Tivoli Alternatives

“Any intelligent fool can make things bigger, more complex, and more violent.
It takes a touch of genius -- and a lot of courage -- to move in the opposite direction.”
 -Albert Einstein

IBM continues to ask for a premium price on its products despite no longer being a monopolist (as in 1996) or leader in many areas of enterprise system management (ESM).  Also in current economic conditions many organizations can be better off with simpler tools, tools which do not require dedicated staff. 

The need for alternative to Tivoli arises mainly due to its overcomplexity, price and poor architecture.  In this sense IBM with its Netcool/Candle perfectly shoot itself in a foot: it replaced a very complex product with a pair of equally complex, equally expensive and only partially compatible  products.  This problem has several aspects

• Cost of personnel. Important consideration of the system is the level of personnel involved. In most large enterprise environment best people should be doing something more productive then monitoring events. It is stupid and wasteful to assign your best personnel to monitoring just because it requires Prolog programming skills. That means that such system should not require a staff of PHDs to deploy and manage such system (which is, unfortunately, the case with TEC: few people with a bachelor degree in computer science can understand Prolog ;-).
   
• Annual maintenance costs. Complex products were less bad idea when the money were easy and you can buy whenever level of support you wish. Truth be told IBM used to compensate inferiority and overcomplexity of  ESM products with an excellent technical support (Classic Tivoli support was really very good and before recent outsourcing wave was the major attraction of IBM's product line). But when money are tight as they are in 2009 and 2010 the situation became more complex. All large ESM vendors including IBM cut or outsourced support personnel to save money. In any case, cost of support should be evaluated in terms on number of on-the-floor people you can hire instead: each $60-100K(depending on the state) of annual maintenance costs is equal to the cost of a dedicated to this area specialist on staff. In this regard IBM strategy of charging $500K for maintenance of medium sized datacenters (say $1K per server on average per year, 500 servers) backfired: in new economic circumstances in no way this is cost/effective solution. That means switching products became not only an option. It became a game plan.
   
• Survivability. Complex product tend to die when the underling technology changes, while simpler product often manage to adapt. Just think about the cost of transition from classic Tivoli to a new product line in terms of both personnel retraining and licensing costs for a large multinational company with offices on all continents. The desire to shoot some members of IBM brass and increased sensitivity to competitor offerings in this situation is a very unsurprising reaction ;-)
   
• Rigid licensing models. First of all for a large enterprise vendors of ESM the licensing model is designed more to recover costs and earn premium on capital then to promote the product.  They already have a market share and vendor lock-in ensures that it will stay. That mean that products are too expensive and vendor can charge all the customer can bear with impunity. In case of IBM this desire to recover costs and earn premium on capital went too far and backfired. For example, per processor core licensing which is typical for Tivoli is now under attack both from other "big guns" like HP as well as from  more nimble open source competitors. HP can provide similar functionality and better architecture TMF+TEC+ITM troika substantially cheaper then IBM. The open source crowd can probably provide 80% of functionality for 30% (or less) of cost.  Alternatives to TWS are not only cheaper, they are better.  So other vendors started to eat IBM's lunch.   IBM can ignore this situation only to its peril.
  
  At the same time you should beware the race to the bottom. Good product takes money to develop and support and vendor need to recover those money and earn some premium on capital. There is no free lunch. It is important to understand that there is some optimum cost for given functionality. "Race to the bottom" usually does not pay as too many compromises need to be made. Still it is quite clear that monitoring can be provided cheaper then costs charged for classic Tivoli line as it became now commonplace solution to the extent that even hardware vendors provide useful, well integrated solutions for free or at minimal cost with their hardware (Dell is one example).
   
• Duplicate functionality. As return on the investment in IT became more central, the selection of the multiple products bought from different vendors and containing overlapping features became less and less acceptable. For example, from the point of view of functionality a good scheduling package can provide probably 80% of monitoring functionality as scripts can be deployed and scheduled on any node from the central location. That means that cost of other components in enterprise package should strongly depend on this functionality overlap and in no way TEC+TWS should cost the same price as the sum of prices of TEC and TWS purchased alone. At the same time, I never heard of 50% discount for TWS for TEC users :-). That also means that interesting alternatives to Tivoli product line may appear under misleading labels.  Duplicate functionality between monitoring systems and enterprise job schedulers is just a one example or a much bigger trend.  Sometimes monitoring system provide pretty usable software distribution functionality too, at least for Unix platform.
   
• Competition from open source world. Adoption of any ESM system is a risky step. Learning curve is steep. You fully understand what you got only in a year or so. Many companies want to start small without going in bed with one of the major vendors and grow gradually. They want an opportunity to switch to more powerful system as they acquire experience. Open source solutions provide this path more readily then big four ESM vendors (IBM, HP, CA and BMC). This is essentially a choice between having more local staff and simpler product or having less local staff and more complex and supposedly more capable product. Each, say, $60-$80K in annual maintenance costs is equal one full time position.

Even on high end of spectrum there are cleaner solutions with lower total cost of  ownership the IBM offerings. It is interesting to note that newer versions of  some Tivoli products are by themselves an alternative to "old" Tivoli :-). Several newer products like ITM 6.1 has nothing to do neither the old product nor with Netcool/Omnibus and is rebranded version of a competing product that  IBM bought. At one point IBM brass realized that it would be difficult for them to command high price in the future and this moment of weakness has found its reflection in so called "Express" products. Later they were sidelined as desire to milk that franchise prevailed over other more rational considerations.  High renewal price of maintenance, often half a million dollar in annual maintenance for portfolio of products (say TMF, TEC, TPM, ITM and TWS) for a medium size datacenter (let's say less then 500 servers) is another factor that push many organization into overdrive in finding alternative. Such efforts usually are synchronized with the end of contract (for large organization the initial contact with IBM usually lasts three years or more so defection during this period is next to impossible) or end of support of one or more "classic" Tivoli product (for TEC this is 2012).

The other problem with Tivoli is low quality of architecture of the whole Tivoli line. For any specialist it is obvious that the same functionality can be provided more elegantly, more flexibly, with less complexity and with less cost. Tivoli became a strange mix of the products that were bought, not developed at house. This underling architectural diversity and functionality overlaps is a serious issue. That raises important question in many middle IT management minds: if IBM cannot provide a high level of uniformity and integration across the line of products why best of the breed approach is weaker?

While successful against "old Tivoli", Netcool/Omnibus line does not necessarily represent state of the art of this fast moving field. As any acquisition-based package it suffers from non-uniformity of architecture with the rest of Tivoli line, especially with TWS and TCM.

Nor IBM provides a scripting friendly environment which is extremely important for cutting the cost of the ownership of the platform.  None of newer products are designed around usage of a classic scripting languages (yes. none) or are as programmable as TEC (with its Prolog-based engine, where nothing is easy but everything is possible ;-).  Old Tivoli at least provided Perl 4 interpreter for all platforms it supported.  And Perl was used internally in various roles. This approach did not survived. IBM stresses Java and webservices now and this is an inferior approach. 

Netcool/Omnibus and Candle were successful competitors, but not necessarily the best technically. Both were  commercial products with a long development history (and Candle with mainframe baggage). That means that  architecturally both Netcool/Omnibus and Candle were a mess even before the acquisition, may be less the  mess then the old Tivoli line but still a mess.  For example Candle definitely suffers from its mainframe heritage.   

So first IBM brass demonstrated lack of technical vision with the indiscriminate acquisition of not  a single, most promising and technically advanced competitor, but two of them simultaneously.  Of course they badly wanted their client base and they got it. But now IBM is facing the problem of integration of overlapping products. So instead of leapfrogging competition IBM put itself in a situation of a technological laggard which desperately tries to defend its market share at all costs.

And that's not a good technical policy as marketplace has several alternative vendors, especially attractive for mid-size enterprises, which are not inclined to pay the steep licensing and maintenance fees on the strength on IBM brand name alone. In this market Tivoli is squeezed by products like HP Operations Center which have lower total cost of ownership and in case of  HP Operations Manager 9.0 higher quality, while retaining close or surpassing functionality.

Also in the current economic conditions cheap tricks like licensing product per core, or worse including number of cores in the calculation of the cost of maintenance became more visible and more annoying.  Why on the earth the price of the monitoring software should depend on the number of cores of the server on which it is deployed?  Is number of calls to product helpdesk correlates better with the number of cores or the number of nodes?  The next logical question after this one is often: What are my alternatives ? There is nothing surprising in the findings of the recent IDG survey, which moung other things have found the waning loyalty of a majority of users to their legacy ESM solution.

Small enterprises traditionally use open source products and typically are not part of IBM Tivoli market.  So mid-size, large companies and governments (which are more gullible then commercial companies)  are the only game at town for IBM. 

We will discuss several possible alternatives:

• HP Operations Center
• BMC Event Manager
• "Best of the breed" mix of  bothe commercial and opensource scripting-friendly products
• Promising startups and Competitors to Omicool/Omnibus

HP Operations Center

The attractiveness of HP offering as an alternative to Tivoli is that both architecturally, cost-wise skill-wise, and from the point of political correctness it is an acceptable solution for both corporate brass and people in the trenches. From all three viewpoint this is a very attractive solution.  Political correctness is very important for high level management which often are afraid of any radical change and might block switching to a smaller, more nimble Tivoli competitor. 

Even if IT is run by some despicable coward (which is actually a pretty typical situation ;-) you have chance to get his/her OK for such a switch.  All-in-all it is a higher quality product then classic Tivoli offering (with the exception of TEC correlation engine) with better GUI, stronger linux support, more reasonable licensing scheme, better quality and cheaper training courses  and approximately the same quality of tech support.

• HP Operations Manager 9.0  (HPOM), which is the central part of HP ESM offering, looks very similar in functionality to Tivoli framework, Tivoli Monitoring 5.x and TEC in classic Tivoli (TFM+TEC+ITM) combination. Here are some strong points:

  • Large part of existing skills on administrator and operator level are reusable. In a way HPOM is more "classic Tivoli" friendly then IBM new Tivoli and migration to it is less costly. It very similar, almost identical client-server model. Both functionality and complexity are close to combination of Tivoli framework, Tivoli Monitoring 5.x and TEC in classic Tivoli.  In other words it is powerful and flexible product.  From my evaluation it looks like considerable part of Tivoli know-how can be almost instantly transferred to HPOM environment . Most concepts and administration procedures of TMF, TEC and ITM looks familiar to seasoned HPOM users and vise versa. Java-based HPOM Event Console is very similar to TEC Enterprise console, so operators need minimal retraining. It looks like TEC operator console should be: more powerful and more flexible. There is also possibility to create a dashboard directly or using SiteScope.
  • Agent is way too complex; the same as in Tivoli set of popular platforms is supported.  Linux is slightly better supported then in Tivoli with separate agents for 32-bit and 64-bit environments. But agent is more complex (half a dozen processes) and more capricious with it prerequisites and installation then Tivoli agent (which is just one process). Agents can be distributed to nodes using SSH or RSH. They also can be installed manually by FTPing relevant files to the nodes.  Sometimes the latest agent 8.60 refuses to install on a particular older Unix platform and older agent needs to be used (this is the case for AIX 5.2 and older, HP-UX 9.x. etc). Communication between agents and the mothership is via HTTPS. Certificates necessary for HTTPS communication used not always install correctly and resolution of such problems at the beginning is challenging. HP support in this area is weak. There is also a capability of agentless monitoring (using telnet of SSH) via a bridge to SiteScope (which is an acquired product which actually should be integrated into HPOM, but it never was. In other words HP is suffering from the same overcomplexity disease as IBM, just to a lesser extent because it implements far better architecture.
     
  • Agents are capable to filter messages. Like in classic Tivoli, agent on each node is simultaneously is the repository of probes (called smart plug-ins) that send messages to the "mothership". HPOM policies determine all aspects of converting an event into operator console message provide pretty powerful capability to specify simple event processing (rewording, duplicate suppression, etc) without actual programming. THis is a strong point of HPOM -- simple processing is simple, and complex is possible, while in Tivoli everything is complex but possible.   Power of policies based filtering in HPOM is substantial and covers all typical areas were TEC was successful and more.  It is really much much better deal both from engineering perspective and, especially, from system administrator perspective: regular sysadmins can be quite productive with the tool.
     
  • HP did a very good job in fault tolerance area: much better then IBM with "classic" Tivoli. The product can be installed on  two servers can be used in round-robin fashion: you can switch primary server to the secondary (from the secondary server) for maintenance. Before that you can synchronize the configurations by backuping it and importing on the second server.  There is also support for clusters and such configuration are widely used. All-in-all the ability to use backup manager for maintenance of primary and "follow the time" functionality as well as ability to send different events to different managers are better then in Tivoli.  HPOM also has the concepts of outages and service hours which are not explicitly present in Tivoli (Tivoli implicitly assumes 24x7 environment).  Planned outages of individual servers is an important feature of any datacenter. In Tivoli that can be solved using correlation engine, but HPOM provides an explicit mechanism. 
     
  • HPOM is more Unix friendly then Tivoli. First of all it mixes directories for binaries and directories for data files much less then Tivoli. HPOM tries to adhere to classic Unix scheme using /etc/opt/OV tree for configuration files, /opt/OV/opc for binaries and /var/OV/opc for data). But the directory trees are as deep and as obscure as in Tivoli.  Without using Midnight Commander or similar tool they are a mess to work with even with aliases and special variables defined.
     
