Infrastructure Monitoring

Infrastructure Monitoring

Infrastructure monitoring is a foundational component of any unified monitoring and observability strategy. Modern observability builds on infrastructure monitoring, working alongside techniques like synthetic monitoring and APM (application performance monitoring) to give teams full visibility into what’s happening beneath the application layer.

Infrastructure monitoring tools collect, store, and analyze data from an organization’s IT infrastructure systems: operating systems, virtual machines, servers, storage volumes, networks, databases, and application messaging platforms. Infrastructure monitoring has also evolved to include public cloud services such as serverless functions and container orchestration platforms such as Kubernetes.

In client-server environments, operations teams monitored infrastructure primarily to detect performance bottlenecks. As modern applications grew more complex and dynamic (with autoscaling and load balancing), application-layer monitoring, digital experience monitoring, and distributed tracing added new dimensions of visibility atop that foundation. Infrastructure and application monitoring work together today: when end-user experience degrades, infrastructure monitoring combined with metrics, logs, traces, and AI-assisted correlation helps trace the root cause from the user all the way down to the underlying system.

The sections below cover the infrastructure objects you should monitor, the data types available (metrics, logs, and traces), core tool functionality, open-source options, and best practices for choosing and implementing a solution.

Basic elements of infrastructure monitoring

Servers

A server is the fundamental piece of infrastructure hardware. Modern servers include management modules (such as iLO on HP servers or iDRAC on Dell servers) that let you directly view the status of their components (processors, memory, storage, network, fans, etc.). In modern environments, servers often run hypervisors.

Hypervisors

A hypervisor is a software layer that decouples an operating system and applications from the underlying physical hardware. Common hypervisors include VMware ESXi, Xen, Linux KVM, and Microsoft Hyper-V.

Hypervisors, like servers, include management modules to provide information about their status and the servers they run on. Hypervisors consolidated under a single management system have broad functionality for maintaining virtual machines’ health. It’s important to collect performance and health metrics that can highlight potential or existing problems.

Virtual machines

A virtual machine is a software-defined computer or server. Collecting metrics data from virtual machines makes it possible to identify cases where they don’t receive the required resources from hypervisors or otherwise experience performance issues.

Operating systems

An operating system is a set of programs designed to manage computer resources and organize user interaction. For most environments, start with CPU, memory, disk, and network utilization, system service status, and log events.

Containers

A container is a lightweight, stand-alone executable software package that includes everything you need to run your application: code, runtime, system tools, system libraries, and settings. Docker is a common container format. You can collect resource utilization metrics from “the side” of containers and logs generated during execution. Due to the use of container orchestration tools (Kubernetes, OpenShift, Nomad, etc.), monitoring should shift to a higher level, as the inoperability of a single container may not affect the performance of an application or service.

Database management systems

A database management system (DBMS) is a set of programs that let you create databases and manipulate data (insert, update, select, and delete). Common products include MySQL, PostgreSQL, Microsoft SQL Server, and Oracle Database. Most applications depend on a database, which makes availability and query performance central to service health. DBMSs let you capture a wide range of metrics such as response time, open connections, query execution speed, transactional locks and deadlocks, and buffer and cache usage.

Message brokers

A message broker is an application that receives and sends messages between individual modules/applications inside a complex system. Common products include RabbitMQ and Kafka. Key monitoring metrics for message brokers are the number of messages in queues and memory consumption.

Data storage systems

A data storage system combines hardware and software into a single solution designed to store and process large amounts of information. In addition to the standard metrics for the health of storage hardware components, these three metrics are central to assessing storage performance:

• Service time – often referred to as latency or response time
• IO/s – the number of input/output operations per second
• MB/s – the number of transferred megabytes per second.

Network devices

These are components (such as routers, switches, access points, and firewalls) used to connect computers, servers, data storage systems, and other devices so they can share data and resources. Network devices allow you to obtain essential metrics (port status and utilization, errors, packet loss, etc.) via the Simple Network Management Protocol (SNMP). It’s also possible to receive detailed traffic information using the NetFlow protocol and capture logs using Syslog from many network devices.

Public clouds

A public cloud is an infrastructure model that provides access to compute, storage, network, and other resources. Most public cloud service providers include their own monitoring tools, but if public cloud resources are part of your IT infrastructure, you should monitor them directly.

Understanding metrics, logs, and traces

Infrastructure monitoring relies on three core data types.

• Metrics – quantitative measurements that capture the state or behavior of a monitored system, such as CPU usage, memory consumption, error rates, and similar signals
• Logs – files containing records of system or application actions
• Traces – tracking the passage of a request through a distributed system. A trace is a tree structure with a parent trace and child spans. A request trace covers several services and is further broken down into smaller fragments called spans, each corresponding to an operation or function.

Infrastructure monitoring key functionality

Infrastructure monitoring tools typically cover the following capabilities.

Collection agents

The monitoring agent is a special lightweight application that collects information about the system and the running applications. Monitoring agents let you reduce the load on the monitoring system’s core and enable performing checks directly from the node. These agents can also check whether the network resources that an application or service depends on are reachable. In some monitoring systems, if the monitoring system is unavailable, the agent can accumulate data to return it later when the system becomes available.

