One of Kentik Portal's time tested assets has always been its capabilities around Network Analytics, and more specifically the Dashboarding and Reporting capabilities it offers. Around the same time last year, we augmented our Subscriptions engine with capabilities around naming generated report files, and more granularly selecting TO, CC and BCC recipients for these reports to be sent. Rewind back another year to 2022, we created a UX pattern across Kentik Portal for users to easily configure these reports in a cohesive interface under the now famous Share button.

We're at it again this year, but have completely rebuilt the foundations of the backend systems which generate these reports and send them to you, so read on !

What did we set off to improve?

At first, let's see how Report Subscriptions used to work: based on user configuration of these reports would be run once a day in our SaaS and on-prem clusters. 

The implementation that served us well for all these years was a sequential one: once a day, a job would run, collect all the reports from the entire installed base and queue them up to be generated and sent sequentially.

While robust, this implementation presented the following drawbacks we weren't fans of:

• While once a day works for a set of customers in a narrow geography, reports configured by users located around the world would get generated at times that weren't in line with these users' time zones, hence receiving subscription emails at unpractical times. Since some of these reports were based on look-back windowed analytics, all look-backs were dependent on the time at which the reports were being generated, going back to the previous point. As an example, midnight Pacific would correspond to mid-day in Singapore, so our Singaporean users wanting a one-day report from midnight to midnight would actually only be allowed to configure a one-day report from 3pm to 3pm, which didn't exactly line up with the activities of their users.
• The job running all our tenants' subscribed reports sequentially could occasionally fail or choke on a single report generation, causing the rest of the queue to be further delayed until we could unblock the queue.
• As we monitored the amount of reports generated every day, we also started monitoring the duration required for the main daily job to run. In the most recent runs, the report generation would hum along for about 7 hours to generate and send all reports.
  -> again, this had an impact on not only the time at which they would be sent, but also made the look-back windows undesirably elastic (i.e. less predictable)

What does the new Report Subscriptions system look like now ?

As we release new Report Subscription engine to our customers, we can confidently tackle current and future challenges thanks to a new design:

• Users can now set the UTC time at which they desire their reports to be generated and sent
  
  
• Our report generation frequency has been made granular to the 30min time-slot (because believe it or not, some time-zones are 30min granular)
  
  
• As a by-product, these generated report subscriptions can now be made to match precisely local windows of network activity to the exact desires of our users
• Moving from a single monolithic job in every SaaS cluster, we also added the notion of parallelization: multiple workers would trigger under the same scheduled job that would expedite the generation process
  • As a data-point, after migrating all of our users' Report Subscriptions to the new engine we kept the initial time the single job would run at as the configured time for all of them, and instead of lasting 7 hours, parallelization reduced this time to 5min !!!
• As an additional byproduct, reports generation is now much more scalable because it is smoothed throughout the day, but also any failing report does so more gracefully because of 1) parallelization, and 2) we took this opportunity to instrument this new system more thoroughly than the legacy one.

... but wait, there's more

For those keen on the last minute "But wait, there's more..." gimmick made famous by Apple's product keynotes, we figured we may slip in to this vintage a few additional features that our users had also been asking for:

• Ability to set a Dashboard or Saved View lookback window to: "This Month" (i.e. month to date, regardless what day of the month it is)
• Ability to set a Dashboard or Saved View lookback window to: "Last Month"

So, what do you think?

More often than not, some additional capabilities don't make it to the release time. As upsetting as it usually is to the Product Manager working on the feature set, we rely on iterations, and whatever capability doesn't make it right now will eventually find its way into the product in a future release if we hear our customers asking for it. This time around, we wanted to directly implement Time-Zones in the Subscription Target time configuration, but couldn't fit it in our busy schedule. What this means is that users will still incur the one time mental cost of computing the UTC time equivalent to configure a subscription's schedule, but this also means that Schedule times will need to be manually changed twice a year for those users whose country follows Daylight Savings.

