Performance monitoring systems Ltd

“Agents versus Agentless” is a very old debate within IT circles. Like many persistent arguments, any given version of it usually ends with “it depends”. It is a pros-and-cons weighing exercise that rests heavily on a number of circumstances.

For those not familiar with the debate, it comes down to one defining question: Do you trust whoever built the agent enough to install it and let it run on your critical infrastructure?

Agent-based monitoring systems require you to install some software onto the device of interest – or compile it into the code of your precious applications. That often puts IT and application managers on edge:

• What if it breaks the server?
• Can you be sure it does not have a memory leak?
• Does it use a lot of the local CPU for its own processing?
• Is it secure? Does it use encrypted communications?
• Do we have to put one on every server?
• How do I choose which servers to put it on?
• How often do patches come out?
• Do they work in virtualized environments as well?
• Will this one conflict with the five other agents I had to install on this server?

Once agents are installed, they can provide an incredible amount of information about the inner workings of a system or device. It is like turning the lights on an otherwise black box. But the view tends to be limited to the local device where it is installed. And the risk, if not the impact, of the installation can make you hesitate.

Agentless approaches, on the other hand, have been attractive if only for avoiding all this teeth-gnashing. Agentless monitoring does not require software to be installed on your systems – usually it relies on some existing agent or interface that is part of a device, such as a native service or daemon – or it consumes some “opportunistic” source of data, such as a syslog file. These data sources are usually available or being generated, regardless of monitoring, and can be accessed without major modifications to the critical infrastructure.

One thing to determine, when considering an opportunistic source of data, is just how rich the information is. It is true these sources are rarely as rich as an agent-based source…But there are notable exceptions. When the opportunistic data source is network traffic, there are a great number of advantages worth noting:

• always on – no additional configuration of the servers required
• a very rich source of data
• carries at least two levels of information – network and application
• easily accessible (e.g. through the SPAN port of a switch)
• data access independent of critical infrastructure
• views across most or all participating devices (depending on network topology)