Can O365 be monitored accurately via SW if all traffic traverses a proxy

Question

We are looking to setup monitoring of our O365 connectivity and want to understand how this can be achieved if external traffic has to be sent via proxy.

Would the proxy need to be by passed and if so this isn't then an accurate reflection of genuine traffic flows.

We would also like to know what can and can't be achieved using solarwinds to monitor traffic.     For instance we get a lot of call regarding slowness opening mail boxes.  Also

users PA 's with shared calendars and mailbox's complain of slowness and freezing, can this all be monitored and can it pick up individual user performance.

Thanks and Kind Regards

Jason

mesverrum · Answer

When you say monitor the O365 connectivity, what metrics are you interested in gathering.  Different modules will show you different things, so it depends on which ones you have purchased to get a sense of what you are looking at.

You mentioned flow which implies network bandwidth use.  If that is the case it won't really matter that you are going through a web proxy, at your edge router just look for all traffic between the proxy server(s) and the microsoft addresses.  Unless you are saturation your WAN link this won't give you much other info though about the specific Office use case you are describing.  Just general bandwidth utilization trends, you can see how much bandwidth moves between the proxy and the web server but wouldn't really be able to tie it back to individual users very specifically.  Without the proxy in the way it is possible to see how much bandwidth was associated with a given user though.  You also might already be able to pull session data back from the proxy server itself if they are logging that kind of thing, but thats not really related to any SW products.

With Netpath (part of NPM) you could set up test probes and get some sample data on how long it takes to connect from inside your environment out to Office's servers on 443.  It wouldn't factor in authentication or anything like that, just how long does it take to get an initial response on 443 so you can have a sense of the network situation and trigger alerts if there is loss on the path or latency jumps up dramatically at some point, and it would let you know where in the path those factors were introduced, so if latency is tight all the way to the edge of your network then you see big jumps in response at their server then that pretty much absolves your team of responsibility in that case

With SAM you could run powershell scripts against the Office servers where you would authenticate and can pull down whatever data you tell it to do, these would track if the connection is successful, and how long it takes to get your requested data, in addition to the actual contents of the responses like counts and lists of licenses and such in use.  This would give you some perspective on the general connectivity from where your poller sits out to Office and actually includes the delays on their end a bit better with a real payload, so you can compare that to a netpath and see maybe it takes an average of 125 ms to do the netpath connection round trip, but your real requests tend to take 300ms or whatever.  If you have multiple pollers you could also compare the results across different locations if that is relevant data for you.

None of the Solarwinds tools are for wire data analysis, so you could never drill down to see slowness of a specific user session in them.  You can see and record data about a synthetic sample "user experience" and get aggregated bandwidth data.  That data is all general trends rather than saying something like "When Jeff tried to pull down his mail at 3:45 yesterday and this is exactly what the delay was"  but you can say, jeff and 10 other people called complaining about slowness during this time frame, our synthetic monitors showed that Office was slower than normal during that window for our users because the WAN connection was getting crushed by some youtube streaming.  Or maybe everything was perfectly normal on your end and someone would have to talk to the user about specifically the things they were trying to load up and maybe you set up a SAM transaction to pull that user's mailbox and see how much data comes back and how long it takes and compare that to a baseline testing mailbox that you might have set up.

Ultimately to get the full data of some specific user's experience from 2 days ago without having to jump through any of these guesses and estimations is something you would expect from something like a Netscout or Gigamon type of network tap appliance.

cnorborg · Answer

With just NPM, you can monitor any interface and see the data from aggregated traffic, ie: no detail, just the # of bytes and such.

With NTA, if the traffic passes through something that will send flow data, which is pushed by the device not polled by solarwinds, you can get pretty accurate breakdown of the conversations, bytes, ports, protocols, services, etc.   Make sure you adjust the "timeouts" on the netflow box to send data for active and inactive flows frequently so you get accurate data.   Most routers and layer-3 switches can do it this way, as well as firewalls and such.  No idea if any proxy servers will.

There used to be software that would parse proxy logs and produce reports off of it, but doubt you'd get much resolution off of it.  Not something SW will do...