This article can also be found in the Premium Editorial Download "Storage magazine: Tame the e-mail beast: Valuable e-mail management strategies."
Download it now to read this article plus other related content.
Filters and expert systems
Many vendors feature post-capture processing such as post-filter and expert system tools, assisting in analyzing the trace. Post-filter allows users to control what's displayed on the screen after the capture. Some vendors are addressing post-filter performance by using hardware-assisted index tables to produce the data virtually on demand. Systems such as Finisar's SANMetrics check the traces for a number of bugs. It also helps users locate problems, but can vary in processing time due to the size of the trace. As traces become larger, post processing and expert system analysis will need to keep pace.
File management is another area of ongoing concern, again due to the size of the traces. Most vendors will tell you not to save or file transfer an entire trace - they are too long. They suggest you partially save the trace and transfer only that section. When you need help in examining an entire trace, you could access the analyzer remotely across the Web either directly, as in the case of Ancot, or via a third-party software package. This clever feature allows a distant user to have complete control over the analyzer, including the view and hardware set up. Users from several different locations of a company can use this to work together to analyze the trace. To do this, users must bypass any security measures the company may have set up. And that's the rub. Many users who need to collaborate on a problem are actually from different companies, and firms often restrict outside users from entering their site.
As the rapid pace of SAN deployment continues, network complexities are escalating. Longer distances, massive port count SAN configuration (exceeding 1,000 ports) and increased switch intelligence are increasing trace sizes and placing additional challenges on the analyzers.
Distances between host and devices on a SAN are growing because of the sheer increase in port count configuration and through the use of MAN routers. Greater distances are an issue because they tend to elongate the trace. The longer it takes for an I/O operation to complete, the more the analyzer needs to capture.
Larger port counts are increasing the size of the trace and are having a profound effect on the design of the analyzers. Most analyzers offer up to 16 ports of simultaneous operation. In order to monitor and control multiple ports simultaneously, the analyzer needs to operate the ports at the same time or events may be missed. Vendors accomplish this by stringing single port hardware together as a group interconnected via a cable or back plane.
A distributed clock is necessary so traffic can be recorded in the same order as seen on the link. Using any other connection - such as Ethernet - would not provide enough precision. This design imposes practical limits to the number of ports that can be simultaneously controlled. The interconnect - cable length and back plane - is constrained by the clock cycle of the link capture speed, and as bandwidth increases, the clock cycle will be shorter. As users need to monitor more ports simultaneously, vendors will need to confront these challenges.
Vendors have been constantly upgrading their viewing software to keep pace with the industry's changes, and many now offer many different formats and displays. Finisar offers a top-down viewer that allows you to see all the ports interleaved one after another in the order they were captured with a detailed view of the highlighted event in another window. I-Tech features a side by side display of all ports also in the order they were captured. Other vendors are making their views more customizable. U.K.-based Xyratex offers a protocol editor that provides greater flexibility in altering the format and display of the data. As analyzers support higher port counts, vendors will need to ensure their displays can handle even more data in an easy-to-view format. Given the amount of space on a standard monitor, this is no easy feat.
SANs complexity is increasing with the advent of emerging protocols, including iSCSI and InfiniBand. These protocols are presenting challenges to the analyzer because they're built upon different physical layers from FC and analyzer vendors based their initial designs on FC. The challenge is to handle more than one protocol in a consistent, unified look and feel. I-Tech offers a seamless approach to analyze FC and iSCSI protocols in a single chassis. Their latest offering allows you to view each of the protocols side by side so you can easily watch data flow from one to the other, in a time synchronized order. Finisar offers support for InfiniBand as well. Their software will control and view all three protocols simultaneously in top-down, time synchronized, intertwined viewing. Other vendors have indicated plans to support other protocols as well.
Higher bandwidths and increasingly complex networks are the future. The FC and Gigabit Ethernet communities are preparing 10Gb/s specifications to meet these demands and the FC is considering an interim 4Gb/s speed. These changes will necessitate new and increasingly more sophisticated analyzers. It's likely analyzer tools will take on the shape of the networks they monitor: more ports, higher speeds and more complexity.
This was first published in October 2002