Rolling Review: NetQoS SuperAgent

In the second installment of our application performance management Rolling Review, we take a look at NetQoS' SuperAgent appliance, which measures application performance by monitoring TCP packets as they travel through the network. SuperAgent, which is part of the NetQoS Performance Center suite, promises to clearly show how well the network is delivering services to end users and provide an overall view of what's happening on the network.

We found that SuperAgent varied in how specific and accurate its reports were, depending on the nature of the trouble. If an issue was related to network performance, the appliance was very good at identifying the exact problem. For server performance issues, alerts indicated there was problem; however, without an SNMP agent, it could not provide significant detail. If your monitoring environment includes a critical application that does not support a generic SNMP agent, SuperAgent is not for you.

The real value of this tool emerges when in the hands of a network engineer working to troubleshoot a performance issue within the network. The appliance allowed us to drill down and get very discrete packet-level performance data. While it does support executive views, this is not the product's strength: SuperAgent's high-level views quickly reach a level of detail that will leave most CIOs and IT generalists scratching their heads.

In all but the simplest environments, multiple SuperAgent appliances will be required. NetQoS supports as many as five collectors per management console and up to three management consoles per Performance Center. NetQoS SuperAgent licenses are sold by appliance, not usage. NetQoS told us that each individual appliance can support up to one gigabyte of traffic across the span interface.

List price for the SuperAgent standalone appliance is $38,500. For a distributed setup, a Master Console is $39,500, plus $22,500 for each additional collector. Performance Center is bundled into the price.Easy Rolling

One thing that's traditionally scared IT away from APM is the complexity of getting these systems up and running. We're pleased to report that deploying SuperAgent was quick and easy, once we did some prep work in the environment to be monitored—in a nutshell, the ports to which monitored applications were connected needed to be spanned to the monitoring network port.

Once SuperAgent was up and running, configuring it to monitor our environment was a snap. We manually defined applications by specifying collector, network, server and application details. SuperAgent can monitor many types of applications, including those that support a single TCP/IP port range, like PeopleSoft, Oracle or Lotus Notes, as well as Web and FTP apps and TCP control-port applications, in which all data transmission is via a selected port.

If you don't want to manually define your applications, SuperAgent can collect information from the network and automatically build a list of apps that an administrator can then assign to a collector for monitoring and reporting.

Also available from NetQoS is the Reporter Analyzer, a traffic-analysis module that's used to break down data collected by the SuperAgent to provide more granular detail, and NetVoyant, a product that provides performance reporting based on information collected via SNMP polling. Neither of these modules was tested in our review.Keep Your Eye On the Ball

SuperAgent let us aggregate elements into a single view. In our testing, this feature allowed us to monitor the performance of our Web server, SQL server and application, as well as the network. Not only was composite application performance data visible, but specific components that were affecting performance were readily identifiable. More detail on our test applications is available in the Kickoff.

NetQoS SuperAgent did a solid job collecting and reporting on end-to-end application performance by monitoring traffic as it crossed the network. We found the SuperAgent useful for pinpointing the specific cause of application performance problems, as it can see all inbound and outbound data.

To determine how well SuperAgent was able to identify and isolate performance problems, we adjusted the performance threshold for our SQL server to report on very minor degradations. The appliance successfully detected and reported on issues and, using the aggregation feature described above, presented the information in a way that enabled us to clearly see what was affected. Good stuff, but we're hoping that other products we test will not only be able to detect the performance problem, but also determine just what's causing it.

We did note that while it's both useful and easy to group components of a multi-tiered application together on a single screen, the threshold violations that occur are based on individual components. This could result in an operator seeing both a slow-response-time error on a Web application and a performance issue with the SQL server, but alerts are not presented in the context of one to the other. Operators must log in to get a sense of how alerts relate. Again, we'll be looking to other products in our testing group to meet this challenge.While the appliance concept may be appealing for many organizations, in order to detect performance issues on a server—for example, insufficient memory, disk, CPU or process problems—and classify the cause, you'll need to have a third-party SNMP-enabled agent installed. SuperAgent can then be configured to launch an investigation automatically, based on threshold violations, to collect basic system stats to help further isolate the problem. These investigations can also be run manually. During our review, we were able to gather CPU, memory, disk and process information.

Application performance threshold violations are sent via SNMP or e-mail. If Performance Center is deployed, SuperAgent can integrate with external data sources to display disparate data alongside the performance information collected by NetQoS applications.

Michael Biddick and Darren Donahue are with Windward Consulting Group, a firm that helps organizations improve IT operational efficiency. Michael is also a contributing editor for Network Computing/Information Week. Write to him at [email protected].