Network management systems

If the diversity, size and lack of control of your network remind you of the United Nations, your network might be a good candidate for a network management system. Configuring devices to work together smoothly; translating wildly different user interfaces into a common vernacular; dealing with congestion, bottlenecks and outages; and just knowing what is up and down are some of the jobs an NMS can simplify for you.

NMS products once earned a poor reputation because of their cost, bulk and awkward interfaces. They lacked the ability to comprehensively manage every facet of the devices they supported. Touted as frameworks for component-like network software tools, they were theoretical successes but practical failures. All too often, customers discarded NMS, in favor of management software bundled with devices, servers, operating systems or applications. NMS vendors had to go back to the drawing board.

We’re happy to report the latest versions are responsive, easy to navigate, comprehensive and highly practical.

An NMS worth its salt – and price – should manage, administer, update, monitor, report on, diagnose, troubleshoot, reset, reconfigure, audit (that is, inventory) and secure essentially your entire network. A network administrator armed with a perfect NMS shouldn’t have to resort to vendor-supplied software to manage users, groups, devices or other network resources.

To find the best NMS for your network, we invited several vendors to send their products to our Connecticut lab for evaluation. Hewlett-Packard submitted 27 OpenView components, including Network Node Manager (NNM) 6.31, Performance Manager and Performance Insight 4.5, Operations 7.0, Storage Area Manager, Internet Services 4.0 and OpenView Reporter.

Interactive Scorecard and NetResults

Archive of Network World reviews

Subscribe to the Product Review newsletter

Computer Associates sent us UniCenter 3.0, which includes Network and Systems Management, Service Level Management, Advanced Network Operations and Performance Management.

Lucent shipped VitalSuite 8.2, consisting of VitalNet, VitalApps and VitalEvent. Concord Communications submitted eHealth 5.0, whose components are Network Health, Live Health, System Health and Application Health.

Declining to participate were IBM Tivoli and Micromuse, which said they were between product versions. Aprisma also declined.

Our results show that three of the four products scored well enough to earn World Class Award status. However, the official World Class Award goes to OpenView, for excellence in managing devices through a consistent interface. Its monitoring of network resources and reporting network activities also shined. OpenView scales well, runs on several different platforms and makes network administration much easier.

Fault and performance management

We found OpenView’s core component, NNM, especially proficient at discovering the network, tracking devices, displaying graphical network maps, capturing and providing device statistics, and processing incoming SNMP alerts.

NNM uses Management Information Bases (MIB) from various sources, including bridges and repeaters. It displays some Layer 2 data, but for the most part NNM maps Layer 3 details. It also applies predefined MIB expressions (provided by HP). This impressive list includes utilization and error percentages, total packets by category (in, out and errors), retransmits, Cisco memory utilization, and full-duplex utilization percentage. NNM’s root cause problem analysis helped us zero in on the specific device causing an outage or slowdown in each test.

OpenView’s Internet Services is an excellent tool for tracking service-level agreement (SLA) violations. For services we defined, from general Web access to particular e-commerce transactions, it noted availability and response-time details, and alerted us when SLA parameters were exceeded. We especially liked the Performance Manager component. Via agents we installed on target servers, it gave us a wealth of information about network resource utilization that we found useful for problem determination, trend analysis and capacity planning.

For Web-based applications, OpenView Transaction Analyzer successfully pinpointed performance bottlenecks and congestion points. However, Transaction Analyzer isn’t as comprehensive or precise as VitalSuite’s Transact Toolkit.

Unicenter’s event management impressed us with its highly organized and easily accessed catalog of network activities and incidents. When we wanted to see the greatest amount of information about one or more events, the Event Console within Unicenter’s Enterprise Manager easily and quickly revealed the repository’s wealth of detail. Creating a new event type is simply a matter of supplying parameters such as domain, node ID, device type, error condition characteristics and an action to take when the error occurred.

We liked the way the Network and Systems Management tool made quick work of locating our network’s deliberately caused trouble spots. The tool highlighted problems beginning at the top level, saving us from looking at downstream errors not directly related to the real problem. Via its agents, Unicenter monitored our network segments, devices and servers. Not quite as comprehensive or full-featured as VitalSuite’s or OpenView’s performance analysis tools, Unicenter’s Performance Management component is nonetheless highly useful for staying on top of potential network and server problems. Based on thresholds we set, Unicenter’s agents detected imminent problems and sent traps (alerts) to Unicenter’s Distributed State Machine, which analyzed the event, recorded it in Unicenter’s event repository and signaled the Network and Systems Management tool to display the object’s critical status.

For detecting problems before they happen, Unicenter’s Historian analyzes network events and activities to show baselines, trends and projections for periods you select.

VitalSuite is a cohesive collection of components for monitoring network activity, ensuring SLA compliance, tracking network performance and watching over applications and their transactions. VitalSuite accurately and easily pinpointed deliberately caused connectivity faults and performance slowdowns in all our tests (See How we did it).

