The EnhancedEndpointTracker app is composed of several components that can be deployed as either
multiple processes running within the same container in
all-in-one mode or as
separate containers distributed over multiple nodes in
3.6is used for persistent storage of data. In
minimode this is a single mongo process with journaling disabled and wireTiger cache size limit to 1.5G memory. In
clustermode, it runs as a distributed database utilizing mongos, configsvr in replica set, and multiple shards configured in replica sets. Sharding is enabled for a subset of collections, generally based on endpoint address.
redisDB is in an memory key-store database. It is used as a fast IPC between components. There are two main messaging implementations in this app.
eptManageris a python process that is responsible for starting, stopping, and monitoring
eptSubscriberproceses along with tracking the status of all available
eptWorkerprocesses. It is also responsible queuing and distributing all work that is dispatched to worker processes. There is only a single instance of
eptManagerdeployed within the app.
eptSubscriberis a python process responsible for communication with the APIC. It collects the initial state from the APIC and stores into the db. It establishes and monitors a websocket to the APIC with subscriptions for all necessary MOs and ensures the db is in sync with the APIC.
eptSubscriberprocess also subscribes to all epm events and dispatches each event to
eptManagerwhich will enqueue to an appropriate
eptWorkerprocess to analyze the event. There is a single
eptSubscriberprocess running for each configured fabric. This process is always a subprocess running in the same container as
The following objects are collected and monitored by the subscriber process:
There is a configurable number of
eptWorkerprocesses that can be executed. Each
eptWorkermust have a unique id and will be deployed with a role of either a worker or watcher process.
eptManagerrequires at least one active
eptWorkerfor all roles before it can start any fabric monitors. The
eptWorkerworker process performs the bulk of the computations for the app. It receives epm events and performs move/offsubnet/stale/rapid analysis and stores the results into the db. If an endpoint is flagged by one of the analyses, a message is sent to
eptManagerto enqueue to an
eptWorkerwatcher process. The watcher will perform the configure notifications along with executing rechecks to prevent incorrect detection of transitory events.
The full source code for the Flask web-service implementation and all ept components is available on Github.