I recently spoke to Scott Crawford, managing research director for Boulder, Colo.-based analyst firm Enterprise Management Associates, about compliance on the mainframe. Here’s what he had to say.
Is compliance on the mainframe more of a challenge today than it has been in the past? Why?
I think it’s a question of perception more than anything else. The reason I say that is there has long been the perception that the mainframe is inherently secure. But security professionals shouldn’t think anything is inherently secure. A lot of benefits are based on how the mainframe is managed and administered. Now there’s the challenge of bringing in a new generation of professionals to manage the mainframe. What do they understand about mainframe security and access? How far is the mainframe really extended? How much mainframe functionality is integrated with applications that have high exposure?
Do you see mainframe applications being integrated with non-mainframe apps more frequently now, and maybe more haphazardly?
We have seen a number of system integrators whose primary business focus was integrating mainframe functionality through Web services. LPARs make is possible to host a Linux environment and a z/OS environment side-by-side. It’s also possible to host many common applications in that environment whose exposures are fairly well known. What the mainframe has going for it is a culture of disciplined control and disciplined management. Centralized control gives you benefits, but the risk has to be managed in such a way to get those benefits.
Is there a certain danger around people just assuming that the mainframe is secure?
There are a lot of assumptions around inherent reliability on the mainframe. A lot of security pros come from networking and distributed computing and not as much from the mainframe. They’re not as educated about the mainframe. Even a lot of the people trained as auditors might not have the skills to recognize risks in certain areas. In some case they might not know what they’re looking for, especially if they’re unfamiliar with the mainframe environment.
Is compliance on the mainframe harder than on distributed platforms? Why or why not?
Aspects of it are different as far as the underlying platform. You have to be knowledgeable of things like z/OS, RACF, and other products like (CA’s) Top Secret. You need to know things such as console operations and securing the console itself. But there is a lot that is alike. Securing a Linux host, for example. Those things are likely to be very similar. But the differences require special expertise.
Should IT shops with mainframe look to do compliance internally or just hire someone to do it for them?
Internally, companies need to realize that they need to make the generational transfer of knowledge and expertise. You need to manage the environment. This isn’t going to happen overnight. For external resources, you can turn to those providing tools, companies like IBM, CA and BMC, who have expertise.
In an announcement letter it put out today, IBM said it would withdraw the System z9 Business Class and Enterprise Class mainframe from marketing effective June 30.
On or after the effective dates for the withdrawal of these offerings, you can no longer order this product directly from IBM. However, IBM will continue to honor contracts until expiration or termination of the current contract.
As one mainframe listserv poster put it: “I thought June 2010 was a little early if the z11 isn’t going to be
available until Q4 2010, but to be honest I haven’t (paid) attention to the exact timing of past withdrawal announcements.”
Ian Bramley, managing director of IT analyst firm Software Strategies, said we can expect to see the z11 mainframes near the end of the third quarter of next year. Perhaps we’ll see them early in the third quarter, or maybe even the end of the second quarter, if IBM plans to pull the z9 off the market on June 30.
Bramley talked about some of the potential forthcoming details of the z11 mainframe, including the move from 65nm to 45nm processors that will run around 5GHz and have simultaneous multithreading, dual-threading and result in a 20-25% performance improvement.
IBM released z/VM 6.1 at the end of October. They had previewed it back in the spring and said it would be ready to go by the end of the year. Well, it’s ready to go. The announcement letter sums up some of the new features:
- Enhanced performance of virtual networking environments running heavy guest-to-guest streaming workloads
- Faster access to data when utilizing FICON Express8
- Closer integration with IBM Systems Director to eliminate the need to download agents and help simplify the installation of those agents
- Significantly better and more highly secure guest transactions when using Crypto Express3 as compared to Crypto Express2
- Guest support for IBM System Storage DS8000 Extended Address Volumes (EAVs) to help simplify storage management and relieve address constraints
z/VM has become a truly important technology for IBM and mainframers alike, as the influx of people using it as the foundation to run zLinux has increased sharply over the past couple years.
And since it has been around for decades, z/VM has a lot of advanced virtualization features that other virtualization platforms don’t have, according to Clabby Analytics President Joe Clabby.
“It is the best virtualization platform,” he said. “It’s constantly raising the bar. Virtualization capabilities on the mainframe are a decade ahead of where x86 is right now, and a few years ahead of Power.”
According to the Wall Street Journal, Robert Moffat, former senior vice president and general manager of IBM’s Systems and Technology Group has been replaced by Rod Adkins, who had previously been in charge of systems development.
Moffat was accused in October of insider trading, passing along confidential information that benefited hedge funds Galleon Group and New Castle Partners.
Moffat, once regarded as a possible future IBM chief executive, may have had plans to start selling off pieces of IBM’s server business according to IT Jungle’s Timothy Prickett Morgan. “This seemed like an exec whose job it was to shut down businesses or offshore them.”
