Free Netflow analyzer training - diagnosing_and_troubleshooting
Download as PPTX, PDF1 like450 views
This document summarizes a training on customizing NetFlow Analyzer for diagnosing and troubleshooting traffic issues faster. It discusses how to customize data storage and dashboards, use reporting and automation, and conduct troubleshooting with forensics. Major topics covered include controlling data retention, identifying potential issues early with alerts, finding the root cause of issues using reports and forensics, resolving issues, optimizing traffic, and verifying billing. The trainer provides guidance on these capabilities in NetFlow Analyzer to help users diagnose network problems more quickly and efficiently.
Free Netflow analyzer training - diagnosing_and_troubleshooting
- 1. Diagnosing and troubleshooting traffic issues faster Free training on NetFlow Analyzer: Part II
- 2. Welcome to a free training on NetFlow Analyzer!
- 3. Can you hear me? Can you see the presentation? Please confirm by commenting in the chat panel.
- 5. Part II Diagnosing and troubleshooting traffic issues faster
- 6. Agenda • Customizing data storage • Customizing dashboards • Reporting and automation • Troubleshooting with forensics • Traffic shaping • Capacity planning and billing
- 7. Major concerns while troubleshooting an issue • How do I control how long data is stored for troubleshooting? • How do I identify potential issues early and get alerted about them? • How do I find the root cause of an issue? • How do I troubleshoot and resolve an issue? • How do I optimize traffic and check if my bandwidth is slowly reaching its limit? • How do I know if I'm being overcharged by my ISP?
- 8. How long data is stored for troubleshooting
- 9. Customizing storage settings Aggregated dataRaw data One-minute data
- 10. Aggregated data Default ON Raw data Default OFF Types of data storage • Each and every detail on application, source, destination, and more • Storage time limit (one hour to one month) • By default one day is selected • Improve raw storage up to one year with High Perf • Troubleshoot faster with forensics • Stores "top 100" records for conversation by default (Up to 300 records) • Retains data forever by default • Capacity planning and long-term reporting
- 12. Benefit of turning on raw data • One-minute granularity for the most detailed traffic analysis • Long-term storage for better root cause analysis • Improves accuracy with each and every conversation detail • Deeper insights for troubleshooting with forensics reports • Real-time alerts to troubleshoot issues immediately http://blogs.manageengine.com/product-blog/netflowanalyzer/2010/01/29/data-storage-pattern-in-netflow-analyzer.html
- 13. Why you need a High Perf reporting engine database So you can: 1. Handle huge volumes of traffic with raw data 2. Improve accuracy of traffic analysis 3. Generate insightful reports faster 4. Increase your raw data storage period up to one year 5. Follow capacity trends and troubleshoot efficiently
- 14. One-minute traffic data • Interface traffic graph for any 24-hour period • Capacity planning traffic report • Compare report Raw data • Forensics • Last 2 hour for interface snapshot graphs • Traffic details for App flow, Medianet, Multicast, AVC and ASA flow. Aggregated data • All widgets in inventory (Application, conversation and QoS) • All interfaces and graphs, except a traffic graph for any 24-hour period • Search and custom search report • Consolidated report • Schedule report • Report profile Data storage summary
- 15. How to identify potential issues early
- 16. Traffic summary dashboards Top N applicationsDevice summary Top N protocols Top N QoS Top N conversations
- 17. View top N traffic details from the dashboard • Track top N details in traffic summary • Drill down to the most consumed traffic; identify suspicious traffic • Create new dashboards to view the details that are important to you • Display live data in your NOC screen with auto-refresh option
- 18. Proactive alerting Link congestionUtilization % exceeds High traffic volume Link speed is low
- 19. Set alarms based on bandwidth usage • Difference between alarms and events Alarms display: • Message • Source • Category • Technician • Notes • Severity • Date/time
- 20. Possible options with alarms • Drill down to faulty router/interface from the alarm • Note the exact time an issue occurred • Check for traffic/application graphs • Add notes to update the status of an alarm • Discuss issues with team members An alarm is raised when WAN link utilization is more than 50%
- 21. How to find the root cause of an issue
- 22. Easy reporting CompareCustom search Consolidated IP group and protocol Forensics
- 23. Drill down to any specific detail with reports Search/custom search report Compare report Consolidated report IP group consolidated report Protocol distribution report Bandwidth analysis reports help you: Search specific traffic details by the associated application, protocol, host, or IP Compare bandwidth usage at different time intervals Track top talkers and conversations with a complete report Visualize the combined bandwidth usage of all IP groups View protocol-based traffic for any particular interface
- 24. Save all your reports in Report Profiles
- 25. Benefits of reporting • Create criteria-based reports to identify bandwidth shortages or traffic spikes • Automate and schedule reports at any specific time; receive notifications about reports • Save reports and export them to PDF or CSV files to share them with upper management • Generate historical reports to promptly diagnose bandwidth capacity • Periodically review and optimize the usage of network bandwidth
- 26. Troubleshooting with forensics What's the root cause of a traffic spike?
