IT Operations Consoles can be a great asset to an organization, as all pertinent events are consolidated and accessible from a single pane of glass. An effective IT Operations Console also requires comprehensive correlation capabilities. This allows organizations to reduce alarm noise to only those that are meaningful and actionable. It also allows organizations to ensure that operator actions are efficient and impactful in business terms.

RiverMuse Pro offers a broad rules-based correlation engine. One of those rules can perform topology-based correlation by looking up relationships from a CMDB, then performing upstream or downstream suppression. Another rule can lookup procedures from a 3^rd party knowledgebase, and execute them through an external action. Through my years in data center operations, perhaps the 3 most popular correlations include:
-       Suppressing duplicate events
-       Sliding time window based correlation (escalate if X events occur in Y minutes), and last but not least
-       Mapping business impact of outages.

De-duplication has been so commonplace with enterprise-class event management systems that it can easily be taken for granted. But the fact remains: de-duplication is the first and primary method of reducing alarm volumes to manageable levels. Some leading tools in the market lose granularity when de-duplicating events. All they know is the first time the problem occurred, the last time it occurred, and how many times it occurred. RiverMuse addresses this issue with a 2-tier event/alert model. Raw incoming ‘events’ are managed separate from processed de-duplicated ‘alerts’, and reside in separate subsystems. This allows RiverMuse to scale and de-duplicate events without sacrificing granularity.

How many times have we seen a link flapping? Or numerous CPU spikes? The problems are auto-remedied within seconds or minutes, but their frequency hides other problems. User transactions might hang or fail. The 3-hour file transfer had 10 seconds left for completion, only to stop unexpectedly. Deploying a time-series or ‘throttle’ based correlation through RiverMuse Pro can detect these recurring flaps, and escalate the problem(s).

In most IT Operations Consoles, there is zero to little notion of business context. Perhaps the most popular correlation method is determining business impact of an outage. Under the covers, this correlation is based on parent-child relationships. These relationships can be based on a service topology present in a CMDB, or other service management tools. Through the use of dynamic variables, RiverMuse can query external tools, such as CMDBs to lookup impacted business services, and other dependent Configuration Items (CIs). Business impact analysis can then be performed.

RiverMuse offers a wealth of correlation capabilities to address an organization’s business and operational needs. Download RiverMuse available free for 30 days and check it out. And if there are specific type of correlations that you would like to set up in your environment let us know. It would be great to discuss that in our RiverMuse Pro Community.

For any IT service provider the service is the business, and assuring it is the first line of customer and revenue protection. Until now mid-sized service providers have had no choice but to resort to a multiplicity of tools and consoles to manage and monitor their services from the application down to the underlying infrastructure.  

Some illustrative areas covered by these tools include network monitoring, storage monitoring, log monitoring, system monitoring, virtualization monitoring, application monitoring, database monitoring, VoIP monitoring and others. Despite claims to the contrary by so called suite vendors, no single monitoring system provider can cover all aspects of management, across all technologies and across all layers, at any given time. There is simply too much out there to address and this market is too dynamic for any one vendor to address it all.

While higher order event consolidation frameworks exist, they are highly expensive, take months and years to configure and need armies of staff to maintain. Most mid-size service providers have bypassed using these framework platforms altogether. 

Consequently, mid-size service providers have ended up with a combination of monitoring tools whether they like it or not. These tools produce their own specific IT events and alarms in their own environments, leading to multiple consoles that command centers operators have to inevitably negotiate through inefficient ‘swivel chair’ management.

Furthermore, because of scalability constraints -most of the existing mid market tools apply only a rudimentary logic of IT event elimination and consolidation, and offer even more limited coverage of real-time events.

In some cases, they may simply discard events rather than process them so that these are neither seen, nor controlled by operators – leading to missed alarms that are eventually business impacting. Operators learn about such events when customers call in with a problem.

In other cases, they may easily overwhelm operations teams with non-correlated alarm floods that often lack business context – lengthening the time to prioritization, escalation and ultimately remediation.

In summary, most current monitoring systems in use in mid-size service providers sacrifice accuracy, granularity, and enrichment to operate within a limited scale. While this worked for low velocity of change environments, this is an unacceptable proposition as we enter a new era of computing with increasing demand for intelligence, elasticity and compliance.

In my next post I will discuss a new approach to Real Time IT operations that meets the needs of the mid size Service providers in this time of change.

RiverMuse PRO includes a Reusable Business Logic (RBL) engine to streamline the creation of all configuration components in a single reusable package.