A recent survey from data center user group AFCOM reports a drop in mainframe use among 436 respondents, but analysts aren’t so sure, and if you add up the numbers, neither do the statistics.
Let’s take a look at the release:
“Only 39.6 percent of all data centers worldwide still operate mainframe computer systems today. In data centers that have mainframes installed, the median number in residence is two. And of all the data centers that have mainframes installed, 45.7 percent expect to replace one or more of them in the next two years. Of those that are expecting to replace their mainframes during the next two years, more than two out of three, or 67.1 percent will be replacing them with new mainframes, and 32.9 percent will be replacing them with high-end servers or other alternatives.”
That’s a mind-bendingly number of percentages so let’s break it down assuming a sample of 1,000 data centers:
- According to the survey, 39.6%, or 396 out of 1,000 data centers, are running a mainframe.
- Of the data centers with mainframes, 45.7% expect to replace one or more in the next two years. So 45.7% of 396 is 181. I will forget, for now, that there’s a chance a data center could replace one or more of its mainframes but still be able to keep the others it might have.
- Then the survey says that only 32.9% of those replacing their mainframes will actually be replacing them with machines other than another mainframe. So 32.9% of 181 is 60.
- So out of 396 data centers that are running a mainframe, 60 of them plan to replace one or more mainframes with a different platform in the next two years. That is 15%.
As you can see, when you take a percentage of a percentage of a percentage, the end percentage ends up being not as alarming as one might think. Especially if you consider that at least some percentage of non-mainframe users — even if it’s a small percentage — might consider moving to a mainframe platform in the next two years. That would cancel out some of the 15% leaving the platform completely, and lead to an even smaller number.
Is the mainframe in decline? I think that’s a good question. Two analysts give their take:
“Does the mainframe decline in the long run? Yeah, probably, but one of the big surprises of the last 10 years to most people outside of IBM is how strong the mainframe has remained,” said Illuminata analyst Gordon Haff.
“The numbers in this survey strike me as unbelievably high,” he said. “To have almost half of data centers saying they’ll replace one or more of their mainframes over the next two years, that’s a strikingly high number. High-end systems in general don’t turn over that quickly.”
Analyst Dan Olds of Gabriel Consulting agreed. “To find that almost half the sample plans to replace their mainframe in the next year or two just doesn’t seem to jibe with reality,” he said.
There are other opinions out there that the mainframe market will actually grow in the next few years, not decline. Just last month research firm IDC released a survey reporting increased investments in mainframe hardware and software in the next five years. In that survey, almost 50% of 300 end users — all of whom were mainframe users — surveyed said they plan to increase annual spending on the mainframe.
The study identifies the emergence of a blended, or hybrid, approach to computing on the IBM System z platform. “Customers are finding that new workloads, including Linux-based and Java-based workloads, can leverage the mainframe’s built-in security and high levels of availability, by running them on mainframe specialty processors, such as the IFL, zIIP and zAAP processors,” said Jean S. Bozman, research vice president with IDC’s Enterprise Platforms Group. “This pattern of adoption is placing software licensing costs on a lower price schedule for these new workloads than if they were running natively on the IBM System z hardware platform. In this way, customers are seeing a blended approach to deploying and maintaining workloads – carrying longtime workloads forward on System z, even as they bring new workloads onto the mainframe.”
In addition, a SearchDataCenter.com survey we did this year found that 74% of 352 data centers running mainframes were planning no change in mainframe spending this year. Meanwhile, 15% were anticipating some kind of increase, and 11% were anticipating some kind of decrease.
What do these seemingly contradictory reports tell us about the future of the mainframe? At worst, the mainframe is in a slow decline. At best, it’s growing. That seems to be pretty middle-of-the-road, vanilla results to me.
IBM today announced VMControl Enterprise Edition, a plug-in to its Tivoli Systems Director software that allows end users to view all their physical and virtual servers under one pane of glass including, eventually, mainframe assets.
The software can provide systems management on the IBM mainframe and Power systems, as well as IBM- and non-IBM x86 hardware. On the x86 hardware, it will be able to handle VMware, Hyper-V, Xen and Linux KVM virtualization software. The initial enterprise version, to ship in December, will support only Power-based systems running AIX, with later versions next year adding support for z/VM on the mainframe and x86 servers.
Prices will start at around $2,500 for lower-end Power blades up to more than $20,000 for the bigger Power Systems.
Server virtualization certainly has had its benefits, but the explosion in virtual machines has led to VM sprawl and management issues, said Gordon Haff, an analyst at Illuminata:
Virtualization is no longer just about server consolidation. It does that, sure, and thereby reduces the number of physical servers that an organization needs to purchase. But, especially in enterprises, it’s increasingly as much about resource pools and services (such as disaster recovery) enabled by virtualization as it is about consolidation. And that makes the need for management more rather than less.
