OpenService NerveCenter Event Correlation Network Management

Transcription

1 John Inverso Product Report 31 July 2003 OpenService NerveCenter Event Correlation Network Management Summary NerveCenter provides network-event correlation and root-cause analysis abilities which its new owner, OpenService, intends to integrate with its own security management software. Table of Contents Overview Analysis Pricing Competitors Strengths Limitations Insight List Of Tables Table 1: Overview: OpenService NerveCenter Table 3: Price List: OpenService NerveCenter Gartner Reproduction of this publication in any form without prior written permission is forbidden. The information contained herein has been obtained from sources believed to be reliable. Gartner disclaims all warranties as to the accuracy, completeness or adequacy of such information. Gartner shall have no liability for errors, omissions or inadequacies in the information contained herein or for interpretations thereof. The reader assumes sole responsibility for the selection of these materials to achieve its intended results. The opinions expressed herein are subject to change without notice.

2 Corporate Headquarters OpenService, Inc. 110 Turnpike Road, Suite 308 Westborough, MA 01581, U.S.A. Tel: ; Fax: Internet: Overview Table 1: Overview: OpenService NerveCenter Product Type Event correlation system Product Functions Event detection, correlation, filtering and notification, and downstream alarm suppression Version 3.8 Platforms Supported Unix, Windows NT, Windows 2000, Windows XP Databases Sybase, SQL, Oracle, Microsoft Access, Unix Flatfile, ODBC Supported Base Price (US$) 14,950 Target Markets Companies with medium to large-scale networks, service providers and managed network outsourcers Root-Cause Analysis Behavior Models Detected problems are analyzed and compared with NerveCenter s database of resolution information and related behavior models. From this, the product determines the best action that will resolve the problem and performs it. Included with NerveCenter is a series of standard behavior models for various faultdetection and performance issues and processes. These models detail critical device or network conditions and the appropriate actions to take when they occur. The customers can also build custom behavior models to fit the specific requirements of their networks. The prepackaged behavior models include pre-configured templates for Nortel and Cisco devices. The package also includes Compaq Insight Manager behavior models for those system managers who want to integrate their Hewlett- Packaged/Compaq equipment into NerveCenter. NerveCenter offers a Correlation Expression Wizard that aids the user in designing alarm diagrams, including triggers and actions to be taken. It is designed to help reduce the labor involved in building these diagrams. 31 July

3 Event Filtering Automated Notification and Correction Polling Reporting Web Console HP OpenView Integration Once a network event is detected, it is compared to a series of pre-defined rules before an alert is sent. These rules are usually set by the customer and detail the event parameters critical enough to warrant the notification of a network operator. This is meant to cut down on the amount of extraneous information that the network operator must sift through to get to the root problem. It is also meant to suppress downstream event alerts resulting from a larger event. (For example, when a router goes down, only one error message is broadcast to the operator. The system suppresses messages from each device connected to the router until the connection is restored.) Its centralized alarm facilities report the occurrence of an event based on preconfigured or user-specified criteria (that is, performance thresholds). The automation enables NerveCenter to perform a number of tasks, including notifying personnel, running corrective action scripts and so on. The ActionRouter module provides programmable features that automatically route service requests generated by alarms, including criteria for directing an action such as a page or alert to different personnel based on time-of-day or topology information. Smart Polling reduces NerveCenter s bandwidth usage by collecting only the information necessary for diagnosing a problem. It also reduces the network management platform s polling requirements. Integrated with Seagate Crystal Reports Designer 6.0. This support allows NerveCenter to produce custom reports using log data. These reports enable the network manager to monitor performance trends and compare network availability with established service-level agreements (SLAs). From any standard Web browser, NerveCenter operators can access its management features regardless of their physical location. This console provides access to network status information, including alarm and network event views, filter alarm types and property groups. When running on HP OpenView, NerveCenter provides integration of distributed trend analysis, action routing and alarm configuration with HP OpenView. Authorized managers can view graphs of traffic data and load pre-configured alarm packages at multiple distributed NerveCenter installations throughout the entire enterprise, reducing the central administrative workload and enhancing local management capabilities. Users can correlate event information from mainframes, desktop systems and network devices for planning and problem management. NerveCenter correlates and filters events for Hewlett-Packard s distributed OpenView Network Node Manager (NNM). It also cross-correlates data from the network, carries out a problem diagnosis and sends a single alert message to the operator in place of multiple alarms. NerveCenter distributes network management functions among NNMs placed throughout the enterprise. It can add its distributed event correlation capabilities to NNM s monitoring and management functions, providing more management throughout the customer s local- and wide-area networks. It can also manage and correlate messages collected from Unix systems by the OpenView OperationsCenter (OpC) system management platform. Notification of correlated events can be sent to both NNM and OpC consoles. 31 July