Metrics and logs storage

Some monitoring systems include an engine for storing data. Others let you configure database management systems for storage.

Look for monitoring tools that let you configure storage policies per metric type, retaining high-resolution data for a short period and longer-term retention for downsampled data.

Alerting

One of the primary purposes of monitoring is to generate alerts when a problem occurs. The monitoring infrastructure tool should let you configure the rules that trigger alerts and the workflow that runs when they’re activated. For example, defining alert contacts, alerting channels (e.g., email, SMS, Slack messages), and when alerts are sent (immediately, after 5 minutes, after an hour, etc.) are essential features of infrastructure monitoring tools.

In some systems, it’s also possible to configure dependencies between alerts to reduce the number of alerts during massive failures (for example, network failures).

Dashboards

Dashboards are interactive panels that group important information on one or more screens. Dashboards let you group data from multiple data sources. With dashboards, you can implement an infrastructure health map, a network map, or a service connectivity map.

Reports

Typically, an infrastructure monitoring tool contains several pre-configured reports on its status and emerging events. The report engine lets users customize reports to retrieve data automatically and on a regular schedule.

Analytics and machine learning

An infrastructure monitoring system with an analytics and machine learning module lets you identify problems based on historical data and discovered dependencies. By analyzing the patterns of behavior of metrics, it can automatically detect deviations from normal behavior. When combined with logs, traces, and Internet Performance Monitoring data, AI-assisted correlation can connect infrastructure anomalies to their service-level impact, and an advanced version of this functionality can also predict some problems in advance.

Open-source infrastructure monitoring tools

Several open-source solutions cover these capabilities to varying degrees.

Zabbix

Zabbix is an open-source distributed monitoring solution covering network parameters, server health, and integrity across distributed environments. It supports configurable alert routing (email, SMS, custom scripts) and provides reporting and data visualization from historical time-series data. It supports both pollers (for actively collecting metrics) and trappers (for passively obtaining metrics).

InfluxDB

InfluxDB is an open-source time-series database for recording metrics, events, and analytics. It isn’t a complete infrastructure monitoring solution, but it’s an effective engine for storing metrics.

Prometheus

Prometheus is an open-source monitoring solution with a dimensional data model, flexible query language, efficient time-series database, and modern alerting approach. Prometheus is great for collecting metrics from dynamic architecture applications (microservices). Prometheus doesn’t contain its own dashboard module, but teams can visualize all Prometheus data in Grafana.

Elastic

Elasticsearch is a distributed, RESTful search and analytics engine capable of centrally storing data for fast search, fine-tuned relevancy, and powerful analytics that scale with ease. It’s commonly used for storing application logs. Teams typically pair Elasticsearch with Kibana for data visualization.

Grafana

Grafana is an open-source, multi-platform web-based analytics and interactive visualization application. It provides charts, graphs, and alerts for the web when connected to supported data sources. Grafana’s dashboards are flexible enough to serve both technical teams and non-technical stakeholders, including leadership.

Best practices for choosing and implementing an infrastructure monitoring tool

When choosing and implementing an infrastructure monitoring tool, address these four areas:

1. Prepare your infrastructure plan and examine how the monitoring utility covers your infrastructure elements out of the box. The more elements you can cover before customizing the monitoring tool, the less time it takes to fully cover your infrastructure.
2. Prepare an escalation plan for the alerts generated by your infrastructure monitoring solution by considering the following:
   • Where to forward the alerts (e.g., Slack, email, PagerDuty, or console)
   • A strategy for deferring alerts that don’t require immediate action
   • Integration with your incident management system
   • Integration with automation systems that can take basic remedial actions
3. If your selected monitoring tool supports multiple database systems (e.g., relational, NoSQL, cloud-based), start with the one that scales more and costs less in the long run. Changing a database system is a complex and challenging task, so it’s worth researching this decision carefully up front.
4. A common problem with infrastructure alerts is the sheer volume. Consider a tool that supports event correlation, or augment it with one that does. Such technologies suppress symptomatic alerts, avoiding a flood of notifications. For example, if a network route is down, it would generate a single alert rather than one for each unreachable segment of the network.

Conclusion

Infrastructure monitoring is a foundational tool for identifying the root cause of performance issues in modern environments. It supports a unified monitoring and observability approach that covers servers and all middleware systems responsible for the physical and virtual delivery of application services. 

Degradation at the infrastructure layer often reaches end-user experience, which is why modern observability strategies build on strong infrastructure monitoring rather than replacing it. Choose a tool that covers your environment out of the box and integrates with your incident management workflow, one that scales without requiring a storage migration. LogicMonitor’s unified platform connects infrastructure telemetry through LM Envision with Internet path and end-user experience visibility through Catchpoint, reducing blind spots from the user to the underlying infrastructure. Edwin AI adds intelligent orchestration on top, correlating metrics, logs, and traces across layers to give teams a single view from infrastructure to end-user experience.

FAQs