Attention to Details
These three high-end monitoring tools automate the management of networks with thousands of nodes.
- By Mitch Tulloch
- September 01, 2003
Managing today’s networks is no easy job. Not only do administrators have to deal with a wide variety of platforms, systems and products, but those things break down—servers crash, applications go haywire, disks fill up and bottlenecks clog network traffic. Keeping things up and running involves constant vigilance, and that’s what network and server monitoring tools are designed to do. Without such monitoring tools, your business could be on shaky ground if a critical server should fail and go unnoticed for any length of time.
A good network monitoring tool performs three basic jobs: monitor how
things are going, alert administrators when things go wrong and automatically
correct problems whenever possible. A good way of remembering this is
the mnemonic “MAC,” which stands for Monitoring, Alerting, and Correcting.
Let’s consider each function in turn.
Monitoring, Alerting, Correcting
Monitoring tools should be able to proactively monitor the wide range
of server platforms, applications, and devices in today’s heterogeneous
networks. Support for different versions of Microsoft Windows, popular
Linux distributions and common flavors of Unix is essential. If your network
has other platforms like Novell NetWare or OpenVMS, then your choice of
a monitoring tool may be determined by such support. In terms of what
it watches on your network, a good monitoring tool should be able to do
things like parse system and event logs, detect when services stop unexpectedly,
and track consumption of critical system resources, including processor
usage, available memory, free disk space and network bandwidth. It should
also be able to monitor key aspects of common server applications and
services such as Active Directory, DNS, IIS, Exchange and SQL Server on
Windows platforms or Apache, Oracle, and Lotus Domino on Unix/Linux platforms.
Support for SNMP-enabled network devices like routers and switches is
also essential to gain a true picture of what’s happening on a network.
In addition, your company may have special monitoring needs for enterprise
applications like SAP R/3 or unique messaging platforms like RIM Blackberry,
and you need to take this into account before committing to a monitoring
Alerting can be done in a variety of ways, ranging from pop-up alert dialogs on administrator workstations to sending e-mail messages and beeping pagers. A monitoring tool should be able to log the information it collects in a database for further analysis. Administrators should be able to specify what types of collected information are logged and how regional logs can be consolidated into a centralized repository in large enterprise environments. Also included should be services for analyzing the vast amounts of information collected, including visualization utilities for generating graphs that can provide clues regarding trends for troubleshooting problems and tools for generating reports based on templates designed for everyone from technical support staff to managers. A desirable feature is the ability to generate reports automatically according to a predefined schedule and either send them by e-mail to the appropriate parties or publish them on the corporate intranet. Most monitoring tools include some kind of functionality along this line. Some can even test for compliance with service level agreements (SLAs), a feature you may want to look for if you lease services from a provider.
Correcting common network problems by killing runaway processes, restarting services and rebooting servers should be easy to configure and use. It should also be possible to set up an escalation path of corrective actions to perform when simple fixes don’t work and to execute scripts or batch files to perform advanced corrective actions automatically when situations require it.
By monitoring the status of network servers and devices, alerting administrators of problems that arise, and automatically taking steps to correct problems when they occur, network monitoring tools help ensure the reliability and availability of your business network. This is ultimately reflected in your company’s bottom line, so it’s a no-brainer that such tools, though sometimes expensive, are worth every penny they cost.
Another desirable feature of a monitoring product is that it be a robust solution that has small impact on the network itself you’re trying to watch. And while budget-conscious administrators may be able to assemble their own toolbox of free or almost-free monitoring tools and use them to keep their network up and running, such solutions become unmanageable for networks with hundreds or thousands of servers. So the ability to scale well and get up to speed quickly through the user interface are also important considerations when choosing monitoring software for your network.
If your company is already using an enterprise-level management product
like Computer Associates Unicenter, HP OpenView, IBM Tivoli or Microsoft
Operations Manager (MOM), it may also be desirable for the monitoring
product you purchase to integrate easily into these framework solutions.
So be sure to watch for that as well when you‘re considering which product
to go with.
|The Argent Guardian
$15,000 for 10 monitored servers with an unlimited number
of monitoring consoles.
Argent Software Inc.
Heroix eQ Management Suite 2.0
Starts at $595 per server.
AppManager Suite 5.0.1
Starts at $600 per server; additional application modules
range from $600 to $1,500 per server.