4 Support for SNMP v.1, v.2, v.2c and v.3 Management Framework Integration Support for all levels of Simple Network Management Protocol (SNMP) agents with security, as well as integration with platforms that do not support SNMP v.3 but have customers that wish to manage v.3-enabled devices. NerveCenter classifies the devices and provides event delivery to the target platform. It also provides encryption, authentication and trap logging as well as a Management Information Base (MIB) compiler. NerveCenter can integrate with Tivoli NetView, Computer Associates Unicenter and Micromuse Netcool/OMNIbus. Analysis OpenService NerveCenter is an SNMP- and Internet Control Message Protocol (ICMP)-based event correlation application that enables administrators to develop alarm-filtering rules using conditional state diagrams. NerveCenter reduces the onslaught of secondary or spurious alarms to the management console with downstream alarm suppression, thereby enabling operators to focus on primary network faults and events. Supporting mixed Unix and Windows NT environments, NerveCenter uses rules-based network behavior models to filter network events and to correlate network conditions. Its drag-and-drop interface allows for the developing and modifying of these and additional behavior models. It is automated to identify problems and to take corrective action without requiring user intervention. NerveCenter can also distribute these behavior models from remote locations and can correlate SNMP events or messages from local networks, systems and applications. It offers detailed analysis, going so far as to distinguish each router IP port from another to differentiate between interface problems and router problems. The client/server architecture of NerveCenter allows it to operate in the background and be readily accessible to any management station; it gives the option for unattended Lights Out management of the network as well. It is also capable of downstream alarm suppression, allowing subsequent alerts triggered by a primary cause to be suppressed. However, there is no discovery of the network topology so the user has to instruct the system as to what s connected to what, and what is downstream from what in order for NerveCenter to do this suppression. The product runs as a native Windows NT/2000 or Unix (Solaris and HP-UX) application, providing complete access to its features through a Windows-style graphical user interface. It integrates with Hewlett-Packard s OpenView Network Node Manager, IBM s NetView for Advanced Interactive Executive (AIX) and Tivoli Enterprise Console, Computer Associates Unicenter and Micromuse s Netcool, but it can also run as a stand-alone platform on smaller environments or Web servers and firewalls. It uses the Microsoft Structured Query Language (SQL) Server database on Windows NT server platforms, but offers support for other Open Database Connectivity (ODBC) databases as well. New Owners, New Direction OpenService has been in the security management space for years, managing firewalls, antivirus and so on and offers a product called SystemWatch to address this. The vendor wanted to enhance its product with certain network management features so that it would be able to manage security devices in much the same way network devices are managed. This decision was based largely on customer requests and trends in the market that showed an increasing number of security devices incorporating SNMP and being managed alongside traditional network equipment. Such a move included adding SNMP support as well as event coorelation to SystemWatch. Rather than build these features from scratch, OpenService pursued the opportunity to acquire NerveCenter from storage management vendor Veritas once it 31 July