Once you get to take this feature for a spin, we'd love to hear your thoughts about where you'd like us to take it in the future, and remember, if history repeats itself, we will probably be evolving Report Subscriptions for another round next summer ;) 

We're thrilled to share the enhancements we've added to Kentik NMS over the past six months. Your feedback and continued support have been instrumental in driving our newest product forward. Here's a summary of the key updates:

New Device Workflows

• Topology Connections: We now show “Connections” on the “Device Overview” screen and “Interface Details” drawer. LLDP connections are automatically detected. Manual connections can be added where LLDP is not in use and are marked with an “M”:

• Device Dependencies: NMS can now detect when one device is downstream from another. When the upstream device goes down and the downstream device does not respond, the upstream device is marked as down while the downstream device(s) are marked as unobservable. This makes it easy to differentiate which device is down and needs your attention vs which devices simply is not responding due to the down device. The first place you will see this is in the status of a device:

Additionally, alerts configured to trigger when a device goes into status down will not trigger for these devices, of course. This is the default and will greatly improve the signal-to-noise ratio when alerting on downed devices. If for some reason you do want to alert for these devices, you can configure the alert to trigger for devices in status down or status unobservable. 

To enable this functionality, you must specify the “Closest Network Device” for the NMS agent by navigating to Settings > Universal Agents (NMS), selecting an agent in the table, and clicking edit:

• Unobservable due to agent down: In the event that an NMS agent goes down, all devices being monitored by that agent will be marked as Unobservable. Mousing over the status label will display a notice indicating that the device is down because the agent is down, and will indicate the name of the down agent.
• ICMP-only devices: Sometimes you don’t have SNMP access to a device but still want to monitor it. NMS now supports this use case with "ICMP only" devices. Add these devices by going to "Menu > NMS > Devices" and clicking "Add Devices" in the top right. At the prompt, select "PING ONLY". Doing so provides up/down status and latency:
  
  
  
  
  
• API for Device CRUD and Query: To better serve the largest and most complex networks in the world, you can now use the Kentik API to create, read, update, and delete (CRUD) NMS devices. You can also now run Metrics Explorer type queries via API. To make it easier, Metrics Explorer can show you the API query for any query you’ve done in the UI.

New Alerting Workflows

• Acknowledge Active Alerts: Alerts can now be acknowledged even while they are active. This is a common practice to indicate to the rest of the team that someone is aware of the issue and is taking action. The name of the acknowledger will be noted an a comment can optionally be added. Users can also choose to automatically acknowledge additional occurrences of the same alert ("auto-ack"), for situations like a flapping link.

• Silence Notifications: Notifications can be "silenced" and "unsilenced" from the Alerting page with the push of the button. Alerts will still trigger and can be seen in the UI, but notification channels will not be executed. By selectively silencing notifications for alerts, network admins can better manage focus and reduce noise to their team.
  
  
  
  
• Suppress Alerts: You can now prevent an alert policy from triggering all together by using suppress alerts from the Alerting page. 

Supressed alert policies will not trigger, and so alerts will not show up on the alert list and, of course, notifications will not be executed. You can see all configured Alert Suppressions on the Alert Suppressions page in Settings. From this page, users can view, create, edit, and delete Alert Suppression Patterns.

• State Alerts: State alerts were previously limited to out-of-the-box supported entities - Devices, Interfaces, and BGP neighbors only. You can now configure state alerts for any metric, including custom metrics. Another way to think about this is that threshold alerts alert when a metric is less than or greater than a value (or baseline) whereas state alerts alert when a value is equal to a certain value, for example the number 3 which corresponds to an interface being down.