The configuration is loaded through a text file; it is then parsed and converted by a back-end engine that updates the configuration of multiple components within the RiverMuse product. This is a vast change from traditional Manager of Managers (MoM) solutions as configurations from multiple components are incorporated in a single configuration.

The RBL engine serves to:
– Map organizational processes into the product through one configuration channel
– Fuel the creation of a community driven repository (aka App Store). Configuration packages can be shared or bought. (i.e. a configuration package for grouping events by event type, and performing isolated problem correlation; a configuration package for interpreting Cisco alarms and integrating with Cisco inventory tools to populate RiverMuse dynamic variables).

RiverMuse PRO also incorporates a presence management engine that can discover entities on demand.

This is most useful when new alarms are reported for devices/entities not yet present in a CMDB or inventory management system. A RiverMuse Business Logic Package can first lookup Configuration Item information from the CMDB, and if nothing is found, attempt to perform a discovery using the RiverMuse Presence Management System. This will provide many additional variables that can be leveraged through correlations, automations, and escalations.

RiverMuse PRO includes a centralized rules management wizard.

Whether there are 1 or 50 remotely deployed collectors, rules are configured in a central location through a GUI. Within a traditional Manager of Managers (MoM) solution, the process of obtaining events, performing correlation, and providing business context are usually separate and distinct. Legacy MoM architectures typically require business logic rules to be updated at various levels and multiple components within their system and frequently using different, proprietary scripting languages. This creates a management challenge – and makes it hard for operations teams to keep up with infrastructure shifts.

RiverMuse PRO provides the facility to consolidate your Data Center Operations in a single pane of glass, and achieve Operational Excellence by automating tasks and streamlining processes.

RiverMuse Core, the first enterprise-class open source Real-time Consolidated Operations Console system ideally collects information via SNMP traps and Syslog messages out-of-the-box. Additionally it supports 8 standards-based APIs to obtain data from virtually any source (gSOAP, Perl, Java, C++, XML, PHP, Python, and Ruby on Rails). RiverMuse PRO builds on top of RiverMuse Core and provides a presence management discovery engine, a powerful enterprise desktop console, dynamic alert enrichment from external systems, enhanced scalability, and additional functionalities to streamline organizational processes and dramatically simplify system maintenance.

Perhaps the most compelling reason for pursuing a Consolidated Operations Console solution is being buried in a myriad of tools. And more importantly having little or no business context mapped to the results. The need for a so-called Manager-of-Managers MOM solution becomes more evident the more complex and dynamic an infrastructure becomes – thus requiring various tools to manage and monitor the environment. While multiple monitoring tools are great for specific tasks such as application monitoring, transaction monitoring, or communication device monitoring, problems that affect more than one silo take longer to identify and isolate.

RiverMuse PRO solves this problem by centralizing data across all the different tools, and retrieving events directly from devices when needed. To perform this, RiverMuse PRO includes passive as well as active collectors such as the RiverMuse VMWare agent. This active collector natively interprets CIM (Common Information Model) formatted data streams. Events from different environments are consolidated in one repository, where cross-domain correlation can occur. This allows operations personnel to quickly identify the problem and associated symptoms.

RiverMuse PRO incorporates the event processing scalability of leading commercial Manager-of-Manager solutions without sacrificing granularily.

In other words, all events related to a specific alert are kept in our system and made available on demand including through a launch in context tool. Additionally, correlation can occur against events and alerts. Other leading Manager of Managers tools are also resource intensive and require several install instances to provide value. In contrast, RiverMuse PRO was incorporates a small footprint to curb the overhead and maintenance requirements of legacy MOM solutions without sacrificing elegance and functionality.

In our new White Paper we discuss the IT Operations Management challenges for mid-size Enterprises and MSP’s. In many ways their environment is starting to look like that of the larger enterprise – only scaled down in size. They have also moved to any-to-any IP networks, VoiP phone systems, Virtualized datacenters and SOA based application architectures just like their larger counterparts. In fact the gap in requirements for operations management tools required by mid-size businesses and larger ones is rapidly closing.

In this scenario, small and mid-size enterprises (SME’s) need to make the leap to the next-tier of IT management sophistication. What has been a huge barrier until now is the high cost and complexity of Enterprise-class operations management tools. Not any more – as a new breed of tools including RiverMuse Core and Pro is bridging the gap of cost, simplicity, functionality and business models to enable SME’s make the move.

