Hot MoMs

Why not just get the events directly and forget the MoM? If a management system is implemented to oversee a specific domain, say Microsoft Windows NT or database servers, or routers and switches, this plan makes more sense than forklifting what's in place. Different portions of an IT organization have the responsibility for managing these various systems.

On the other hand, while separate management domains offer useful and granular performance information, they lack perspective on how their performance affects other devices in the chain. Without event correlation, it's impossible to deduce that a faltering switch is causing long application-response time. The MoM's job is to bridge the event streams of various management domains by monitoring all pieces of the business IT services. Conversely, it is not the role of the MoM to provide granular diagnostic and tuning data on how a database, Web server or network switch is performing.

Today's MoMs have a more difficult task than previous generations did. Multitiered applications run on separate, distinct systems, forcing the MoMs to gather and correlate a wider array of events.

Earlier MoMs had the advantage in that transactions, application logic and databases all lived in a single monolithic mini or mainframe computer. Matrons such as the earliest versions of BMC Software's Patrol Enterprise Manager have provided event management and automation for Fortune 500 companies and service providers since the 1980s. These products focused disparate enterprise and system problems onto a single pane of glass, and gathered data from as many sources as possible--other management systems, performance point products and even devices with only proprietary serial interfaces, such as air conditioners and security systems. The value beyond having a single point of management was a reduction in the number of events, through deduplication and visual correlation.

MoM vendors Aprisma, BMC, Managed Objects, Micromuse and System Management Arts (Smarts) point to the improvements they have made, such as root-cause efficiencies aided by discovering Layer 2 topologies and using object-oriented data models. Still, this category remains complex. You won't move from crumpling the cellophane to managing multitiered, networked business applications in a day, though if you don't expect miracles out of the box, implementation and project planning will improve, and you'll likely contain costs along the way.MoMs are event managers. If they can alert IT about an outage before a user or a customer calls, that's a win. This sounds like a no-brainer, but wading through thousands of events is akin to searching for a needle in a haystack. Such event management isn't enough; event reporting requires diagnostics to shorten downtime. Most MoMs call for heavy front-end implementation and a fair amount of rigor, procedure and discipline to achieve that goal.

Managing events was a huge part of the early MoM's job, necessitating the development of special techniques. Decreasing the mammoth number of events was one strategy. Methods such as deduplication and event damping reduced recurring events to a single line on the console.

Automation further reduced the number of events that required a response. The idea was to build rules that, when met, triggered some action. Simple rules required identification of an action that would occur based on a particular event, such as mounting and assigning tapes when a file arrived.

Interevent rules, which specify multiple triggers and actions, advanced the MoMs further. A prime example of such a rule is the suppression of events for the loss of contact between a router and downstream devices. If an interface is disabled, and the device is a router, ignore or trash any events arising from devices that cannot be contacted because they are attached to said router.

In a router's case, the relationship between the attached downstream devices and the router's failed interface is understood based on Layer 3 addressing. That is, the subnets supported by the router will be down when the router is down. With processes that run on separate servers, clients, switches and other equipment, the old MoMs' rules would become too brittle, requiring too much upkeep to make the automation provided worth the effort.The new MoMs still handle event management--in many cases, better than ever. But they need to do more. The ultimate MoM has a clue to errors' origins and can take a corrective action automatically.

Management = Money

Unfortunately, MoMs cost a small fortune to implement. The simplest MoM is going to run about $200,000 to get off the ground, with an additional $40,000 a year for maintenance and several thousand dollars for training. This is on top of the purchase, implementation and maintenance costs for the management domain you're using.

More complicated scenarios will cost even more: $500,000 would be realistic for a large organization with, say, 100,000 managed entities in 500 offices across the country.

It's obvious that the more complex the organization, the less the proportional cost in comparison with the overall IT budget, assuming a higher IT budget as complexity rises. For this reason, large, complex organizations will reap MoMs' benefits more easily than small ones. For more on the costs, see the pricing chart.Although MoM vendors have good penetration into the service-provider market, they are pushing to offset the flatness of that market by driving into the enterprise. They see the medium-size enterprise as the next low-hanging fruit. However, these enterprises need to proceed carefully. After all, management is a cost center. There's a link between better operations, management and business, but it's not concrete.

MoMs make the most sense if you're managing profitable networked applications and when downtime would cost hard dollars. Transaction-oriented applications that support e-commerce or financial services are examples of medium-size business models that could benefit from a MoM. Midsize retail businesses often have costs associated with WAN and distributed support issues and can benefit from a MoM too.

At other times, implementing a MoM simply doesn't make sense. For instance, in our testing, we used Syracuse University's multitiered PeopleSoft registration system. No doubt, it's important and complex. If the system fails during the first week of classes, epithets will fly. However, because you can't attach a hard dollar value to such downtime, it's unlikely the university will implement a $200,000 to $500,000 solution to safeguard against it. Existing technical expertise and point products provide enough insurance against that unlikely event.

Obviously, recurring WAN costs make it easier to justify even slight improvements in efficiency provided by management applications. But midsize enterprises don't have the same dollars to throw at a management problem, even though they have equally complex and critical networked applications.

Managing internal application environments in midsize businesses carries mostly soft dollar justifications, such as the cost of downtime. Many of the services are provided over reliable LAN infrastructures that can be upgraded or duplicated for far less money than even a modest MoM project.This means most MoM vendors won't be able to transition to the enterprise. Not only aren't they going to be able to adjust their products to offer enough shrinkwrap functionality, but doing so would remove their professional services revenue. That's a double whammy.

Bruce Boardman is executive editor of Network Computing, testing and writing about network management and systems. He has 12 years' IT experience managing networks and distributed computing for a financial service provider. Send your comments on this article to Bruce Boardman at [email protected]

Meet the new MoMs. These managers of managers aren't baking apple pies--they're overseeing your network and putting a quick end to the "Johnny did it!" problems that ensue when applications, systems and networks are monitored by different management tools.

Because these products monitor all three major components--the network, applications and systems--they can help find the root cause of problems that ultimately result in service delays to customers and other end users.

MoMs are expensive and take a lot of work to implement and maintain; that's why they're best suited to large, complex organizations running multitiered applications. In the midsize-enterprise sector, companies running e-commerce and financial services applications can also benefit from the event management these packages provide.We tested five BMC knowledge modulecompatible MoMs, from Aprisma Management Technologies, BMC Software, Managed Objects, Micromuse and System Management Arts (Smarts). Smarts, with its unique Layer 2 network discovery technology, did the best job of correlating events and finding the root cause of problems. For this reason, we gave Smarts InCharge Solutions Suite our Editor's Choice award (see our review).