Contact William Rinko-Gay Scorecard and NetResults How we ranked the two in several categories, key findings, hardware supported by EcoSCOPE, Patrol modules and contact info. CompuWare's EcoSCOPE page BMC's Patrol page How we did it: The two applications we tested are network-independent. We connected both products to the network in our server test center, which includes five 100-MHz Pentium-based computers running Windows 95 and two quad-processor 200-MHz Pentium Pro servers running Novell, Inc.'s IntranetWare 4.11 and Windows NT Server 4.0. Our monitoring station was a 120-MHz Pentium-based computer running Windows NT Workstation 4.0. To connect the network we used a 3Com Corp. OfficeConnect 10Base-T hub. We monitored our network during normal operation. Our goal was to determine how well the network was keeping up with our demands. We looked for total bytes transmitted across the network, traffic information by computer, traffic information by application and details about particular transactions where available.

By William Rinko-Gay
Network World, 6/23/97

Is your network under control? Are you sure? Managing your network is more than an exercise in keeping track of assets and watching for problems - you also need to know how changing traffic patterns affect performance. To monitor NetWare and Windows NT-based networks you need real-time information on activity, with a graphical view of the network and customizable reports of the data. Ideally, the software can even spot trends and make recommendations on improving your network's performance.

We compared two recently released products that take slightly different approaches toward monitoring network performance. CompuWare Corp.'s EcoSCOPE provides application and hardware activity monitoring by looking at network traffic on the wire itself. It provides a good graphical depiction of the network and generates reports that are easy to comprehend so you can locate the source of any network problems. Those features helped earn it our Blue Ribbon.

BMC Software, Inc.'s Patrol monitors and controls parameters in the servers and applications running on the servers. For this reason it is less difficult to deploy, but lacks a graphical representation of network connections and doesn't provide any tools to help you with the big picture.

Both products are useful, but neither is perfect. For instance, neither yet supports Remote Monitoring 2 (RMON), which will eventually provide a standard for application monitoring.

Architecture

Single View, which runs on any networked workstation, can do simple management of the Super Monitors, including changing data collection parameters and setting alerts to report dangerous conditions. You can generate long-term trend reports using the Reports Navigator, which relies on a run-time Microsoft Corp. Access engine supplied with EcoSCOPE.

Unlike EcoSCOPE, Patrol is based on agents that run on servers. Patrol agents take advantage of Knowledge Modules (KM), files that tell the agents what to monitor and how to report problems. These separately scripted programs provide tremendous flexibility. You can learn to write KMs to perform tasks or take advantage of the large number BMC Software provides. A single console can monitor the entire network or any portion - you identify the agents to be monitored when you install the console.

Each agent is represented on the console by an icon. Double clicking on an icon brings up the applications the KM is monitoring. Drilling down further you can look at instances of a monitored application, and finally, at the monitored parameters. On an NT server KM, for example, you can see network information such as total bytes transferred per second or processor information such as the percent of CPU time spent in the user space. Displayed data is updated in real time.

Patrol agents recognize dangerous conditions - such as overly full hard drives or poor response times - and sound alerts. They can also correct alert conditions if you program the Knowledge Modules to do so.

Monitoring the network

EcoSCOPE did a good job reporting on Oracle Corp. transactions on our Windows NT server, but not on our NetWare server. None of the database transactions showed up as Oracle transactions. We were able to use the application discovery feature to improve on this situation, but the difference across the two network operating systems was disappointing.

We also wished for a way to move the computers in the topology map to make the screen easier to read, especially on small monitors.

Unfortunately, EcoSCOPE displays all the data that's been collected from the Super Monitors in the database. When you're looking at the topology map, you see the collected activity over the entire monitoring period. The only way to see a real-time view is to create appropriately small collection increments (called intervals in EcoSCOPE) and manually select the increment you wish to analyze. To get an updated look you must select a different interval to view.

This data collection information helps find persistent problems, but it makes troubleshooting a transient problem difficult. EcoSCOPE should provide a real-time mode that would continue to collect data for the database for long-term analysis, but display only data from the last collection interval for a current view of activity.

CompuWare provides a full list of reports via Microsoft Access's real-time engine or via Access if you already have a licensed copy. When you click on the Reports tool from Single View, EcoSCOPE imports your current database into Access, then displays a list of reports. You can select reports by protocol, application, server, workstation, or a combination of these. Your ability to create custom reports is limited, but we didn't need more than the predefined reports CompuWare provides.

