According to one of our motor cycling enthusiast software developers, the majority of Harley Davidson owners are likely to be 45-year-old accountants from Ann Arbor, Michigan. In fact, a minute on Google brings up the stat that the majority of motorcycle owners are on average 41 years old, and earn $77,714 in annual household income.

The reason these ‘unlikely’ Harley Davidson owners give is that nothing beats riding down the highway, on a warm sunny day with no fixed timetable and no place to be… It is controlled risk, a type of safe rebellion.

I believe it has similar parallels to why our customers look to invest in RiverMuse, a new entrant in an established industry. Just like the Harley Davidson owners, our customers are taking a controlled risk; the software is not a decade old, but this is where safe rebellion has its advantages. With RiverMuse you are acquiring new functionality that you cannot get from existing players, technology that is modern and meets the needs of datacenter and network operations today.

And as a customer of a new entrant into the industry, you are able to exert a stronger influence on the future direction of the RiverMuse technology, so as to assist in developing functionality that you need for your network, datacenter or cloud implementations.

Another advantage of safe rebellion is that you avoid that feeling of being a ‘small fish in a big pond’ mentality you get from the legacy IT event and fault management companies. Aided by the simplicity of its platform, RiverMuse offers a new layer of interactivity with a downloadable “try and buy” model. And we are more responsive to your needs and ready to ride the extra mile to make things work for you.

Controlled risk in new entrants such as RiverMuse brings the advantage of being seen to be close to the leading edge of technology. You are technically investing in the future of IT.

According to those Harley owners, a Harley is not just transport; it is a legend and a way of life. So in the workplace, join us in bringing safe rebellion to the IT operations management industry, and creating another legend.

I remember many years ago, working for a large American bank when they went through an exercise to change their IP address ranges throughout Europe. Despite the best efforts of the project team, the task was an absolute nightmare. Not so much the actual address changes throughout every European site – that went fairly smoothly – but the sheer man-effort required around the clock to re-configure the many element management systems scattered across the campus. It took almost a week to re-configure everything, and for almost three weeks after that, we were still mopping up mistakes, mis-configurations and syntax errors. Before these errors were rectified, we (the group that I was part of) missed network faults and missed SLAs, and we were suffering from silent failure (not that I knew what that was back then). The department’s name was mud; it took months of effort to restore confidence in the network management team, and we created a function whose sole purpose was to maintain configuration files throughout the company. I just remember thinking that there must be an easier way to do this.

Several years later, working for a European systems integrator, I designed and built a remote network management system. Key to the success of this system was its ability to monitor change; I was very aware of the pain of that experience with the American bank, and I designed this new system to reduce this kind of pain. But, every time a new customer was added, there were still many weeks of frenetic activity before a service could be commissioned. Despite my best efforts, I was still slave to the sheer number of configuration files that required updating every time a network was added, or something changed in a given network. I could automate the heck out of many parts of the system, but there were still situations where manual intervention was required, and these were always the most contentious times.

If I were tasked with doing the same thing again, my criteria when choosing the right tools would be massively different; I would be looking for a system that used a single language throughout, required minimal intervention to get up and running, and one that would let me re-use configuration files time and time again. This last part would allow me to deliver similar services to multiple customers. People who have worked with me in the past will remember me banging on about “light, generic and elegant” systems.

I’ve finally found one.

RiverMuse has developed the concept of Transportable Business Logic (TBL). This, in essence, is a method of configuring how the various components of the Pro product respond to Alerts from any system or device. Written using a simple yet eloquent meta-language called RiverMuse Object Definition Language (or RODL for short), TBL is object oriented in approach, and is completely device-agnostic. So, if a host changes name or IP address, RiverMuse Pro simply adapts to the change (without the risk of silent failure – see above) and the business logic remains intact.

And, because of the structured nature of TBL, I can take any object file and load it on any number of RiverMuse implementations, and it will always work — truly transportable. If I were a reseller of RiverMuse and other related products, my value proposition would be to reduce the time to value through the RMOs I had written around integrations between these products.

