Financial Services Technology Leader Turns Mainframe Logs into Real-Time Insights
Signaler
Partager
•0 j'aime•107 vues
Financial Services Technology Leader Turns Mainframe Logs into Real-Time Insights
•0 j'aime•107 vues
Signaler
Partager
Télécharger pour lire hors ligne
A global financial services leader in payment, banking, and investment solutions, stays ahead of the competition by relying on powerful mainframe processing and real-time analytics. The company delivers an exceptional – and secure – digital experience to their global customer base by using Splunk and Precisely Ironstream. View this on-demand webinar to hear how this customer turns mainframe security and operational log data into real-time insights with Ironstream and Splunk to: - Proactively detect fraud and monitor security - Meet SLAs with near-instant application response times - Save time, effort and resources while lowering MTTI & MTTR
Recommandé
Contenu connexe
Tendances
Tendances(20)
Similaire à Financial Services Technology Leader Turns Mainframe Logs into Real-Time Insights
Similaire à Financial Services Technology Leader Turns Mainframe Logs into Real-Time Insights(20)
Plus de Precisely
Plus de Precisely(20)
Dernier
Dernier(20)
Financial Services Technology Leader Turns Mainframe Logs into Real-Time Insights
- 1. Financial Services Technology Leader Turns Mainframe Logs into Real-Time Insights Ian Hartley | Product Management Director
- 2. Housekeeping Webinar Audio • Today’s webinar audio is streamed through your computer speakers • If you need technical assistance with the web interface or audio, please refresh your browser window – Chrome is recommended Questions Welcome • Submit your questions at any time during the presentation using the Q&A box Recording and slides • This webinar is being recorded. You will receive an email following the webinar with a link to the recording and slides 2
- 3. Agenda What happens when… A large, fast-paced, complex financial organization… …a legacy computing platform… …and Splunk…get together? Dramatic shifts! Great insights! • Precisely • Business & Challenges • How things used to be • How things are now • Where things are going • Q & A 3
- 4. The global leader in data integrity Trust your data. Build your possibilities. Our data integrity software and data enrichment products deliver accuracy and consistency to power confident business decisions. Brands you trust, trust us Data leaders partner with us of the Fortune 100 90 Customers in more than 100 2,000 employees customers 12,000 countries
- 6. World of Finance 6 • Fast-paced • Mission-critical • High-demand • 24 x 7 x 365 • Consistency is vital • Availability • Performance “Money makes the world go round”… …if you can keep it flowing
- 7. Use Case 7 • Credit card services • Provide card services to clients • Technology-driven • Common services/facilities • Unique elements • Splunk “control center” for each client Large, Multi-National Financial Services Organization
- 8. “Legacy” Environment…is Still Center Stage • Core technology, running for several years • Central to many processes & systems • Underpins essential business services Significant investment in current software Highly scalable Low latency processing Multi-threaded batch processing Mainframe Love 8
- 9. How Things Used To Be
- 10. Too Limited, No Correlation Single machine status at a time – out of context with larger system 10 Limited Screen Estate Limited Visualizations Data Changes Frequently One Region per Screen Non- Dynamic Data Long MTTR
- 11. Mainframe – Excellent Platform, but… Delivers the information needed…but with limitations Long Lead Times 11 Expensive Development Long Lead Times High CPU Costs Potential Impacts Limited Access Limited Data Scope
- 12. Need to Improve Ideal Solution… • Leverage investment in Splunk • Add mainframe…somehow! • Better visibility & agility • Enable deeper insights • Improve MTTI & MTTR • Fast development time • Be more accessible • Real-time would be awesome! 12 + ??? There must be a solution Need to raise data profile Invested in Splunk…but mainframe missing
- 13. SMF RMF File Load Log4jIMS SYSLOG SYSLOGD System State SYSOUT Live SPOOL Db2 Unix USS ! Network Alerts Assembler C, COBOL, REXX Forwarder API Mainframe LPAR IDMS Splunk Enterprise IT Service Intelligence Enterprise Security Data Models Starter Packs (searches, dashboards, etc.) Ironstream ® Data forwarder from Precisely 13
- 14. “Traditional” Systems are Typically Excluded 14 Distributed and Cloud environments “Traditional” systems IBM Z Mainframe IBM i System
- 15. Ironstream for Splunk Precisely Ironstream Data Forwarder TCP/IP Ironstream Desktop DCE IDT Data Collection Extension Real-time Collection Assembler C, COBOL, REXX ! Data Sources HTTP(S) RMF File Load Log4j IMS System State SYSOUT Live SPOOL Db2 USS Alerts Network Components 15 Forwarder API SYSLOG SYSLOGD SMF
- 16. Precisely Ironstream Data Forwarder TCP/IP Ironstream Desktop DCE IDT Data Collection Extension Real-time Collection Assembler C, COBOL, REXX ! Data Sources HTTP(S) RMF File Load Log4j IMS System State SYSOUT Live SPOOL Db2 USS Alerts Network Components Ironstream for Splunk Forwarder API SYSLOG SYSLOGD SMF 16
- 17. How Things Are Now
- 18. Mainframe Now In Context and Real-Time • Real-time metric delivery to Splunk • Mainframe data points • Alongside data from other sources • View of complete system • Available to more users (in a controlled way) • Serve information to • Internal users • External customers SYSLOG Db2 SMF ExternalInternal
- 19. Now: So Much Better • Real-time visibility • Better scope & understanding • Monitoring & alerting • Improved insights – seeing issues BEFORE clients • Better agility • Proactive problem identification (MTTI) • Faster resolutions (MTTR) • Time savings 19
- 20. Presentation name Many More Possibilities 20
- 23. Impressive Leaps Forward 23 Previously… …Now Same information…now enriched & presented with more insight and context
- 24. What and Where Next?
