By Splunk June 18, 2012
The Splunk App for VMware is now here. To get a sense of all it can do, look no further than our customers, who put the App through its paces during the beta. Check out www.splunk.com/goto/getvmware to read a few of the stories; our case study with CloudShare about end to end monitoring of cloud environments with Splunk & the app for VMware is here. We will also be at VMworld next week, see the details here.
One really interesting story is from one of the earliest evaluators of the Splunk App for VMware. They started with looking at Splunk as a way to understand and harness their ESX/ESXi logs – but when they realized everything that was possible with the App, they were rocking their own dashboards in no time.
One of the problems they needed to tackle was the discrepancy in memory usage reported by the hypervisor vs. memory actually used by the virtual machines. When they ran large workloads such as databases, cache memory played a big role in application performance – but this was not reported by the hypervisor. So to get the data they had to look inside the virtual machines at the OS metrics (cached memory reported by top, committed memory reported by WMI). VMware unfortunately reports memory usage using calculations that make the metric unreliable – they subtract overhead, and add in de-dupe etcetera. Splunk gave the customer a whole new way of getting accurate statistics about virtual machine memory usage. After installing a Splunk lightweight forwarder inside their virtual machines they were able to compare actual memory usage with what was granted by the hypervisor.
The result? A really cool way to determine exactly which virtual machines are over provisioned or under provisioned! Why did this matter? VMware now charges by allocated vRAM and this is a good way of knowing whether the granted vRAM is adequate or not. Eliminating over-provisioning without starving virtual machine performance is key to cutting costs.
Another customer reclaimed a huge amount datastore space by simply finding and cleaning up snapshots, using the snapshot view in the App. They had also modified our datastore summary dashboard to find over-provisioned datastores. Since they use thin provisioning they wanted to be alerted when the datastore’s free space is less than 10% of total volume size.
Another of our long-time customers really liked the log browsing views inside the App. They quickly gained new visibility into their virtual infrastructure, “We have been down this road with VMware before where they just point us to their documentation – you are making these logs English for us.”
Look out for a Splunk webinar in July with Rachel Chalmers, of 451 Group – one of the more influential thinkers in the virtualization space. We will cover these and other customer stories and use cases in the webinar. Meanwhile, if you need access to the Splunk App for VMware, email sales@splunk.com and someone will get in touch with you right away.
If you have feedback on the App or have more views/dashboards you would like to see: email vmware AT splunk.com.
If you want to hear more on what we’re doing in the virtualization space, don’t forget to register for the 3rd annual Splunk User’s Conference Sept 10-13, 2012 at The Cosmopolitan in Las Vegas! We have numerous sessions on Splunk for Server & Desktop virtualization – be sure to attend to catch these! Learn more at www.splunk.com/goto/conf
----------------------------------------------------
Thanks!
Leena Joshi