Quality Enhancements

• Status Bugs: In very specific scenarios, devices were incorrectly marked as down. While most customers were not affected by this bug, those that were had instances where many devices were reported down but were not really down.
• SNMP Polling Efficiency: Several bug fixes involving SNMP timeouts, conflicting statuses and agent stability.
• Query Performance: In an effort to reduce the amount of time it takes to load some of the more complex NMS pages, we've made query optimizations to backend improve performance. While there's still room for improvement, we think you'll already notice the difference.
• Other Bugs: We addressed numerous issues relating to usability, reliability and predictability - especially where alerting is concerned.

In addition to the software changes above, you will find a great deal more information about NMS available in the knowledge base. These articles will help you get the most out of Kentik NMS.

We are committed to continuously improving to meet your needs and exceed your expectations. We encourage you to explore these enhancements and send us your feedback!

Thank you for being a part of the Kentik community. Stay tuned for more exciting updates soon.

When we launched CDN Analytics, the only CDNs that were offering ISPs to embed caches in their networks were limited: Netflix, Akamai, Facebook and Google.
Since then, numerous additional CDNs have released their programs to embed caches and our Service Provider customers have been asking for more of these indicators on the landing page.

With this update, we are adding a whole lot of new CDNs which we can compute offload for, and users can now determine which one they want displayed on the landing page for CDN Analytics.

Embedded CDNs 'A La Carte'

How do we compute offload ?
For the reference, Offload for an embedding CDN is the measurement of how efficient they are at serving content from the last mile out of embedded cache vs how much content they pull from outside of the user's network - which is less cost and performance effective.
A high ratio means a better outcome for the embedding ISP, but is tightly linked to the nature of the CDN: pure-play CDNs only have to store their own content in the ISP's last mile, while Commercial CDNs store content of multiple Content Providers competing for popularity, meaning lower ratios are in this case expected.
The formula we use to compute offload is to look at peak time for each CDN, and compute the ratio of {"Mbps from Embeds to Subscribers" / "Mbps from OnNet + OffNet to Subscribers"}

A new tab appears in the [Configuration] panel for the CDN Analytics screen that surfaces all the Embedding CDNs

• that we detected (via interface classification)
• that our users manually declared (via this same config screen)

and we’re allowing users to selectively enable them on the landing page, see for yourself:

...with a CDN Analytics landing page that now looks like this

Embedding Cache Analytics Guided Mode Dashboard

On each vignette for each Embedding CDN, we’ve added a link to a newly created preset dashboard that presents, as a guided mode dashboard, an in-depth analysis of how the CDN functions in terms of:

• cache fill (internal and external)
• cache offload (on-net and off-net)

This new dashboard replaces the existing one in our Presets section and it's now really comprehensive for users to understand how each embedding CDN behaves when it comes to long-tail and cache-filling, as you can see on the screen grab below:

Today we roll out a myriad of changes to supercharge our Search capabilities. When we began looking at product usage statistics, it became quite clear rather quickly how little our users were aware of the search capability – either they didn't know about it, or it didn't pack enough features to be useful, so we set out to improve the functionality. Today, you'll notice the search bar is now ubiquitous, i.e. it displays on every single screen in the portal; but, that's not all of it – the updated Search capabilities pack a whole lot more punch than they used to, read on to discover!

Always-on: search anywhere

Let's start with the most obvious changes: 

1. The Universal Search bar is now present on every screen, at the same central top location, and is not hidden behind a keyboard shortcut anymore: this change is part of a long series of future changes that will make Universal Search a much more central piece of UX in Kentik Portal, so we started by giving it its rightful place.
2. For the Keyboard users, we have changed the shortcut to summon it with cmd + / : this is more aligned to SaaS industry standards. Summoning Search without a search term will bring up a much more useful empty state, but don't worry if you're not a keyboard-type user: clicking into it without entering any search term will also bring up the same improved empty state.

Favorite everything!

While working on a more useful empty state for this search overlay, we extended the ability to favorite screens. Starting today, you can favorite almost every screen in the product by clicking on the star icon next to the screen title. This will come in handy with the new empty state this overhauled Search feature comes with, read on.

