A Market-Leading Event Manager: Micromuse

Micromuse was an early player in the event management market. It has expanded its capabilities by adding a family of active probes, root-cause analysis tools, and business impact analysis tools. It competes with BMC Software, Hewlett-Packard, Tivoli, and Computer Associates, among others. It has established itself strongly with service providers.

The discussion about Micromuse is divided into the following subsections:

• Netcool product suite

• Event management

Netcool Product Suite

The Netcool product suite depends on the strong event management of the Netcool OMNIbus application, which is the basic driver of the Netcool suite of management tools. An early OMNIbus design goal was abstracting basic element alert information, adding value, and transforming it into operations information. The tools are associated with specific events and activated when they occur.

Central to Netcool OMNIbus is the Netcool ObjectServer, a memory-resident database that holds operational information as well as the information that associates elements with the services they support. Customers must still build the associations between services and elements, which adds extra administrative burdens. However, the ObjectServer is designed for fast access so that it does not become a choke point under high-request volumes.

A set of Netcool Probes and Monitors uses active techniques for collecting operational information and feeds the data to the ObjectServer. The Probes are passive collectors, implemented as software modules placed in monitored elements. Monitors are separate systems carrying out active measurements. The set of Probes and Monitors covers a wide variety of equipment, services, and transactions.

The Probes and Monitors also provide local processing to reduce the loads on the network and ObjectServer. Local processing enables sophisticated filtering of the alarm streams, and it helps the solution scale for large, managed environments.

The active monitors maintain complex rules that can calculate expressions with multiple alarm sources. The value of the expression determines if an event is triggered. Both types of collectors track cumulative behavior, such as the number of slow transactions over the preceding two hours.

Instrumenting across the service infrastructures gives Netcool a definite advantage compared with many event management systems that are focused on network elements and alarms. In contrast, Netcool uses complex expressions in the monitors that are based on sources in different infrastructures. Administrators can zero in on service behaviors across the infrastructures.

A publish/subscribe interface is used to associate management tools and events. Any tool registers for one or more events; when these events occur, the appropriate tool is launched and responds as needed.

Administrators access the event management system from anywhere on the Internet. They can navigate quickly through different views. Administrators can view event status, clear events, change their priority, and generate reports on event-management activity.

Event Management

Micromuse offers a set of capabilities for reducing alarm volumes and delivering action-oriented information to the management tools. Some of these functions include de-duplication, normalization, automatic suppression of transient conditions, and presentation from a service perspective.

De-duplication consolidates related alarms and thereby provides a clearer picture for the staff. Instead of dozens of individual alert messages, the operators see a single message with associated information about the number of underlying alarms.

Normalization is a means of aligning the values from many different sources so that data can be compared accurately. As a case in point, consider the situation in which one collector measures utilization as an integer value representing the percentage, and another expresses utilization as a fraction. A management tool would not necessarily know that 0.9 is actually larger than 80. Normalization converts incoming information into consistent formats and data ranges. Any tool that subscribes to the ObjectServer can use the normalized data.

Transient conditions are a burden for the management team. An arriving alert can take staff time and effort to set up new measurements, select troubleshooting tools, and launch a trouble ticket. Transients may have already died down, leaving the staff with nothing out of the ordinary to measure and analyze. The Netcool auto-clear function tracks these transients and removes them from the active list when they disappear by themselves.

The Netcool/Impact management tool adds the intelligence to transform element information into service-centric perspectives. Impact enables the staff to build service models and associate them with actual elements. Whenever an element fails, Impact determines which customers and services are affected. It uses other information to assign the event the proper priority so that the staff guides the workload accordingly. Finally, Impact provides the problem resolution policy associated with the failed element.

Micromuse is adding more tools and integrating partner products into the Netcool suite as well. Their basic architecture is copied extensively.