  • Like in Tivoli most operations can be performed from the command line. Commands for most operations that can be performed via GUI are available. That created possibilities of automation for example in installation of agents on the nodes. On a negative side command syntax is, like in Tivoli, a mess with different prefixes and different options style for different commands. Here HPOM matches or even exceeds Tivoli in a very bad sense ;-)
     
  • HPOM matches skills of the typical system administrator much better then Tivoli. For example probes (smart plug-ins in HPOM terminology) can be written in shell, Perl or other scripting language. In Tivoli ITM 5.x they are written in JavaScript which is the language few sysadmin know, while correlation engine uses Prolog, a non-procedural the language similar to regular expressions that requires special training to master.  In HPOM any scripting language can be used. Actually, examples supplied with HPOM are written in Born shell (disk_mon.sh, cpu_mon.sh, proc_mon.sh, mailq_l.sh, etc) and Perl (bridge to SiteScope). Sending the alert from the probe involves using the utility opcmsg   (or similar utility opcmon) which in many ways is similar to  wpostemsg in Tivoli. It works only on nodes with the installed agent as communication is via HTTPS.

  Probes (aka smart plug-ins in HPOM-speak can be written in any scripting language including Perl and shell.

  • Messages can be distributed between multiple "expert centers"; protection from event storms is better as agent can contain correlation engine. There is no gateways but servers are relatively cheap (~$12-18K per server license; the main cost is node licensing, which is around $400-$500 depending on volume) and can be linked hierarchically. There is also a unique capability for "horizontal" message forwarding between two or more managers on the same level of hierarchy. This is called "Message forwarding" and it can be used for implementing "Expert centers" concept, when particular group of messages is forwarded for specific group responsible for resolving it (for example network group, Unix admin group, Windows admin group, etc) from the "total message view" on operator console.  This is a clean and very powerful concept that is very useful in large organizations:  it helps to prevent infighting for  the access to the HPOM server administration capabilities.
     
  • Correlation engine is different. Provided by defulat capabilities include deduplication available directly from policies and Correlation composer which provides six predefined correlation templates (event suppression, transient states, duplicate events, event timing, event create and annotation).  This is much weaker the Prolog capabilities in TEC but for most organizations this is not the problem as they never used advanced capabilities of TEC (few organizations have capable Prolog programmers).  For more powerful correlation capabilities you need to buy ECS Designer which permits defining your own correlation templates.  In other words each HPOM installation contains fully fledged correlation engine, capabilities of which are hidden by HP, which supplies ECS Designer as a separate product.   An interesting feature is that correlation engine exists on node level, not on the server level, which improves tremendous scalability (at the risk of hosing the node the agent is running on ;-).   Unlike programming in Prolog-like rules language used in TEC, the correlation engine is of "click and enjoy" type which has major negative aspects as without programmability the system is "half-baked", even if rich  functionality is provided out of the box. IF you looks at discussion at HPOM forums it is clear that people lack a systematic approach of dealing with correlation and are slaves of the provided GUI style "click and enjoy" approach.  But one positive aspect of this approach is that elementary tasks can be performed by people with minimal or no programming skills. Again, the fact that there is no algorithmic language in which to program correlation rules  is a weakness, but truth be told Prolog was mostly ignored in a typical Tivoli deployment. Often no custom rules were used or only a few (often outdated and not well maintained) rules developed by IBM or external Tivoli consultants were used.   As with enough trust pigs can fly you probably can get some API and thus programmability using add-in correlation engine called OMi Topology Based Event Correlation which is installed on a separate box and is a Windows-only product that HP recently acquired.
     
  • Documentation is frustrating and minimal; manpages lack examples and often are sketchy. This is huge deficiency but:
     
    • First of all this is so typical for enterprise software products that should not probably even be mentioned as a shortcoming,
    • For those who got used to Tivoli documentation it is OK and conciseness might be seen as an improvement over IBM-style when a 300+ pages document can carry almost no useful information.
    • Taking "Essentials" course provide aspiring HPOM admins with two volumes of relatively well written and really useful documentation (and only idiotic IT managers prevent the staff attending at least Essential course after buying this complex and rather expensive, product). 

    At least documentation does reflect the current version of software. An interesting nuance is that HP provides a separate set of documentation for each platform (Windows, Linux, Solaris and HP-UX on Itanium).  There is just a half-dozen books that you need to read  ( Installation Guide, Concepts Guide, Administrator's Reference,  HTTPS Agent Concepts and Configuration Guide, UI installation and admin guides). For people with the multi-year training in reading obscure IBM documentation, deciphering main ideas, extracting typical operations procedures from HP documentation presents the same challenges as before. It's not an improvement, but they are not much worse either.  As usual you can compensate for the incompleteness of documentation with training.  In essence, all HPOM personnel needs training as many aspects of the system are not covered in documentation and man pages often does not have useful examples or have no examples at all.
     

  • Training is better organized, better structured and cheaper then outsourced training that IBM provides, which, based on my experience, is a mixed blessing despite generally good curriculum and manuals.  Two major HPOM admin courses are $7.5K per person (3750*2).  HP virtual rooms software is used, which is adequate for the purposes. Students are supplied with own private network of several virtual linux (including two Linux HPOM servers and a client) and Windows servers. That makes possible to use identical IPs for all students and simplifies instructor life.
     
  • License cost consists of the cost of server license (deployment can consist of multiple hierarchically interconnected servers) and the flat cost of agent for each server (the cost of agent does not depend on the number of cores or number of CPUs.  HP is more reasonable then IBM and does not resort to cheap tricks like charging per CPU core ;-).  So both the initial acquisition cost and the annual maintenance cost are lower. Not dramatically (the product is still expensive), but lower.  If intelligent IT staff was outsourced you still can get a prepackaged offering of installation of the server plus 50 nodes from HP Professional services for approx $50K. Otherwise taking two telecourses is enough to get you to the level when you can install the server and configure several agents with some basic probes. Migration from Tivoli TEC is more complex issue and here a good consultant can be tremendous help (but only a good one, which is difficult to find). 
     
  • Integration with scheduler is on the same level as in Tivoli and several different schedulers can be integrated. ORSYP, UC4 and probably several other enterprise scheduler vendors have (outdated, if we judge from versions on HP site) Smart Plug-Ins for HP Operations Manager. For example ORSYP has a smart plug-in for HPOM 8.x, but hopefully a new version exists or is at work that works with 9.x. It also lists plug-in on its site (Enterprise Scheduler for HP Operations Manager)

    Dollar Universe Manager for HP Operations Manager is a fully integrated, out-of-the-box solution for HP OM systems. The tight integration makes Dollar Universe the natural choice for HP, integrating and scheduling all IT & business processes and further augmenting the value of the HP suite for customers. Dollar Universe is a certified HP OM Smart Plug-In.

    There some positive stories about successful integration of UC4 with HPOM by large organizations on HP website.

    In most cases you can use SNMP for basic integration even if no smart plug-in exists or supplied smart plug-in is of low quality.
     

  • During the planning phase, the key issue are event processing and implementation of filesystems monitoring.

    Event processing usually does not represent too big a problem as facilities of OMU are adequate for "imitating" useful part of TEC. Please note that most firms use TEC in extremely primitive way so they can actually benefit form more user friendly event processing and correlation infrastructure that OMU provides.

    Situation with filesystem monitoring is more complex. As a minimum you need to create infrastructure for regular filesystems monitoring and Oracle archive filesystem monitoring. While primitive, Tivoli Monitoring 5.x  does provide ability to create hierarchical set of filesystem monitoring profiles. Say one "universal" profile is used for monitoring standard Unix filesystems such as /usr/, tmp. /var and then individual profiles are used to monitoring filesystems that are critical for the particular box or particular set of boxes (for example, Oracle servers). 

    During the planning phase, the key issue is how to implement filesystems monitoring. As a minimum you need to create infrastructure for regular filesystems monitoring and Oracle archive filesystem monitoring.

    HP does not provide any useful monitoring scripts with OMU and the sample script that it provides for monitoring root filesystem is a joke. So here you need to write some custom scripts, which in my view is a good thing.  In a way, while HPOM does not requires from sysadmin knowledge of JavaScript and Prolog like Tivoli, it does require a very good knowledge of shell and Perl (and other similar scripting language).  Quality of probes determines the quality of monitoring and if your sysadmin is of garden know-nothing variety as for scripting, the results can be very disappointing.

  Previous version of the product was known under the more common name OpenView Operations (OVO) and this name is still used in the agent documentation.  There is a certain confusion and interchangeability in usage of the term of Operations Manager and Operations Center, althouth recently the term Operations Center is used an umbrella term that also includes SiteScope. For example prefix opc is used for many commands as well as user names which adds to the confusion.   Like any large corporation HP development has its problems, but still the product looks better engineered than classic Tivoli.

  With HPOM version 9 network manager is a separate product and that reduced the cost of the server.  To cut costs for networking part you can use Nagios of other open source product. 

Previous version of the product was known under the more common name OpenView Operations (OVO) and this name is still used in the agent documentation.  There is a certain confusion and interchangeability in usage of the term of Operations Manager and Operations Center, althouth recently the term Operations Center is used an umbrella term that also includes SiteScope. For example prefix opc is used for many commands as well as user names which adds to the confusion.   Like any large corporation HP development has its problems, but still the product looks better engineered than classic Tivoli. It' more cost effective and HP have been known to negotiate “all you can eat licenses” with larger customers, where they are offered unlimited licenses over a particular time period (e.g. 5 years).

With HPOM version 9 network manager is a separate product and that reduced the cost of the server.  To cut costs for networking part you can use Nagios of other open source product. 

BMC Event Manager

This offering is very interesting and probably represents optimal alternative if (and only if) there was substantial efforts to develop custom correlation rules in TEC.  It provides a very smooth transition path that allows to save most of the know-how related to use of Prolog-style approach (which can be viewed as extended regular expressions) for event correlation.  BMC Event manager uses BAROC and similar rules but does not support native Prolog so this is not a perfect alternative if Prolog is used in rules, but this is rarely the case. Common rules are more or less easily convertible. See  Migrating to BMC Event Manager from IBM Tivoli Enterprise Console. for example

The following Tivoli Enterprise Console rule sets the severity of an incoming event of type AgentRestarted to “HARMLESS” if the event comes from host testserver.

rule:change_severity:(

	event: _event of_class 'AgentRestarted'
	where [ 
          hostname: equals 'testserver'
          ],
	reception_action:set_to_harmless:(
         bo_set_slotval(_event, 
	severity, 'HARMLESS'),
         re_mark_as_modified(_event)
    )

).

The same rule written in MRL would be:

refine change_severity:
AgentRestarted ($EV) where [$EV.hostname == testserver ]

{
$EV.severity = HARMLESS ;

}
END

MRL uses specialized rules to cater to the different event management scenarios. Rules of type “refine” are used whenever an incoming event needs to be enriched. Specialized rules improve performance and make rules development much easier. “$EV” is an arbitrary variable name that acts as a pointer to the entire event structure. It makes the rule much more straightforward to write — and read.

BMC Event Manager also uses the same event format so messages from TEC adapters can be processed correctly.

Paradoxically both old TEC 3.9 (which will become unsupported in 2012) and BMC Event Manager can give a run to newer IBM product line for the money.  First of all TEC has huge amount of documentation and substantial amount of people trained in old infrastructure. Both products use Prolog as a rules writing language (preserving programmability) and simplifying rulebase migration.  While Prolog has multiple shortcomings it also has multiple strong points and it is unclear whether SQL-based correlation engines are superior (they are definitely simpler and that a huge positive point).

IBM lost the chance of integration of Prolog with Perl or using Python-based implementation of Prolog to increase flexibility (pure Prolog is more like straitjacket for simple cases and shine only in complex correlations, if and only if it is supported by qualified staff ). But that does not mean that competitors also need to sleep at the wheel like IBM did.

At the same time Tivoli State Correlation Engine does an excellent job for simple tasks. This, introduced by "classic Tivoli", dual correlation scheme has important advantages over any competitor with a one size fits all correlation engine. That's an area where Netcool is simply lacking althouth using SQL for event correlation is not a bad idea and it is more simple and straightforward approach then Prolog.  

In 2003 BMC   bought  IT Masters and turned it into BMC Event Manager (Formerly PATROL; see also BEM migration). BMC also owns Remedy and Prolog interpreter and as such have more complete stack of products.  Integration with Remedy is definitely a big plus.  Many customers have substantial investment in old TEC and some trained in the Prolog-based technology staff.  BMC Event Manager v7.1 supports Linux and UNIX platforms, as well as integrations to z/OS. 

BMC actually moved aggressively into the area with another key acquisitions and beat IBM not only in Prolog area. In late 2002 it bought service desk company Remedy, and IBM was left with nothing as for integration with helpdesk.

"Best of the breed" mix of low cost proprietary and open source scripting-friendly products

Monitoring became now commonplace solution and many hardware vendors provide useful well integrated solution for free or at minimal cost. One example is Dell.

Dell™ Management Console (DMC), powered by Altiris™ from Symantec™, is designed to address everything from basic hardware management applications to advanced enterprise management. DMC provides a single view into the deployment, inventory, monitoring and updating of your IT infrastructure, and creates a foundation for more advanced management functionality

Open source monitoring products are also adequate for most enterprise needs and are typically more scripting friendly. This creates tremendous advantage for IT if the monitoring product uses subset of Perl, PHP, JavaScript, Python or other full fledged scripting language as correlations rules language and LAMP stack as the base of their implementation.  IBM experience with Netcool has shown again that it's  difficult and time-consuming to integrate acquired technologies and to rationalize overextended product portfolio. This situation pose for IBM substantial marketing and sales challenges which can be exploited by nimble competitors who adopt scripting languages. For example, Perl now is used by any self-respected Unix administrator.