There are also Express and Standard versions that will be cheaper and made available as well. According to Ian Robinson, IBM’s PowerVM platform manager, the enterprise edition is geared toward those businesses that are “close to 100% virtualized and want help in managing their infrastructure.”
“You can define a collection of physical resources as a pool,” he said. “You are managing physical and virtual aspects as if you were managing a single virtual machine. That is the key point of the enterprise edition.”
There’s been some news this week that the U.S. House of Representatives has gotten rid of its last mainframe. From the story:
“It’s a symbolic transition into the latest and greatest in terms of green technology, virtualization, consolidation and all those things,” says Jack Nichols, director of enterprise operations at the House of Representatives. “The mainframe plug was pulled, but it was pulled in favor of something that was started in the mainframe world.”
The House had been using mainframes since at least the early 1970s, and at one time had a 13,000-square-foot data center dedicated to mainframe and mainframe operations. As mainframes grew stronger, the House moved down to just one machine, in addition to other types of servers.
The mainframe had apparently been there since 1997. According to the story, the House spent $700,000 per year to maintain it, and another $30,000 to power it. They’re holding those numbers up as potential savings, but haven’t actually said how much the new infrastructure — including x86 and Unix servers — will cost for power and maintenance.
“It wasn’t the fastest box in the world,” says Rich Zanatta, director of facilities for the House. “Some of our blades and some of our standard servers have more capability than that entire 8-cubic-foot box has. Technology-wise, it’s obviously been surpassed.”
No kidding, Rich. The mainframe was there for 12 years. You do know that mainframe technology has advanced since then, too, right? Another paragraph in the story says:
Turning off the mainframe is a big step in reducing the House’s server footprint. Already, the House consolidated about 150 test servers down to 20 through virtualization, and consolidated about 120 production servers onto 15 or 20.
Um, what? The mainframe does not consist of 270 production and test servers. Those can be consolidated down and still continue to communicate with a mainframe.
Anyway, the best responses came from the IBM-Main listserv, which is full of mainframers. Some tidbits from posters:
“If the US government is migrating away from IBM mainframes, they must have found something more expensive”
“If Congress is getting rid of their last mainframe, this only proves the VALUE of a mainframe. Lord knows they get everything ELSE wrong up there…”
“is this one of those “great savings” from someplace that hadn’t upgraded their mainframe system in 20 years? and I love this part: The last mainframe was an IBM model in place since 1997…1997, let’s see, so we’re talking either the 9021 family or the early generation cmos…yea, okay, I just answered the q”
By the way, Congress’ job approval rating in August was 31%, according to Gallup.
For those of you familiar with the social networking platform Twitter, you can follow along with connected attendees at the IBM Mainframe SHARE user group conference by searching for the hashtags #SHARE2009 and #D09. These links will allow you to follow along real-time with the events in Denver this week.
Join the conversation with IBM, SHARE board members, and fellow mainframers.
If you want to earn the big bucks, you’d better get onboard with a mainframe shop, ccording to Enterprise Systems Journal’s salary survey.
According to ESJ, CIOs, VPs, IT directors and managers that oversee mainframes: Have average base salaries of more than $230,000 a year. Those at Unix-based sites followed with $173,000, and midrange systems sites at close to $150,000. By contrast, IT executives overseeing distributed computing sites (with no mainframes present) had the lowest salary ranges. Those overseeing Windows environments averaged $115,000 a year. Top-level executives at Linux-centric sites (with no mainframes) had the lowest annual rate, at about $60,000 a year.
IBM has announced seven different hardware and software packages that include the System z mainframe and target specific application workloads such as disaster recovery and data warehousing.
The move is an effort by Big Blue to keep the mainframe relevant and attractive for whose who might otherwise select a distributed server infrastructure in difficult economic times. It also piggybacks off a similar package IBM put together last year for SAP applications, an offering that has helped cause 20% growth in SAP applications on the mainframe, according to IBM.
The packages are for data warehousing, application development, disaster recovery, security, risk mitigation and WebSphere; and include mainframe hardware, middleware and maintenance applications. More details here.
Perhaps more importantly, however, is the news that IBM is slashing the cost of the Integrated Facility for Linux (IFL), the mainframe specialty engine designed to run Linux applications. Once around $100,000, they will now cost less than $50,000.
Linux has certainly been a bright spot for IBM on the mainframe. According to the company, more than half of the unique applications on the platform are now for Linux, and more than 40% of new System z customers installed Linux last year. It seems as if the mainframe has largely become a box that hosts old z/OS applications too costly/burdensome to migrate off, and consolidated Linux servers. Halving the cost of the processor that runs them is a clear move by IBM to try to stay cost competitive with distributed servers on the Linux front, especially considering the proliferation of chip cores that is flowing out of Intel and AMD chip labs these days.