Patrol provides a wealth of monitoring and control features that EcoSCOPE doesn't. You can monitor each parameter the KM recognizes. You can send commands to applications or to an operating system from the Patrol console. While you are monitoring a parameter, Patrol updates the screen in real time to give you a current and continuous view of server or application performance. If the KM doesn't monitor a parameter you need to see, you can modify it so it does or write your own KMs with the software BMC provides.

While these features are valuable, they take much longer to learn and require more effort to analyze than EcoSCOPE. Patrol's KMs are excellent at picking up on the parameters on each server and application to monitor, but it doesn't create an overall picture of how your network is doing. You have to drill down to each parameter separately and fully understand each one to know whether it contains information worth drilling down to. If you make a mistake and drill down to the wrong one, you may be required to close and open several windows to get back to the right one. In short, Patrol does nothing to make managing your network easier except allowing you to manage multiple servers from a single location. You still have to integrate and interpret the information yourself, a task which requires a great deal of knowledge and skill.

With this extensibility and flexibility, Patrol is much more powerful than EcoSCOPE, but at the cost of integration of information from the different servers. In EcoSCOPE, you can generate a long-term pie chart showing the percentage of total traffic generated from each protocol or application. With that information, you can drill down in the database to see whether the most frequently used protocol or application is becoming a bottleneck. With Patrol, you must go into the servers in real time to spot the offending component, which can be difficult if the problem is transient and disappears while you are investigating.

Setup

Configuring the Single View application was less intuitive. It was not clear that the topology builder, a topology map editor, was necessary only for items that Single View couldn't automatically discover. Because we didn't have any of those items in our network, we could simply collect our first set of data and the topology automatically appeared. We recommend making this the first option in the Topology Builder menu.

EcoSCOPE discovers applications on its own based on information CompuWare includes. It also provides information on ''conversations'' - basically transactions between nodes - that it can't attribute to applications. If you know an application well enough to recognize it, from its data file extensions or its UDP port, you can teach EcoSCOPE to recognize it as well.

This feature is very helpful, but it could be easier to implement. For example, Super Monitor allows you to define application files by directory but not by extension. This is awkward because the operating system recognizes applications by file extension, not direcory. This means you must specify each directory that contains .doc files as being related to Word - a tedious task. If you have one directory with both .doc and .xls files, you can't distinguish the applications, although you can refer to the aggregate application by a generic name such as ''file server.''

It could also be easier to set Super Monitors to generate alarms. A large list box in the alarm dialog box contains all the applications that Single View recognizes. We'd like to see some kind of hierarchical grouping of this list, by database, Web server, Notes server or other grouping, to avoid having to scroll through the large list every time you set an alarm.

Patrol was not quite as easy to set up. The console installation offers you a choice of which sets of KMs you want to install; none are set up by default.

You can enter the console in Operator or Developer mode. Operator mode is used for day-to-day network monitoring. Developer mode is used to change the way the KMs operate, reprogram the agents and do other development tasks that are run occasionally. The Operator and Developer modes don't share initialization information - identified agents and loaded KMs are not common between the two. If you don't realize this, you might be confused when your icons don't appear.

Because all the agents run on the servers, there are no issues with compatible hardware as there are with EcoSCOPE. Patrol can monitor any hardware that the server and workstation can access.

Once we had the console running, we had to identify the agents we were monitoring; there is no autodiscovery feature as with EcoSCOPE. Agents appear on the console as icons, but there is no connection information to give you a picture of your network.

Individual KMs are much like scripts, so setting up one requires some knowledge of the application to be monitored. For example, you have to establish table spaces and a Patrol account in your Oracle database before you can set up your Oracle KM. This shouldn't be too great a constraint, however, because some knowledge of the application is always required to do effective monitoring. Still EcoSCOPE, by contrast, only requires knowledge of the physical network.

Deployment Issues

Patrol is much easier to deploy because it requires only one computer for the console and that can be a workstation you're already using. The KMs and agents run on servers already in your network. This is more intrusive than EcoSCOPE, but takes up little enough bandwidth to be worth the trade-off. Patrol supports a great number of applications.

Documentation

Patrol comes with a nearly overwhelming array of separate books. Fortunately, the installation manual and Getting Started guide are easy to find and provide navigational tools to the rest of the manuals geared toward the tasks you want to perform rather than the knowledge you want to gain. You may not know whether you need to know how to customize KMs, but you will know whether your job is deploying Patrol or developing new applications.

Summary

Patrol is less expensive to deploy and provides server control as well as monitoring opportunities, but it doesn't have the integrated results nor the long-term database of EcoSCOPE.