Weak point of open source vendors is that correlation usually is not supported so they probably cannot be used as a "pure play" for a large enterprise, but used in in tandem with product that provides correlation engine (licensed for minimal amount of nodes) they can dramatically lower the cost of acquisition and maintenance of the system if  hierarchical two level deployment is used with satellite open source monitoring servers reporting to the mothership with the correlation engine and event console.   This is one way you can defeat "payment for endpoint" model used by most large EMS vendors. See Unix System Monitoring. Among systems that might appeal for mid-side enterprises are (for more comprehensive list see Wikipedia/Comparison_of_network_monitoring_systems):

• Zenoss Python-based low cost product. 24 x 7 support is possible. No correlation engine yet.

• Nagios (C). Nagios 3.0 is provided with Novell SLES 11 so installation is a breeze. Functionality is adequate for many monitoring tasks.

• OpenSMART (Perl) a very interesting agent based system. Communication is XML-based.

• ZABBIX (PHP, C)

• The Hobbit Monitor a derivative of the Big Brother monitoring system

• OpenNMS (Java) designed mainly for Network Monitoring, it’s discovery feature works really well and being configurable form XML files makes it relatively easy to setup and maintain. Installation requires  Tomcat.

Promising startups

It looks like IBM is especially vulnerable in its scheduler offerings as both startups and established  players in enterprise space provide similar or better functionality as TWS for a fraction of the price. See Enterprise Job schedulers.

• Open Source Job Scheduler  Open Source Job Scheduler is developed by Software-und-Organisations-Service (SOS) GmbH in Berlin, Germany. Versions are available for Linux, Solaris, HP-UX (PA-RISC, IA64), AIX, and Windows.  Like all open source products it provide excellent opportunities to understand whether the product can meet the demands of the organization.  While evaluation period for most product is limited to 90 days here it is unlimited.

  Jobs can be configured from the Job Scheduler Editor GUI or XML files which can be edited directly.

  The Job Editor GUI is a Java-based application that you can use to configure the various jobs, chains, and other aspects of the system. All of the server configuration information is stored in XML files, and all you need to do is open up the respective XML file in the Job Editor to make your changes.

  The day-to-day operation is handled by the Job Scheduler operations GUI (Operations GUI), which is Web-based (AJAX) application accessible from any web browser. You can monitor jobs, start, stop, handle errors, and so on.  The Job Scheduler also provides an API that allows you to manage and control jobs externally. The API supports Perl, VBScript, JavaScript, and Java.

• Oracle Scheduler (for users of Oracle 11 R2 or higher it is free; all you need to pay is Oracle maintainance costs on your database). This is a pretty powerful scheduler which allowing the database to schedule external jobs which run on a remote server. There is no separate licensing on agent installed on nodes so one server license is essentially all that you need. The clients (remote servers) doesn't have to have an Oracle client or database installation, but it must have an Oracle Scheduler Agent installation. This agent is responsible for executing the jobs and communicating with the database server that initiated the job. (http://www.oracle-base.com/articles/11g/SchedulerEnhancements_11gR1.php )

  There are two interfaces for the Oracle Scheduler:

  • UI which is part of Oracle Enterprise Manager (free with Oracle Enterprise license)
  • API (DBMS_SCHEDULER package).

  It is a free feature of the database. Oracle Scheduler  is implemented via the procedures and functions in the DBMS_SCHEDULER PL/SQL package.

  The Scheduler provides sophisticated, flexible enterprise scheduling functionality, which you can use to:
  • Run PL/SQL anonymous blocks, PL/SQL stored procedures, and Java stored procedures.
  • Run executables that are external to the database (external executables), such as applications, shell scripts, and batch files. You can run external executables on the local system or on remote systems. Remote systems do not require an Oracle Database installation; they require only a Scheduler agent. Scheduler agents are available for all platforms supported by Oracle Database and some additional platforms.
  • Schedule job execution using the following methods:
    • Time-based scheduling You can schedule a job to run at a particular date and time, either once or on a repeating basis. You can define complex repeat intervals, such as "every Monday and Thursday at 3:00a.m except on public holidays" or "the last Wednesday of each business quarter."

       

    • Event-based scheduling The Scheduler enables you to start jobs in response to system or business events. Your applications can detect events and then signal the Scheduler. Depending on the type of signal sent, the Scheduler starts a specific job. Examples of event-based scheduling include starting jobs when a file arrives on a system, when inventory falls below predetermined levels, or when a transaction fails.

       

    • Dependency scheduling The Scheduler can run tasks based on the outcome of one or more previous tasks. You can define complex dependency chains that include branching and nested chains.

       

  • Prioritize jobs based on business requirements.

    The Scheduler enables control over resource allocation among competing jobs, thus aligning job processing with your business needs. This is accomplished in the following ways:

    • Jobs that share common characteristics and behavior can be grouped into larger entities called job classes. You can prioritize among the classes by controlling the resources allocated to each class. This enables you to ensure that your critical jobs have priority and have enough resources to complete. For example, if you have a critical project to load a data warehouse, then you can combine all the data warehousing jobs into one class and give priority to it over other jobs by allocating it a high percentage of the available resources.
    • The Scheduler takes prioritization of jobs one step further, by providing you the ability to change the prioritization based on a schedule. Because your definition of a critical job can change over time, the Scheduler enables you to also change the priority among your jobs over that time frame. For example, you may consider the extract, transfer, and load (ETL) jobs used to load a data warehouse to be critical jobs during non-peak hours but not during peak hours. However, jobs that must run during the close of a business quarter may need to take priority over the ETL jobs. In these cases, you can change the priority among the job classes by changing the resource allocated to each class. See "Creating Job Classes" and "Creating Windows" for more information.

As enterprise scheduler marketplace became pretty crowded, there is no incentive to pay IBM high price for TWS when products with similar or better functionality can be acquired for a fraction of the cost. In this sense TWS is the most vulnerable product in IBM Tivoli line.

Competitors to Omicool/Omnibus with SQL based correlation engines

• Monolith Software . Monolith's Software Wins Network Products Guide 2010 Best Products and Services Award They claim  not only be able to replace Netcool Omnibus, but also to improve upon its functionality providing lower cost due to absence of per device/per user licensing.

  Monolith mSuite ITM with 3.1 provides strong, robust event management with out-of-the-box intelligent escalation & notification, ticketing integration, and historical collection/reporting; all with NO Device or User Licensing.

  Monolith provide easy syslog and trap routing in your environment with Monolith's Event Router appliance now available in version 1.1 which includes consolidated syslog-ng and looper ng integration; affordable and supportable today.

• RiverMuse Pro  is an implementation of ESM system with (in their opinion) functionality equal of surpassing Netcool. They claim it to be "a next-generation systems management tool brought to you by the founders of MicrHPOMse and Riversoft."

  Our Community Edition is currently in alpha* and we are getting some great feedback on both functionality and performance.  We hope to have a beta available for download very shortly.

  For those of you eagerly awaiting the general release we wanted to give you some insight into the architecture.  We will go into more detail on individual features in future blogs.

  An OpenMOS based platform offering a scaleable, resilient and secure high performance environment.  All data management uses MySQL optimised for the ProCool architecture.  Passive data collection is undertaken using Rsyslog and package deployment and automated updates are managed by RPM and YUM.

  SOAP abstraction is leveraged to its best advantage allowing rapid integration and transport versatility whilst maintaining platform independence.

•  Augur  The claim to fame for Augur is in its "easier" rule engine. This is a Java based system.  DB is proprietary. See a good write-up of differences with Netcool in  Augur Systems Event Manager Compare Tivoli-Netcool. The cost is relatively low (starts at free). Currently the target market is small/mid-size businesses, but the software might have promise for large enterprises too (for example, Telco)

Event Management

Augur simultaneously collects and analyzes log entries, SNMP traps, application output, and proprietary protocols too.  The graphical rule engine processes events streams using your business rules, and then generates or clears root-cause alerts.

De-duplication, prioritization, and thresholding tools are all built in.  Plug-ins add data enrichment, external integrations, and any other customizations.

We tried to provide the flexibility of a “framework” system, with thoughtful features to make common tasks easier.  We think it’s a reasonable balance of power and ease.

Unified View

Alerts from all sources are automatically aggregated together and filtered according to your role-based configurations.  So you see just what you want, and your personnel see just what they need.

Workforce Dispatching

A full-featured paging notification system frees users from a screen so they can multi-task from anywhere.  The automation of workforce dispatching ensures consistent accountability, which ultimately benefits your service.  Fine-grained controls notify the right personnel based on alert type, location, schedule, and your business rules.

Enterprise-Class

In addition to Augur’s role-based access controls, its configuration is also secured by fine-grained permissions.  So you can safely share or delegate administration roles to trusted individuals or groups across your company.

When deployed as a distributed network, the cluster delivers the same views and configuration as if it were all one Augur, but with expandable capacity and the safety of network/geographic diversity.  The configuration database itself is a fault-tolerant high-availability pair that provide three tiers of protection.

Also nothing prevents you from exploring you own combination of open source products (with its model of free product, paid maintenance).  Right now several decent quality open source monitoring systems are free (Nagios).

Also several good quality schedulers are also free (Oracle scheduler, Open Source scheduler, etc).

Email infrastructure provides good event messaging with a email client as viewers. The latter in quality superior to any event enterprise console that I know. Responses might be implemented by forwarding message to predefined "actionable" email addresses.  

Enterprise customers want a stable vendor, complete coverage of enterprise flavor of Unix and Windows and high stability.  Here is list of considerations that might be worse to take into account during search for Tivoli alternatives:

1. Availability of trial version (with or without support) and free download of documentation with a trial.  No amount of presentations can be compared to trail as for understanding strong and weak spots of the product and its suitability for the particular environment.  Free documentation to registered trial users is a must. If particular ISP don't provide that, avoid the product.
     

2. Stability of the product and company. Switching from one architecture to another that happened with Tivoli due to acquisition is a bad sign. Gradual growth provides a better value unless we are talking about replacing a distinctly legacy system (but fashionable protocol like web services does not always provide a better value, or better stability). Public company with strong balance sheet is preferred. Ability to survive in difficult economic environment (say in 2001-2003 or 2008-2010) by growing customer base is an important positive sign.
   
   Maintaining large and complex ESM application codebase (for example monitoring system or scheduler) is expensive and at the same time very boring activity that needs flow of funds from a large customer base. That's Catch 22 for startups.  May be in a decade ESM products will became  "off the shelf" products (priced hundred or thousand time more then Microsoft office, but with much simpler codebase :-) with just a few players who managed to grab a significant market share that provides the opportunity to fund the maintenance of existing versions and further development.  Overcomplexity is expensive to develop and maintain and that Catch 22 for large ESM developers. That's one of the reason why commercial applications usually command pretty high price :-). 
    

3. Reasonable resource requirements (a single server should be able of service at least a thousand nodes; that means that HTTPS connectivity or agentless SSH-based approach in not always such a good thing as it looks in marketing presentations ;-). Much depends on the number of nodes. One hundred SSL connections per minute is a "slum dunk", but 1K SSL connections per minute is  not easy to accommodate.
    

4. Broad platform coverage should include AIX 5.3 and 6.1, HP-UX 11, Solaris 9 and 10, RHEL 4 and 5 and SLES 10.  Large organization often have all flavor Unix in existence and if not buying a couple of companies is just one step to bringing unsuspecting IT public to this situation :-). 
    

5. Quality of tech support. That's a very important metric. You can say dirty things about tech. quality of Tivoli product line all day long but they are by and large compensated by really high level of tech support that IBM provides. In this sense you might think specifically about "low ball" offerings" as it is difficult from a small revenue stream to fund really excellent 24*7 tech support desk. Some medium size developers of ESM products solve this problem by allowing to escalate complex  tickets to developers and that is preferable solution.
    

6. Price competitiveness with Tivoli on 10 year basis (total cost of ownership can be approximated as

   1.2*initial_license_cost + 2*esimated_transition_costs + 10*annual_maintenance_costs

   Please note that people often underestimate transition costs by factor of 3 or more. That's why I doubled it in the equation above .  Also even in cases were organization has bought complete junk it is difficult to get rid of it in less then five years (or a major acquisition). That's why maintenance costs has factor 10 in the equation above.  That means that the ability to negotiate a stable cost of maintenance into the contract should be an important consideration (at least the ability to break contact, if cost of maintenance exceeds certain threshold).
    

7. Scripting friendliness, specifically "admin friendly" handling of custom Perl probes.
    

8. Level of integration between scheduler and monitoring (that might add to the cost of transition if it requires services of a professional services organization to create such a bridge)
    

9. Extensibility of  dashboard  (nothing fancy; simple ability to tune triggers, etc)
    

10. Presence of flexible event console (dashboard are not enough). Ability to launch custom, event specific scripts from the even console.
     

11. Simplicity of administration; uniformity of components across the product line (unlike suits of products that were the result of multiple acquisitions like Netcool-Omnibus-classic Tivoli combo that IBM now sells).
     

12. Programmable correlation (in memory SQL-based is OK, See   Event Correlation Technologies)
     

13. Strong Unix-monitoring bias. Universal agent based products are preferable to agentless solutions although ssh based solution might be considered.
     

14. Ability to process Unix syslog and extract alerts from logs (either locally or via central syslog server).
     

15. Good integration with your backup solution.
     

16. Some level of "knowledge integration" via event archive or external connection to helpdesk  software

Another problem is IBM hype. When IT is supporting a vital business service and problems occurs without ESM products there is no clear feedback for those in charge of those business services as for to why that has occurred. Businesses want both value and predictability from IT.  Traditional PR-staff  used by IBM such as 'five 9s availability' don't mean very much to any intelligent IT manager.  He understands that this is a myth and he starts to distrust the company and its products.  