VitalSuite consists of VitalNet, VitalAnalysis, VitalHelp, VitalAgent, AutoMon and the Transact Toolkit. VitalNet collects data from SNMP-aware devices and from desktop computers where you’ve installed the VitalAgent client software. VitalNet relays the information to VitalAnalysis and VitalHelp. VitalAnalysis monitors applications and maintains an historical analysis of system and application performance and trends. For capacity-planning and other purposes, it stores a year’s worth of data in the included Microsoft SQL Server database.

VitalHelp assesses the health of TCP/IP-based applications. When it determines the cause of a problem, VitalHelp posts alerts to a network administrator via e-mail, pager or SNMP traps to an NMS such as OpenView. VitalSuite’s AutoMon is a script-driven synthetic transaction engine, and the Transact Toolkit lets programmers define unique business application transactions for VitalSuite to monitor.

Concord’s Live Health actively polls SNMP-manageable devices to determine their status and condition, and it displays in real time Live Health’s detection of faults, potential outages and response-time delays. Network Health monitors the performance and availability of WAN interfaces, routers, switches, Frame Relay circuits and remote access equipment. System Health monitors servers and clients to alert administrators to application performance problems, server crashes and disk space shortages. Application Health is a transaction-oriented collection of tools for determining the cause of poor application response times. An Application Assessment component of Application Health keeps watch over server software.

Like VitalSuite, eHealth is an OpenView complement because it too sends SNMP alerts that OpenView can process. However, VitalSuite and eHealth are primarily monitoring tools, and they lack OpenView’s and Unicenter’s ability to manage, control and configure a wide breadth of devices.

EHealth’s discovery process is quick and accurate. By default, eHealth discovers network nodes daily at midnight, but users can run the discovery process interactively or schedule discovery to occur on specific days and at specific times.

At 5-minute intervals (or less often, if you wish), the SNMP polling process probes the condition and status of network devices. EHealth understands a plethora of MIBs, and it correctly recognized specific Lucent and Cisco router models, Hitachi switches and all the other devices in our lab. Concord supplies MIB definitions for more than 500 SNMP-aware devices. EHealth uses these MIBs for determining device performance and availability. It stores the collected network device information for six weeks in its bundled Open Ingres database. Via Open Database Connectivity, eHealth also worked well with the Oracle, Sybase and Microsoft relational databases in our tests.

Initially, eHealth builds a baseline that characterizes a network’s normal behavior. It excels thereafter at highlighting out-of-the-ordinary events, such as excessively high or low traffic through a router or switch port, based on a set of multifaceted and highly configurable rules. EHealth’s default rules, which are easy to tune and tweak, perfectly adequate for our network. The rules help eHealth identify exceptions such as a WAN port whose activity varies wildly from its historical day-of-week and time-of-day historical usage patterns. Once eHealth displays an exception, a network administrator can choose to monitor the problem device in what Concord calls fast mode, in which eHealth polls the device up to twice a minute. EHealth offers real-time monitoring of server parameters such as CPU utilization, memory usage, memory paging/swapping and log file entries.

Reports

All four products produced excellent, highly useful reports in our tests. We especially liked OpenView’s Performance Manager network metrics, Unicenter’s Severity Browser, VitalSuite’s Heat Chart and eHealth’s ability to emit Acrobat PDF files.

OpenView’s NNM report generation is so easy it took just a few minutes to generate daily reports on general availability, Cisco routers, top talkers and asset inventory. NNM’s delivery of performance data via e-mail reports, which contain HTML links to individual devices, was simple to set up and thoughtfully designed for use over bandwidth-challenged dial-up remote connections. NNM also gave us useful statistics on our network’s protocols. OpenView Reporter is a flexible, comprehensive tool for mining OpenView’s plethora of network detail. Configuring Reporter to produce custom reports is fairly simple, but not quite as straightforward as defining reports in VitalSuite. You can tell Reporter to format its reports for printing or as Web pages. Its performance data graphs are revealing and helpful, but OpenView’s Performance Manager is the ultimate in performance monitoring. Performance Manager has a graphing function for monitoring performance in real time, a zoom feature for seeing network metrics in greater detail for a specific time period and multiple graphing options (including linear, exponential and s-curve, all with confidence levels). Trend Performance Manager, a repository and database engine, and Performance Insight for Networks add the ability to accurately forecast network resource utilization.

Unicenter provides a variety of helpful reports. The Java-based Management Portal component, consisting of notification summary pages, Business Process View pages and SLA pages, shows an expandable tree view of business entities you specify. For the entire corporation and for each entity, the Management Portal workplace shows utilization levels, error events and SLA violations. Drilling down through the workplace to see smaller groups of network resources or a specific resource takes just a few mouse clicks. Unicenter’s Topology Browser shows managed objects for the portion of the company you’ve selected, while the Severity Browser takes you directly to detailed event data identifying the resources associated with an outage or performance slowdown.