The possibilities are endless; what if I could create RMOs and post them in an Apps Store of some description? And what if I could buy and download RMOs for specific functions created by other RiverMuse users? At the end of the day, experience is best shared, so why should I have to re-invent the wheel every time I come across a new (to me) piece of equipment, system, application or condition? The chances are that somebody out there has already been through that experience, so I could benefit from their knowledge. Light, generic and elegant.

Try for yourself. Download RiverMuse Pro free for 30 days and check out Transportable Business Logic.

Solarwinds is a great network polling solution, and offers some event collection capabilities. However, googling ‘Solarwinds event correlation’ reveals the product’s shortcomings in the correlation and problem isolation space.

For example, many problems can occur in the IT environment of a business:

• Silent failures: many issues can go unnoticed such as link flapping, spanning tree changes, etc.
• High level of event noise, requiring time and resources to diagnose.
• No conciliation of collected events with performance degradation, and
• No correlation against application performance problems reported by 3rd party tools such as Microsoft SCOM, Hyperic, and CA Wily – essentially no cross-tool correlation.

RiverMuse Pro, our commercial IT operations management solution, accepts any event from any source. That includes Solarwinds Network Performance Manager, Syslog and SNMP traps from network devices, and alarms from other systems and application management tools. RiverMuse Pro addresses the correlation gap in Solarwinds.

A customer of mine recently experienced the scenario of a critical network link flapping. The problem went undetected for 60 minutes. Solarwinds was polling the interfaces every 5 minutes, and pinging for availability every 2 minutes. Coincidentally, the interface happened to be up during each poll. Syslog messages from the devices were noisy, but link down and link up traps were reported. However, given the volume of messages they went unnoticed. Without a real-time operations tool in place, it was not evident that the interface was down or flapping. On the 15-minute mark poll, Solarwinds reported heavy interface errors and packet discards. But the fault was cleared on the subsequent 20-minute mark poll. At the 60 minute mark, the link was down again, which coincided with the Solarwinds poll. It was only then that some smart operators manually sifted through Syslog messages, and determined that the link was flapping.

In contrast, RiverMuse offers a throttle based correlation that can detect link flaps. If 2 or more link down events are reported for the same interface in 3 minutes, RiverMuse can escalate the issue, and generate a summary event indicating the link flap. In addition to that, RiverMuse can perform event priority based correlation. Solarwinds events reporting high packet discards and errors would be correlated as symptoms of the ‘Link flapping’ event.

Lastly, RiverMuse can provide business context and automation on the ‘Link Flapping’ event. A dynamic lookup from an inventory management system would identify the carrier and circuit id. A second lookup from a change management system can provide the escalation contact name and email address. All this information can be viewable in the alert within the RiverMuse console. The escalation contact would also be automatically emailed.

With RiverMuse, a problem that went unnoticed could be detected in real-time. And previously manual procedures would also be automated. Both would safeguard business operation and save time and effort of the operations staff.

Download RiverMuse Pro  free for 30 days and check it out. And if there are additional types of correlations that you would like to set up in your environment, let us know. It would be great to discuss that in our RiverMuse Pro Community.

IT Operations Consoles can be a great asset to an organization, as all pertinent events are consolidated and accessible from a single pane of glass. An effective IT Operations Console also requires comprehensive correlation capabilities. This allows organizations to reduce alarm noise to only those that are meaningful and actionable. It also allows organizations to ensure that operator actions are efficient and impactful in business terms.

RiverMuse Pro offers a broad rules-based correlation engine. One of those rules can perform topology-based correlation by looking up relationships from a CMDB, then performing upstream or downstream suppression. Another rule can lookup procedures from a 3^rd party knowledgebase, and execute them through an external action. Through my years in data center operations, perhaps the 3 most popular correlations include:
-       Suppressing duplicate events
-       Sliding time window based correlation (escalate if X events occur in Y minutes), and last but not least
-       Mapping business impact of outages.

De-duplication has been so commonplace with enterprise-class event management systems that it can easily be taken for granted. But the fact remains: de-duplication is the first and primary method of reducing alarm volumes to manageable levels. Some leading tools in the market lose granularity when de-duplicating events. All they know is the first time the problem occurred, the last time it occurred, and how many times it occurred. RiverMuse addresses this issue with a 2-tier event/alert model. Raw incoming ‘events’ are managed separate from processed de-duplicated ‘alerts’, and reside in separate subsystems. This allows RiverMuse to scale and de-duplicate events without sacrificing granularity.