Another myth is the importance of "real time" correlation (Netcool advertisement campaign against IBM was actually based on this claim; paradoxically it actually worked pretty well for them in a long run :-).  First of all not all correlation is created equal: pre-filtering (duplicates removal, etc) can really be done at very high speeds by specialized software and "old" Tivoli actually provided this function on gateways. It was not widely used but that's another story.  More complex correlation does not need and usually does not benefit from tremendous speed. Also at very large organizations problems are regional in nature and that means that there is a hierarchical set of regional servers  reporting to central "super-server". Each regional server can be specialized to particular environment and have tuned for the environment set of correlation rules, as problems in Asia are usually different that problems in North America.  A dozen events per second is actually an adequate speed for pretty large enterprises. Moreover higher speed can be  a sign of deficient architecture (as in Netcool's single level correlation engine) and as such is more of a warning sign then an advantage. 

Proliferation of ESM systems signals a fundamental change in the way that the IT systems management function is structured in large enterprises and moves large part of administration and management outside single OS framework (some Unix distributions, for example Suse 11 actually contain server based monitoring package  -- Nagios 3.0 in  case of Suse).  While traditionally systems have been managed along technology lines - with different groups for PCs, servers, networks, databases, ESM provides an opportunity to view them more along functional lines. For example, subset of systems serving to SAP/R3 usually includes both servers, networking equipment and PCs.  For business owner it does not matter whether the problem is with networking or with the server: all he sees is that order take too slow to enter and the system is sluggish.  and that created the question of integration of event streams from the appropriate subset of events and correlation between them The large systems management vendors certainly see the potential for additional revenue here. BMC Software, Mercury Interactive, Hewlett-Packard, IBM, and Computer Associates are all broadening their portfolios. But they tend to balkanize their line by trying to extract additional revenue and thus they are adding to existing over-complexity of their products. 

From another point of view vertical integration means that the loop is not complete unless the helpdesk desk software is tied in, so that problems are managed, diagnosed, prioritized and later analyzed based of stored history to avoid reoccurrences. In this sense absence of strong links between Tivoli and helpdesk software is a problem for IBM that definitely can be exploited by competitors. 

This "overcomplexity trap" does provide a breezing space for smaller more nibble players, who can better utilize the recent advances both in hardware and technology and first of all scripting languages and HTTP protocol. Also it usually takes at least a decade for the technology to mature and that means that ESM systems are no longer  young (first ESM systems can into being around 1996) and  some consolidation and drops in pricing are on the agenda. 

The goal of ESM is to relate problem with end users to a particular part of IT infrastructure as quickly as and as precisely as possible is still illusive. It's still difficult to pinpoint real problem behind symptoms but at least the view of symptoms can now be well organized and monitored in real time. Especially difficult are to pinpoint the problems that directly impart performance. So for enterprise it is important to know were to stop and not to overpay for unrealistic claims about products or services promoted by "slick suits" who does not understand the technology they are pushing, but understand very well the weaknesses of IT management ;-).

Dr. Nikolai Bezroukov

NEWS CONTENTS

• 20100807 : Best Practices for IBM Tivoli Enterprise Console to Netcool/OMNIbus Upgrade ( Best Practices for IBM Tivoli Enterprise Console to Netcool/OMNIbus Upgrade, Aug 07, 2010 )
• 20100806 : OpenNMS beat HP OpenView and IBM Tivoli Joes Soap Box ( OpenNMS beat HP OpenView and IBM Tivoli Joe's Soap Box, Aug 06, 2010 )
• 20090412 : Augur ( Augur, Apr 12, 2009 )
• 20090412 : Rivermusings ( Rivermusings, )
• 20081121 : RiverMuse Emerging from Stealth Mode ( RiverMuse Emerging from Stealth Mode, Nov 21, 2008 )
• 20080310 : Gulf Breeze Blog SCEProlog - Prolog for the State Based Correlation Engine ( Gulf Breeze Blog SCEProlog - Prolog for the State Based Correlation Engine, Mar 10, 2008 )
• 20070214 : Monolith Software ( Monolith Software, Feb 14, 2007 )
• 20060417 : Investors seek network-management innovation - Network World by Cara Garretson ( Investors seek network-management innovation - Network World, Apr 17, 2006 )
• 20060417 : gartner_enterprise-event-mgmt-magic-quadrant ( gartner_enterprise-event-mgmt-magic-quadrant, )
• 20060417 : Magic Quadrant for Enterprise Event Management, 2003 Enterprise ... ( Magic Quadrant for Enterprise Event Management, 2003 Enterprise ..., )
• 20060417 : BMC overhauls management software ( )
• 20060417 : BMC Software Broadens Management Capabilities with Acquisition of IT Masters ( BMC Software Broadens Management Capabilities with Acquisition of IT Masters, )
• 20060417 : System and method of enterprise systems and business impact management - Patent 6983321 ( System and method of enterprise systems and business impact management - Patent 6983321, )
• 20030331 : BMC grabs IT Masters The Register ( BMC grabs IT Masters The Register, March 31, 2003 )
• 20021202 : MasterCell promises mastery over IT services by Dennis Drogseth ( MasterCell promises mastery over IT services, Dec 02, 2002 )

Old News ;-)

[Aug 07, 2010] Best Practices for IBM Tivoli Enterprise Console to Netcool/OMNIbus Upgrade

The acquisition of MicrHPOMse® Inc. brings new opportunities for all involved in IBM® Systems Management discipline, and the development of a new and exciting strategy.

This IBM Redbooks® publication should be used when planning and implementing an integration and upgrade strategy from TEC to OMNIbus. In this book we provide recommended best practices and describe strategies for upgrading existing installations in a way that should best suit the needs of existing TEC-based environments.

The audience for this book is anyone involved in the Systems Management discipline, but it applies primarily to both those with a Tivoli or Netcool background, and is aimed at customers with an existing Tivoli Enterprise Console® investment who are looking to evaluate the comparative characteristics of TEC and Netcool/OMNIbus™ , so that they can perform a system upgrade.

Depending on the complexity of the existing environment and the depth of the requirements, this upgrade could be a significant project, but we aim with this book to make it as straightforward and as successful as possible.

We have structured the book to first introduce a quick overview of the products, highlighting the key benefits of Netcool/OMNIbus so that both audiences can become familiar with the different concepts. Then the architectures of both products are discussed in more detail, concluding with some typical scenarios.

Part 2, "Strategies" on page101, reviews planning and strategy. It begins with detailed guidelines on assessing the existing customer environment in order to identify how TEC is currently deployed. We discuss considerations to make and how to plan the activities required to upgrade. Then different upgrade scenarios are presented with a best practice recommendation that the reader can adapt to his environment.

At this point we would like to stress that this book builds on the utilities provided by the Tivoli and Netcool Integration Event Flow package (downloadable from the IBM OPAL Web site), and the recommendations from the Tivoli & Netcool Event Flow Integration white paper. The main distinction is that they cover various event integration scenarios, whereas we, in addition, map out a complete upgrade path to OMNIbus in our recommended strategy.

The implementation of the suggested strategy is then covered in Chapter 2, "Configuring the event sources" on page277. We describe in detail the steps required to achieve the upgrade with the core components, and discuss other tasks to also keep in mind. A wide range of different rule processing examples are provided, giving comparative and practical guidance, providing a valuable asset for the rule programmer.

Finally, additional technical details on configurations and scripts used and other valuable references can be found in Appendix 2, "Lab configuration" on page367.

Table of contents

Part 1. Overview
Chapter 1. Introduction
Chapter 2. Architecture
Part 2. Strategies
Chapter 3. TEC environmental assessment and planning guidelines
Chapter 4. Upgrade strategies
Part 3. Implementation
Chapter 5. Upgrading to an IBM Tivoli Netcool environment
Chapter 6. Event processing
Chapter 7. Configuring the event sources
Appendix A. Lab configuration
Appendix B. Additional material

[Aug 06, 2010] OpenNMS beat HP OpenView and IBM Tivoli Joe's Soap Box

Mar 07, 2007 | Joe's Soap Box

Noticed that OpenNMS, an opensource systems management software is the winner of the Search Networking - Product Leadership Awards 2007 for Network and IT management platforms.

I am impressed because they managed to beat HP (OpenView) and IBM (Tivoli). Pretty neat for an opensource product.

[Apr 14, 2009] Event Correlation Server (ECS) Security Download PC World

Jan 13, 2006 | PC World

Description of Event Correlation Server (ECS)

The Event Correlation Server (ECS) is a Network Security Management platform that receives events as inputs from many different sources and management protocols, processes them through complex correlation filters, and forwards them to outbound destinations, such as network and security management consoles. ECS enables OEMs, VARs, and end-users to quickly develop event correlation solutions, and sell them as separate value-added products. EventGnosis ECS is a security information management server application, which performs real-time event correlation, event aggregation and archiving, protocol conversion and transaction validation, forensic and transaction data analysis, as well as audit and accountability management. Network Security Management (also known as Security Information Management or Security Event Management) is an emerging market for applications, which analyse separate events from different application sources and devices, and forwards the results to other management systems. The examples of network security applications that are used as the sources of EventGnosis ECS are firewalls, virus checkers, intrusion detection systems, web services (e.g. transactions between businesses using XML and SOAP data encoding), and other network and security applications. EventGnosis ECS is the industry standard Event Management Markup Language (EMML) development environment for designing, editing and debugging enterprise class real-time event correlation applications involving network and security software systems, business applications, physical and electronic security systems, financial trading systems, environmental systems, classified systems, and fraud avoidance systems. EventGnosis Inc. promotes and sells third party software solutions powered by EventGnosis ECS, through its web site www.eventgnosis.com, as the value-added security event management products for ECS.

[Apr 12, 2009] Augur Systems Event Manager Compare Tivoli-Netcool

Netcool Relational Database

Netcool uses a (mostly) standard SQL database. Netcool rules scripts update fields in this database. Triggers and Impact policies also interact with this database.

Pro: Databases provide uniform access. Netcool users can write Perl scripts to interact with the database (although this is unsupported). You can extend the database schema to add your own fields for implementing complex rules.

Con: Database field sizes are limited, so data may be truncated. Basic, intermediate, and advanced customizations require DB Admin skills.

Netcool Rule Scripts

Netcool uses a script language to parse events for generating/clearing alerts in the Omnibus database. A rule script is essentially a large if/then/else structure, with parsed variables. Scripts can be broken into "include" files. "Lookup" files for variable replacement are supported too.

Pro: Scripts are comfortable for experts to edit, and foster programatic tools like "m2r" (MIB to rules). An IDE helps with syntax checking, etc. There is a large library of existing rule scripts, although they may need customization for your needs.

Con: As the scripts get long, they can be difficult to maintain and debug. Maintenance may require a full-time expert. Rule sets may require additional fees. Rule script files are difficult to delegate to multiple subject matter experts for administration. Events that clear alerts may need to reference built-in or custom database fields (e.g. "class"), which can be difficult to document. Lookups are limited to text files.

... ... ...

Netcool Administration

Netcool is configured via a combination of files and GUIs.

Pro:File editing is comfortable for Unix admins.

Con: Limited ability to delegate configuration duties. Changes may require 'kill -HUP' command line signals or restarts. Limited support for multiple administrators or simultaneous editing.

[Apr 12, 2009] Augur

This is a Java based system. Live DB is proprietary. See a good write-up of differences with Netcool in Augur Systems Event Manager Compare Tivoli-Netcool

Event Management

Augur simultaneously collects and analyzes log entries, SNMP traps, application output, and proprietary protocols too. The graphical rule engine processes events streams using your business rules, and then generates or clears root-cause alerts.

De-duplication, prioritization, and thresholding tools are all built in. Plug-ins add data enrichment, external integrations, and any other customizations.

We tried to provide the flexibility of a "framework" system, with thoughtful features to make common tasks easier. We think it's a reasonable balance of power and ease.

Unified View

Alerts from all sources are automatically aggregated together and filtered according to your role-based configurations. So you see just what you want, and your personnel see just what they need.

Workforce Dispatching

A full-featured paging notification system frees users from a screen so they can multi-task from anywhere. The automation of workforce dispatching ensures consistent accountability, which ultimately benefits your service. Fine-grained controls notify the right personnel based on alert type, location, schedule, and your business rules.

Enterprise-Class

In addition to Augur's role-based access controls, its configuration is also secured by fine-grained permissions. So you can safely share or delegate administration roles to trusted individuals or groups across your company.

When deployed as a distributed network, the cluster delivers the same views and configuration as if it were all one Augur, but with expandable capacity and the safety of network/geographic diversity. The configuration database itself is a fault-tolerant high-availability pair that provide three tiers of protection.

Rivermusings

IT Operations Management

Posted: January 30th, 2009 | Author: Phil Blades | Filed under: Market, Uncategorized | Tags: configuration, enterprise event consoles, FCAPS, IT Operations, ITIL, ITOM. Service Management, network monitoring tools, service desk solutions, Technology Innovation | No Comments "

IT Operations Management (ITOM) has become a major industry since the development of the first SNMP management systems and event consolidation alerting tools in the late 1980's. Originally ITOM was solely the domain of technology in the guise of fault monitoring systems. However over the last 20 years the realm has expanded across Fault, Configuration, Accounting, Performance and Security (FCAPS) to offer a whole of IT Infrastructure suite of management technologies, and then with the proliferation of the adoption of IT Infrastructure Library (ITIL) process guidelines, the IT department has been given IT Service Management (ITSM), the integration of ITIL Process guidelines and ITOM technology platforms to increase the levels of service from their IT Infrastructures.

The practice of ITSM by the management of IT Operations is devoted solely to reducing the cost of managing their IT infrastructures, and cost savings can be demonstrated on paper through the deployment of FCAPS technologies in conjunction with Processes following ITIL guidelines. In 2007, according to Gartner Group, greater than 85% of medium and large enterprise companies have embraced a commitment to implementing ITIL guidelines, and Network2 claims that in 2007 the global spend on network and systems management technology was over $10 Billion dollars.