VitalSuite’s key report, Heat Chart, made troubleshooting application bottlenecks a breeze with its at-a-glance identification of problems and their causes. Each Heat Chart displays a color-coded matrix of application performance factors and computing components, termed resource classes. And each Heat Chart cell corresponds to a resource class and a performance metric. Heat Chart cells change color to indicate the health of the underlying computing resources that comprise each corresponding resource class.

VitalSuite reports application performance data in three views: Business, Applications and Reports. Customizing the Business view as My Vital or My Business is a preference you can configure, with each view a different way of looking at performance metrics from application and network statistics. The My Vital personal Web page is highly configurable and uses password protection to restrict access to and configuration of the page. The Applications view groups tab-indexed information into categories such as domains, groups, clients and servers. Each tab index displays network-related application performance criteria, including lost packets, round-trip delays, availability, response-time throughput, and client, network and server delay times.

Producing useful and easy-to-understand network status reports is a Concord strong suit. EHealth’s reports showed device information by time period, relationship to the organizational structure and type of behavior or exception. We could see devices that experienced problems, by type of problem, and those associated with a particular application. EHealth’s reports are excellent for capacity planning, monitoring Web site responsiveness, guarding against network hacking attempts and tracking hardware and software assets. EHealth can display its reports through its quick and responsive Web interface, or it can generate Adobe Acrobat PDF files for viewing or printing.

Ease of use

NMS user interfaces used to be ponderously slow and confusing. Fortunately, vendors have completely revamped their native operating system consoles and augmented them with smart-looking, well-designed Web-based instrument panels.

In addition to its native mode (Windows or Unix) display, OpenView NNM sports a browser-based interface. NNM is an intuitive tool that makes network management easy. NNM’s native mode display basically offers report scheduling, configuration and filtering options, network maps, event notifications, device detail, statistics and alarms. The Java client can show network maps, device detail, alarms and a variety of reports, including asset inventory. NNM’s dynamic Web pages are especially well-designed. Easy and clear filters make it possible to manage large networks with NNM.

Unicenter offers tree-view, tabular, 2-D and 3-D manipulation and display of its managed objects. For global companies, the 3-D display shows a firm’s entire network on a rotating representation of Earth. If a site is having problems, Unicenter draws a red ball over the site. Each click on a red ball takes you to a city, a data center site, a network domain, a network segment and the device or server associated with the error.

On the 2-D map, Unicenter’s interface also uses screen colors to its advantage. If Server XYZ is exhausting its memory resources, Unicenter colors XYZ’s network domain red (from green). Drilling down through the tree displays ever-increasing network segment detail regarding the context of the error until you come to Server XYZ’s “Physical Memory” error condition.

The Unicenter Management Portal is an intuitive, Web-based tree view of business entities and the network resources the entities use. The 3-D display is fun to use, but we found ourselves spending most of our time in the Management Portal as we managed our network with Unicenter.

We especially liked VitalSuite’s responsive and intuitive user interface. It was surprisingly easy to use in light of its complexity. VitalSuite’s flexible architecture impressed us with its ability to handle a variety of business application environments. VitalSuite is so finely scalable you can choose to install, for example, the reporting server module on a separate computer.

EHealth presents its collected performance metrics and device status data via a browser-based interface, a server-based console and Adobe Acrobat-based reports. EHealth also can send device status and condition data to network management products such as HP OpenView. It graphically depicts the network as a “fish bone” – a spine whose ribs represent the different network segments.

EHealth’s server console uses SCO’s XVision PC X server to display screen data. As a result, eHealth’s user interface scored a bit lower because it isn’t quite Windows nor pure X-Windows but a hybrid of both. Via its SystemEdge component, eHealth can e-mail or page someone when a problem occurs, and it offers links to third-party help desk programs. It also can restart failed processes automatically.

OpenView, Unicenter and eHealth run on many platforms, including various Unix flavors and Windows NT/2000. Some OpenView and Unicenter components even run on mainframe and AS/400 computers. But not all components run on all supported platforms. Unicenter’s Web-based Management Portal requires Java on NT/2000. On the other hand, Unicenter has special support for displaying system events on or accepting commands (such as rebooting a particular server) from a wireless Pocket PC. VitalSuite runs on NT/2000.

Despite their complexity, all four products are easy to install and have excellent online documentation. Only Lucent supplied full printed documentation with its product. CA and Concord also provided Getting Started guides.

Conclusion

All four products are mature, well-crafted and thoughtfully designed. We suffered nary a crash during our testing. With its wealth of features, useful reports and consistent user interface, OpenView emerged the winner. However, each product is an excellent, worthwhile addition to large networks in need of management and control.