Digging into the DCAB’s 6 functional areas: Resource Reconciliation

 The second up and coming area goes by many names these days.  Some call it next-generation asset management, many others call it CMDB.

I’m calling it resource reconciliation as I would like to see it extend beyond a discovery engine, IT asset database, dependency mapping and the necessary graphical topology and reports.  I also believe that these tools not only should communicate directly with the infrastructure outlined in the Data Center Automation Blueprint (DCAB) – but also synchronize and provide reconciliation capabilities with the 5 other DCAB functions.

What I’m saying is I want to make sure that all my other functional products always are 100% accurate to what my IT infrastructure contains.  There is no reason my performance & capacity products don’t know about a specific IT resource.  Nor, do I want multiple discovery engines combing my infrastructure setting off false alarms in my security products or requiring me to open additional communication avenues making the infrastructure less secure.

Here are a list of the vendors I know of, this space saw some major consolidation during  2006.

BMC
CA (Cendura acquisition)
EMC (nLayers acquisition)
HP (Opsware acquisition)
IBM (Collation acquisition)
Symantec (Relicore acquisition)
Tideway

Another area I’m researching and pondering inclusion in this category are service catalogs (e.g. NewScale)  Any thoughts or opinions on how they compare to the players/products  above?

What are the most desired features in IT Process Orchestration (e.g. RBA)?

Alright, looking for feedback on this one. After talking about the players in the IT Process Orchestration space, I’m wondering what are the primary capabilities people are looking for?

Here are my top five, please feel free to throw down yours in the comments below:

1. Drag/Drop graphical interface for designing process workflows
2. Common, normalized Data Model of common/primary attributes
3. Library of pre-defined, re-usable actions/triggers/processes for usage out-of-the-box (bigger the better – even a community that shares is a plus)
4. Policy/Desired-state engine driving things
5. Sandbox, simulator to help test workflows without impacting actual resources/instances within the production enterprise.

Beyond these five core capabilities, depending on the processes you wish to automate you need to verify what interaction/communications protocols are supported (e.g., SNMP, WMI, JMX, ODBC, Telnet/SSH/FTP to CLI, XML/Web Services). Make sure they have what you need to communicate with.

Of course, it also goes without saying (just like with any commercial product) table stakes require RBAC security, reporting, logging, appropriate hardware/software requirements.

Bottom line, I guarantee if your a medium to large enterprise you have current manual processes that these products can automate for you! Reducing errors due to the mundane nature of that task, freeing up people currently doing the task for other projects or tasks and also the intangible benefit of it’s simply faster which provides better customer service depending on the process that is automated. Make this a priority in 2008 and get one of these vendors in there to help out!

Disclosure: I have no relationships with any of the vendors in this space. The comments are all made based on my personal experiences and perspectives.

Digging into the DCAB 6′s functional areas: Process Orchestration

Alright, back on track with our review of the 6 functional DCAB areas. We are now onto the hottest, fastest growth areas! First up, Process Orchestration or what Gartner has coined as Run Book Automation?

These products offer the ability to define, build, orchestrate, manage, monitor and report on workflows that automate specific IT intra or inter domain processes (intra = between different products for the Windows Server team or inter = between the application and network team). There are a ton of case studies and examples on most the players websites.

A couple quick examples to get a flavor include:

A monitoring product identifies a specific condition (e.g., an outage), it then checks a configuration auditing product to see if a recent change was performed for that system.

A configuration auditing product monitoring if a device is in or out of compliance notices an situation and then automatically opens a trouble ticket. Later, it notices again the situation has been resolved and it adds the appropriate details to the ticket and automatically closes it out.

Here are the companies I know about (as always, in alphabetical order)

BMC (formerly RealOps)
Enigmatec
GridApp
HP (formerly Opsware, formerly iConclude)
IBM (formerly ThinkDynamics)
LANDesk (Process Manager product)
NetIQ (Aegis product)
OpTier
Opalis
Optinuity
Scapa Technologies
Stratavia
UC4 Software
xTigo

As always, who am I missing. What are the opinions out there from users or evaluators for each platform (please chime in down in the comments section). I have personal product exposure and experience with only BMC, Stratavia. Some of the key features that I learned from those products included the value of having a normalized, common data model and “action” abstraction capabilities so you re-use previous process actions in new workflows.

Here are a couple good reviews and write-ups for further reading if desired.

