UberAgent

When sizing a new environment it is tempting to use averages. It seems the logical thing to do. But it also guarantees a bad user experience. Example: Sizing an RDS or XenApp Farm Let’s say you’re tasked with building a new Citrix XenApp farm. Being a diligent IT person you set up a pilot: one or two machines with all the right software and settings. Then you carefully select a group of pilot users in such a way that they represent the organization’s employee types statistically correctly. Then you let them work on the new platform, ironing out bugs and such. At the end of that period, you have a great new platform. But there is one big question left: how many servers to buy?!

One of the (many) great things about Splunk is that data, once indexed, is not being tampered with. Of course, you can choose for how long you want to retain your data, but Splunk won’t go and average multiple older events into one, because that would flatten peaks and remove potentially important detail.

uberAgent is the perfect monitoring and analysis tool for virtualized and physical Windows workloads. In a nutshell, it tells you what is going on and why things are slow. Seeing is Believing There are a number of easy ways to see what uberAgent can do in practice:

In version 2.1 uberAgent collects detailed ICA, PCoIP, and RDP remoting client properties. Yes, that is right, we have added support for VMware Horizon View to our user experience and application performance monitoring product. Read on for more goodness!

The most important change in version 2.0 of uberAgent is the new architecture. In addition to that we have made many other improvements, significantly reducing the agent’s footprint while increasing the quality of the collected data.

You have probably heard of Splunk, but can you describe what it does to a colleague in a few sentences? That is not easy. Splunk does not belong in any traditional category but stands apart from the crowd. That makes it interesting, but also the explaining harder. Here is my attempt.

Tools that monitor network traffic typically work with IP addresses, not server names. Humans, on the other hand, seem to prefer names over cryptic numbers. Most tools deal with that by doing reverse lookups of the IP addresses, i.e. they are looking for DNS PTR records. The result of such a lookup, however, is not always what you expect. Let us look at a simple example:

You have been there: end-users are complaining and your boss demands an explanation why “Citrix is slow” - again. You, the XenApp/XenDesktop admin, desperately look at Task Manager and Perfmon, but you cannot find a thing. Your servers are humming along quite nicely, but still: applications are slow, the system feels sluggish and logons are taking forever. And then, all of a sudden, things are back to normal. What was going on? How do you prevent that from happening again?

The most obscure effects often have the simplest explanations - once you know where to go looking for them. Luckily uberAgent tells you exactly what is going on. People often ask about the resource footprint of uberAgent. I usually tell them “no IO at all, around 15 MB RAM and below 0.5% CPU” and everybody is happy. Not this time, however.

This is what I have been doing for the past few days: draining the battery of my new Dell Venue Pro 11, a Windows 8.1 tablet (the real deal, not RT). I wanted to find out how good Windows has become at battery-efficient video playback and how that is affected by GPU acceleration.

Application startup duration is an essential component of user experience. If you want to make sure that UX on your Windows machines is acceptable you need to monitor the time it takes for applications to start up. That, however, is not exactly easy - without uberAgent for Splunk.

Whether user profiles are loading slowly or group policy processing is taking too long - uberAgent for Splunk tells you exactly what is causing slow logons. uberAgent always supported a broad range of platforms, from physical PCs through virtual desktops to Citrix XenApp. Today we add RES Workspace Manager to that list!

Analyzing slow boots is a difficult task. You need to install software like XPerf and master its far-from-intuitive command-line options to generate a trace file that you can then analyze. Once you find a possible cause for the long startup duration you never know if it is specific to the machine you analyzed or if it affects other PCs, too. In other words: XPerf, although powerful, is difficult to master. And it does not scale. uberAgent does. And it is super-easy to use.

Do you know the maximum number of users each of your terminal servers can host with acceptable performance? You may have found out the hard way how many are too many - but how many are just right? Farm sizing and server capacity planning are typical tasks for consultants who often have a hard time fighting the peculiarities of perfmon and logman trying to get the data they need for their calculations. It can be so much easier at no additional cost. The 60-day Enterprise Trial version of Splunk in conjunction with an evaluation license of uberAgent give all the information you need in much less time. Here is how.

Today it is still as common as it was in the 90s to go for a coffee after switching on the PC in the morning, only to find it still booting when coming back several minutes later. SSDs have not arrived in the average office yet, and even they can only cure some of the diseases that cause computers to start up agonizingly slowly.

The days are long gone when a browser was just another application. Modern websites are applications of their own, and the browser is their operating system. That has consequences for monitoring. It is no longer sufficient to gather performance data for the browser as a whole. When, for example, Internet Explorer’s CPU usage is high, Administrators need to understand what caused that. Is it the business-critical ERP site or are people just watching fun videos on YouTube?

Considering the importance of fast logons for a good user experience there is surprisingly little information on the subject. Windows does not even record the total logon time, let alone where it is spent. Administrators wishing to analyze their users’ logons are left in the dark. But that can be changed.

uberAgent has been pretty good at monitoring applications for some time. It is capable of auto-grouping processes to applications and showing IOPS and other stats per application in addition to per process. All this gets even better today: beta 2, available now, adds application usage metering to the feature list.

If you have ever used Sysinternals’ Process Monitor, chances are high you were a little intimidated when you looked at your first capture: it probably contained hundreds of thousands of registry and file system events, generated in a minute or less. That amount of activity must surely indicate high system load - but strangely, very often it does not. Looking at the hard disk LED you will only see an occasional flickering, even though thousands of file system events are captured per second. How is that possible? Read on to find out.

The beta version of uberAgent for Splunk is available. Official news release uberAgent’s website Download

Who said that end users get all the pretty UIs? Administrators are as happy as anyone to replace ugly consoles with good-looking HTML5 that runs on a smartphone just as well as on a PC.

uberAgent for Splunk monitors Windows machines. It does not try to display as much data as possible but focuses on visualizing what is actually going on instead. In the last post we gave you a glimpse of the information it can display about user sessions and logon times. Today we are going to talk about machines, processes and applications.

uberAgent for Splunk takes Windows monitoring a step further. uberAgent does not just collect data - it gives you the information that matters. Other monitoring products rely on the performance counters built into Windows. uberAgent has its own metrics, covering key aspects of user experience and system performance.