- 25. • Ironstream now essential part of infrastructure • So many benefits from implementation • Rolling out to other parts of the business Next? Ironstream ®
- 26. Takeaways Mainframe and IBM i Still very relevant & mission-critical Include in your Splunk solution …or Elastic, Kafka… Wealth of information & metrics Ironstream removes the challenges …e.g. EBCDIC to ASCII Rights tools make it easy to get real-time insights Searches, dashboards, data models Combine & correlate with data from other platforms Use with Splunk solutions: • Machine Learning Toolkit • Enterprise Security • IT Service Intelligence, etc. 26 How can you make similar dramatic shift?
- 27. Q & A
- 28. Thank you
Notes de l'éditeur
- Thank you Amy…and welcome everyone. I hope you are all keeping well and you’re looking forward to a little downtime over the upcoming holiday season. Like most people I am working from my home office…so hopefully we will have no interruptions during this session. I have put the dog on mute…told the kids its OK to use their iPads for once…and I am not expecting any Amazon deliveries…so…fingers crossed …we’ll sail through this. Today we’re going to talk about one of our financial services customers who is getting incredible value and deep insights into their existing infrastructure and systems by leveraging a more modern way of looking at log and machine data. We’ll see what happens when an intense, mission-critical system involving a mainframe is combined with Splunk to realize some impressive and thought-provoking changes to how they ensure vital services remain performant and available. First we’ll kick things off with a quick introduction to Precisely…because you may not be aware of our new company name and brand. Next we’ll look at how this organization used to do things…how they would typically tackle a problem or diagnose a system slowdown Then move on to examine how they keep on top of things today by leveraging the power of Splunk. We’ll round off with a brief look at where they are taking things next. And…if there is time…we’ll open the floor for some questions. With that…let’s get started.
- Let’s begin by introducing you to Precisely This is a fresh, new brand and organization for an exciting, vibrant market. Precisely was launched in May this year…and is the new name for of a combination of Syncsort…a very well-known, and respected vendor within the mainframe and IBMi industry…and the Software and Data business from Pitney Bowes, valued for their geospatial, location and data intelligence capabilities. Syncsort had made many acquisitions in recent years and the addition of the software and data business extended and complemented the company’s 50 years of expertise in managing data. So, Precisely was a great way to position this combination in today’s market…where there are new data challenges and opportunities. So…under the new Precisely name…we’re leading the way with data integrity…which is top of mind for many organizations and, clearly, a broad topic. Let’s face it. All businesses rely on data. But can we trust it? Are we sure of its integrity? We use data everyday to make critical decisions…and do we simply assume we have a good data foundation to work with. Today…Precisely has over 12,000 customers around the world…across many industries…involving a multitude of use cases. We work closely with household names and industry-leading brands…both directly and indirectly through our growing list of respected partners. Splunk is one of those great partners. We continue to collaborate closely with Splunk…frequently coming together to help customers complete their Splunk implementations. So…with all that said…let’s look at how Precisely and Splunk has helped our use case organization with their data operations and their critical business systems.
- Let’s examine some of the aspects influencing this use case…what the business is about…and some of the challenges this organization has faced in the context of what they are trying to achieve for their customers
- If you work in IT…for a finance organization…or any other for that matter…you’ll know there is always something going on. Trying to push ahead with new technologies and implementations…adapting to changing data protection laws and new governance rules…while also trying to keep systems stable, performant and running in order to provide excellent customer service…whether that is in a business to business…or business to consumer model…the pressure exists. Today’s world of finance is both fast-paced and mission-critical. And your customers generally expect to be able to work with their accounts and money at any time of day or night…every day of the year. So…ensuring uptime…availability…and stable operating environments is incredibly important. In fact it can be a differentiator between you and your competitors.