The Argent Guardian 6.2
Installing The Argent Guardian was a breeze because, by default, it uses
a proprietary database system. This database is designed to provide a
quick out-of-the-box solution for smaller networks of up to 20 to 30 managed
nodes. For larger networks the product also supports Microsoft SQL Server
7.0 or higher to store the monitoring information it collects. What’s
really unique about Guardian is its agent-optional architecture, which
allows you to monitor servers with or without installing agent software
on them. In general you only need to install agents on special servers
like firewalls or, if you’re monitoring servers remotely, over a WAN.
In a LAN environment installing agents is unnecessary. This gets you up
and running with a minimum of hassle.
Guardian’s GUI is a simple Explorer-like interface that’s easy to work
with. (See Figure 1.) The Definition tab is where the meat of the product
resides, which consists of four elements: rules, alerts, node lists and
relators. The basic approach to using the product is simple: Rules define
a specific test to perform for an application or service, such as checking
if a domain controller is online, checking the System log for new Error
events, checking for a processor bottleneck and so on. Alerts are actions
to be taken when a rule is broken, such as sending an e-mail, paging someone
or performing some custom command. Node lists are collections of up to
1,024 managed nodes to monitor, which can include Windows NT/2000 machines,
Unix/ Linux hosts or any network device that supports SNMP. (Support for
monitoring Windows Server 2003 machines will be in the next incremental
release of the product, which should be available at the time you read
this article.) Tying this together are relators, which associate rules,
alerts, and node lists together with a schedule.
|Figure 1. Argent Software’s The Argent
Guardian is a powerful but easy-to-use solution for enterprise monitoring
and alerting. (Click image to view larger version.)
Before configuring my first relator, I began by defining a new node list for my testbed network. Using Node Manager, I scanned for servers running on my network; Guardian had no trouble finding and displaying them. Specifying the servers I wanted to monitor became as easy as dragging and dropping them onto the node list. Then I selected a rule to test (excessive bad logons) and modified it so that it triggered after three failed logons. (Modifications are saved automatically.) Guardian comes with over a thousand built-in rules that monitor Active Directory and DNS, Event Logs, perfmon counters, services, SNMP get/trap, system down, custom commands and more. One indication of the support Argent offers is the fact that the company will develop custom rules and rule sets for licensed customers at no extra cost. Once I selected a rule, I then chose an alert to trigger (send console message) and modified the message sent when the alert triggers. Finally, I created my new relator and added the rule, node list and alert to it—unfortunately, you can’t use drag and drop to do this step. I experienced one glitch when I added my rule to my relator and then double-clicked on the rule to reconfigure it, which prompted me to save changes to the relator before the properties for the rule opened. I chose No and Guardian unexpectedly closed, so I had to open it again and finish adding a node list and alert to the relator.
Once the relator was configured, I specified an aggressive monitoring schedule for testing purposes and switched the relator from testing to production mode to begin monitoring. I tried a few failed logons to a workstation and the expected alert appeared. I tried adding additional rules for CPU usage and service failure, created an alert escalation plan to warn of service failure and attempt service restart, used service-level agreement (SLA) rules to capture uptime/downtime info, performed a service inventory on all my managed nodes and tested a number of other management tasks. Everything worked as expected. I also tried generating some built-in reports to display uptime, pending alerts, domain account activity and so on. Guardian’s reporting facility is basic but easy to use and does the job to communicate essential info to administrators concerning their network. On the whole the product is impressive—its easy learning curve gets you up and monitoring your servers in no time flat.
Guardian integrates with other Argent products including The Argent Predictor
(used for trend analysis), The Argent Sentinel (used to check Web site
response times and watch for site changes), Argent Console (a master console
for displaying all alerts), Argent Exchange Monitor (for monitoring Exchange
5.5/2000 servers) and more. Guardian also includes pre-configured relators
for monitoring Exchange, SQL Server and Oracle, and it easily integrates
into enterprise framework solutions like Tivoli and HP OpenView.
