Today’s post brought to you by the logical fallacy “Equivocation” 

thoughtfulGenerally speaking we don't respond to competitive commentary that's purposefully antagonistic. The reasons for that vary from corporate culture to the annoying reality that responding confers upon the claims some measure of veracity that it generally does not deserve.

But even technical agitprop can raise points that need to be addressed with respect to the underlying premises upon which the arguments are made. Of late, certain claims coming from Citrix has brought these premises to the fore, and those premises deserve to be addressed.

Issue: Application Visibility

Access to application information is one of the key areas that span the complete organization, especially as the boundaries between applications and infrastructure blur.  Network engineers, system engineers, NOC engineers, application developers, etc. want to get data and have visibility into application performance, packet/session flows, and logging in order to perform their duties.  CIOs and managers want to receive reports on things like usage, capacity, and optimizations in order to better understand when they may need to have components in the network added to meet demand or how much optimization occurred so they can manage their budgets. 

We’re fairly certain Citrix would agree with us on the importance of application information. Data regarding the performance, security, and load impact of applications is imperative to the health of an application, allowing IT to react to a broad spectrum of events across operational concerns.

Where Citrix diverges is how application visibility is implemented, deployed, and supported with respect to an application delivery controller (ADC). Citrix’s view is presented in the following statement from one of its white papers:

"[F5] iApp Analytics is a completely proprietary performance monitoring and reporting feature that does not permit customers to export data in standardized formats or schema. Additionally, it prevents customers from using existing performance monitoring and business analysis solutions to get at the root of performance issues. F5 customers are forced to deploy yet another single-vendor, proprietary solution.

Citrix has taken a completely different approach with AppFlow™, an open industry standard. With AppFlow, organizations can use their ADC footprint as a full application tap, and leverage existing performance monitoring tools such as SolarWinds and analytics tools such as Splunk. By providing a standards-based approach, along with broad industry partner support, AppFlow eliminates networking expertise as the admission price to gain improved business intelligence, and provides enhanced application visibility in both enterprise and cloud infrastructures."

Premise: Standards-based off-device solutions are superior

There are two basic premises in this statement. First, that standards-based offerings are preferable to proprietary and second, that off-device solutions are superior to those deployed on the ADC. Both of these premises are based on faulty assumptions.

Faulty assumption #1 – Submission as an RFC is equivalent to industry acceptance as a standard.

Even ignoring all the completely valid RFCs submitted on various April Fools’ day throughout the years, publication via the RFC mechanism does not confer upon said published content standards’ status. In fact, RFC 1796 “Not all RFCs are Standards” explains this quite well.

It is a regrettably well spread misconception that publication as an RFC provides some level of recognition. It does not, or at least not any more than the publication in a regular journal. In fact, each RFC has a status, relative to its relation with the Internet standardization process: Informational, Experimental, or Standards Track (Proposed Standard, Draft Standard, Internet Standard), or Historic. This status is reproduced on the first page of the RFC itself, and is also documented in the periodic "Internet Official Protocols Standards" RFC (STD 1). But this status is sometimes omitted from quotes and references, which may feed the confusion.

-- RFC 1796 “Not all RFCs are Standards

Citrix claims AppFlow is an open, industry standard. While it is open, it is not a standard. AppFlow is based on IPFIX RFC  5101 and RFC 5102, both proposed standards, the status of which is important to note as proposed standards may never move beyond that status and the assignment of industry standard status has very real implications for those in relevant industries.

This is not to knock AppFlow as a mechanism for transferring information to a third-party management platform, but rather to point out that as a “would-be” standard it does warrant the level of urgency to support as assigned it by Citrix in its collateral.

Citrix’ statement that AppFlow, “along with broad industry partner support” should be pointed out as a bit of dissembling, as the formulation of the statement is intended to imply broad support for AppFlow rather than Citrix. Citrix does indeed enjoy broad industry partner support, as does F5. A lengthy listing of partners for both organizations would be exhausting without adding much value to this post; suffice to say both companies understand the value of partnerships and work to maintain a healthy ecosystem in which integration and joint solutions across a wide variety of data center concerns are developed and offered.