How many times have we seen a link flapping? Or numerous CPU spikes? The problems are auto-remedied within seconds or minutes, but their frequency hides other problems. User transactions might hang or fail. The 3-hour file transfer had 10 seconds left for completion, only to stop unexpectedly. Deploying a time-series or ‘throttle’ based correlation through RiverMuse Pro can detect these recurring flaps, and escalate the problem(s).

In most IT Operations Consoles, there is zero to little notion of business context. Perhaps the most popular correlation method is determining business impact of an outage. Under the covers, this correlation is based on parent-child relationships. These relationships can be based on a service topology present in a CMDB, or other service management tools. Through the use of dynamic variables, RiverMuse can query external tools, such as CMDBs to lookup impacted business services, and other dependent Configuration Items (CIs). Business impact analysis can then be performed.

RiverMuse offers a wealth of correlation capabilities to address an organization’s business and operational needs. Download RiverMuse available free for 30 days and check it out. And if there are specific type of correlations that you would like to set up in your environment let us know. It would be great to discuss that in our RiverMuse Pro Community.

Until ITIL V3 came to fruition, there was a common misconception that any reported event was an incident, and required a ticket be opened. That could be a CPU threshold exceedance, a process restarting, or a change in network topology. Service Desk vendors drooled like Tasmanian Devils, and some went as far as redefining terms such as Business Service Management.

On the opposite end of the spectrum, many organizations still send email notifications or pager alerts whenever any exception occurs in the monitoring infrastructure. IT administrators receive numerous notifications to the point that many emails are ignored or deleted – since the notifications were too common to be taken seriously. Some infrastructure monitoring tools incorporate a certain level of correlation, but they only correlate the data captured by the tool itself; and often, the correlation capabilities are too narrow or limited. Naturally, these tools cannot correlate information reported by other toolsets. So, the IT administrators are now bombarded with emails from multiple tools, not just one.

With an event management platform in place, correlation first occurs prior to taking any secondary action. Correlation can occur whether the events originated from the same source, or multiple sources. Tickets are then opened on real incidents and problems.  Email notification volumes are dramatically reduced. When an administrator receives an email, he/she can rest assured it’s regarding a real problem. It ensures that those 3 AM calls are actually worth getting up for.

Aside from correlation, an event management platform also acts as a central location to consolidate events across the infrastructure. It is ideal for data center operators since they can see the status of any component in real-time in a single pane of glass. That can include power supplies, HVAC units, servers, virtual machines, the network, the cloud, and virtually any other component. Operators can launch “in context” to other tools once incidents have been correlated to problems. This facilitates troubleshooting, and ensures operators drilldown to the right tool, rather than wasting their time swiveling between multiple tools, and manually trying to correlate problems.

Last but not least, a good event management system also makes business sense out of IT events. In a previous life, I recall instructing operators to ignore a set of messages from 1 – 2 AM due to system maintenance. And that was just for my systems! What about every other application, system, and network device out there? Alert enrichment to the rescue! By looking up the maintenance schedule from a change control system, alerts can be suppressed during maintenance periods, or automatically escalated otherwise. What if escalation contacts are automatically populated into alerts, but the contact information resides in an external inventory management system? Alert enrichment can automate the lookup, and automatically send notifications to the contact. How about populating carrier Circuit ID for ‘link down’ events? Or customers impacted by an outage? Perhaps looking up procedures from a knowledgebase, and automatically executing the verification steps? Alert enrichment allows for such intelligence, which facilitates correlation, automation, and visualization.

RiverMuse, the next generation real-time IT Operations platform enables operational efficiency through event consolidation, alert reduction, and business context enrichment. Rather than swiveling chairs from one tool to another, and looking up procedural information in spreadsheets and other systems, all pertinent information is automatically mapped to alerts. In the past such systems were only afforded by large corporations with large budgets. RiverMuse completely breaks through that barrier by delivering sophisticated event management technology at the right price and ease-of-use that can appeal to mid-market companies too.  Join our RiverMuse Pro Community to discuss your thoughts on IT event management.

Read the Press Announcements on the release of RiverMuse Pro v2.0 – the new commercial offering from RiverMuse.

