Reporting Data Traffic on a Fiber Switch in a SAN

Once Hardware Sentry KM has been configured to monitor a fiber switch in a SAN (Brocade, Cisco, or McData), it measures the amount of ingoing and outgoing data for each fiber port in the switch. This information is stored in the PATROL Agent’s history as a data rate (in megabytes per second), and as a total amount of data (in gigabytes). The history retention period specified in the PATROL Agent’s configuration defines how much data is retained in the history file and how much can be used for the reports.

By using the Reporting > Ethernet/Fiber Port Traffic Report… KM Command, the PATROL administrator can build a report of the data traffic on a SAN switch. This tool generates a multi-parameter graph in the PATROL Console with the total amount of data transmitted and received by each port in the switch, on a per-hour or per-day basis.

Ex_Reporting_Traffic_SAN_1

Ethernet/Fiber Port Traffic Report

The graph above was generated with the Ethernet/Fiber Port Traffic Report tool of Hardware Sentry KM 1.6.01. It shows that one device has been transmitting 30GB an hour for a couple days, while the other ports are barely active.

Ex_Reporting_Traffic_SAN_2

Ethernet/Fiber Port Traffic Report — On a per-day basis

The graph above shows the same data on a per-day basis, with a peak at almost 700GB transmitted on Thursday, while the other ports are almost idle.

Ex_Reporting_Traffic_SAN_3

Ethernet/Fiber Port Traffic Report — Bar Style Graph

By choosing the “bar-style” graph (see picture above), we can identify that actually 2 ports on the switch reported an important activity, which is logical since one port was receiving data and another transmitting the very same data to another device.

Ex_Reporting_Traffic_SAN_4

Ethernet/Fiber Port Traffic Report — Statistics

The statistics button of the graph window allows us to see some numerical information about each graph, i.e. about the amount of data that each port received or transmitted (see above). In this case, we can identify that the port 15 (WWN 2004000DEC2F880B) received as much as 683GB and send that data through the port 1 (WWN 200A000DEC2F880B).

The infobox on port 1 and port 15 helps us identify which devices on the SAN are the cause of such an abnormal activity:

Ex_Reporting_Traffic_SAN_5 Ex_Reporting_Traffic_SAN_6

Ethernet/Fiber Port Traffic Report — Port Infoboxes

The Connected to Physical Address item provides us with the WWN of the SAN device at the other end of each port, in this case: a Windows server was stuck in a file copy loop on a LUN hosted on an EMC storage array.

The Ethernet/Fiber Port Traffic Report is a powerful tool to diagnose a performance issue in a SAN:

•	which servers are too demanding?

•	which disk array is under pressure?

•	what is the traffic caused by the backups (from the disk array to the tape library)?

•	are the "multi-pathing" links properly configured and the load shared among the different paths?

For the SAN administrator, it can also be a convenient way to inform one of his customers (a server administrator, or a person in charge of an application) of how much their servers are reading from or writing to a disk array, in total, per day.

This tool can be invoked from either the main hardware icon corresponding to the SAN switch, or from a group of ports (the Network Interfaces icon), or directly from a selected port instance.