators, advanced users, and team leads. If a server is online again, the appropriate notification message is sent to the group. You can also set alerts for low disk space, CPU overload, and insufficient memory on servers. If the network device has the appropriate functionality, you can even configure notifications about the low level of toner in a cartridge in the network printer. It can be useful if users always print important pages, and you want to avoid  forgetting to check whether there are full cartridges in the inventory.

Some software allows you to run commands on the remote server automatically when a trigger is activated. For example, the command to restart a service in a remote operating system can run automatically after the defined period following service failure.

When you configure system monitoring software, set the adequate intervals to collect data and generate reports. If the interval to generate a report is too small, the processes generating reports and graphs in dashboards can interfere with core processes, and CPU load increases significantly. That can cause overload and failure of the monitoring server.

Principles and Methods of IT Monitoring

Let’s overview the main principles of IT infrastructure monitoring used by most monitoring tools. Monitoring can be performed using client-server software by installing agents on monitored machines. Agentless monitoring is performed using the server-side software and supported network protocols, while VM and container monitoring has its own features that should be taken into account.

The server side. The most powerful IT monitoring tools require installing the server component of the system monitoring software on a server or virtual machine. The server software records collected data into a database, provides a web interface for administrators and users to configure the system monitoring software and monitor IT infrastructure statistics.

An agent is the component of the IT monitoring software that is installed on the target machine from which data must be collected. The agent interacts with the server via the network and sends the collected data to the monitoring server. The agent should support multiple operating systems to cover the IT infrastructure better.

Agentless monitoring. This type of monitoring can be done without installing monitoring software agents and can be used for different platforms, which is especially useful if you cannot install the monitoring agent (for example, a switch or router). IT monitoring software can check the availability of services on a remote host using ICMP, SSH, FTP, HTTP, and DNS protocols without monitoring agents. The server monitoring software tries to access the destination host via the defined protocol, and depending on the server response, determines the status of the needed service.

SNMP (Simple Network Management Protocol) is developed especially for monitoring tasks without installing monitoring agents on remote hosts. The remote host must run the appropriate SNMP service to support data collection via SNMP from this monitored host. SNMP works on the application layer of the OSI model, and the latest version is SNMPv3. The SNMP protocol is usually supported in switches, routers, access points, firewalls, network printers, and other devices that are connected to the network. Each object identifier is associated with the appropriate parameter, such as received bytes, transmitted bytes, CPU temperature, level of toner in the printer cartridge, etc. Object identifiers are numbered using the hierarchical (tree-like) structure. For example, 1.3.6.1.4.1.343.2.19.1.2.10.206.1.1.16 is the identifier for the temperature sensor of Intel hardware. An SNMP agent is not the same as the monitoring agent of system monitoring software.

WMI (Windows Management Instrumentation) is the proprietary network protocol developed by Microsoft to monitor Windows-based systems without installing agents. The monitoring tool should send a WMI query to a monitored host and then read the returned data.

VM Monitoring. If you want to monitor virtual machines, consider agentless monitoring software solutions using VMware APIs for monitoring ESXi hosts, vCenter servers, virtual machines, including parameters such as CPU, memory, storage, network usage. This approach allows you to avoid overheads comparing to the method when monitoring agents are installed on VMs.

Container monitoring is tricky compared to monitoring traditional servers and virtual machines. This is because containers are provisioned/destroyed quickly, and they share resources, which makes it difficult to measure the consumed resources of a host. Deployment of N agents in N containers is not rational. Just like VMs, containers can be monitored via special APIs. The Docker stats API is a native mechanism provided with Docker containers to monitor them. The main idea of container monitoring is to monitor containerized applications of the microservice architecture running in containers.

Types of Monitoring

Let’s explore different types of IT infrastructure monitoring to learn more about how monitoring can help you in various categories. This classification of monitoring types is conditional because many of the types listed below intersect with each other.

Hardware monitoring is used to monitor hardware health (CPU temperature, HDD temperature, HDD SMART status, battery life data, voltage, etc.) using available sensors and technologies, online status of servers and other devices. Free memory, disk space, disk activity, and swap file usage have an impact on overall performance. If memory is full, and swap file is used intensively, you may need to optimize running applications or perform a memory upgrade.

Network Monitoring is used to monitor data transfer rates on different network interfaces, the number of connected users (useful for VPN connections), network connections, firewalls, etc. Network monitoring helps you detect network overload, low data transfer speed, and unauthorized attempts of access to the network. You can also detect a malfunctioning network card. Monitoring TCP and UDP connections on a router allows administrators to detect unwanted network connections that might be caused by malware or other sources of attacks.

Security monitoring is used to detect security issues to fix them and prevent attacks. Software vulnerabilities, opened ports, and unwanted permissions can be used to initiate attacks in your environment. Time synchronization on hosts is monitored to ensure that antivirus software can download updates and encrypted connections can be established. Monitoring users who logged into a server and accessing file shares and other resources helps administrators detect whether an account has been compromised.

Critical activity monitoring. This type of IT infrastructure monitoring allows you to detect unauthorized login attempts to a system, files modifications, etc. Monitoring files and folders help you detect unusual activities caused by ransomware and respond quickly to avoid data loss. Mass deletion of files can be classified as a critical activity. Database activity monitoring also allows you to prevent data leaks.

Application monitoring is important if users of your organization or external clients use applications that must always work properly. Some system monitoring software can check application logs, including operating system logs, detect error codes, and display aggregated information in the web interface or send notifications to administrators. Application monitoring can include CPU and memory consumption by an application. Depending on the application type, different monitoring approaches can be used. Applications monitoring tools are often included in IT monitoring software.

Uptime monitoring. Uptime is the period since a host was powered on and booted. Uptime monitoring is useful to detect whether a host was powered off even if nobody has noticed that (for example, a server was rebooted at night during non-working hours after installing automatic updates or after a power outage). The longer the host operates properly without reboot, the more reliable and stable the system is.

Distribution models

There are three main distribution models of system monitoring software and IT monitoring tools.

Free/Open source. Monitoring tools are downloaded and installed on the needed machines by a system administrator for free.

Proprietary/closed source/paid. IT monitoring tools are bought and then are installed by an administrator on the needed machines.

SaaS (Software as a Service). System monitoring software of this type is pre-installed by a vendor or service provider in a public cloud. Access is granted to the tenants after payment. Payment can be made on a per-month or per-year basis. Infrastructure monitoring tools distributed in a SaaS model can be useful to monitor cloud infrastructures.

Conclusion

This blog post has covered basic ideas and principles of IT infrastructure monitoring. IT monitoring is vitally important for each organization and is crucial for large organizations. Modern IT monitoring software supports many useful features to monitor hardware and software components of servers, virtual machines, and other infrastructure components connected to the network. Infrastructure monitoring allows system administrators to detect issues very quickly, predict resource usage, prevent failures, and perform hardware upgrades in time.

Even if you use the best system monitoring software, don’t forget about data backup. Server failure and data loss can happen to everyone. VMware backup and Hyper-V backup allow you to protect your data, recover data in case of failure, and restore workloads with normal operation in a short time. NAKIVO Backup & Replication is a universal data protection solution that supports backup of physical Linux and Windows machines, VMware vSphere VMs, Microsoft Hyper-V VMs, and Oracle Database. You can download the free edition of the product on the official website.