Despite this global investment in defined processes and supporting technology, when Gartner Group surveyed their customer base at their Data Center conference in November 2007, the need to troubleshoot problems faster and prevent performance problems still came out as the top two issues. The reason troubleshooting problems faster and averting performance issues consistently rank at the top of CIOs wish list is simple to comprehend; the results of IT Infrastructure problems are transparent to their customers.

- NetworkWorld reported that 82% of network problems are identified through users complaining about application performance.

- Apparent Networks demonstrated in their testing that 38% of 20,000 helpdesk issues showed that network issues translated directly to application issue calls.

- Telus Corporation even admitted that 78% of network problems are beyond their control [with today's IT Operations Management technologies].

So, for an enterprise, the ability to change the perception of their customers by fixing problems sooner and providing more consistent application performance is paramount. This is the domain of the Fault Management technology platform. When a problem occurs, there is a corresponding impact upon the customers' business operations. That impact carries a cost which is both measurable and real.

The cost of impact to each customer can be attributed to the time taken to resolve the problem. Therefore, if one can resolve the problem more quickly, one can reduce the impact and associated cost of the problem. Problem management has four clear phases:

(i) IT Infrastructure State Changes; the circumstances leading to the problem
(ii) Problem Identification; the knowledge that there is a problem
(iii) Problem Isolation; the isolation of the Root Cause, and
(iv) Problem Resolution; the return to normal operations

There is a fifth phase too which is Problem Impact; the ability to understand what Services and which Customers are impacted by the problem, but this is not the directly impact the cost of a problem to a business, just allows the measurement of the cost, and would allow prioritization of the fault management process – i.e. focus resources on one problem over another. The more quickly the IT Operations team can resolve a problem, the better the perception by their customer.

The application of automation to accelerate the problem identification and isolation process reduces the total time taken to resolve the problem, thereby reducing the cost of the impact of the problem, and so, Fault Management technology, in the form of Event Consolidation, Correlation and Root-Cause Analysis (RCA) solutions represent the major spend in an IT Operations Management budget.

Business, both Telecom and Enterprise, have employed an array of automation technologies to help identify problems sooner, isolate the root cause, and align problem management processes to reduce the time to resolve the issues which include:

- Network monitoring tools;

• HP OpenView Network Node Manager
• Tivoli Netcool Precision
• EMC SMARTS
• BMC Patrol

- Enterprise Event Consoles;

• Tivoli Netcool Omnibus
• HP OpenView Operations
• BMC Enterprise Manager, and

- Service Desk solutions;

• HP OpenView ServiceDesk & ServiceCenter
• BMC Remedy
• IBM MRO

All of these technologies conceived, designed and, developed in the late 1980's and early 1990's however still represent the pinnacle of IT Service Management technology innovation and expertize today. In fact, they now represent huge industries in themselves, with a whole supply chain evolved for the design, implementation, configuration and lifecycle maintenance of each tool.

Yet despite the investment in these tools and technologies, the ability for IT Operations Management to resolve problems faster has not eventualized. In fact, the cost of Problem Impact is the same today as it was in the 1990's.

[Nov 21, 2008] RiverMuse Emerging from Stealth Mode by doug

See also Initial presentation at OSS Professionals

Event Processing - dougmcclure.net

This open source start up is unveiling their exciting message and pre-release web site for what could be an industry changing tipping point that firmly places open source as a viable alternative to the "Big4″ and the "Other 6″ within any sized company in any industry.

RiverMuse has launched their website and has plans for initial software availability in early November. RiverMuse (Riversoft and MicrHPOMse) is the brainchild of the founders of the MicrHPOMse and the industry recognized Netcool/OMNIbus solution.

• Chief Science Officer: Philip Tee – Co-Founder of MicrHPOMse/CTO, Founder of RiverSoft/CTO & Chairman, Early software designer Avantgarde (Boole & Babbage/BMC Event Manager)
• Chief Technology Officer: Predrag [Fred] Mutavdzic – Architect Netcool Mediation Technologies, MicrHPOMse
• Executive Director: Mike Silvey – Co-Founder of MicrHPOMse/SVP Marketing and Business Development, VP Business Development and Marketing at RiverSoft.

Here's a snip from their website - clearly positioning their product at those who've made significant investments in or are considering Netcool/OMNIbus technology with promises of a brighter future, improved architecture and a roadmap that if delivered would easily place this open source alternative in the leader's quadrant of any analyst's market assessment.

Their plans for putting the administrators first is AWESOME. They get the Total Cost of Ownership (TCO) issue with the Big4 and Other6. They're putting that first OVER any current buzzword bingo (ITIL, ISM, SOA, Green, and yes even BSM - Mike and I need to have more heart to heart talks on that!). Run the numbers in any decent sized monitoring shop and look at the staff and maintenance costs (HW and SW) and you'll see that something has to be done in the next decade of IT management and monitoring. Do more with less, smarter, cheaper (free) tools, products and solutions as a competitive differentiator (and job security).

That is, if they can deliver. Some that I've talked to advised me that "they'd believe it when they see it". I spoke with Mike a couple months back and took away the sense of a solid vision and plan to execute against. I'd love to hear about some big wins, replacements or other success (benchmarks against Netcool/OMNIbus, OpenNMS, HPOV, EMC/SMARTS, BMC, etc.). I've signed up for the software and look forward to kicking the tires!

RiverMuse for IBM Tivoli Netcool Owners

(IBM Tivoli Netcool Omnibus / MicrHPOMse Netcool Omnibus, Cisco InfoCenter)

What a great product – we think so, we originally conceived, designed and built Netcool as an antidote to the offerings of the day. However, we never finished it and, neither did the people who inherited MicrHPOMse after we left, nor have [or will] IBM. The issue is Netcool's discombobulated configuration methods that lead to an ownership Tax on you, the customer.

Although Netcool is undoubtedly the best-of-the-best Legacy Event Management system, having invented:

* the Exclusive event paradigm
* automatic repeat filtering 'de-duplication'
* drag and drop correlation, and
* simplified event enrichment

Netcool hobbles around on a major Achilles Heel. Namely, the more filtering and correlation, the more embedded complexity in the platform since Netcool has three different configuration programming languages that have no configuration integrity. Consequently, the more you use Netcool the higher the Total Cost of Ownership gets.

RiverMuse offers the same out of the box functionality as Netcool, however with a thoroughly modern architecture, configuration is easier to perform and maintain offering a significantly lower total cost of ownership. Oh, and did we tell you the core RiverMuse FreeCool is free?

RiverMuse will gradually introduce migration tools for Netcool customers, initially we'll enable our customers to consuming Netcool Probe events, and in the future, RiverMuse will launch a 'Netcool Configuration Conversion' tool to simplify migrations of Probe Rules and ObjectServer Triggers and Actions.

[Mar 10, 2008] Gulf Breeze Blog SCEProlog - Prolog for the State Based Correlation Engine

A new release of OpenESM for Prolog (V1.1) is now available at Sourceforge. This new release includes a Prolog engine for the TEC 3.9 State Based Correlation Engine (SCE).

You can download the new release at:

http://sourceforge.net/projects/gulfsoft

Here are some notes from the Readme:

SCEProlog - Prolog for the State Based Correlation Engine

This library implements a Prolog environment as a State Based Correlation Engine custom action. Why would you want to use Prolog at the TEC Gateway or adapter level? Firstly, a Prolog environment would allow you to leverage most of your existing Prolog facts and logic that enrich events before true event correlation. Secondly, the Prolog language provides a flexible and powerful language to manipulate event objects. Finally, since Prolog is the base language for the TEC rule language, it is familiar to every seasoned TEC rule writers.

The underlying Prolog implementation for SCEProlog is GNU Prolog for Java (http://gnuprologjava.sourceforge.net/) by Constantine A. Plotnikov. While this project seems stagnant, I found it the simplest to integrate with the State Based Correlation Engine. Included with this distribution is the gnuprolog.jar file. If you desire to see the source of the GNU Prolog for Java library it is available for download from the original project website.

The SCEProlog environment implements the most of the ISO standard with the following additional predicates:

BIM Prolog compatability:
lowertoupper(LowerAtom,UpperAtom)
inttoatom(Integer,Atom)
realtoatom(Real,Atom)
atomconcat(Atom1,Atom2,Concat)
atomconcat(AtomList,Concat)
append(List1,List2,ApendedList)
member(Element,List)
memberchk(Element,List)
erase(Key)
erase(Key1,Key2)
record(Key,Term)
record(Key1,Key2,Term)
recorded(Key,Term)
recorded(Key1,Key2,Term)
rerecord(Key,Term)
rerecord(Key1,Key2,Term)

State based Correlation Engine:
set_event_class(ClassName)
get_event_class(ClassName)
set_event_slot(SlotName,SlotValue)
get_event_slot(SlotName,SlotValue)
get_event_slot(SlotName,SlotValue,DefualtValueIfNotSet)
delete_event_slots(SlotNameList)
discard_event
forward_event(SCE_RuleName_List)
get_rule_id(SCE_RuleId)
get_rule_variable(SCE_VariableName,VariabeValue)

IP Address Name Resolution:
get_hostname(IPAddress_or_Name,Hostname)
get_ipaddress(Hostname,IPAddress)
get_local_hostname(LocalHostname)
get_local_ipaddress(LocalIPAddress)
get_canonical_hostname(IPAddress_or_Name,CanonicalHostname)

Regular Expressions:
regex_create(RegexID,Pattern)
regex_create(RegexID,Pattern,RegexFlagList)
valid RegexFlag values:
canon_eq,
case_insensitive,
comments,
dotall,
multiline,
unicode_case,
unix_lines
regex_exists(RegexID)
regex_match(RegexID,Atom)
regex_match(RegexID,Atom,GroupMatchList)
regex_replace(RegexID,Atom,Replacement,Result)

Misc. Utilities:
get_system_property(JavaSystemProperty,PropertyValue)

You can see the rest of the notes in the readme that is part of the gb_08MAR2006.zip file

[Feb 14, 2007] Monolith Software

Monolith Software understands that you've had your MicrHPOMse system for a while. We also understand that the process of migrating platforms may raise some anxiety. Monolith Software is the first legitimate solution that can not only replace Netcool Omnibus, but also improve upon its functionality. Until now your options have been limited and those that have positioned a replacement are dictating a whole new methodology and approach to your operations process (i.e. SMARTS).

Monolith Event Manager does not change the way your operations group works. The system has been designed to work with your existing processes and procedures. We have tools to help our customers migrate their existing rules and scripts thereby ensuring not only a seamless transition, but also reuse of your existing intellectual capital.

Top Reasons You'll Love our Solution

• 100% Browser Based with No Plug-ins (java or active x) - Say Goodbye to JRE for Good
• Significantly Lower Costs with Unlimited Client Licensing / Unlimited Device Licensing
• Leverages AJAX - Quicker Response than Webtop
• Rules are Perl Syntax versus 'Perl Like' - Lowers Development and Maintenance Costs
• Industries first 'Available Source Licensing Mode' - Protecting your future and Allowing Extensibility

If your maintenance renewal is approaching or if you are looking for a solution that addresses many of Netcool's shortcomings, then we'd encourage you to take a look at Monolith. Innovation is alive and well in the management space. Ask us about our special promotion for Netcool Migrations.

[Apr 17, 2006] Investors seek network-management innovation - Network World By Cara Garretson

April 17, 2006 (Network World) Special Focus: Start-ups seeking to challenge the dominance of complex network management suites draw rounds of funding.

Start-up companies looking to challenge the dominance enjoyed by expensive, complex network-management suites are attracting second and third rounds of funding from venture capitalists eager to get in on the next big thing.

In particular, investors are putting money into companies with network-monitoring and -troubleshooting products that are attracting customers who want to care for their networks without the cost and dedicated staff demanded by CA's Unicenter, IBM's Tivoli and HP's OpenView - typically considered the leading products in this market.

Start-ups Cittio, Splunk and GroundWork Open Source Solutions have received a combined $35 million in the past 13 months, and a fourth company called LogLogic says it will soon announce a third round of investment, following the $13 million it received in September 2004 (see graphic). Attracting investors to companies such as these is the promise of a new generation of network-management tools that may be innovative and nimble enough to eventually supplant the incumbent.

Importance of solid net management

Broadly defined, network management is a $3.5 billion market, says Benjamin Nye, managing director of venture capital with Bain Capital in Boston. As networks become more distributed physically and populated with devices, network management is more important than ever, he says.

"Think about the distributed organization today; it's the norm, not the exception," Nye says. "Whether you're big or small, if you're running a mission-critical network, look at how many different devices are resident on the network. . . . There's much more dependency that rides on that network."

In February 2005, Bain invested $12 million in Network Intelligence, which sells software that monitors and reports on network events for security and compliance purposes.

Managing the increased complexity in the network calls for a new breed of simpler, sleeker tools, some investors say.

Despite his extensive background in network management, Marc Sokol, CA's former vice president of marketing and now a partner at venture capital firm JK&B Capital in Chicago, waited six years before investing in a network-monitoring start-up.

"It's because the big guys - Unicenter, Tivoli and OpenView - commanded such market control," he says. "But today there's a large market of customers that for lots of different reasons consider the Big Three not to be options - either the license fee priced them out of the market, or the cost of implementation or the customer just didn't need all those features."

At the end of March, JK&B invested $8 million in Cittio, maker of network-monitoring and -operations software called WatchTower. In January, the firm invested $10 million in Splunk, which creates a search engine that helps troubleshoot systems by navigating through the logs they create. Sokol has taken a seat on the board of directors of both companies.