5 presented itself. NerveCenter adds these features and more to OpenService s portfolio, giving the vendor the ability to offer security and network management functionality to its customers. NerveCenter can manage most any events sent to it, making it an easy integration with SystemWatch. OpenService s current plans are to develop that integration further while maintaining both products separate identities. The current version of NerveCenter is able to receive events collected by SystemWatch and send alerts back to the SystemWatch user console. OpenService will enhance this by developing plug-in integration for NerveCenter and tighter integration with SystemWatch s agent technology that will provide greater event coorelation and management than is currently available. OpenService has continued to enhance NerveCenter as a network management product. Enhancements so far include: An updated Practical Extraction Report Language (PERL) scripting engine that supports PERL 5.8 Direct control over PERL counters via the AlarmCounter module An alarm diagramming wizard Enhanced support for SNMP v.3 Helping in its development is Veritas itself, which, as part of the acquisition agreement, became a major equity holder in OpenService. Veritas continues to have say in the development and longevity of the product. Pricing Table 3: Price List: OpenService NerveCenter Product Price ($) NerveCenter Additional Management Console License 14,950 (1 server, 1 console and 100-node license) 29,950 (1 server, 1 console and 500-node license) 44,950 (1 server, 1 console and 1,000-node license) 59,950 (1 server, 1 console and unlimited-node licenses) 375 Support and 1 year percent of list Maintenance 1 year percent of list Hot Backup* 22,475 (1,000 nodes) 29,975 (unlimited nodes) Education Discount Yes Leasing Yes Multicopy Discount Yes Site License Yes *Hot Backup refers to a redundant copy of NerveCenter that runs as a backup server to the main NerveCenter installation; available only in addition to a NerveCenter purchase. Pricing as of July GSA Pricing Yes. 31 July

6 Competitors Aprisma SPECTRUM Hewlett-Packard Event Correlation System (ECS) Micromuse NetCool Precision System Management Arts (SMARTS) InCharge Strengths Built-In PERL Interpreter NerveCenter has a built-in PERL interpreter, which allows the end user to avoid the performance penalty associated with starting up an external interpreter. Furthermore, the interpreter precompiles scripts and subroutines, accelerating their ability to be executed. Customers who already have subroutines written in PERL up to version 5.8 can integrate them into NerveCenter with relative ease. Also, new models can be written without requiring the programmers to learn a proprietary language. This cuts down on the training and implementation time required to set up and run NerveCenter. Detailed Reports This version of NerveCenter allows the operators to report on almost any variable associated with the network. The capability to group devices in a variety of categories is another improvement over the previous version. This is effective in reporting the service levels of specific segments of the network. There is also the added benefit of a Web interface that allows authorized report access from any standard browser. Low Price NerveCenter is priced below much of its competition, making it a more attractive offering than some other products in its class. Limitations Behavior Model Programming Required To best utilize the event-filtering feature, NerveCenter must be populated with user-defined behavior models of the network. While it does come with a few behavior models for certain devices, they do not cover nearly enough to effectively monitor the network. As a result, the administrators must invest a significant amount of time to build models that will accurately reflect proper network administration; however, NerveCenter does support models written in PERL rather than in a proprietary language. OpenService has begun to address this with its Correlation Expression Wizard, but its effectiveness has not yet been proven. Individual Configuration Required Multiple copies of NerveCenter servers must be configured individually. Currently, NerveCenter does not support group configuration. In companies where hundreds of NerveCenter servers are deployed, individual configuration changes will be extremely time- and resource-consuming. OpenService is working on ways to remedy this. Requires Third-Party Front End 31 July

7 NerveCenter does not have an alert management console requiring it to be run in conjunction with a management product, such as Computer Associates Unicenter, Micromuse NetCool and Hewlett- Packard s OpenView, to name a few. Insight Customers could benefit from NerveCenter s reporting facilities and from the effectiveness of its downstream suppression behavior models in responding to events. However, customers should also bear in mind that it is no small task to create complex behavior models; the process requires a fair amount of programming. This could be taxing on information systems (IS) resources even with NerveCenter s wizard and PERL support. 31 July