As we discuss in the WhitePaper some of the key IT Operations Management challenges that mid-size enterprise and MSP organizations face today include -

i) Rise in the Volume and Complexity of Events  – more applications, dynamic infrastructures, rapid changes, distributed components – are all contributing to an explosion in the number of operations events and faults that IT has to contend with.

ii) Moving from Infrastructure Operations to Service-Centric Operations - it is no longer enough to just manage a component of the network or the datacenter – the IT manager in the mid-size enterprise has to be able to define, monitor and assure end-to-end services.

iii) Swivel Chair management of multiple monitoring Systems – specialized components with their own management mechanisms have a created a veritable zoo of management consoles. The result? No complete view of the service and silo-based operations that slow down operational response.

iv) Lack of Centralized, Enterprise Wide Operations Management – with event and performance data sitting in different databases and reporting systems – any kind of intelligent correlation is left to the skill of the operator. And as the volumes of event scale up – this process is well but broken. 

v) The Demand for Scalable, Real-time Operations – most of the new application services demand near real-time operational response. Think VoiP, video conferencing, social media based collaboration and so on. The issue is mid-size monitoring tools weren’t built for high volume, scalable event processing and hence critical insight into the infrastructure is lost as they filter out most events – even critical ones.

Do you agree with the set of challenges described above? Do you think there are other problem areas with regards to IT Operations management that we miss here? Let us know.

Over the last few years, the heightened pace of innovation in service delivery technologies has increased the complexity of IT Operations Management for organizations of all sizes. This problem is particularly acute for Small and Medium Enterprises (SME’s) including regional managed service providers – which have traditionally operated with a lean staff and simpler but silo-based management systems. As long as the technologies they managed were relatively isolated and did not change rapidly, this management and monitoring structure worked fine. However, with the rapid advent of new technologies and the increasing pressure to do more with less – the very fabric of enterprise services has undergone a sea change.  

For example, converged communication services today no longer carry only data, but latency-sensitive voice and video packets that require considerable systems and application processing. Virtualized systems have completely overturned the conservative “one application per server” rule that was a costly, but safe choice for many IT managers. Expectations on utilization rates of virtualized servers are now pegged at more than fifty percent, instead of single digit rates.  Return on investment expectations has likewise increased considerably, and focuses on the effective delivery of end-to-end services (like say web apps, voice or video) rather than individual infrastructure availability. And lately, cloud based architectures are making resource allocation and monitoring even more dynamic and distributed.

While all of these changes have helped reign in IT budgets and do more with less, they also have introduced more specialized service components within scalable multi-tier architectures that are far more complex to manage and monitor. Many of these components are dynamic and can be moved or re-allocated based on advanced automated tools – for e.g. the movement of virtual machines across a server farm or entire applications from the enterprises premises to the cloud. Interestingly enough, while the first adopters of virtualization were large enterprises, recent analyst reports predict that x86 virtualization adoption in SME’s will outstrip large enterprise penetration levels in the next few years.

The implication of the structural shift in the nature of service delivery technologies and management is that SME’s will have to contend with vastly different kind of operational challenges going forward.

If you work in an SME or mid tier MSP organization – what kind of challenges do you see? On our part we will try and relate what we hear from our customers on this topic in later posts.

Over the past five years we have witnessed an acceleration of open source software (OSS) adoption by both service provider and enterprises alike. As Gartner stated in a November 2008 report, the primary advantages for customers adopting OSS tools were lower cost of ownership, ease of implementation, investment protection against a single vendor and faster time to market.

These key advantages have held true for the open source industry time and again, enabling it to gain significant market share across the entire IT stack, from operating system to middleware to tools to business applications and across enterprises and service providers (see the discussion on this subject on the microSperience blog). In fact, in the Network and System Management (NSM) space, there is already a wide selection of open source monitoring tools that have gained a broad following.

 And with RiverMuse last year, we have now launched the first and only open source IT Operations Management platform. By our definition, Operations Management includes at its core the disciplines of IT event and fault management. This is the primary platform that operations teams rely upon to keep their services and infrastructure running and healthy 24/7.

The founders at Rivermuse recognized early on that the IT event and fault management market is at the cusp of a major shift. Technology innovation in this market has stagnated for nearly a decade while the infrastructure environment has gone through transformational changes. Existing tools have become overly complex and costly, and return on investment has become questionable. In fact, customers today demand a number of things that legacy vendors are unable to fulfill. These include built-in support for today’s dynamic infrastructures, marked simplification of current management toolsets, significant TCO reduction as required by the new software economics, and the desire of many IT organizations to be liberated from management vendor lock-in. Let’s take a brief look at each of these points.