Cittio breaks out of the traditional network-management mold by offering a critical management function, monitoring, that's relatively inexpensive and easily integrates with third-party products, Sokol says.

"I think there's now a need for disintegration among [network-management components]," Sokol says. "Because of new service-oriented architectures and the [Asynchronous JavaScript + XML] user interface, you can get the benefits of integration without having to sell an all-in-one product."

A streamlined approach

While Cittio and other companies offer more streamlined approaches to network monitoring, enterprises are usually hesitant to bet on products from start-ups, especially for a task as crucial as keeping the network running.

"That's always going to be the challenge" for start-ups, says James Governor, principal analyst with RedMonk. To get around this hurdle, start-ups need to partner with bigger vendors that can introduce them to customers and, to some extent, vouch for them. Or, as in Cittio's case, they need to focus on one aspect of a larger market.

"Cittio has very explicitly stated they don't offer all the functions that larger vendors offer, but they're trying to define a sweet spot," Governor says.

Some organizations are willing to take their chances with products from start-ups to get the features they need at an affordable price.

The National Parks Conservation Association chose Cittio's WatchTower network-monitoring tool so the IT department can find trouble spots on the network, says Caterina Luppi, the nonprofit organization's IT director.

"We didn't have anything before, and that created a number of problems," Luppi says. "The users were being our alarm system; we were finding out something wasn't working, because there was a user complaining."

The Washington, D.C.-based organization, which has about 85 users on its network, uses IT products from a diverse group of vendors; Luppi chose Cittio's WatchTower because it gives the LAN administrator a single point from which to monitor them all.

Cittio's tool also is relatively inexpensive, an important consideration for a nonprofit group, she says. According to company officials, WatchTower is priced at between $200 and $400 per node, depending on number of nodes managed.

"The big network-management suites were totally out of our budget, and I don't have the manpower to use 100% of their features," Luppi says. "That would be like buying a truck and using it as a bike."

Other network-monitoring and -troubleshooting tools from relative newcomers also are making inroads.

Splunk, which approaches network management by helping IT staff find the proverbial needle in a haystack, says 35,000 people have downloaded its search engine since it launched in August 2005. The company's Splunk Professional search software filters through all the logs and other data generated by IT systems, devices and applications so problems can be found and fixed faster, according to the company. It is priced at $2,500 for an annual license.

LogLogic also attempts to enhance network troubleshooting by capturing logs from all of a corporation's hardware and software in what it calls a log-management intelligence platform. Delivered as an appliance, LogLogic lets customers analyze, store, generate reports on data for compliance and risk mitigation, company officials say. The LogLogic Compliance Suite starts at $10,000.

Log data more relevant

While he doesn't see log management falling under the definition of network management, RedMonk's Governor says companies such as LogLogic, Splunk and others are making log data more relevant for network managers.

"Network management tends to be real time; log management is after the fact - it's more about looking at what happened and analyzing that," Governor says. "These companies are making log management more of a real-time function, and then it becomes more valuable. It's moving from being a subset of security management to more of an application-management function."

Another company, GroundWork Open Source Solutions, is positioning its IT monitoring tool as costing a fraction of what commercial products go for. GroundWork Monitor Professional, based on open source components, including Nagios, RRDTool and MySQL, gives customers a central point for monitoring applications, databases, servers and network equipment, officials say.

GroundWork Monitor Professional costs about $16,000 for an annual subscription and is installed at "hundreds of enterprises," according to company officials.

gartner_enterprise-event-mgmt-magic-quadrant

[PDF] Magic Quadrant for Enterprise Event Management, 2003 Enterprise ...

You should not generally believe Gartner :-)

BMC overhauls management software

By Denise Dubie, Network World, 05/23/05

At management software vendor BMC, these days it's all about streamlining.

The company last month said it is shedding 12% of its staff to tighten expenses in the face of disappointing revenue. And this month BMC says it is revamping its product line, consolidating previously separate software packages and simplifying licensing.

The company this year and next will eliminate the Patrol brand it has touted since acquiring the system management technology in 1994 and reinvent its product portfolio under the moniker Performance Manager. Among the new offerings planned is Performance Manager for Servers, a combination of Patrol for Unix and Patrol for Windows.

The changes won't be in name alone. BMC has redesigned its core software so customers get agent-based and agentless products under the same license. Previously, customers needed to buy agent-based Patrol and agentless Patrol Express separately.

Products within the Performance Manager line also will share a database, a console for configuration and provisioning, and a user interface for reporting.

"The trend right now among management vendors is to fix all the installation, integration and performance problems in their existing tools and supplement them with features to help IT managers get a consistent way to measure performance and availability across their network infrastructure, security and applications," says George Hamilton, a senior analyst at The Yankee Group.

Industry watchers say BMC needed to do something to breathe life into its $1.4-billion business. It announced last month that preliminary revenue estimates for the fourth quarter of its fiscal year 2005, ended March 31, would fall below expectations, at $388 million to $400 million, down from the previous forecast of $410 million to $425 million. BMC cited customers' delayed spending as a reason for the lower revenue.

"BMC, and in particular Computer Associates, this year really have to prove they are going to deliver on their product plans to customers to maintain their installed bases," Hamilton adds.

That includes sorting out and integrating technologies acquired from Calendra, Marimba and OpenNetwork to fill out its long-term business service management strategy. BMC has named Tom Bishop, formerly with Vieo and Tivoli, to lead its technology direction as CTO.

"It's important BMC streamline it's technology because management tools can be expensive, and it needs to keep its customers as the market is going to continue to consolidate," says Lance Travis, a vice president with AMR Research. "The redesigned Patrol will also better serve the company's bigger plans of [business service management] in the long term."

In an attempt to make its software more attractive, BMC is focusing on basics, such as easing installation.

Performance Manager, using provisioning technology BMC acquired via Marimba last July, will distribute agents only to servers that require higher-level management and will do so automatically based on customer configurations. Patrol depended on centralized server software, and required an agent be installed on every managed server to deliver on its performance and availability-management promises. Patrol Express was designed without agents to help customers remotely manage systems at branch offices.

BMC customer Marc Machin, senior systems engineer at Lender's Service in Santa Ana, Calif., says he's looking forward to the upcoming changes.

"Anything that could lighten the footprint of management software on a machine would be welcome," says Machin, who maintains six consoles for Patrol applications across a network of 150 Windows servers. "I'd still like an agent on certain servers to automatically take an action or react to an event, but there are more servers that don't need agents than there are ones that do."

In June, BMC says it will start to offer its single-license model to customers under the new brand, and in December the company expects to start shipping new products with the architecture.

All contents copyright 1995-2005 Network World, Inc. http://www.networkworld.com BMC Revs Management Tool
August 18, 2003
By Paula Musich

BMC Software Inc. this week will launch the MasterCell technology it acquired last April with the acquisition of IT Masters Inc. under a new moniker and with further integration into BMC's management tools.

The Houston company's new Service Impact Manager, which automatically links IT assets with the business services they support, detects changes in the status of those assets and communicates the impact of those changes to targeted users, according to Mark Levy, director of product management for BMC.

The updated software includes new integration with Patrol Enterprise Manager, allowing it to gather event data from BMC's Event Manager. It can also integrate with other event management systems, such as IBM's Tivoli Enterprise Console, and with BMC's Remedy trouble-ticketing system.

"The Patrol integration was enhanced to make it easier to integrate existing systems managed by Patrol," said Gary Davis, product manager for Service Impact Manager.

BMC split up the event management function in the original MasterCell tool to create a separate Event Manager, which will also be launched this week. Event Manager collects, processes and automates events from the IT infrastructure, automatically reducing redundant events. It displays results in user-customized views, based on roles and preferences, and feeds the results to Service Impact Manager to aid in prioritizing IT response to outages.

"It does let you see the relationship between a particular asset or a process ... and how events will affect other things because of those relationships," said John Siniawski, senior partner at Renovance LLP, in Chicago. "In the old days, you'd get a Tivoli alert, and it tells you the IP address of the problem but gives you no visualization of how it affects things."

Service Impact Manager is available now in a new service starter pack that includes the infrastructure, console and predefined service components for $80,000. Event Manager's pricing starts at $50,000.

BMC Software Broadens Management Capabilities with Acquisition of IT Masters

HOUSTON - (March 25, 2003) - BMC Software, Inc., [NYSE: BMC], a leader in enterprise management, today announced that it has acquired IT Masters International S.A., an enterprise management solutions company, for approximately $42 million. The acquisition further strengthens BMC Software's market leading Service Level Management solutions by adding adaptive service management capabilities to BMC Software's leading enterprise-wide offerings. The acquisition adds approximately 75 IT Masters employees to BMC Software.

IT Masters is a privately-held company with software development offices in Belgium and Austin, Texas. The company develops service management technology that allows customers to model and visualize IT infrastructure components correlated with the ultimate services being delivered. With this technology, IT organizations can prioritize their work according to their company's critical business needs. Specifically, customers can prioritize problem responses in a real-time, business-relevant manner by directly linking service delivery and support with IT infrastructure and application elements.

The acquisition of IT Masters enhances BMC Software's ability to provide best-in-class tools with an integrated service management approach. BMC Software's comprehensive enterprise management solutions combined with IT Masters' service modeling capabilities will enable customers to manage their business with a truly integrated service management approach.

IT Masters' flagship product is MasterCell^TM, an adaptive service management solution. The MasterCell technology will be a key element of BMC Software's service management strategy, providing the base platform for service impact management, real-time service modeling, root-cause analysis and service level agreement management. MasterCell is already integrated with BMC Software's PATROL^® for distributed systems. BMC Software's leading systems management solutions MAINVIEW^®, for mainframe systems, and INCONTROL^®, for batch scheduling and output management, as well as the Remedy IT Service Management products will be tightly integrated with the MasterCell technology in the future to extract key data from the enterprise. The information will be used to enhance MasterCell's adaptive service management capabilities so that the impact of all IT objects on real-time service delivery is easily understood by IT and business professionals.

In addition to MasterCell, IT Masters also delivers MasterAR Suite^TM, a suite of productivity tools that are integrated into the Remedy Action Request System^®, (AR System^®). AR System, an application platform and comprehensive development environment, was obtained by BMC Software as part of its acquisition of Remedy in November 2002.

"The acquisition of IT Masters and its leading service management solutions gives BMC a significant advantage in the industry and strengthens our ability to help our customers understand more fully how the performance and availability of IT technology impacts specific business services," said Mary Nugent, vice president and general manager, Service Management Solutions, BMC Software. "Knowing there is constant pressure on IT and business managers to reduce costs and target improvement efforts to areas that are critical to the business, companies need solutions that will help them understand where to focus. IT Masters' technology allows modeling of the relationships between elements of the business service so that service can be managed dynamically. This makes the customer's service management infrastructure more adaptable so that their business can change faster."

"We believe that this is the best strategic move for IT Masters and that the combination of both companies' strengths will greatly benefit our customers and the marketplace," said Philippe Moitroux, IT Masters President and CEO. "BMC Software's powerful enterprise-wide solutions coupled with our leading model-based approach, which can capture change information and discover changes in the environment, will not only allow customers to take control of their technology but more importantly allow them to move ahead and provide proactive service management."

About IT Masters
IT Masters is an enterprise management solutions company providing intelligent software solutions allowing companies to effectively manage their IT infrastructure and quickly analyze the impact technology has on their business. MasterCell™ is an adaptive service management solution that delivers cost effective, reliable and flexible event management via a highly scalable cellular architecture. IT Masters has offices in the United States and Europe. For more information, visit http://www.itmasters.com.

About BMC Software
BMC Software, Inc. [NYSE:BMC], is a leader in enterprise management. The company focuses on Assuring Business Availability^® for its customers by helping them proactively improve service, reduce costs and increase value to their business. BMC Software solutions span enterprise systems, applications and databases. Founded in 1980, BMC Software has offices worldwide and is a member of the S&P 500, with fiscal year 2002 revenues of approximately $1.3 billion. Visit www.bmc.com to learn more.

System and method of enterprise systems and business impact management - Patent 6983321

http://www.freepatentsonline.com/6983321.html Abstract:
A system architecture and a method for management using a cellular architecture to allow multi-tier management of events such as the managing of the actual impact or the potential impact of IT infrastructure situations on business services.

A preferred embodiment includes a high availability management backbone to frame monitoring operations using a cross-domain model where IT Component events are abstracted into IT Aggregate events.

By combining IT Aggregate events with transaction events, an operational representation of the business services is possible. Another feature is the ability to connect this information to dependent business user groups such as internal end-users or external customers for direct impact measurement.

A web of peer-to-peer rule-based cellular event processors preferably using Dynamic Data Association constitutes management backbone crossed by event flows, the execution of rules, and distributed set of dynamic inter-related object data rooted in the top data instances featuring the business services.

[March 31, 2003] BMC grabs IT Masters The Register

BMC Software has acquired IT Masters International S.A. and its 75 staff for around $42m, writes Tony Lock.

IT Masters supplies software management tools which assess the impact that technology has on business services. The company's principal offering, MasterCell, is an adaptive management tool that is used to model the effect that IT service level degradation will have on business processes. In effect the technology allows the effect of varying IT service delivery to be assessed, in real time, for its impact on real world business.

BMC is to incorporate MasterCell in its frontline service management offerings to improve its capability to supply service management, real-time service modelling, root cause analysis and service level management. BMC already has a head start with the assimilation of MasterCell as the technology is already integrated with the well-known BMC Patrol product line.

BMC will integrate MasterCell with its MainView mainframe management tool and INCONTROL, the company's batch scheduling and output management system. BMC also plans to integrate its new acquisitions with its Remedy IT Service Management product.

