Combining Both Worlds
Today, monitoring a company’s infrastructure and business processes is a requirement, not a choice. Every unmonitored asset is a missed optimization opportunity that complicates maintenance and poses a high likelihood of failure.
Depending on the nature of the asset being monitored, we have several approaches. In this post, we’ll focus on those related to network monitoring.
The approach to network monitoring is divided into two main groups: passive monitoring and active monitoring. Both monitoring methodologies are completely different. Each group has its benefits and limitations and should be considered complementary; in fact, they can be used together, as WOCU does.
What Do We Mean by Passive Monitoring?
The main difference between active monitoring and passive monitoring is that passive checks are performed by external applications, while active checks are initiated and performed by the monitoring solution.
When we talk about passive monitoring in networks, we mainly refer to the sending and management of traps generated in the devices that are part of the network: routers, switches, load balancers, etc.
This form of monitoring is asynchronous by nature, meaning its state is not regularly monitored; instead, the device itself sends a message indicating the severity and informing that a change in some processes has occurred since the previous state.
Passive monitoring can be very useful for troubleshooting performance issues after they have occurred; however, as we say, they can only be discovered after they have occurred.
What Do We Mean by Active Monitoring?
In this approach, regularly scheduled active checks are used to monitor network devices. Active checks can be used to probe a device or service, obtaining information about its state at regular intervals.
In our case, active checks are initiated by the logic of the WOCU monitoring engine. When it’s time to verify the state of a host or service, a plugin is executed that passes information about what needs to be checked. This plugin then verifies the operational status of the host or service and reports the results back to WOCU.
Finally, WOCU processes the results of the host or service check and takes appropriate actions as necessary (e.g., sending notifications, executing events, etc.).
Better Together
As we can see, both active monitoring and passive monitoring are necessary to get a complete picture.
Active monitoring should be used to provide visibility into the performance of Service Level Agreements (SLAs); when used in this way, it warns us early of a potential performance degradation, even before the client notices it, increasing the proactivity of our operational teams.
This, combined with business process modeling, will allow us to quickly classify affected services and identify access points or common cause elements to ensure that the most critical issues are addressed first.
Passive monitoring allows two key operational functions, firstly post-event analysis: by building a historical profile of traffic and signaling flows, analysis can be performed to look for anomalous traffic, such as distributed denial of service attacks, or unusual or indicative signaling, such as excessive calls or high retransmission activity.
And secondly, passive monitoring is ideal for building a detailed understanding of usage patterns, planning network and system upgrades to accommodate growth in demand, and identifying opportunities for new services.
