The doctor will see your network now

While last month's network statistics can help you spot trends or become fodder for capacity planning efforts, there's nothing like real-time data when you're working in the trenches to keep a network running. You need the current condition of the network presented in a clear, simple and unambiguous form. If you have to spend minutes - or hours - analyzing real-time network data to find problems, the data's no longer real-time. It's historical.

Concord Communications offers a useful network-statistics reporting tool called Network Health. The company claims its new complement to Network Health, called LiveHealth, collects real-time data and reports it in an easy-to-understand, comprehensive and timely way.

We found in our labs that LiveHealth lived up to Concord's claims. We were impressed by its variety of excellent reports, its support for more than 500 kinds of SNMP-aware devices and its flexibility. However, LiveHealth lacked the ability to display a network's topology, didn't offer corrective actions and was harder to install than we expected.

NetResults

LiveHealth (part of the eHealth 4.7 suite)

Rating 7.30 COMPANY:Concord Communications (508) 460-4646, www.rockliffe.com COST: Starts at $35,000. PROS: Superior reporting, highly configurable; understands more than 500 MIBs. CONS: Can't pause the discovery process; expensive; difficult installation.

Disc. 30% Mgt. 30% Rep. 20% Doc. 10% Install 10% Total 8 7 9 6 4 7.30 Individual category scores are based on a scale of 1 to 10. Percentages are the weight given each category in determining the total score. Scoring key: 10 - Can't be better;9-8 - Excellent; 7 - Very good; 6-5 - Average; 4-2 - Needs improvement; 1 - Not supported or doesn't work.

The right information, right now

A four-part suite of network monitoring components, eHealth consists of LiveHealth and separately licensed Network Health, System Health and Application Health modules. LiveHealth provides network administrators with an up-to-date network connectivity fitness report for LAN and WAN links. We found it scales well across an extensive breadth of different-size networks.

LiveHealth actively polls SNMP-manageable devices, determines their status and condition, and displays the result in real time. LiveHealth can present its collected performance metrics and device status data via a browser-based interface, a server-based console and Adobe Acrobat-based reports. We found it can also send device status and condition data to network management products such as Hewlett-Packard's OpenView. Indeed, LiveHealth is an effective addition to OpenView.

EHealth is complex software. In addition to its sophisticated network monitoring and reporting elements, it comes with the CERN Web server for rendering management data and reports as Web pages, an Open Ingres database engine for storing network device data and The Santa Cruz Operation's XVision PC Xserver, which LiveHealth's server console uses to display screen data.

LiveHealth's discovery process is quick and accurate. By default, LiveHealth discovers network nodes daily at midnight, but we could use the server console to run the discovery process interactively or schedule discovery to occur on specific days and at specific times. The process isn't restartable. For example, if you're running it interactively and want to pause it for a while, stopping the discovery process results in LiveHealth discarding what it's found.

At 5-minute intervals (or less often, if you wish), the SNMP polling process probes the condition and status of network devices. LiveHealth understands a plethora of Management Information Bases (MIB), and it correctly recognized Lucent and Cisco routers, Samsung and 3Com switches, and the other devices in our lab.

How we did it We installed the eHealth 4.7 suite, which includes LiveHealth, on our six-segment Fast Ethernet network. Each segment consisted of a NetWare 5.0 or Windows NT 4.0 file server and 10 Windows 95/98, Windows 2000 Professional, Macintosh System 8 and OS/2 Warp 4.0 clients along with an SNMP-manageable switch, a Lucent or Cisco router, DSU/CSU and an SNMP-manageable hardware probe. In each test, we looked at LiveHealth's ability to discover our network nodes, monitor those nodes for availability, help troubleshoot problems and report on the status of the network's devices and connections. The LiveHealth server component ran on a NT 4.0 Service Pack 5 Gateway NS-8000 computer with dual 333-MHz Pentium II processors, 512M bytes of RAM and three 9G-byte SCSI RAID drives. In addition to using LiveHealth's bundled Open Ingres database, we alternately connected LiveHealth to Oracle, Sybase and Microsoft relational databases running on an NT 4.0 Service Pack 5 Gateway NS-7000 computer with a single 333-MHz Pentium II, 512M bytes of RAM and six 9G-byte SCSI RAID drives.

Concord supplies MIB definitions for more than 500 kinds of SNMP-aware devices with LiveHealth, far more than most network monitoring products. LiveHealth uses these MIBs to determine performance and availability, but not network topology - LiveHealth doesn't capture device and port dependencies and thus can't produce graphical maps showing network hierarchies. It stores the collected network device information for six weeks in the Open Ingres database. LiveHealth also worked well with Oracle, Sybase and Microsoft relational databases in our tests.

In its first few days, LiveHealth builds a baseline that characterizes a network's normal behavior. It excels thereafter at highlighting out-of-the-ordinary events, such as excessively high or low traffic through a router or switch port, based on a set of multifaceted and highly configurable rules.

We found that LiveHealth's default rules were adequate for our network. These tweakable rules help LiveHealth identify exceptions such as a WAN port whose activity varies from its historical day-of-week and time-of-day historical usage patterns.

Once LiveHealth displays an exception, a network administrator can choose to monitor the problem device in what Concord calls fast mode. LiveHealth polls the device up to twice a minute to help the administrator track the situation.

Instead of issuing an alert every time network behavior exceeds a threshold, LiveHealth uses its baseline as a guide to eliminate duplicate alerts and thus help network administrators separate the wheat from the chaff.

LiveHealth doesn't offer external alerting functions, such as e-mail or paging, but relies instead on links to third-party programs (such as HP's OpenView) to provide such notifications or take corrective actions.

Concord's expertise in producing network status reports is apparent in LiveHealth. For instance, its reports showed us device information by time period, relationship to the organizational structure and type of behavior or exception. We could also see devices that had experienced problems, by type of problem, as well as those associated with a particular application. LiveHealth can display these reports through its quick and responsive Web interface, or generate Adobe Acrobat PDF files for viewing or printing.

LiveHealth runs on HP-UX, Solaris, Windows NT and 2000. The documentation is comprehensive but should include a better road map to help users find the various software component discussions in the manuals.

LiveHealth's installation was more difficult than we expected. For example, it left the XVision PC X server in a disabled state, which caused LiveHealth's refusal to start the first time. A text file of troubleshooting tips provided the solution, but clearly Concord should have enabled the X server during the install.

Overall, we found that LiveHealth's focus on performance and its extensive reporting is just what the doctor ordered.

Nance, a software developer and consultant for 29 years, is the author of Introduction to Networking, 4th Edition, and Client/Server LAN Programming. He can be contacted at barryn@erols.com.

Nance is also a member of the Network World Global Test Alliance, a cooperative of the premier reviewers in the network industry, each bringing to bear years of practical experience on every review. For more Test Alliance information, including what it takes to become a member, go to www.nwfusion.com/alliance.