The purchase of IT Masters will also see its collection of productivity tools, MasterAR Suite, integrated with the Remedy Action Request System.

For the past year or so most major systems management software vendors have been looking for ways to enhance the value of their offerings. The so-called gang of four (BMC Patrol, CA UniCenter, HP OpenView and IBM/Tivoli) are all now capable of providing technology capable of monitoring and managing IT systems. However, until recently there was limited ability to assess the impact that different levels of IT service would have on the business itself; and it is this area that the suppliers have been actively working to improve.

Today business impact is the only reasonable measure against which IT service should be looking to be measured. If BMC can incorporate the IT Masters technology successfully into its core offerings the company has the potential to move forward significantly in the race to provide proactive service management to business customers.

It islikely than there will be many more acquisitions and mergers in the near future among management tools suppliers. ©
IT-Analysis.com

MasterCell Base Pack - 3.1.00 - mastercell documentation

Multi-National Food Conglomerate Converts to Remedy IT Service ...
Ahold USA Selects Remedy and IT Masters to Replace Tivoli Service Desk And Peregrine
... MasterCell, the company's flagship product, bridges the gap between ...
www.findwealth.com/ multi-national-food-conglomerate-converts-251888pr.html - 12k - Cached -

FTPOnline - N-Tier Is the New Frontier of IT Operations Management
Not to be outdone, IBM is on a multiyear mission to modernize its Tivoli product
... BMC's acquisitions of Remedy ITSM software and IT Masters' MasterCell ...
www.ftponline.com/special/ opsmgmt/overview/default_pf.asp - 32k - Cached - December 16, 2002 MasterCell 3.0 Highlights Services Trouble-Shooting

MasterCell 3.0 Highlights Services Trouble-Shooting Paula Musich
December 16, 2002

As more enterprises try to dissect system failures and performance problems, IT Masters Inc. is readying updated tools that can automatically show the impact of IT trouble on services and business processes.

The company's newest MasterCell product, Version 3.0, includes new services modeling functions that allow the status of services to be correlated with the availability and health of the IT infrastructure components that deliver those services, according to officials. The product was originally designed to be more scalable than traditional client/server-oriented ESM (enterprise systems management) frameworks or suites.

The IT organization at a large German bank, Postbank Systems AG, chose Master- Cell over IBM's Tivoli Enterprise Console because of its scalability and resilience. The tool also won out over BMC Software Inc.'s Patrol Event Manager and Computer Associates International Inc.'s Unicenter, according to Hans-Joachim von de Lieth, a project leader at Postbank, in Bonn.

"For the first time, we're able to see the relationship between different hardware and software components in one view, so we can decide what the business impact is of certain errors and prioritize problems," von de Lieth said. "If a key component of our hardware or software has a failure, we can instantly see if [an ATM or online banking interface] is affected."

MasterCell is made up of cells, or lightweight event processors, placed strategically across an enterprise IT infrastructure. The cells form a peer-to-peer network to share the processing load and results for events and information gathered from third-party elements. The P2P cell network allows information to be pushed to appropriate users.

MasterCell provides bidirectional integration with such ESM tools as Patrol, Tivoli Enterprise Manager and Tivoli Netview, Unicenter, and Hewlett-Packard Co.'s OpenView. It can gather SNMP events, Windows events and Unix system events.

MasterCell is also integrated with service desk systems such as Peregrine Systems Inc.'s ServiceCenter and BMC's Remedy Action Request system.

"We provide two-way interactions, so we can get information out of a third-party product and push information into it," said Jean-Marc Trinon, chief technology officer at IT Masters, in Brussels, Belgium. "That's important in describing the service provisioning."

MasterCell also adapts to changing environments. "Cells will automatically reassess what the business impact is when you change infrastructure or [service- level agreements]," said Trinon.

Despite the difficult IT spending environment, privately held IT Masters managed to increase its revenues by 30 percent in the third quarter-on top of 15 percent growth in the second. The 7-year-old company, which has 80 employees, says it has more than 1,000 customers.

[Dec 02, 2002] MasterCell promises mastery over IT servicesBy Dennis Drogseth

As many of you know, root-cause analysis and automated fault resolution have been an area of particular interest for me. It's sad to see that with the exception of SMARTS and a few other vendors, this market has struggled as much as it has.

Innovators are often discounted because of their small size and possible instability, even with worthwhile approaches. Of course, some products did not evolve quickly enough to survive the downturn. Small companies with visionary products not ready for showtime got hit hard.

With that in mind, it pleases me to focus this column on one of the more worthwhile innovators and something of a success story: IT Masters.

IT Masters' MasterCell deliberately stays away from "root-cause," which the company feels is too network-centric. Its own "roots" are in systems event automation, and so MasterCell's design point is unusual, well suited to large enterprises with other management investments seeking to rein in operational costs and to more effectively automate service availability across an infrastructure.

MasterCell adapts to adjustments in production-level environments and can export events to a relational database. But it doesn't yet do historical reporting, trending or analysis.

IT Masters has done an exceptionally good job of identifying critical "role players" who can profit from its capabilities. Each person gets a targeted set of reports and screens. These include operations center personnel seeking to manage infrastructure availability in real time, help desk personnel seeking superior support for service calls, service managers seeking a clear overview of real-time service availability, and "users" seeking visibility into contracted services (both within the enterprise and from external sources).

With headquarters both in Austin, Texas, and Brussels, Belgium, it's not surprising that IT Masters' customers are distributed across both continents, often in financial institutions, but MasterCell is also supporting a healthy mix of other enterprise verticals and service providers, as well.

IT Masters expects its customers to have other vendors' products and leverages those products in MasterCell. It is designed to tap data sources from Tivoli, BMC Patrol, HP OpenView, CA Unicenter, Peregrine ServiceCenter, Remedy ARS, and Dirig Fenway. It has custom adapters as well. The product also can import events directly through adapters for NT event logs, file log adapters for Unix or Windows platforms, and of course SNMP traps from network sources.

At the heart of MasterCell's design are flexible, lightweight event processors that can run on nondedicated hardware and can support up to 500 events per second. Every transaction is logged and then committed to local files, saving the need for an added relational database. This "cellular," peer-to-peer architecture enables failover - and prevents having a single point of failure. One drawback, which IT Masters recognizes, is that these event processors do not yet have a central point for automated distribution and installation.

On the other hand, IT Masters has a sophisticated and effective approach to user administration with its Configuration Server. The MasterCell Configuration Server can leverage Lightweight Directory Access Protocol to support user authentication, role-based security, user preferences and licensing.

IT Masters does not claim that MasterCell works "out of the box" - an admission which is, I suppose, refreshing. What MasterCell provides is an automated, adaptive environment for automation policies to function within (the Dynamic Data Model), so that rules can relate in plug-and-play fashion to a wide variety of environments or changes in environments, and so that they can be amended dynamically without shutting down the system. IT Masters also provides its own MasterCell Rules language, and a Graphical Configuration Editor - making developing rules more a "paint by the numbers" process than in more traditional event management systems.

MasterCell GUIs are effective and, as I indicated, targeted at specific user types. Those supporting administrators are flexible and easily navigated, but won't win any awards at the Whitney Biennial. On the other hand, the service views are strong graphical representations with easy drill-down, so that service failure interdependencies are easily and automatically viewable in real time.

MasterCell is a strong product for large enterprises seeking effective control of their services. Installations can range from $50,000 to $250,000, but then this is a strategic investment with significant operational and business advantages. If you're seeking control over infrastructure service availability beyond the network - and if you want to consolidate and enhance existing management investments - MasterCell should definitely be on your short list.

Recommended Links

Google matched content

Softpanorama Recommended

Top articles

Sites

Best Practices for IBM Tivoli Enterprise Console to Netcool/OMNIbus Upgrade

The acquisition of MicrHPOMse® Inc. brings new opportunities for all involved in IBM® Systems Management discipline, and the development of a new and exciting strategy.

This IBM Redbooks® publication should be used when planning and implementing an integration and upgrade strategy from TEC to OMNIbus. In this book we provide recommended best practices and describe strategies for upgrading existing installations in a way that should best suit the needs of existing TEC-based environments.

The audience for this book is anyone involved in the Systems Management discipline, but it applies primarily to both those with a Tivoli or Netcool background, and is aimed at customers with an existing Tivoli Enterprise Console® investment who are looking to evaluate the comparative characteristics of TEC and Netcool/OMNIbus™ , so that they can perform a system upgrade.

Depending on the complexity of the existing environment and the depth of the requirements, this upgrade could be a significant project, but we aim with this book to make it as straightforward and as successful as possible.

We have structured the book to first introduce a quick overview of the products, highlighting the key benefits of Netcool/OMNIbus so that both audiences can become familiar with the different concepts. Then the architectures of both products are discussed in more detail, concluding with some typical scenarios.

Part 2, "Strategies" on page101, reviews planning and strategy. It begins with detailed guidelines on assessing the existing customer environment in order to identify how TEC is currently deployed. We discuss considerations to make and how to plan the activities required to upgrade. Then different upgrade scenarios are presented with a best practice recommendation that the reader can adapt to his environment.

At this point we would like to stress that this book builds on the utilities provided by the Tivoli and Netcool Integration Event Flow package (downloadable from the IBM OPAL Web site), and the recommendations from the Tivoli & Netcool Event Flow Integration white paper. The main distinction is that they cover various event integration scenarios, whereas we, in addition, map out a complete upgrade path to OMNIbus in our recommended strategy.

The implementation of the suggested strategy is then covered in Chapter 2, "Configuring the event sources" on page277. We describe in detail the steps required to achieve the upgrade with the core components, and discuss other tasks to also keep in mind. A wide range of different rule processing examples are provided, giving comparative and practical guidance, providing a valuable asset for the rule programmer.

Finally, additional technical details on configurations and scripts used and other valuable references can be found in Appendix 2, "Lab configuration" on page367.

Table of contents

Part 1. Overview
Chapter 1. Introduction
Chapter 2. Architecture
Part 2. Strategies
Chapter 3. TEC environmental assessment and planning guidelines
Chapter 4. Upgrade strategies
Part 3. Implementation
Chapter 5. Upgrading to an IBM Tivoli Netcool environment
Chapter 6. Event processing
Chapter 7. Configuring the event sources
Appendix A. Lab configuration
Appendix B. Additional material

Event Correlation - Wikipedia, the free encyclopedia

Event Processing - dougmcclure.net

Open source network monitoring and management tools

Analyst Perspectives on Business Service Management (BSM) - Read analyst papers on the topic of BSM

White paper Understanding Business Service Management

BMC Positions Itself for Business Service Management BMC...

In addition to being used as a foundation for BMC's new BSM strategy, IT Masters' technology will breathe new life into BMC's event console product, Patrol Enterprise Manager (PEM), which was the former Command/Post product from BMC's acquisitionof Boole & Babbage.

Many BMC Patrol customers have not adopted PEM and simply use the more rudimentary PatrolConsole to monitor and view events. BMC will immediately integrate technology from MasterCell into PEM to improve event correlation, threshold analysis and alert escalation.

During the long term, BMC will re-architect PEM to improve event handling by replacing its REXX-based scripting engine with MasterCell'srule engine.

Gartner believes that, although future versions of PEM will maintain unique PEM functions, such as mainframe connectivity, MasterCell code will increasingly overtake PEM code in the product. Enterprises with a long-term commitment to BMC and PEM should demand early access to MasterCell as part of their PEM maintenance contract so they can familiarize themselves with the new base MasterCell technology and begin to plan their migration.

Although PEM gets a much-needed makeover, PEM customers will face costs in training on a new console view and migration to a new and compelling rule engine. Enterprises that own PEM and have not deployed it should ask for IT Masters MasterCell and begin their deployment with that instead. This may even result in cost savings because the deployment of Patrol Console as midlevel manager(s) may not be necessary with MasterCell because the MasterCell agent technology is able to do better local event suppression, filtering and low-levelautomation.IT Masters gets a safe exit from an intensively competitive event console market, dominated by big enterprise management suite vendors. IT Masters customers will benefit because theacquisition by BMC ensures future support and development of the MasterCell product.

BMC Software Broadens Management Capabilities with Acquisition of IT Masters BMC Software Broadens Management Capabilities with Acquisition of IT Masters. Service Modeling Solutions Enable Companies To View Impact of Their IT Organizations

HOUSTON - (March 25, 2003) - BMC Software, Inc. [NYSE: BMC], a leader in enterprise management, today announced that it has acquired IT Masters International S.A., an enterprise management solutions company, for approximately $42 million. The acquisition further strengthens BMC Software's market leading Service Level Management solutions by adding adaptive service management capabilities to BMC Software's leading enterprise-wide offerings. The acquisition adds approximately 75 IT Masters employees to BMC Software.

IT Masters is a privately-held company with software development offices in Belgium and Austin, Texas. The company develops service management technology that allows customers to model and visualize IT infrastructure components correlated with the ultimate services being delivered. With this technology, IT organizations can prioritize their work according to their company's critical business needs. Specifically, customers can prioritize problem responses in a real-time, business-relevant manner by directly linking service delivery and support with IT infrastructure and application elements.

The acquisition of IT Masters enhances BMC Software's ability to provide best-in-class tools with an integrated service management approach. BMC Software's comprehensive enterprise management solutions combined with IT Masters' service modeling capabilities will enable customers to manage their business with a truly integrated service management approach.

IT Masters' flagship product is MasterCell™, an adaptive service management solution. The MasterCell technology will be a key element of BMC Software's service management strategy, providing the base platform for service impact management, real-time service modeling, root-cause analysis and service level agreement management. MasterCell is already integrated with BMC Software's PATROL^® for distributed systems. BMC Software's leading systems management solutions MAINVIEW^®, for mainframe systems, and INCONTROL^®, for batch scheduling and output management, as well as the Remedy IT Service Management products will be tightly integrated with the MasterCell technology in the future to extract key data from the enterprise. The information will be used to enhance MasterCell's adaptive service management capabilities so that the impact of all IT objects on real-time service delivery is easily understood by IT and business professionals.

