Telemetry, Monitoring, and Analytics
CX 10000 emphasizes deep visibility. Candidates should know the telemetry toolkit: streaming telemetry (push-based, model-driven) versus traditional SNMP polling, and why streaming is preferred for high-frequency data center monitoring. Understand the DPU's role in producing rich flow-level analytics - flow records, application visibility, and security events - that feed a central analytics/management platform.
Know the operational basics: syslog, SNMP, NTP (time accuracy matters for correlating events), and REST API for automation. Be able to describe how flow telemetry differs from interface counters: counters tell you how much, flows tell you who to whom, and whether it was allowed.
Traps:
- Assuming SNMP polling gives the same granularity as streaming telemetry.
- Forgetting NTP - skewed clocks ruin event correlation and flow timelines.
- Believing telemetry is collected only on the ASIC; the DPU is a major source of flow/security insight.
- Overlooking that analytics depend on policy/steering so the right flows are observed.
Rule of thumb: use streaming telemetry for high-frequency state and flow analytics for security and application context; keep SNMP for legacy polling only. Worked example: an application is slow between two tiers. Interface counters show no saturation, but flow telemetry reveals a specific denied-then-retried flow pattern; correlating with security logs (timestamps accurate via NTP) identifies a policy gap. Verify by comparing counter data with flow records for the same interval.
Also review how to export telemetry to a collector and retention considerations.