Press Release, May 12, 2010 – RiverMuse Announces New Commercial Product

Press Release, May 12, 2010 – RiverMuse Innovates in IT Operations Management

Also read the blog from JL Valente, CEO of RiverMuse commenting on the launch.

It’s an exhilarating time at RiverMuse this week as we reach a notable milestone in our business with the launch of our new commercial product, RiverMuse Pro v2.0. It has taken us slightly longer than anticipated to get there but frankly it was worth the wait and the additional effort and intensity from our team, our partners and our beta customers. We are excited and proud to bring to the mid-market what we believe is genuine technical innovation in IT Operations management and I want to thank everyone that contributed to this major milestone.

Service providers and enterprises now have a viable solution to consolidate myriads of daily IT events from all infrastructure components and monitoring tools into one centralized console for rapid problem detection, isolation and resolution – thereby dramatically lowering cost of operations and improving customer experience. RiverMuse PRO builds on top of our open source platform with a number of unique innovative capabilities toward faster time to value, lower cost of ownership, and higher scalability. In addition to our free open source RiverMuse Core edition, we have decided to make RiverMuse Pro available for a 30-day free trial as well, so that users have the freedom to choose which edition is best for them. So feel free to check it out for yourself.

RiverMuse Pro includes unique capabilities around event capture and correlation, external data enrichment and centralized configuration that stays in step with infrastructure changes. I am also very excited with the prospect of further collaborating with our partners, VARs and system integrators who will benefit from a global marketplace setup by RiverMuse where they will be able to provide complementary products and services to our growing user community. I will cover this in detail in a separate post in the upcoming weeks.

In the meantime I invite you to download RiverMuse Pro, give it a test run in your environment and let me know what you think.

Ever since I first became involved with systems and network management tools (back in 1990) the idea of using a single vendor “framework”, versus buying “best of breed” tools from multiple sources has been in and out of favour with customers and “experts” alike. As an influential customer (as part of BT) I have had the opportunity to get pitched by both sides and consider both perspectives. From a purely theoretical standpoint it’s very difficult to accurately compare the relative merits of these approaches.

For example a “framework” supplier will tell you things like:

• They are easier and quicker to deploy.
• The vendor deals with all the integration headaches, saving you integration costs and time.
• If you have any problems you only have to negotiate with one supplier.
• One vendor can’t pass the buck to another, by saying it’s not our product that’s causing the problem it’s all the fault of someone else.

Whereas a “best of breed” tools supplier will counter with claims such as:

• You get the best solution for the job, not a “Jack of all trades master of none”.
• You can save money by encouraging competition for the components you need. Basically pitching one hungry supplier against another.
• You are at less risk of your chosen vendor disappearing from the market (all your eggs in one basket).
• Best of breed products are more “innovative” and “agile”, developed by people who are both keen and understand their space. Usually because they are smaller and hungrier.

Why frameworks seem attractive to mid size customers

For many medium sized customers concentrating on the theoretical advantages alone usually makes the “framework” approach appear to be a no-brainer. Especially attractive are the claims that they are quicker/easier to deploy, and that the single vendor deals with all the integration issues.

This desire to implement a framework solution is often further amplified by the fact that many medium sized customers have grown from small infrastructures – either organically or via mergers. In the small infrastructure tools world, nearly all solutions are “integrated products” from one vendor, fulfilling 80% to 90% of customer requirements. For decision makers in mid size companies, previous experience tells them that a single vendor integrated product works well. Consequently, as they move beyond the capabilities of the small tools (usually because they don’t scale, or do not have enough horizontal coverage for a medium size infrastructure) they think frameworks are the answer.

Why frameworks really don’t work for mid size customers

As always though the devil is in the details, and often times the theory and real life experience are at odds. My advice would be to visit existing medium/large customers (similar in size as your organization) who have implemented frameworks and check first hand. When you do, talk to the people on the ground “using the tools” rather than only with the senior managers.

In my experience, most customers with medium sized infrastructures that I have visited over the years have experienced a number of significant issues implementing frameworks (regardless of who the supplier is). For example one customer I visited told me they had developed 75% of the solution in-house (over two years) to make the framework solution they had picked work in their environment.