Data Center Manager Primed for IT Process Automation
IT Process Automaton Overview and review of some players

Came across a great BSM blog series in process

During the holidays I came across this great blog by Mark Lynd over at Firescope here in Dallas, currently at part 3 in what should eventually be a 6 part series on BSM.  Since it’s on the same path and talks concepts/ideals for IT Management it provides insights around capabilities that also apply to automating your data center through software.  I’ve subscribed now and look forward to reading the next 3 parts.  Here are the first three parts.

Part 3 – History of BSM – great little run down of ITSM, ITIL, BS15000 and MOF and how it leads into the current state of BSM.

Part 2 – Intro to BSM Fundamental -  define the goal of BSM and five supporting points involved with accomplishing that goal.  The goal as defined by Mark is “…To Manage IT investments in alignment with business priorities in order to create competitive advantage.”

Part 1 – Defining BSM

Cisco and BMC? Why IT fears ITIL?

Here are a couple more reads as I play catch-up from the holidays. First up, ITIL then some thoughts around a recent interview with John Chambers at Cisco.

10 Reasons why ITIL spooks IT managers, originally written back in October by NetworkWorld, it was noted by another blog I read so I checked it out. One more I would like to add making it 11 is around challenges with “organizational stability”. Companies evolve to fast – i know sounds odd (e.g. reorganizations), technologies keep offering new approaches or benefits (e.g., virtualization), M&A activity that requires trying to blend two different organization and the technical and political challenges that offers Bottom line, there are just way to many things conspiring against something so all-inclusive from the top-down that takes years and years and year to accomplish. It touches ever part of the business and it’s snot elf-contained or focused like deploying a new financial application. Now I’m not saying ITIL isn’t useful, for example CMDB (e.g., configuration management) is something all large enterprises should have in my eyes. The amount of savings could/would be immense around effective utilization of resources, reducing redundancies, keeping every thing/one on the same page and the list goes on (more on that when we talk resource reconciliation next week).

Cisco’s John Chambers interview with Paul Musich titled “Cisco Charts New Course” was an enjoyable read as you attempt to read in between the lines and ponder Cisco’s strategy.

My personal thoughts from this center around Cisco’s push into collaborative applications being about driving bandwidth intensive applications to sell more/protect current investments companies have made in network plumbing (everything but servers, storage, desktops) while trying to find a bigger piece of the IT pie. They have to be careful not to upset the apple cart as they wish to bite off more of that IT budget pie. Since applications aren’t core to the main players that channel/sell (e.g., HP, IBM, EMC, Microsoft) their current cash cow products this ensures only light co-opetition today versus hard head-to-head competition. To date their application choices have been very calculated around unified communications and collaboration, not generalized. So with that said I’m not so sure they are about to just yet take that big jump and go after a more general application strategy (e.g., BEA). I think they have some maturing plans here which include finding a way to more efficiently manage applications, then maybe later in 2008 or early 2009 watch for that next step down the stack from actual applications to enabling the development of applications. I started pondering this back in December where I started making the case for Cisco acquiring BMC. With that said, if they do “go large” in IT management and grab BMC instead of someone like BladeLogic then scrap my thought on them doing the BEA thing.

Data Center Automation 2008 perspectives

Time to push pause on reviewing the 6 functional areas of the DCAB, just way to many interesting news articles, survey and blog postings to talk about now that everyone is back from the holidays. I’ll pick up on those two rapidly evolving areas that include CMDB & Run Book Automation next week, I’m also in the process of organizing my thoughts and some research around virtualization which should hit the week after that (just to much going on).

Interesting read here that still thinks data center automation will “inch” along this year. I’m struggling to agree with the perspective of “inching” along. I honestly believe 2008 will be a blockbuster year of growth for DCA. There are so many non-mission critical processes that administrators are just bored and tired of doing. Even if software doesn’t work 100%, it will still be a major, major improvement over the “x” people pushing the same buttons over and over today. I do agree that we are years away from “turning over the keys to the data center” if you will. Actually, I’m not sure we ever will, but it could/should be a long range goal to strive for…but the idea of a “lights out data center” is in my opinion for the traditional enterprise 15-20 years away.

Which on that same thought leads to what may be a somewhat controversial article talking about a new book calling for the “Fall of IT.” Pretty bold to some degree but is it really that bold…the argument about electricity makes sense but is to some degree beyond many (including mine) sense of reality as that didn’t happen during my lifetime. If I think about it, telephone service is the same way…automation has reduced quite a bit of manual labor. But even still, in both those spaces we still have innovation taking place, so will it ever “die” – I think not…but their may some points in the book about how it will evolve. Sometimes books like this are fun. They have the ability (like science fiction) to get those creative brain juices flowing toward “what will things look like in 20-30 years.” Needless to say, I think it will be an interesting read as we continue strive towards more automation of not just the data center, but IT as a whole.