For instance, you can favorite:

• Any dynamic quick view page, for instance a specific ASN that you've been working on, like Kentik's AS6169 – this basically works for any page of the form https://portal.kentik.com/v4/core/quick-views/<object_type>/<object_name> this includes Sites, IPs, etc. ...

• Any Top Talkers page from Network Explorer, such as this top IPs page – essentially any screen with a base URL of https://portal.kentik.com/v4/core/quick-views/<object_type>
  
  
• Any settings screen you often go back to, for instance this Interface Classification settings screen
  
  
• Even better, you can now favorite a specific Capacity Plan you're currently tracking, or a specific Connectivity Costs Provider you want to keep your eye on!

But what's the use of being able to Favorite any screen if these favorites aren't put to good use you rightfully ask? Well. Read on.

An (much) improved empty state

Now that you can favorite any screen, we brought this into the new Universal Search empty state so you can now get quick access to your favorites by just hitting the search keyboard shortcut, or just click into it. A greatly improved search results page will show as an overlay with 3 tabs, two of them being naturally populated with useful empty states: Favorites, Recents, and Search Results.

Until you start typing in the search input field, your favorites will be displayed. If you don't have any, then your Recent Dashboards and Saved Views tab will be active. As soon as you start typing in the search input, the active tab will switch to Search Results.

Amongst other features you'll notice:

• you are able to favorite or un-favorite any item directly from the search results overlay!
• you can entirely navigate the search overlay with a keyboard: 
  • ← and → let you switch between Favorites, Recents, Search Results
  • ↑ and ↓ let you select records in the main search result
  • [Enter] will take you to the selected screen
• Hitting [Esc] clears the search bar if you have text in it, and discard the search overlay when the search input is empty
• The Recents tab now contains a time and category ordered list of the recently viewed Dashboards and Saved views, and you will notice that we now centrally persist your Recently Viewed items.

Better Structured search results

As you type text in the Search input, you'll notice the Search Results tab populating, and we've dramatically improved its appearance and usability, see for yourself – it is now much easier to locate  the right search result using this updated UX.

Moving forward

With this update, we've laid the ground work for powerful, future capabilities for Search. We've made it central and are now ready to tackle the next iterations. At current, we're thinking, in no particular order:

• What if users could search for any screen to navigate towards ? This is about making Search a substitute to click-based navigation – and the most common example out there would be Windows' Search or MacOS' Spotlight.
• Conversational AI everywhere? What if you could directly ask any question on your infrastructure in the Search bar, with a mode that turns it into a Network Copilot prompt?
• Command Bar for Action type commands: with productivity Apps such as Alfred, or Launchbar - we've started to ask ourselves, what if a user wanted to create a new synthetic test directly from the search bar? or add a new device directly from the search bar?

If you have more ideas that you'd like to share with us as to how you foresee the future of our search capabilities, please do let us know!

Since we've overhauled the experience around our Library, we have kept listening to our users' feedback to further improve it.
In the recent past, we've added the following:

• reduced the visual noise by re-designing labels throughout the product
• added the ability to attach multiple labels to every view
• added a toggle to show/hide Favorites and Recents
• introduced RBAC for elements in the Library, allowing users to granularly select which content is available to which users

This time around, we are adding a couple niceties that we think our users may like or have requested in the past, read on!

Last Viewed Attribute

Some of our users have multiple hundreds of Dashboards and Saved Views in their Library. Not all of these user-created analytics are up-to-date and some get stale over time, replaced by newer visualizations.

It has been a frequent ask from the "Librarian" population of our user base to let them order content in the Library based on the date at which it has last been used – this way, they could more safely perform spring cleaning actions and keep their Library as up-to-date and noiseless as possible.

From now on, every time a user opens a Dashboard or Saved View, the meta-data around it gets a timestamp updated to store when it was last opened.