In addition to MasterCell, IT Masters also delivers MasterAR Suite™, a suite of productivity tools that are integrated into the Remedy Action Request System^®, (AR System^®). AR System, an application platform and comprehensive development environment, was obtained by BMC Software as part of its acquisition of Remedy in November 2002.

"The acquisition of IT Masters and its leading service management solutions gives BMC a significant advantage in the industry and strengthens our ability to help our customers understand more fully how the performance and availability of IT technology impacts specific business services," said Mary Nugent, vice president and general manager, Service Management Solutions, BMC Software. "Knowing there is constant pressure on IT and business managers to reduce costs and target improvement efforts to areas that are critical to the business, companies need solutions that will help them understand where to focus. IT Masters' technology allows modeling of the relationships between elements of the business service so that service can be managed dynamically. This makes the customer's service management infrastructure more adaptable so that their business can change faster."

"We believe that this is the best strategic move for IT Masters and that the combination of both companies' strengths will greatly benefit our customers and the marketplace," said Philippe Moitroux, IT Masters President and CEO. "BMC Software's powerful enterprise-wide solutions coupled with our leading model-based approach, which can capture change information and discover changes in the environment, will not only allow customers to take control of their technology but more importantly allow them to move ahead and provide proactive service management."

About IT Masters

IT Masters is an enterprise management solutions company providing intelligent software solutions allowing companies to effectively manage their IT infrastructure and quickly analyze the impact technology has on their business. MasterCell™ is an adaptive service management solution that delivers cost effective, reliable and flexible event management via a highly scalable cellular architecture. IT Masters has offices in the United States and Europe. For more information, visit http://www.itmasters.com

Remedi

• Downloads & Resources

Software Magazine Newsletter - Vol. 4, No. 2 MasterCell Provides Critical Resource Monitoring

There's a new kid on the block offering critical resource monitoring. MasterCell from IT Masters not only provides its own agent technology, but also manages that of other vendors, offering global, integrated monitoring of networks, systems, and applications. It delivers these event management services via a highly scalable cellular architecture, with a view to lowering operational costs, and providing more effective automation of service availability across the infrastructure.

Before MasterCell, customers couldn't get intelligence close enough to where the events were processed, notes Jim Duster, IT Masters' COO in North America. Now they have this intelligence at the business site. Duster attributes the localized intelligence to MasterCell's "cellular event processing architecture," whereby "little pieces of code [are] close to where the business is, and connected." You can't do this from a central place, says Duster, contrasting the product with other service-management software such as that from BMC, Computer Associates and Tivoli.

The MasterCell product components consist of the console, event processors, configuration server, knowledgebase editor, and event adapters. The console delivers the right information to the right people. MasterCell event processors model the availability of business and IT services, dynamically transforming raw event data from IT components into real-time knowledge about business services. The service management capabilities correlate raw events from IT components, and model the status of IT resources, SLAs, and business services, providing real-time adaptive service management.

The base pack for MasterCell costs $50,000 for the first environment - consisting of one geography and one business application. Because the product is cellular, companies can "hook [up] as they go." For example, a bank could first hook up its U.S. locations, and later link its European sites.

For more information, go to:
http://www.softwaremag.com/L.cfm?Doc=newsletter/2003-01-30#MasterCell

MasterCell promises mastery over IT services By Dennis Drogseth

12/02/02 | Network World Network/Systems Management Newsletter

As many of you know, root-cause analysis and automated fault resolution have been an area of particular interest for me. It's sad to see that with the exception of SMARTS and a few other vendors, this market has struggled as much as it has.

Innovators are often discounted because of their small size and possible instability, even with worthwhile approaches. Of course, some products did not evolve quickly enough to survive the downturn. Small companies with visionary products not ready for showtime got hit hard.

With that in mind, it pleases me to focus this column on one of the more worthwhile innovators and something of a success story: IT Masters.

IT Masters' MasterCell deliberately stays away from "root-cause," which the company feels is too network-centric. Its own "roots" are in systems event automation, and so MasterCell's design point is unusual, well suited to large enterprises with other management investments seeking to rein in operational costs and to more effectively automate service availability across an infrastructure.

MasterCell adapts to adjustments in production-level environments and can export events to a relational database. But it doesn't yet do historical reporting, trending or analysis.

IT Masters has done an exceptionally good job of identifying critical "role players" who can profit from its capabilities. Each person gets a targeted set of reports and screens. These include operations center personnel seeking to manage infrastructure availability in real time, help desk personnel seeking superior support for service calls, service managers seeking a clear overview of real-time service availability, and "users" seeking visibility into contracted services (both within the enterprise and from external sources).

With headquarters both in Austin, Texas, and Brussels, Belgium, it's not surprising that IT Masters' customers are distributed across both continents, often in financial institutions, but MasterCell is also supporting a healthy mix of other enterprise verticals and service providers, as well.

IT Masters expects its customers to have other vendors' products and leverages those products in MasterCell. It is designed to tap data sources from Tivoli, BMC Patrol, HP OpenView, CA Unicenter, Peregrine ServiceCenter, Remedy ARS, and Dirig Fenway. It has custom adapters as well. The product also can import events directly through adapters for NT event logs, file log adapters for Unix or Windows platforms, and of course SNMP traps from network sources.

At the heart of MasterCell's design are flexible, lightweight event processors that can run on nondedicated hardware and can support up to 500 events per second. Every transaction is logged and then committed to local files, saving the need for an added relational database. This "cellular," peer-to-peer architecture enables failover - and prevents having a single point of failure. One drawback, which IT Masters recognizes, is that these event processors do not yet have a central point for automated distribution and installation.

On the other hand, IT Masters has a sophisticated and effective approach to user administration with its Configuration Server. The MasterCell Configuration Server can leverage Lightweight Directory Access Protocol to support user authentication, role-based security, user preferences and licensing.

IT Masters does not claim that MasterCell works "out of the box" - an admission which is, I suppose, refreshing. What MasterCell provides is an automated, adaptive environment for automation policies to function within (the Dynamic Data Model), so that rules can relate in plug-and-play fashion to a wide variety of environments or changes in environments, and so that they can be amended dynamically without shutting down the system. IT Masters also provides its own MasterCell Rules language, and a Graphical Configuration Editor - making developing rules more a "paint by the numbers" process than in more traditional event management systems.

MasterCell GUIs are effective and, as I indicated, targeted at specific user types. Those supporting administrators are flexible and easily navigated, but won't win any awards at the Whitney Biennial. On the other hand, the service views are strong graphical representations with easy drill-down, so that service failure interdependencies are easily and automatically viewable in real time.

MasterCell is a strong product for large enterprises seeking effective control of their services. Installations can range from $50,000 to $250,000, but then this is a strategic investment with significant operational and business advantages. If you're seeking control over infrastructure service availability beyond the network - and if you want to consolidate and enhance existing management investments - MasterCell should definitely be on your short list.

Dennis Drogseth is a director with Enterprise Management Associates, a leading analyst and market research firm based in Boulder, Colorado, focusing exclusively on all aspects of enterprise management. Dennis has extensive experience in network management platforms and products and is researching trends in management software and changing IT roles internationally. His 18-plus years of experience in high-tech includes positions at IBM and Cabletron. He has been quoted in the press and is a speaker at industry events. He can be reached via e-mail.

Audrey Rasmussen is a research director with Enterprise Management Associates in Boulder, Colorado, a leading analyst and market research firm focusing exclusively on all aspects of enterprise management. Audrey has more than 20 years of experience working with distributed systems, applications and networks. Her current focus at EMA is e-business, SMB/SME and MSPs. She can be reached via e-mail.

Enterprise Management Associates in Boulder, Colorado, is a leading analyst and market research firm focusing exclusively on all aspects of enterprise management software and services.

As more enterprises try to dissect system failures and performance problems, IT Masters Inc. is readying updated tools that can automatically show the impact of IT trouble on services and business processes.

The company's newest MasterCell product, Version 3.0, includes new services modeling functions that allow the status of services to be correlated with the availability and health of the IT infrastructure components that deliver those services, according to officials. The product was originally designed to be more scalable than traditional client/server-oriented ESM (enterprise systems management) frameworks or suites.

The IT organization at a large German bank, Postbank Systems AG, chose Master- Cell over IBM's Tivoli Enterprise Console because of its scalability and resilience. The tool also won out over BMC Software Inc.'s Patrol Event Manager and Computer Associates International Inc.'s Unicenter, according to Hans-Joachim von de Lieth, a project leader at Postbank, in Bonn.

"For the first time, we're able to see the relationship between different hardware and software components in one view, so we can decide what the business impact is of certain errors and prioritize problems," von de Lieth said. "If a key component of our hardware or software has a failure, we can instantly see if [an ATM or online banking interface] is affected."

MasterCell is made up of cells, or lightweight event processors, placed strategically across an enterprise IT infrastructure. The cells form a peer-to-peer network to share the processing load and results for events and information gathered from third-party elements. The P2P cell network allows information to be pushed to appropriate users.

MasterCell provides bidirectional integration with such ESM tools as Patrol, Tivoli Enterprise Manager and Tivoli Netview, Unicenter, and Hewlett-Packard Co.'s OpenView. It can gather SNMP events, Windows events and Unix system events.

MasterCell is also integrated with service desk systems such as Peregrine Systems Inc.'s ServiceCenter and BMC's Remedy Action Request system.

"We provide two-way interactions, so we can get information out of a third-party product and push information into it," said Jean-Marc Trinon, chief technology officer at IT Masters, in Brussels, Belgium. "That's important in describing the service provisioning."

MasterCell also adapts to changing environments. "Cells will automatically reassess what the business impact is when you change infrastructure or [service- level agreements]," said Trinon.

Despite the difficult IT spending environment, privately held IT Masters managed to increase its revenues by 30 percent in the third quarter-on top of 15 percent growth in the second. The 7-year-old company, which has 80 employees, says it has more than 1,000 customers.

Copyright © 2002 Ziff Davis Media Inc. All Rights Reserved. Originally appearing in eWEEK.

---

---

Etc

Society

Groupthink : Two Party System as Polyarchy : Corruption of Regulators : Bureaucracies : Understanding Micromanagers and Control Freaks : Toxic Managers :   Harvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Neoliberalism  : The Iron Law of Oligarchy : Libertarian Philosophy

Quotes

War and Peace : Skeptical Finance : John Kenneth Galbraith :Talleyrand : Oscar Wilde : Otto Von Bismarck : Keynes : George Carlin : Skeptics : Propaganda  : SE quotes : Language Design and Programming Quotes : Random IT-related quotes :  Somerset Maugham : Marcus Aurelius : Kurt Vonnegut : Eric Hoffer : Winston Churchill : Napoleon Bonaparte : Ambrose Bierce :  Bernard Shaw : Mark Twain Quotes

Bulletin:

Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks The efficient markets hypothesis : Political Skeptic Bulletin, 2013 : Unemployment Bulletin, 2010 :  Vol 23, No.10 (October, 2011) An observation about corporate security departments : Slightly Skeptical Euromaydan Chronicles, June 2014 : Greenspan legacy bulletin, 2008 : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Financial Humor Bulletin, 2010 : Inequality Bulletin, 2009 : Financial Humor Bulletin, 2008 : Copyleft Problems Bulletin, 2004 : Financial Humor Bulletin, 2011 : Energy Bulletin, 2010 : Malware Protection Bulletin, 2010 : Vol 26, No.1 (January, 2013) Object-Oriented Cult : Political Skeptic Bulletin, 2011 : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method  : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law

History:

Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds  : Larry Wall  : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOS :  Programming Languages History : PL/1 : Simula 67 : C : History of GCC development :  Scripting Languages : Perl history   : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history

Classic books:

The Peter Principle : Parkinson Law : 1984 : The Mythical Man-Month :  How to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Hater’s Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite

Most popular humor pages:

Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor

The Last but not Least Technology is dominated by two types of people: those who understand what they do not manage and those who manage what they do not understand ~Archibald Putt. Ph.D

---

Copyright © 1996-2021 by Softpanorama Society. www.softpanorama.org was initially created as a service to the (now defunct) UN Sustainable Development Networking Programme (SDNP) without any remuneration. This document is an industrial compilation designed and created exclusively for educational use and is distributed under the Softpanorama Content License. Original materials copyright belong to respective owners. Quotes are made for educational purposes only in compliance with the fair use doctrine.

FAIR USE NOTICE This site contains copyrighted material the use of which has not always been specifically authorized by the copyright owner. We are making such material available to advance understanding of computer science, IT technology, economic, scientific, and social issues. We believe this constitutes a 'fair use' of any such copyrighted material as provided by section 107 of the US Copyright Law according to which such material can be distributed without profit exclusively for research and educational purposes.

This is a Spartan WHYFF (We Help You For Free) site written by people for whom English is not a native language. Grammar and spelling errors should be expected. The site contain some broken links as it develops like a living tree...

You can use PayPal to to buy a cup of coffee for authors of this site

Disclaimer:

The statements, views and opinions presented on this web page are those of the author (or referenced source) and are not endorsed by, nor do they necessarily reflect, the opinions of the Softpanorama society. We do not warrant the correctness of the information provided or its fitness for any purpose. The site uses AdSense so you need to be aware of Google privacy policy. You you do not want to be tracked by Google please disable Javascript for this site. This site is perfectly usable without Javascript.

Created: Jan 10, 2002; Last modified: March 12, 2019