sFlow Agent for Windows Server 2012 Hyper-V

Virtualization and cloud computing promise to deliver dynamic, efficient and flexible services. In order to realize these benefits, complete visibility into network and system performance is required. It is no longer sufficient for systems administrators to focus on CPU and memory usage, while network managers look at performance in the core of the network only.

For example, virtual machines can be moved between servers to balance server load or to perform maintenance without incurring downtime. However, if dependencies between virtual machine and their applications are not understood, migrating a virtual machine to another server can result network traffic flowing through the core of the network rather than between virtual machines on the same virtual switch. Such dramatic changes in traffic patterns can cause cloud-wide performance problems.

The sFlow standard provides an integrated end-to-end view of performance. It defines a coherent framework of metrics for integrated network, server and application performance monitoring. The sFlow architecture consists of numerous simple sFlow agents sending raw measurements to a central collector. The combination of traffic measurements from the high-speed switch fabric, system management metrics from the servers, virtual machine to virtual machine traffic measurements from virtual switches, virtual machine performance metrics from the hypervisor, and application transaction monitoring provides a detailed picture of overall data center and cloud performance.

The sFlow Agent for Microsoft Windows Server 2012 Hyper-V is a complete implementation of the sFlow standard. It integrates with the Windows Server 2012 Hyper-V extensible switch so that the virtual network traffic can be monitored in the same way as physical network traffic. In addition the sFlow Agent exports performance metrics for the physical system and virtual machines, automatically discovering and monitoring new virtual machines. The sFlow Agent has been designed so that it can be deployed throughout the data center without impacting performance. By integrating with Microsoft System Center Virtual Machine Manager, the sFlow Agent is easily deployed throughout the data center. It is the ability to provide integrated and coherent performance data, combined with the scalability to monitor every resource in the data center that makes the sFlow Agent for Windows Server 2012 Hyper-V revolutionary.

The sFlow Agent for Hyper-V provides all the data required to solve performance problems. For example if a user complains that an application is running slowly, the sFlow data can be used to identify that the server hosting the application is seeing poor disk performance, link the disk performance to a slow file server, identify the other clients of the file server, and finally determine that all the request are competing for access to a single resource. With this information specific actions can be taken to resolve the problem.

For public or private cloud operators, the sFlow Agent for Hyper-V provides the scalable, integrated visibility needed to optimize workload placement minimizing operating costs, and to accounting for usage for billing.

The following charts use sFlowTrend to illustrate some of the performance metrics reported by the sFlow Agent for Windows Server 2012 Hyper-V.

The following chart shows top network connections flowing through the Hyper-V extensible switch.

It is easy to see that the majority of the traffic is associated with Windows file sharing. The chart provides a minute-by-minute view of network activity.

The following chart shows the CPU utilization of the physical server.

The processor utilization is averaging at just under 15% with a brief peak of 40%. Based on this chart it looks as if there is plenty of capacity to run run additional virtual machines.

The final chart shows disk activity for the server and each virtual machine.

The following diagram shows how the sFlow Agent for Windows Server 2012 Hyper-V is built into the Hyper-V extensible switch.

The sFlow extension is inserted into the packet forwarding path, randomly sampling packets that flow through the virtual switch. The packet sampling mechanism is extremely lightweight, delivering detailed visibility while ensuring minimal impact on forwarding performance. Sampled packets are sent to a userspace sFlow agent that exports the sampled packet headers along with physical and virtual NIC interface counters, server and virtual machine CPU, memory and I/O performance to an sFlow collector.