Digging into the DCAB 6 functional areas: Security and Protection

The massive number of security management vendors make simply covering this portion of the DCAB a very intimidating task. So many technology approaches and different data center technology focuses (e.g., networks vs. system vs. applications etc). I’ve attempted a first pass at sub-dividing this functional area. I know that do to it’s vastness, I’m going to miss tons of vendors I already know about and also stretch the categories a little in my attempt to limit the number of sub-divisions.

Proactive Identification (proactive searching for a potential exposure point that could become a situation) which includes:

• IP Scanning – query remotely that simply requires IP address to gather information and determine if their is a potential condition of concern. Vendors include: eEye, nCircle, Nessus, Qualys, McAfee, Rapid7
• Configuration/Settings Auditing – query remotely (using credentials) or having an agent on the system to take a more details look at the configuration files, etc. Vendors include: ConfigureSoft, Ecora, nCircle, Tripwire, Solidcore, Skybox Security
• Penetration Testing – remote query attempts to actually expose or harm a data center resource. Vendor include: Core Security, HP (former Spi Dynamics), IBM (former Watchfire), Imperva, Mu Security, BreakingPoint Systems

Reactive Identification (reactive, collecting of events or watching data flows to identify a condition or re-occuring trend)

• Security Event Consolidation (aka. SEM) – unified view of events from a variety of sources with the hope that you can quickly identify a problem and resolve it sooner after it occurred, or seeing something that tells you that problem may be about to happen. Vendors include: ArcSight, NetForensics, EMC/RSA
• Information Archival & Reporting (aka. SIM) – archiving and then the analysis and mining of all that event data to identify a re-occurring situation that could be resolved. This archive is also a great resource for reporting certain compliance situation to auditors. Vendors include: ArcSight, NetForensics, LogLogic
• Data Leakage – monitoring activities or traffic flows to identify if sensitive information is being . Vendors include: EMC/RSA (Tablus), Reconnex, Symantec (Vontu), Vericept

Alright, that will have to do for now. Identity & Access Management is a whole other area but this will have to do for now. Wow, I’m really starting to realize that this DCAB was biting off more then I could honestly chew Hopefully, it will prove helpful to someone out there. When I do start to make updates the best way to manage that may be moving this to a wiki.

Quick status check, I’ve now taken a first pass on 4 of the 6 functional areas (and most of them require/deserve a return visit sometime soon). Each functional area alone probably could/would be topic enough for an individual blogger (any volunteers). I’ve also had some great recent conversations with people on virtualization, process orchestration and resource reconciliation that i’m eager to talk about. So as I’ve stated before, comments are open for anyone and everyone to add thoughts and commentary. Which vendors did I miss, what capabilities/functions did I miss as we monitor the security in our data center.

Digging into the DCAB 6′s functional areas: Configuration and Change

There seem to be two key components or approaches to this functional area. Some vendors are focused on auditing & monitoring the configuration/state of a device while others are focused on that and the provisioning/deployment of configuration/software to a device. Typically, the vendors going across data center technology categories are audit-centric.

Vendors doing both Deployment & Auditing (listed alphabetical)

• AlterPoint (for network devices)
• BladeLogic (for appilcations, servers)
• BMC (for applications, servers with Marimba acquisition and networks with Emprisa acquisition)
• CA (for systems)
• Cassatt (for systems, applications, networks
• Cisco (for network devices)
• ConfigureSoft (for applications, servers)
• Ecora (for servers, applications)
• EMC (for network with Voyence acquisition, for storage with ControlCenter)
• HP (former Opsware for applications, servers, networks, storage)
• IBM Tivoli (for applications, servers)
• mValent (for applications)
• Phurnace (for applications)
• Scalent Systems (for servers, applications)
• Symantec (for servers, applications with Jareva, Altiris and storage with CommandCenter)

Vendors focused on Auditing

• Solidcore (for servers, databases, networks)
• Tripwire (for servers, databases, networks)

Vendors that do both primarily for desktop’s which extends to provide some server configuration and change capabilities for the data center

• Avocent (from Landesk acquisition)
• Lumension (former Patchlink)
• Microsoft (former SMS product)

Just as with my previous post on Performance & Capacity I’m not done with this one. I started going through the laundry list of vendors in the “virtualization” space but simply ran out of my allocated time for today. So I’ll pick back up on it at a later time

Month in Review – December 2007

Thanks for all your feedback and ideas during this months postings. Keep them coming.
Development of Data Center Automation Blueprint (DCAB)

• What are the Six Functional Areas of Data Center Automation - first stab at a graphic attempting to capture they key areas of management software to help automate the data center.
• Next pass on Data Center Automation “Blueprint” – based on some feedback and further brainstorming took another pass at a graphic.

