The art of managing an SOA

Changing business requires high-performance service-oriented architecture.

Managing application services quality is becoming a critical IT discipline as companies increase their service-oriented architecture (SOA) deployments.

There are plenty of vendors on hand to help, including those with SOA testing and validation tools, policy management and enforcement software, and XML processing and security appliances.

Testing the SOA waters

SOA components are difficult to test by conventional means. One reason is that services don’t have an associated GUI. In addition, all the possible interrelationships among services and the applications they support can make it difficult for IT staff to devise a thorough testing methodology.

Enhancing SOA performance Keeping an SOA running smoothly can require a range of products for making sure services development, deployment and maintenance are enterprise-class. Here are some options.
Testing productsManagement toolsXML appliances
Typical functions: Provide test scripts for verifying the quality of services; validate service functions and performance; simulate unavailable services; diagnose development-related problems.Typical functions: Monitor service performance and availability; enforce security and usage policies; report business-level metrics; alert and respond to events and exceptions.Typical functions: Offload XML processing, validation and transformation; provide application and service integration; control access and manage service interactions; provide traffic shaping capabilities; enforce security and usage policies.
Example products: AmberPoint's SOA Validation System, Compuware's DevPartner, HP's Mercury Interactive TestDirector, iTKO's LISA, Mindreef's SOAPscope, Parasoft's SOAtest suite.Example products: AmberPoint's SOA Management System, CA's Unicenter Web Services Distributed Management, HP's SOA Manager, IBM's Tivoli Composite Application Manager for SOA, SOA Software's Service Manager, Progress Software's Actional SOAPstation and webMethods' Servicenet.Example products: Forum Systems' Vantage XML accelerator, IBM's WebSphere DataPower SOA appliances; Layer 7 Technologies' SecureSpan XML Networking Gateway, Reactivity's XML Security Gateway.

“With a multitier application, you knew who your users were, and you scaled it to the number of users. With a service designed for lots of different departments within an organization, performance needs to be thought about early on,” says Frank Grossman, president and chief technical officer at Mindreef.

Mindreef and competitors such as iTKO espouse a collaborative approach to testing that lets different IT staff weigh in throughout a development project. For example, architects can start running regression tests and small load tests to spot potential bottlenecks before a development project gets too far along, “then when you get to the large load testing . . . it becomes an issue of verification rather than the first stress that a system has seen,” Grossman says.

Once in production, services-based applications require management tools that can perform application-layer message inspection and trigger automated policy rules based on headers, payloads and other message attributes. IT managers are investing in tools from specialists such as AmberPoint, as well as familiar management players, such as CA and HP, to more granularly track service performance and availability as well as enforce security and use policies and report business-level metrics.

With a packaged application, it’s not difficult to find out what’s going on using standard management interfaces, says Martin Milani, CTO at Tidal Software, which last week launched a new version of its Intersperse software for monitoring and managing SOA applications. “You can get a pretty good picture of the application by looking at certain APIs or error logs, or perhaps monitoring a database.”

Not so simple

With an SOA application, it’s not so simple. “Even in a simple scenario, [such as] using a J2EE run-time, a Web service is connected to servlets, and there are hundreds of different moving parts, such as EJBs [Enterprise JavaBeans], and potentially a message bus behind the scenes. There are just way too many points of failure,” Milani says. “If you see a degrading of performance, it’s pretty hard to find out what part of the system is not behaving.”

SOA management tools can trace transactions across application tiers to determine why a component’s performance is degrading -- if there’s a problem with the database connection to the persistence layer that an application is using, for example.

Another key feature of SOA management products is dependency planning. SOAs introduce complex operational dependencies -- application and network configuration details that need to be addressed, for example -- as well as business-oriented criteria such as service level agreements and usage policies that need to be managed. Vendors with a focus on dependency management, such as Progress Software with its Actional portfolio, can help users create and keep track of changes to service policies that could affect in-production applications.

“It’s important to do dependency planning, but it’s complex, because you don’t know ahead of time what compositions you're going to have,” Bloomberg says.

It’s a challenge that becomes even greater as companies deploy services outside the firewall, adds David Butler, SOA evangelist at HP’s Mercury Interactive. “As you expose your system externally, the need to monitor at all levels of the system becomes exponentially greater.”

Variety of players

Getting it right requires bringing together players from quality assurance, operations and IT architecture disciplines, Butler says. “Solving the collaboration issue is a big gauntlet in getting good performance in an SOA application, because it’s going to require all of these groups to be able to link together to understand the full system view of performance,” he says. “You want to be able to exponentially add services and service consumers and not impact performance and quality of service. That's the hard stuff.”

Indeed, services-based applications depend on multiple processing steps to occur as loosely coupled components are strung together. As use scales, the volume of message-based communication grows, and if IT staff haven’t prepared for the processing overhead, performance suffers.

“It’s one thing to have a few services that have a few hundred users, but what if you have tens of thousands of users, or services that exchange very large messages, or services that exchange very large numbers of messages?” Bloomberg says. “All of these are potential bottleneck areas that could run things out of memory or cause network slowdowns, for example.”

To keep systems from buckling under the processing load, more companies are considering deploying dedicated appliances that take over such chores as XML transformation, routing and security. By 2009, 40% of 2,000 largest global organizations will use XML appliances as part of their SOA network implementations, Gartner predicts.

Following RouteOne

That’s the tactic RouteOne is taking. RouteOne is a joint venture formed by the financing divisions of DaimlerChrysler, Ford, GMAC and Toyota to streamline the loan-application process for the car dealers and their customers. The company’s new architecture depends on XI50 integration appliances from IBM subsidiary DataPower to mediate between proprietary dealer systems and third-party banking systems

The XI50s handle all the standard SOA chores such as transformations, mapping, routing and making Web service calls -- while maintaining tremendous transaction rates, says T.N. Subramaniam, director of technology and chief architect at RouteOne in Farmington Hills, Mich. "We are really enthusiastic about putting all this on the network and shifting the focus from an application perspective to more of a configuration and operations management perspective. I think there are some very big gains to be made there,” Subramaniam says.

The IBM DataPower appliances also are turning out to be among the most reliable components in RouteOne’s infrastructure, CIO Joel Gruber adds. “So we’re doing security and XML transformations at wire speed. Plus it costs less, it’s more reliable and it scales better. It’s pretty hard not to sign up for that.”

Learn more about this topic

SOA testing tools facilitate collaboration


Mercury strengthens SOA lineup


SOA governance: Preventing rogue services


Join the Network World communities on Facebook and LinkedIn to comment on topics that are top of mind.

Copyright © 2006 IDG Communications, Inc.