- The customer use case we’re looking at today definitively falls into the mission-critical category. This organization offers…amongst many financials services…credit card processing facilities to other businesses. In effect, they act as a central hub and processing powerhouse for many other frontline organizations…who…in turn…deal with card consumers. So ensuring each business customer’s facilities are running smoothly is vital…with major consequences when things go wrong. The use case focuses on intense processing that leverages a lot of technologies….amongst them is a central mainframe environment that is at the core of their card systems. Wrapped around this are layers of other technologies such as off-mainframe Java and .Net applications driving web traffic into this intense environment: new card activations, payments, card declines, balance enquiries…all the typical things you’d expect for card accounts. This all uses a common set of services as well as some unique elements depending of the organization generating the card traffic. And…today…our use case customer is using Splunk Cloud as a “control center” to serve up private insights into activities and status for each customer’s set of centrally hosted facilities.
- As I said…mainframe is central to many things this customer does. Like many companies using a mainframe…they have it for several reasons… They have invested in it over some time and it continues to be a very valuable asset. It is an incredibly robust, performant workhorse that allows them to process many different workloads from batch to online transactions and everything in between. The mainframe does a lot…and it does it very well. From their business perspective…the mainframe allows for scalable processing even when data and traffic volumes are increasing…driven by more and more card transactions…something we all know are essentials in today’s online world. This customer is totally sold on mainframe because it continues to offer so many benefits. It just works.
- Let’s go back to how things used to be…how things were from the perspective of monitoring what was happening with their key financial systems The tools and facilities that used to be at the frontline of their monitoring strategy. In fact, these tools are still in place. Nothing has gone away…its just the perspective and emphasis has changed. Even though mainframe is central…it not the only platform that must be monitored in today’s multi-tiered environment. It’s necessary to zoom out to a higher level to get a wider view across the entire IT landscape…but without losing key insights and access to essential data points such as response times, status, etc.
- So these are the kind of views they used to turn to when something was not performing or was misbehaving. In itself it is OK. It gives you what you are looking for…if that is a very focused, narrow view of a specific sub-system or component. For example…a CICS region or Db2 instance. But the user interface may have been acceptable in the 80’s. Today there is so much more that is possible. Scrolling, call-outs, and many other interactive features. Plus, typically the information presented on a 3270 is static until you press Enter…and then trying to get sufficient information on to the fixed screen real estate can be a challenge. And then there is the question of who can access this information…traditionally it has only been available to system programmers or those SMEs who understand what they are looking at. All-in-all this can lead to longer problem resolution times. When an issue occurs…and sometimes they are very subtle…you need to know about it quickly so a resultion can be put in place. You do not want to leave it until it becomes so obvious that your customers are being affected…especially true for our use case where many high-profile organizations could be disrupted if something goes off the rails.
- In order to mitigate this…our organization created a very specific application…on the mainframe…to monitor key data points for their clients. Trouble is…this is also very limited…even though it does show some decent insights into card activities. If you look closey you can see VISA, AMEX and Master Card activities, declines, average response times, etc. At the time this was produced it was considered a major leap forward. But it took a lot of effort to build this and took quite some time to implement…and it is what it is…showing quite limited scope. Plus…gathering this information actually resulted in an increase in CPU on the mainframe. Now I cannot comment on how they did this, but it does bring several things into question: how…why… And then only a limited audience could access the screen…and it was out of context with the rest of the wider systems at play.
- So they wanted to find a better way to get to this information. They were already using Splunk within the organization for monitoring Windows and Linux servers… Splunk was giving them great insights into activites and issues…so why could they not simply add the mainframe? Simply put…they wanted the same benefits they were getting from the other platforms as this would leap them forward again …with better visibility over card activities…improved awareness of response times…improved agility around problem identification and resolution They could also present the information in a modern way with fresh tooling with much less effort. And just think if they could get this information delivered automatically…in real-time…without having press Enter…now that would be awesome. So they looked into building something to do just this…but quickly realized it was a daunting task with many complexities. Sounds simple, but there are significant challenges.
- This is when they discovered Precisely Ironstream. A purpose-built, lightweight solution for real-time delivery of machine and log data to destinations such as Splunk. This does exactly what they need and more… Easily deployed and configured...collecting just what is needed in real-time and getting the information to Splunk where things like credit card authorizations can be monitored as they are happening. Plus, Ironstream has much more waiting for them to use as they move beyond their initial use case.