We are presenting this attribute in the "Last Viewed" column of the Library listing table:

This column should be enabled by default for new users and will be added by migration later this month to existing users. If not enabled, hit the "Customize" button at the top-right corner of the listing table:

Trending Views

In our frequent feedback sessions with users, one of the things that often comes up is the difficulty for other users in their company to know if any good Saved Views or Dashboards are available to them.

One of the ways we're attempting to help with this is by computing at regular intervals (once a day or once a week – we're currently experimenting with the frequency) what the Top 10 Dashboards and Saved Views are within each company.

We then tag all of these with a "Trending" label making them easy for users to discover in the library.

We currently use the number of views for each Dashboard/Saved View over the last rolling month to rank them.

In the Library, you can now filter for "Trending" content:

Dashboards or Saved Views which are trending come with a special label associated to their name in the Library content listing table:

And when looking at any Dashboard or Saved View, the title bar will now indicate with a little flame icon if it is trendy (i.e. if it is within the Top 10 of all content in its category within the last month).

We wanted to help our users reduce the back and forth between the library and Saved Views/Dashboards: observing sample sessions, we realized users often developed routines which consisted in periodically checking on multiple Dashboards or Saved Views one after the other.
If these users could simply load the next Dashboard or a Saved View directly from the current one they are looking at, we could shave off minutes of unnecessary interactions every day.

In a previous release, we established the following UX pattern to resolve this use case for Saved Views: a new toggle in the grey sub-nav would upon click unveil a drawer allowing users to immediately search and access their Saved Views without the expense of an unnecessary trip to the Library.
You can see the announcement here: https://new.kentik.com/new-data-explorer-saved-views-drawer-2Ft2Y8

This time around, we're extending this exact concept to the Dashboard runtime. The benefits are exactly the same:

• No need to go back to the Library to select the next Dashboard to load
• The newly added Library panel contains Favorites, Recents, but also search capabilities
• The Library drawer is entirely designed to be keyboard friendly:
  
  
  • move between Favorites/Recents/Search Results tab using the keyboard arrow keys
  • scroll up and down the list of results in the drawer with the vertical arrow keys
  • upon selection, load any Dashboard with the [Return] keystroke

For visual documentation purposes, here's where the "Dasbhoard" drawer toggle button is:

... and here's how it looks once expanded, both in its compact and cosy modes

Compact Mode

Cosy Mode

What's next ? We will keep using this pattern and extend it in other parts of the product to save more of our users valuable time, stay tuned.

Not so long ago, we released the Credentials Vault capability, which lets you centrally manage credentials used by Kentik NMS to poll your devices. This allowed for a much more efficient way to provision NMS devices in Kentik:

• without having to redefine the same credentials for each device
• supporting the need to swap the credentials used by Kentik for a large amount of devices in a central way

The Credentials Vault was released including Synthetic Monitoring capabilities to let users leverage centrally defined credentials from the Vault in the authentication steps of all forms of HTTP and Transaction Tests.

We are also currently extending the Credentials Vault-only method  from Kentik NMS to flow devices - as you know, both SNMP polling and BGP MD5 config info for these is still currently stored at a local, device-per-device level. This should feature should be released in the weeks to come, and once done, both NMS and Flow devices will both exclusively leverage the Credentials Vault.

Yet, this post focuses another aspect of Credentials Vault that we are improving today.

What is RBAC for Credentials Vault ?

When we created Credentials Vault, we relied on our legacy User Levels (Member, Admin, SuperAdmin) to go with simple defaults: basically Members cannot create any credentials but can list/use them, while only Admins and SuperAdmins are allowed to create/update/delete credentials - and this all seemed like reasonable defaults.

We have heard from a few Customers that their Synthetic Testing users were Member type users allowed to create and author Synthetic Tests, but were blocked because they weren't allowed to create credentials. The corollary being that these users would need to ask Admin users to register these secrets for them in their place, increasing the risk surface of leaking them when needing to send them over email or chat.