- Con Blackett

When designing the RiverMuse architecture, we were fully cognizant of the constraints of other system management solutions that use only a single tier ‘alert’ model with no historical archival of ‘events’.  By adopting an architecture that supports a two-tier ‘event’ and ‘alert’ model at the basic level, freed RiverMuse from many of these past constraints.
 
For clarity, we describe an ’event’ as an infrastructure occurrence communicated as a message (e.g. trap or syslog), polling result (reachable/not reachable) or a rule (threshold below ‘x’ for a service). An ‘alert’ is generated based on how an event (and its related occurrences) is processed based on specified business rules. In essence, events are the raw incoming data stream; alerts are processed and de-duplicated events.
 
Legacy system management platforms for instance – only manage “alerts”; and therefore risk losing data. For example, in the case of de-duplication, the individual occurrences of the duplicate alert are discarded.
 
In contrast, with RiverMuse’s two-tier alert and event model means that you can select from the database all the events that have occurred for any given alert. Each alert has a unique “alert_id” (integer) and each event references an “alert_id”.
 
Through the desktop console you can retrieve all events relevant to a specific “alert_id”, thus providing an audit trail of every occurrence that has happened to a specific alert. For example, you can find out: create time, time of every duplicate, assignment time, acknowledgement time, how long it took to close the alert and so on.
 
Being able to detect every change to an alert creates a fully compliant system for regulations such as Sarbanes Oxley and Basel II, as no information is ever discarded. Consequently, in relation to ‘alert management’ RiverMuse offers the best solution for compliance sensitive environments.
 
The two level event and alert model is a key component of RiverMuse’s lightweight platform for event acquisition, correlation, alert generation and processing in dynamic IT environments.

We were pleased to complete the beta release of the next version of our commercial product RiverMuse Pro v2.0 last week. RiverMuse Pro replaces and builds on top of the RiverMuse ES (Enterprise Subscription) v1.0 product released in Nov 2009.

Now that RiverMuse PRO is in the hands of many beta customers and will be GA in a few weeks, I thought that this would be a good opportunity to explain what makes RiverMuse Pro different.

The first critical advantage of RiverMuse Pro is its ability to automatically fingerprint any new entity in an IT  infrastructure and configure a set of predefined rules against it for de-duplication,  polling, enrichment, and correlation without any manual intervention. From that point on the RiverMuse system automatically maintains its rules configuration in step with changes in the environment.  The second critical advantage is its power to integrate business logic from other application, data center an network management systems  using an open architecture.

This single capability differentiates RiverMuse from other IT Event and Fault Management software when dealing with the demands of highly dynamic operations environments such as virtualized or cloud systems.

RiverMuse Pro intelligently converts raw input of topology and external management data into configuration files called RiverMuse Objects (RMOs). By working with a hierarchical set of objects and analyzing the business logic, the entity modeling component (called modeld) automatically creates the right RMO representation, say, when device or system of type X is encountered.

Consequently, you can arrange for knowledge of ‘what is out there’ in the environment, to be automatically incorporated in the RiverMuse Pro system. If you have a large environment, no doubt you will agree that it is much easier to write one rule as opposed to 100’s or 1000’s of rules to cover every conceivable situation.

RiverMuse Pro thus removes in its entirety the job of manually configuring the changes to your configuration. In theory, you write it once and run it always.

Within the RMOs, the configuration is written in a meta-language so there is no reference to a physical device by name. You express configuration in pure business logic rather than ‘IP address = 192.168.42.36’. Hence, in theory – you can take your configuration, put it into a different system, with a different notion of what is out there, and it will still create a valid configuration.

Another innovation in the architecture is the RiverMuse presence topology acquirer (called topod). This tells the system when something is there and what it is. topod runs a linear augmentation style discovery through the use of seed Explorers, and Embellishing Agents. The Seed Explorer looks for devices it has never seen before, as you can be quite confident if you get an alert from something, it exists. topod then passes any discovered entities along to different Embellishing Agents, which find out and augment the RiverMuse database with more information as they are uncovered. This enables the system to dynamically manage new entities, like say, virtual machine entities as they are created, moved or torn down.

Together these capabilities make RiverMuse Pro uniquely suited for automated adaptation and configuration in dynamic cloud and IT environments.