Most of the legacy operations/fault management platforms were developed to manage network-centric infrastructures that were relatively slow to change. Hence they were built to deal with network-related faults but not much more. Ten years later the entire scenario has completely changed. Today’s infrastructure is abstracted away from the underlying physical assets and governed by policies that relate to business and service priorities. It has evolved to support the need for business agility – new projects can be deployed rapidly, resources can be dialed up or down as needed, and change is easily accommodated throughout a virtualized fabric of computing, storage and networking. The legacy fault management platforms, with their proprietary design, are ill conceived to cope with such a diverse and dynamic environment in an elegant and nimble way.

Second, these management toolsets have extremely rigid architectures built for a different era in computing. Rather than redesigning their products to meet technology and business needs, legacy vendors have responded with bolt-on products from acquisitions or partnerships. Consequently they have multiple user interfaces and programming languages, and do not support standard reference architectures that are needed to fully capture the modern IT infrastructure. This in turn limits their integration and automation capabilities. The number of products and options presented by a legacy vendor to a typical IT organization is a bewildering and convoluted list that only the largest customers can afford. Yet, there is no reason why IT Operations Management platforms can’t be simpler. Vendors like VMWare have delivered simplicity in complex environments of their own. To meet market demands, NSM tools must facilitate agility in IT operations, not get in the way as they often do today and that requires a complete change of attitude and engineering design.

Third, the overall solution cost of legacy operations / fault management tools is prohibitive, particularly in the areas of support and maintenance and ongoing administration. How is an IT organization to achieve ROI on the top of these exorbitant costs? For example, IBM Tivoli Netcool, the most widely deployed enterprise fault management solution requires months of setup, has minimal configuration automation capabilities among other limitations – all contributing to push its TCO through the roof. This is a losing proposition. As more enterprises, Tier 2 and 3 service providers, and managed service providers recognize the need to adopt a new class of IT Operations Management tools, they mandate a level of affordability that only a fully functional open source platform like RiverMuse can deliver.

RiverMuse arrived and will meet market demand because IT organizations have asked for change. The IT world evolves quickly and these organizations simply can’t afford to keep waiting for promised features and integration that never make it past the roadmap slides of many IT vendors. Too much ‘lock-in’ power rests with the legacy vendors. It is time to shift the balance of innovation and control from a few oligopolistic vendors to the many practitioners,  and end users who ultimately know best what IT operations management capabilities they really need and when. It’s time for RiverMuse – and its open source roots to shake up the status quo and move the needle forward.

This is our January RiverMuse poll.

The poll results archive will be stored within the RiverMuse Community pages.

We are delighted that NetworkWorld have named RiverMuse as one of their top 10 IT management start up’s to watch in their annual review announced today.

You can read the full article here.

Keep us with all the exciting news at RiverMuse by following us on twitter

A recent ComputerWorld article entitled “Big IT is Back, Say HP, IBM, Oracle, EMC, Cisco” discusses the recent formation of the Acadia joint venture between Cisco Systems, EMC and VMware to provide a complete virtual computing environment for enterprises. This alliance pits itself against similar initiatives from HP, IBM and Oracle aiming to offer a complete virtualized infrastructure stack to enterprises. The central argument is that a single-source integrated stack increases productivity in IT operations, strips cost down and offers a higher level of agility. We at RiverMuse agree that a dynamic IT infrastructure based on a strong virtualization fabric is the path forward for IT. Clearly the mega vendors listed above along with Microsoft are best positioned to sway enterprises over for adoption and that’s a good thing.

However when it comes to managing such abstracted and complex fabric their management platforms fall short and the additional vendors in the space including CA, BMC and Compuware seem severely challenged as well due to a lack of genuine innovation. The systematic recourse of all the large vendors for years, even decades has been an acquisition strategy whereby they absorb products, knowledge and engineering talent and swiftly shift their focus from innovation to integration, touting “synergies” as the new panacea.

As the world of IT embraces more advanced computing and networking environments there is a parallel requirement put onto the management platform to harness them effectively and efficiently.  Event and fault management, which is at the very core of any infrastructure and service delivery management offering has fallen prey to this rash of acquisition/integration and witnessed little innovation for a decade. Legacy fault management tools from IBM, CA, HP and EMC are no longer adequate as they were built for a more static world, with a low rate of change, no virtuaiization and a single focus on networks and network elements rather than on a broader computing infrastructure and the IT service delivery chain. Fault management is out, event management is in as it captures, processes and renders all signals coming from the infrastructure whether be network, compute, middleware, service or security-related.

Hence RiverMuse was born out of necessity to address the event and fault management challenges of a dynamic IT infrastructure that mega vendors have so long ignored. Genuine innovation is back and it’s not just technical. See for yourself.

• View resource area
• Download white paper
• Download Core
• Join our community

JL Valente