6 Replies Latest reply: Dec 21, 2017 9:19 AM by Joe Kraenzle RSS

ARX insight creation

Rafal Lewkowicz

Hello,

 

I have a question:

 

I'm using subnet audit insight in ARX to visualise /24 addressations to check SLA statuses like RTT, packet loss, throughput..

The problem is that I want to do this subnet audit only on a specific /8 subnet (in this case - defined buisness group).

 

Is there any possibility to restric subnet audit insight only to a specific buisness group?

Sorting by IP address is not going to work, because /24s from other /8s are visible then.

Maybe it's possible to build your own insight which such restrictions?

 

ARX version: 9.6.3

 

 

Regards,

Rafal

  • Re: ARX insight creation
    Joe Kraenzle

    You would need to build your own Insight. To start, you can actually duplicate the existing Insight.


    The Insight Development Kit requires you to choose the producers (e.g., source of the data, the drilldowns from that source), and then the consumers (e.g., charts and tables).


    In this case, you would have to replace/edit all of the producers. This involves:

    (1) replacing from the existing Subnet Group selector to a Business Group selector

    (2) editing all of the drilldowns showing "Group Paths" to being sourced from the Business Group

    (3) ensuring that the replaced and edited objects still show in the proper location in the Grid


    Once you understand how this is done, it's pretty quick to do. I'll try to follow up with this response with an attached file that can be imported with the created Insight. You can compare before and after to see if you can see how it's done.


     

    • Re: Re: ARX insight creation
      Joe Kraenzle

      This isn't fully tested, but here's a quick attempt at what you want.

       

      To install on your system:

      (1) Go to Insights / Insight Manager.

      (2) Click New in the bottom left.

      (3) In the window that opens, leave as Blank and click OK.

      (4) Choose File / Open.

      (5) Choose this XML file, and click Open.

      (6) When it opens, click OK in the bottom right corner.

      (7) In the Insight Manager, in the Name field, type "Business Group Subnet Audit".

      (8) Click OK.

      (9) Open the Insight from Insights / Community / Business Group Subnet Audit.

      (10) Happy AppResponse-ing!

      • Re: Re: ARX insight creation
        Rafal Lewkowicz

        Hello Joe,

         

        Thank you very much for your attention.

        Your answer is quite helpful, but I'm looking for something different.

         

        Do you think it's possible to instead of "(1) replacing from the existing Subnet Group selector to a Business Group selector" to just add Buisness Group selector without removing Subnet Group one?


        The workflow I want to achieve is to do this type of drilldown:

        BGS -> Subnets in selected BGs - > conversations/clients/servers...


        for example:

        1. select 10.1.0.0/16 BG

        2. select 10.1.252.0/24 subnet from BG selected previously

        3. select 10.1.252.13 to check it's throughput


        In this case it's impossible for me to create BGs for each /24 subnet I want to monitor, because there is more than 1700 of them.


        Regards,

        Rafal Lewkowicz

        • Re: Re: ARX insight creation
          Joe Kraenzle

          Rafal,

           

          The Insights rely on the underlying metadata stored in a database. In this case, the drill down from Business Group has a few top level options:

          • Local Traffic (traffic within the business group)
          • Applications
          • IP Protocols
          • Member IPs
          • Connected IPs
          • IP Conversations
          • Connected Groups

           

          Since the Business Group tables do not store a drill down to the underlying amount of the traffic that talks to a specific /24 network, the workflow that you desire cannot be accomplished in the way that you are describing. AppResponse does not natively go to the packet storage to create these metrics from the Insights. It only uses the pre-calculated metrics in the database.

           

          You could use Business Group to Connected Group to get similar information, and an Insight could be created for that purpose. You could script the list of /24 subnets into a spreadsheet and import 1,700 Business Groups in the Business Group Manager. However, as you stated, 1,700 Business Groups is pushing the rated limit of the appliance. The impact will be that it will have implications for metric storage duration and it could cause more processing on the appliance. If your appliance is already running at limits or if you are not okay with losing metric storage duration, you may want to see if there's a way to reduce the number of /24 subnets to focus on a sample of those Business Groups where you expect to want to see this information. There are a lot of factors that go into metric storage duration, but adding that many Business Groups may take you, for example, from having 3 days of 1-minute interval data to having only 1 day, and from having 10 days of 5-minute interval data to have 5 days.

           

          Note, we have had a few clients use more than 1,500 Business Groups on the appliance because it fit their required reporting need. Just realize that it comes with its own set of challenges that you'll have to overcome.

           

          Joe

          • Re: ARX insight creation
            Rafal Lewkowicz

            Joe,

             

            Thank you for realy good explaination of this workflow!

             

            Maybe there is a way to display /24 subnet audit only from a specific addressation? I mean puting filter from insight configuration level to a specific /8 mask. In this example 9.0.0.0/8, which consists of devices i want to divide into /24 subnets.

             

            Adding 1700BGs is not the best way to achieve this.

             

            Also, I have been doing subnet list import (1700 /24 subnets) into favourites table view, but I guess it's impossible to share it with other users from console point of view. I know that it's possible to share project file, but I want to implement funcionality which makes it possible to check throughput timeline from every 1700 remote localizations discribed as /24 addressations for every user without  list/project file imports.

             

            ARX version is 9.6.3.

             

            Regards,

            Rafal Lewkowicz

            • Re: ARX insight creation
              Joe Kraenzle

              Rafal,

               

              I believe what you're asking for an Insight cannot be easily accomplished on the appliance, as I believe it would require a (signed) script to be able to iterate over the possible subnets in the /8 space and pull metrics on each of the /24 subnets. Riverbed does not allow arbitrary scripts to run on the appliance. There are ways that a Local Insight can call a Local Script on your system to do this sort of thing, but it would also complicate your next question around not dealing with local files for every user.

               

              The easiest way to do this would probably be to set up a website outside of the appliance and use the AppResponse Xpert Python Web Services API to pull the raw data. This would allow you to filter and display the subnets in a Web page by /8 address and then pull relevant metrics for a selected /24 subnet. You would have to develop the rest of the graphical display around the Web Services API though. I do not know if the Web Services API will pull all 1,700 groups in one query, whether you could get the /24 subnet information, etc., so there would have to be more research on what is possible.


              With continued development around AppResponse 11, you will most likely be able to use the SteelScript Application Framework to do a lot of this graphical work for you, https://support.riverbed.com/apis/steelscript/install/toc.html.

               

              As far as the saved list of 1,700 subnets, there may be a way to do it. There is a way to receive a tabular data format and send that data to an 'external table' which could be used to drive display of information. The feature was used as an integration mechanisms for special Insights that interacted with other SteelCentral products. However, it'll take some time to find examples as it was a rarely used feature and I have concerns that we may run into character limits when defining the large set of tabular data. I'll see what I can dig up.

               

              Joe