- 27. Benefits of forensics • Get more granular traffic statistics using raw data • Drill down to identify which users, applications, and protocols are consuming the most bandwidth at a specific time • Troubleshoot accurately by defining multiple criteria to filter required traffic • Flexibility to review historical data and find out why a particular spike was generated
- 29. There was major network congestion and critical applications were running slowly...
- 31. ...which affected all users connected to the network. The biggest challenge was figuring out how to quickly resolve the issue. Step 1: Determine which part of the network was experiencing congestion Step 2: Identify what caused the congestion. App or user or external attack? Step 3: Troubleshoot by applying policies and bring the network back up
- 32. Step 1: Determine which part of the network was experiencing congestion • Where is the congestion and is it notified to me? • Which applications were contributing to the most traffic? • What QoS precedence value was the traffic utilizing at the time? • What were the top source, destination & conversations in the network? The dashboard immediately provided details on what was being affected.
- 33. Step 2: Use forensics to identify what caused the congestion • Which applications or users were consuming the most traffic? • What was the top conversation in the network at that time? Forensics help locate the real cause. The issue was with a patch management upgrade that happened on all windows server during business hours.
- 34. 1. Block the IP using an access control list (ACL) 2. Reduce the traffic bandwidth utilization 3. Load share the traffic with the help of Compare Reports 4. Reschedule the action to occur during non-business hours How to troubleshoot and fix the issue
- 35. 1. Filter out excess router traffic by blocking IP/ IP network 2. Allow certain packets and deny everything else #1. Block the IP with an ACL
- 36. 1. Tweak your traffic policies with CBQoS configurations 2. Shape interface traffic and prioritize your critical applications 3. Monitor the policy change in CBQoS graphs #2. Reduce the traffic bandwidth utilization
- 37. 1. Compare multiple devices across the same time period to view each one's capacity 2. Decide how much to deviate traffic on each interface/device #3 and #4: Load share the traffic or rescheduling using Compare Reports
- 38. Once the issue is resolved, generate a consolidated report to view the traffic stats.
- 39. What should you do if your bandwidth is slowly reaching its limit?
- 40. Capacity planning Know immediately when you've reached your maximum capacity. Generate short-term or long-term reports to view your network's usage trends. Get meaningful insight into application growth, average usage, and any usage deviations.
- 41. How to bill your customers correctly
- 42. Billing Measure bandwidth usage to cross-check with your ISP billing. Generate bill plans for your customers/clients if you're an ISP.
- 43. iPhone app
- 45. Summary
- 46. Need more help? youtube.com/netflowanalyzertechvideos help.netflowanalyzer.com forums.manageengine.com/netflowanalyzer netflowanalyzer-support@manageengine.com +1 (888) 720-9500 / +1 (408) 916 - 9595
- 47. Q&A