We agreed that this was not the most secure approach to it and took the opportunity to roll Credentials Vault into our RBAC framework.

How can you add RBAC permissions to users to let them create Credentials in the Vault?

Users with the ability to create and edit RBAC roles will now be able to assign these new permissions to roles (and in turn the users these roles are assigned to)

Beyond this, the label-based permission framework has been made available to Secrets in the Credentials Vault so that users can for instance only have access for view and edit to secrets with specific labels.

For instance, the following Vault Secret Creators role will allow users in this role to:

• to create secrets
• only view and use secrets labeled Production or CDN
• only update credentials with the CDN label

So to conclude, if you need your low-privilege Member users to be able to create credentials, a speedy option is to

1. create a new RBAC Role containing the "Can create credential secret" permission enabled
2. directly add users to that role from the "Users" tab of the same screen
3. profit.

As consumers of alerts, you want every alert to be easy to understand, meaningful, and actionable. But when systems bombard you with alerts for metrics you don't need, it's hard to distinguish between the signal of what matters from the noise of what doesn't (cue alert fatigue). Claude Debussy said, “Music is the space between the notes.” That space enables resonation and expression. Music needs a degree of emptiness to be truly appreciated, and the same holds true when it comes to alerting.

We've listened to your feedback and have significantly improved our synthetics alerting capabilities to help reduce the noise and increase alert accuracy. The changes we've made with Synthetics Alerting give our customers the ability to receive more detailed alert notifications, while giving you agency over the individual metrics that are critical to your success – and perhaps more importantly, the ability to silence the metrics that are not. 

Flexible Health Options

For a long time, we have set extreme thresholds to disable certain metrics from causing an unhealthy health status in our tests. While this technically works, it does not make for a great user experience. As part of the new Alerting stack, the Synthetics team developed new switches that allow for individual metrics to be enabled or disabled when determining an unhealthy status and ultimately, an alert notification.

Single Metric Alerting & Improved Alert Notifications

Another big improvement to Synthetics Alerting is the change to alert tracking by single metrics. The system now keeps track of triggers for each health-enabled metric and will trigger alerts for them individually. When combined with Flexible Health Options, users can tailor their alerts to only the metrics that fit their use case. This provides more clarity of what is going wrong with a test when receiving an alert.

Based on user feedback, we have added a new option for the way our Network Mesh and Agent-to-Agent tests alert. Previously, alerts were tracked by test – calculating health and alerts for the test as a whole; however, this was not a perfect fit for every use case. 

The Synthetics team has now deployed changes allowing alerts to be calculated and tracked on a per agent basis. With this feature enabled, each agent in a test will have its own trigger for the test's health thresholds and one test can have multiple ongoing alerts for different agent-to-agent pairings. Simply select the Agent option in the Status Calculations field to have the test tracked on a per agent basis. 

If you have any feedback on this new option, please reach out to your CSM. We are continuing to improve our alerting options and aim to bring even more health and alerting features to Kentik Synthetics as we migrate to Alerts 2.0.

At Kentik, one of our core goals with synthetic monitoring is to enable your team to quickly and effectively triage any issues that come your way. This effective triage process starts with ensuring alerts are easily delivered to the right team in their preferred notification method. 

Previously, alerts associated with agent issues (downtime or recovery) would show and alert in the same notification channel and test results summary in the UI. Based on feedback, we realized this setup was not optimized for customer needs. 

We are pleased to share that agents can now be configured to send status alerts to their own notification channel. Simply navigate to the  'Synthetics' > ‘Agent Management’ section of the portal, select an agent, and click Configure to set up status alerting and notification channel(s) for that specific agent. To see agent downtime details, select the agent and click on the ‘Agent Downtime' tab.

With this setup, an email notification is sent for down or recovering agents.

The notification links to the ‘Agent Downtime Details’ tab under the ‘Agent Management’ part of the portal.