On the other hand, AppFlow is currently supported by two recognizable management vendors – SolarWinds and Splunk. Furthermore, this support is somewhat underwhelming, as AppFlow is not supported in the main SolarWinds product line (Orion) but is rather offered as an adjunct free utility, almost as an afterthought. AppFlow is also not an officially supported input on the Splunk platform. Compare this to the multiple “Splunk for F5” applications, written and supported directly by the Splunk team. 

Faulty assumption #2: Because F5 offers iApp Analytics, organizations cannot use existing APM systems

There are actually a number of inaccurate or misleading statements in Citrix’s claims regarding APM and integration, but the conclusion the aforementioned statement appears to be leading readers to is that by offering iApp Analytics, F5 customers are somehow prevented from using existing systems and are further unable to troubleshoot application performance-related issues.

The claim that customers are “forced” to deploy additional, single-vendor, proprietary solution with F5 is somewhat baffling given that iApp and iApp Analytics are an integrated component of BIG-IP and require no external systems to provide comprehensive application-focused monitoring and reporting. It is further somewhat of an odd (and contradictory) claim to make given it appears to deride the need for an additional solution but then goes on to tout the benefits of a feature that requires an additional solution, in this case Splunk or SolarWinds.

If the intent of this statement was to imply that monitoring and reporting on application data with F5 can only be accomplished through a proprietary mechanism, then the author has failed to adequately research the topic as, noted earlier, F5 BIG-IP is natively supported by the very solution (Splunk) touted as superior to iApp and iApp Analytics. The use of and integration with existing APM solutions has been and continues to be a priority for F5.

Citrix’s claim is based on a logical fallacy known as equivocation, in which a term with multiple meanings is used to misdirect a conclusion. The equivocation by Citrix of export of data via an industry standard with the ability to leverage existing systems is not just misleading, it is false. Applications and systems use a variety of mechanisms to import data, only one of which is export via standards. Native integration has been and continues to be an acceptable means of sharing data across systems as is the use of a centralized syslog system and SNMP integration.   

Citrix’s claim further assumes the majority of customers have already deployed SolarWinds or Splunk in their environments. While both are, in fact, popular choices for monitoring and troubleshooting, they are not the only solutions in use today. Application performance monitoring – both on the end-user and data-center side of the equation – is a well-established market with a healthy install base comprised of a variety of open-source and commercial offerings.  Many other options – both open-source and commercial – exist and are in use today, from simple syslog receivers to solutions from CA, IBM, Cisco, and LogLogic. Furthermore, convergence with SEIM (Security Event and Information Management) vendors is also occurring, driven by the need to more efficiently share data and systems across multiple functions. F5’s integration and collaboration with such vendors is unparalleled in the industry, and native support for BIG-IP is more often seen than not.


Citrix has chosen as the solution to the problem of application performance monitoring a would-be standard, AppFlow. F5 has taken a different approach, offering iApp and iApp Analytics as a means to provide a full-featured method of tracking, managing, and monitoring applications and application use on the ADC while actively supporting the integration efforts of third-party monitoring and management systems like Splunk.

While we agree standards-based support is important, we’re not ready to concede that non-support of a single would-be standard constitutes significant oversight on our part. It is also important to note that both canned and ad-hoc reporting is vital to both operational and business analysis, not just for troubleshooting but for capacity planning, chargeback services, and projecting usage and transactional costs. Organizations frequently leverage both canned and ad-hoc (custom) reporting systems as a means to extract data vital to their specific analysis needs. F5 iApp includes iStats, which allow customers to extract virtually any metric from the BIG-IP system, providing detailed analysis of the information that is deemed necessary by the business, rather than the industry.

F5 believes the best model is to provide as much data as possible without requiring – but still supporting - additional solutions. An integrated and extensible system that allows for custom reporting while also making that data available to existing APM systems is a much better choice.

Additional Resources:

Connect with F5:
o_facebook[1] o_twitter[1] o_slideshare[1] o_youtube[1] rss[8]google

Latest F5 Information