Reviewing Details within some of the DCAB functional areas

• So let’s start to dig into each of these 6 functional areas: Availability and Notification – first pass at looking at monitoring the availability of data center assets.
• Digging into each of these 6 functional areas: Performance and Capacity – first pass at looking at monitoring the performance of data center assets.
• Recent activities in Configuration Management, tis’ the season on webinars - looking around a noticed lots of the CCM vendors have been busy giving webinars.
• Availability Management, so what’s been going on here? - quick mention on what is going on here.

Overall DCA Trends and Observations

• Pondering Cisco and their play in Data Center Automation… – after reading some other blogs it got me thinking about Cisco and DCA.
• Data Center Virtualization Automation/Management is becoming very, very congested - a list of virtualization management players that span all areas of the DCAB
• 2 of 10 are “disruptive” according to Gartner – CMDB’s and Process Orchestration mentioned by Gartner.
• Great IBM Tivoli ESM Recap, quick stab at mapping to DCAB – read a nice blog posting from John Willis and inspired me to take a pass at mapping it.
• BarCampESM, January 18-20th, 2008 – learned about this upcoming meeting
• Great write-up on Security Management activities this year – quick summary of M&A activities in Security Management

Out with 2007 and in with 2008, Happy New Year!

Digging into each of these 6 functional areas: Performance and Capacity

First things first, we have many of the same vendors from the Availability & Notification functional area of this Data Center Automation Blueprint in this category. Which probably begs the question, do we combine Availability & Notification with Performance & Capacity? I know in the OSS (not Open Source Software but telco-oriented Operational  Support Systems) model they do this and call it “Service Assurance”, another name could be Service Level Management as they two monitoring-centric functions are about ensuring service levels are met…or simply I call it Availability & Performance? I’ll come back to this at the end after I type up the players in this Performance & Capacity area:

• BMC – Performance Manager & ProactiveNet Analytics
• CA – eHealth (former Concord)
• IBM – Netcool Proviso (former Quallaby that Micromuse acquired), Monitoring
• HP – Performance Manager, Performance Insight, Operations
• Quest Software – Foglight, PerformaSure
• Symantec – i3 (former Precise product line Veritas acquired)
• EMC – IP Performance Manager

But then, we have a slew of others that have been around for quite some time now…

• InfoVista - In January ’07 Microsoft announced a $15M licensing deal of their product
• NetQoS -
• Netscout – nGenius & Network General (acquired in November ’07)
• Compuware – Vantage
• Alcatel-Lucent – VitalSuite (former INS)
• Fluke Networks (they also OEM NetQoS’ products)
• Network Instruments (also have reseller relationship with NetQoS)
• NetIQ – AppManager
• Opnet
• Entuity
• Brix Networks
• Keynote
• Gomez

And some innovative up-and-comers in some unique technology/approaches…

Real-Time Behavior/Pattern Analysis through Dynamic Thresholding

• Netuitive
• Integrien

IP Traffic/Packet Flow Monitoring & Analysis

• Xangati
• Apparent Networks
• Packet Design

Open Source Software (OSS) vendors

• Groundwork
• Hyperic
• Nagios
• OpenNMS
• ZenOSS
• Zabbix

Whew..that was more work then I expected to pull together and I’m not done yet…  Please throw into the comment who I’ve missed (I know there has to be a few).

The major challenge here is organizing and breaking down this functional area.  There are so many approaches to obtain performance metrics from/for the data center.  Some of the techniques and perspectives include;

• passive vs. active
• agent vs. agent-less
• in-line appliance vs. out-of-band appliance (e.g., span a port)
• proprietary vs. leverage infrastructure mgmt. capabilities (e.g., Cisco Netflow)
• outside the data center looking in vs. inside the data center itself.
• Reactive troubleshooting vs. Proactive Predictive

I’m going to need to have a part two (and maybe more) for this functional category breaking down the pro’s and con’s of various approaches.  Which vendors do what, etc.  I also need to revisit that question from the top of do we combine this into a single “availability & performance” functional category???  For now, this first pass will have to do…