- You have to remember…these “traditional” systems like mainframe and IBMi are generally excluded from modern tools such as Splunk. Natively, they do not understand or accept data from these sources. There are barriers and hurdles to be overcome to allow these “mature” platforms to join today’s way of monitoring in the NOC or SOC (that’s the Network and Security Operations Centers) This is where Ironstream comes into play.
- Ironsrtream removes these hurdles. It live streams all sorts of mainframe machine and log data to Splunk from the “big iron” platform. It can even tap into application data…if needed. Not only can Ironstream do this in real-time…as the data is being written on the mainframe…but it also does all the heavy lifting for you…unwinding the complexities and converting the information to ASCII… Delivering just what you want to the Splunk destination of your choice…whether that is on-premise or in the cloud via a secured connection. You can choose from an expanding array of data sources on the mainframe. All added as a result of customer requirements…and not just because we thought they may be useful. All of the sources at the bottom of this slide are there for a reason. Like our use case customer, you decide what you want to collect…even down to the field level…and the conditions dictating when to capture the data using the simple…but powerful…WHERE command.
- And to be able to monitor card activities our customer is using a combination of a few types of System Management Facilities information (also known as SMF data)…SYSLOG…and a sprinkling of Db2 application data brought in via the Ironstream forwarder API. By easily combining these sources…selecting just a few fields…they get what they need…where they need it. Plus they know they can readily expand to other data sources whenever they want.
- So…how do things look now? Have they simply replicated what was available in their mainframe environment and the 3270 displays? Let’s take a look…
- First of all they have brought their mainframe onto a single pane of glass. The data points and metrics they are forwarding into Splunk can now be seen alongside information from other parts of their IT infrastructure…perhaps for the first time. So now they can see across the complete system. All the platforms…all the components…greater visibility and greater agility. Its like the watch tower in the forest. The ability to see across the tops of the trees for miles…when a smallplume of smoke appears you can react to get ahead of a distaterous blaze. And…via Splunk…it is easy for them to give visibility to many more users in a very controlled way. So now…more have what they need. Plus there is the power of Splunk at their disposal.
- Now they have real-time visibility Now they have much better scope and understanding of what is actually happening They can leverage Splunk’s ability to monitor automatically…looking for anomalies, outliers and trends…instantly alerting when response times fall…or whatever they need to look for Our customer can get ahead of issues before their customers are even aware of any problem…in effect…there is no problem. This has given them better efficiencies…considerable time savings…and overall cost benefits What’s not to like?
- And…of course…they have only scratched the surface of what can be achieved. Splunk offers so many ways to realize and leverage insights from log and machine data…especially when you tap into the wealth of metrics available on platforms such as the mainframe and IBMi. For example, they have yet to explore the many other data sources supported by Ironstream. Similarly, there are facilities in Spluk to be tapped into. For example, machine learning can forward project where trends are going based on the previously seen history…so many ways to realize new possibilities of looking at what could be considered the same data you’ve always looked at. But a new viewpoint can be revealing and refreshing…especially when you have access to a range of free dashboards that are pre-built and ready for use in your environment.
- And in the context of our use case customer…they have taken things a few steps further. Not only do they offer core and bespoke facilities out to their own financial clients via Splunk Cloud…which includes insights into mainframe-based activities such as card activities. But they have also…again in a very controlled way…allowed some facilties to become much more accessible. Here we have an iPad being used to view a Splunk dashboard showing real-time card transaction rates and types...alongside…on the right…status categories by card provider such as Mastercard and Visa And then below we see just the top of a line chart showing activity rates over a period of time. The table of information may be easy to do on the mainframe…but creating speed dials, pie charts and line graphs is a thing of dreams.
- [Ian] so what we have seen here is that it is possible to bring “legacy” platforms into the modern era without too much effort…and yet get some fantastic, tangible results. And, actually…there was no need to really change anything…this is data that is already being generated on the IBM platforms. What you have done is opened up the mission-critical mainframe environment…in a very controlled way…to deliver real agility to the business and your customers. [Chris] Yes…we’ve managed to leap forward… [Summarise what has been achieved…emphasis how easy to get started without the need to radically change anything]
- [Ian] Thanks for your time everyone. Chris & I hope you enjoyed this quick session. It’s clear that bringing machine and log data from all platforms is valuable and very worthwhile. If you happen to have something like a mainframe kicking around…don’t forget it is there for a very valid reason…and it is definitely looking into connecting it to Splunk. As Chris and FIS have proven there are load so benefits to be found and so many use cases to be covered. And…you don’t have to be in the credit card or finance industry to do this. It applies to everyone…we can all turn data into doing.