Product review: Agents make suite diagnoses

Web site found. Waiting for reply. And waiting. And waiting. And waiting . . .

Look familiar? Do you often wonder whether the problem is with your local network, the ISP's backbone or the content provider's servers? Until now, that's been a tough question to answer. However, you can now get a new view into the internal workings of your network with VitalSuite 2.0 from VitalSigns Software (which International Network Services last month announced plans to acquire). As soon as we installed VitalSuite, identifying overloaded servers, slow Domain Name System (DNS) responses, missing Web pages and bogged-down client CPUs was easy.

VitalSuite consists of VitalAgent client software and complimentary servers VitalAnalysis and VitalHelp. During the course of our tests, we let our clients gather data for several days while we monitored the reports on the VitalHelp server. Several times we suffered network outages, which were duly noted by the VitalAgents. At one point, our primary ISP suffered a fibre cut in the Washington, DC area that significantly degraded network performance for several hours. The slowdown was quickly reported by VitalSuite.

The bundle earns our World Class Award and a strong recommendation for its effectiveness, ease of installation and excellent documentation.

We installed VitalAnalysis and VitalHelp on a Dell Optiplex 400-MHz Pentium II with 128Mbytes of memory and 8Gbytes of disk space running Windows NT 4.0, Service Pack 3 and the NTFS file system. The VitalAgent client was deployed on nine workstations, ranging from a 266MHz IBM Thinkpad 600 running Windows 98 to a Dell 166MHz Pentium with Windows NT 4.0 and 32Mbytes of memory.

For several days we scattered the clients across a 20,000-node test network to provide the software with a variety of network conditions. We connected the server and several clients by cable modem to the main network at 1.5Mbit/sec. Two clients had an 8Mbit/sec Multi-Megabit Data Service feed supplied by GTE, and the remainder were on switched 10Mbit/sec ports.

Deployed on users' workstations, the VitalAgent clients monitor and diagnose network problems. A dashboard display tracks activity, speed and delay in three panes.

VitalAgent's activity pane monitors the performance of applications and displays a connectivity diagram that traces a path from the client to the server. Problem areas are highlighted in red, and if you double click on those areas, you get instant feedback on the nature of the difficulties. The application being monitored is displayed at the top of the activity pane.

The speed pane reveals how much data is currently flowing on the network in kilobits per second. Current and average bandwidth consumption are displayed, and a slick bar graph shows the ratio of sent to received data.

The delay pane highlights network or server slowdowns, and attributes a percentage of the total delay to each. We found the delay pane to be useful in providing a quick pointer to the source of congestion.

We were skeptical of VitalAgent's ability to accurately measure network traffic, so we decided to put it to the test. We downloaded a 40Mbyte file through our 1.5Mbit/sec cable modem connection while watching the dashboard. VitalAgent reported 1.5Mbit/sec of traffic, the maximum available bandwidth.

We then fired up a second download on another machine and watched both clients immediately report a drop to 750Kbit/sec -- a 50 per cent reduction in throughput. A third download dropped the average bandwidth consumption to 500Kbit/sec.

We found only one application that appeared to confuse VitalAgent: RealPlayer Version 5.0. After an initial burst of activity, the current bandwidth display dropped to zero. VitalSigns technical support indicated that RealPlayer Version 5.0 may use a different TCP port number than earlier versions.

Once VitalAgent performs its monitoring and traffic-tracking tasks, the VitalAnalysis server collects the data at regularly scheduled intervals and produces a comprehensive set of charts and reports. We were impressed with the amount of detail available. For example, application heat charts summarise the performance conditions experienced by each application, including packet loss, throughput and delay.

The heat charts are tables with spherical indicators that are color-coded according to the severity of a problem. Client reports list information about each client, such as IP address, CPU type, memory and operating system. Server reports summarise the health of servers monitored by VitalAgent clients.

You can view reports by accessing VitalAnalysis' Web server with a Netscape or Microsoft 4.0 (or higher) browser and a monitor capable of at least 1024x768 pixel resolution. This integral Web server doesn't have many of the enhanced features of Microsoft's Internet Information Server (IIS), although it works fine for the initial VitalSuite installation. We recommend installing IIS once the system is in production mode.

VitalHelp chronicles each client's transaction history, providing a cleanly organised log of network, server and application problems. The VitalHelp console runs under Windows NT 4.0 and is divided into three areas.

The severe events frame presents the operator with a digital display indicating the number of severe events on an application-by-application basis, currently in the queue or those that have occurred within the last one- or eight-hour period.

The group frame displays all active clients sorted by application, and color codes their current status. We found this display to be particularly useful; we could immediately see how many clients were reporting problems with an application.

The active events log shows the status of current events, the number of times each problem has been seen and the ticket number assigned to each problem. Quick diagnosis is available by double clicking on an event.

The VitalHelp console supplies a rich suite of test tools, including a packet-capture feature. Administrators can retrieve the client network configuration as well as run traceroutes and DNS queries. While no substitute for a full-fledged packet analyser, the packet-capture function is unique, and the inclusion of such a feature demonstrates why VitalSuite is a standout package. One caveat: the supplied settings for alarm thresholds are very sensitive. With a large user base, it would be easy for the VitalHelp operator to become overwhelmed by noncritical warnings such as "Web page not found" or "DNS lookup failed".

Installing VitalSuite was a snap. We followed the documentation and encountered no major difficulties. To ensure a clean installation, we formatted our server's disk and loaded a fresh copy of Windows NT 4.0, Service Pack 3.

VitalAnalysis and VitalHelp really put the server's hardware to the test. We recommend a minimum 350MHz Pentium II with 128Mbytes of RAM.

VitalSigns provides all the necessary software, including Web server, reporting tools and Sybase's SQLAnywhere database. We used the generic installation options for each package.

We installed VitalAnalysis and VitalHelp on the same server, a configuration that VitalSigns doesn't recommend for a large production network. We noticed the CPU load on our server reached 100 per cent during report generation, so we recommend using different servers if you plan to install more than 25 VitalAgent clients.

VitalSigns provides the best documentation we've seen in a long time. The manuals are clearly laid out, cover a wide range of topics and provide a large number of illustrations and screen shots. With these guidebooks at your side, it's unlikely you'll need to contact VitalSigns for any but the most complex questions.

Overall, we were extremely impressed with the quality of this software. Installation is simple; documentation is excellent; reports are concise; and clients operate transparently.

For network administrators and help desk managers responsible for large enterprise networks, VitalSuite is a must-have package worthy of our World Class Award.