SplunkLive Miami Carnival Cruiselines - John Masseria
•
0 gostou•1,447 visualizações
John Masseria presented on Carnival Cruise Lines' use of Splunk software. Carnival operates multiple cruise lines and uses Splunk to monitor and troubleshoot their IT infrastructure, including Windows servers, IIS logs, and other applications. Splunk has helped Carnival reduce troubleshooting time, proactively detect issues, integrate data sources, and create dashboards for analysis. Going forward, Carnival plans to expand their use of Splunk to additional environments and data sources.
Recomendados
Recomendados
Mais conteúdo relacionado
Semelhante a SplunkLive Miami Carnival Cruiselines - John Masseria
Semelhante a SplunkLive Miami Carnival Cruiselines - John Masseria (20)
Mais de Splunk
Mais de Splunk (20)
Último
Último (20)
SplunkLive Miami Carnival Cruiselines - John Masseria
- 1. John Masseria Manager of Architecture and Performance Copyright © 2011, Splunk Inc. January 12, 2012 Miami, 11 Listen to your data. Copyright © 2012, Splunk Inc.
- 2. Carnival Cruise Lines • Operating Company of Carnival Corporation • Carnival Corporation & PLC is the largest cruise company in the world • Each Cruise Line operates autonomously: Princess, Carnival, Holland- America, Cunard, Costa, Aida Copyright © 2011, Splunk Inc. January 12, 2012 Miami, 2 Listen to your data. Copyright © 2012, Splunk Inc.
- 3. What We Do.... • IT Engineering Group --Report to VP of Operations and Engineering • Responsible for all areas of I/T Engineering shore-side & shipboard • Responsible for: – Unisys mainframe Group (for reservations/bookings) – Unix and Storage group (Linux/Solaris - Oracle) – Windows Application Programming/Engineering Group (IIS, Apache, Tomcat, WebMethods, Autonomy, Tealeaf, Splunk) Copyright © 2011, Splunk Inc. January 12, 2012 Miami, 3 Listen to your data. Copyright © 2012, Splunk Inc.
- 4. Why Splunk? • Challenges mining the information generated Carnival.com IIS web servers • Apps generating thousands of exceptions • Very difficult to find meaningful information in the data • Needed visibility into our event information “Within minutes of downloading the evaluation copy, we had visibility into our event logs” Copyright © 2011, Splunk Inc. January 12, 2012 Miami, 4 Listen to your data. Copyright © 2012, Splunk Inc.
- 5. Environment Overview • 2 Splunk installations: Production and UAT • Running on VMs • Indexing: • All Windows event logs • All IIS servers and back-up servers • Sitecore / Documentum (Content management sys) logs – flat files • Using WMI vs. Splunk forwarders Copyright © 2011, Splunk Inc. January 12, 2012 Miami, 5 Listen to your data. Copyright © 2012, Splunk Inc.
- 6. From Reactive To Proactive • Alerting helps us to be more proactive • Threshold-based alerting • We are actively looking for error messages versus fixing them after customers have reported them Copyright © 2011, Splunk Inc. January 12, 2012 Miami, 6 Listen to your data. Copyright © 2012, Splunk Inc.
- 7. Saving Time With Splunk PROBLEM: 11 Servers for Carnival.com. We had to look at all 11 x 15 minutes to find root cause • Seconds to minutes to resolve issue in Splunk • Developers now have direct access to servers • 2 hours to minutes phenomenal time saver Copyright © 2011, Splunk Inc. January 12, 2012 Miami, 7 Listen to your data. Copyright © 2012, Splunk Inc.
- 8. Root Cause Analysis via Splunk Copyright © 2011, Splunk Inc. January 12, 2012 Miami, 8 Listen to your data. Copyright © 2012, Splunk Inc.
- 9. Aha! Moment: Integration • Integration between Splunk and Tealeaf • Tealeaf helps us understand End-user-Experience • Splunk helps us understand why that experience might not be as optimal as we want • Precise to monitor SQL databases • Integration means speedy MTTR “I am amazed at how easy it is to index and analyze data in Splunk.” Copyright © 2011, Splunk Inc. January 12, 2012 Miami, 9 Listen to your data. Copyright © 2012, Splunk Inc.
- 10. DashboardsRoot Cause Drill Down • Searched: event logs for 'SQL' • Found: Communication problem between webserver and SQL database Copyright © 2011, Splunk Inc. January 12, 2012 Miami, 10 Listen to your data. Copyright © 2012, Splunk Inc.
- 11. # of Bookings Through Website Copyright © 2011, Splunk Inc. January 12, 2012 Miami, 11 Listen to your data. Copyright © 2012, Splunk Inc.
- 12. Booking Requests • Splunk calculates and displays statistics on the value stored • Average age for the search Copyright © 2011, Splunk Inc. January 12, 2012 Miami, 12 Listen to your data. Copyright © 2012, Splunk Inc.
- 13. Dynamic Webpages Copyright © 2011, Splunk Inc. January 12, 2012 Miami, 13 Listen to your data. Copyright © 2012, Splunk Inc.
- 14. Top 10 pages that are still being referenced Copyright © 2011, Splunk Inc. January 12, 2012 Miami, 14 14 Listen to your data. Copyright © 2012, Splunk Inc.
- 15. Future Plans • Evaluating Splunk security and compliance solution • Use Splunk more in QA/ testing environment prior to going into production • Leverage more Splunk out-of-the-box functionality • Index UNISYS mainframe generated data Copyright © 2011, Splunk Inc. January 12, 2012 Miami, 15 Listen to your data. Copyright © 2012, Splunk Inc.
- 16. Thank you! John Masseria Manager Architecture and Performance Copyright © 2011, Splunk Inc. January 12, 2012 Miami, 16 16 Listen to your data. Copyright © 2012, Splunk Inc.
Notas do Editor
- Tealeaf much more difficult to implement. But we successfully implemented that with Splunk. They work well together. We might be looking at Splunk at an interesting exception.What did user do exactly? And in Tealeaf we can see the session cookie.
- W3C log files (web requests) potentially valuable information
- Beauty of the product is seeing what other are doing with it and then doing the same thing. A lot of out of the box canned reports and we haven't really taken advantage of. ROI
- You can also talk about the APO/FPO example here and how Splunk found that exception and you solved it. Reduced time to MTTR
- TTR (Time to Resolution) – load balance using round robin. Which webserver is having problem. Tealeas will tell us that, Splunk will tell us which Server. We pro-actively know what is happening. Site having problemsFriendly error page – to understand exception (can't get into database or query is taking too long
- Below is an example of a Dashboard graph generated by Splunk showing the number of bookings generated by our web site over a period of time. This was facilitated by adding one line of ASP.NET code to our application to generated an event log entry whenever a new booking was successfully created.
- The search below displays more detailed information for booking requests that receive a specific advisory status code. This screenshot also shows how Splunk automatically calculates and displays statistics on the values stored in the fields being reported on. For example, here Splunk tells that what the average value for age is for the subset of records selected by this search.
- Here’s an example of events that are generated when dynamic pages on our web site that no longer exist are referenced. We display a friendly page telling the user that the page being accessed no longer exists. This is typically caused by design changes to our site that retire pages and either users having these retired pages bookmarked, blog posting references, or search engines that haven’t been updated.
- Use Splunk supported apps such as: Splunk for Windows & Splunk for UNIX