NetIQ AppManager Suite 5.0.1
Installing AppManager was a bit of a challenge since the product requires
SQL Server for its repository. Fortunately the documentation included
with the product is exceptional. AppManager has a component architecture
that consists of a repository, management server, operator console and
agents running on managed nodes. To monitor a target server, you first
install an agent on it and then create a job on the operator console specifying
what parameters you want to monitor. The job is stored in the repository
and is assigned to the agent by the management server, which acts as a
For testing purposes, I installed the repository, management server and operator console all on the same machine, a member server running SQL Server 2000 with Service Pack 3a and configured to use Windows authentication. A nice feature of AppManager is that Setup can be run in a special Pre-Installation Check mode to generate an HTML report on whether your system meets the various hardware and software requirements for successful installation. From my experience with the product I strongly recommend that you make use of this pre-installation feature and that you meet or exceed the CPU requirements, especially if your repository and management server are running on the same box. I also suggest you specify a fixed amount of memory for SQL Server in order to minimize resource contention between the repository and management server components. AppManager has three different operator consoles you can use: a standard Win32 application, an MMC snap-in and a Web console requiring a special Web management server component that uses IIS to be installed. I found the Win32 console the easiest to work with and focused on this for my testing.
Once I had my management box set up, the next step was to install agents
on the machines I wanted to monitor. You can install agents two ways,
locally or remotely. I then discovered the other servers running on my
testbed network and ran the Install Agent knowledge script to install
the agent along with selected manageable objects on the target machines.
Knowledge scripts are at the heart of AppManager and consist of VBScript
code for performing some action such as installing an agent, discovering
a service or monitoring some aspect of a managed node. The Install Agent
knowledge script is configured with an easy-to-use wizard that let me
specify what services I wanted to monitor. (I chose Active Directory and
IIS.) The wizard automatically discovers these services on the target
machines. As these services were discovered, new tabs were added to the
bottom of the console representing views of all my NT/2000 machines, Web
servers, domain controllers and so on. (See Figure 2.)
|Figure 2. NetIQ’s AppManager lets you easily
create jobs for proactively monitoring servers across an enterprise.
(Click image to view larger version.)
Once I had agents installed on my servers, I next tried creating and running various monitoring jobs against them. Creating a job is as simple as choosing a knowledge script from the built-in library and dragging it onto one or more machines in the console tree. Jobs can be configured to run with various schedules, threshold parameters for triggering events and corrective actions to be performed when an event is triggered. Knowledge scripts themselves can also be permanently configured or edited if desired. For example, I used the CheckDomainController response time script for Active Directory to create a job to check the response time threshold for logging on to the domain controller. Then I ran a process on the domain controller to drive CPU utilization to 100 percent and slow response to logons. The job triggered a warning event in the console, identifying the server and response test by a flashing yellow symbol. (AppManager is great for getting your attention and directing it to problems it discovers.) I used the NumberOfUsers script to configure a network alert when a specified number of domain users is exceeded, then created more users in Active Directory until the alert appeared. I used the ServiceDown script to create a job to restart IIS if the WWW service was down, then manually stopped the service. AppManager detected the problem and automatically restarted the service. I also collected perfmon counters for CPU and memory usage and used AppManager’s excellent graphing feature to create three-dimensional charts of performance activity that I could rotate and explore in real time. One thing that tripped me up for a moment was that the scripts for CPU and memory usage were found only on the NT tab and not the WIN2000 or WIN2003 tabs. The trick is that these three tabs are cumulative—NT scripts apply to later OS versions as well.
AppManager supports a wide range of platforms (Windows, Unix/Linux and
most popular enterprise applications) and integrates into popular management
frameworks (Unicenter, Tivoli, OpenView and Microsoft Operations Manager).
Other installed tools include a Distributed Events Console, which gives
you a quick birds-eye view of pending events for all your managed nodes,
and Security Manager, which lets you define roles to distribute the administrative
load of using the product among your IT staff. The learning curve for
the product is steep but not insurmountable given the excellent documentation.
Plus, there’s an active user community on NetIQ’s Web site where new scripts
are developed and shared and user questions are answered.
Heroix eQ Management Suite 2.0
To use the newly enhanced Web Management Console of version 2.0 of Heroix
eQ, I had to install the product on SQL Server (it requires version 7.0
SP4 or higher). It was worth the wait—Heroix eQ has one of the best Web-based
interfaces I’ve ever seen (see Figure 3). It’s easy to work with and well
laid-out, and context-sensitive help is available for every task.
Once I had the product up and running, the next step was to deploy agents
on the servers I wanted to monitor. Agents can be installed either locally
or remotely, and I chose a remote install. Unfortunately remote installation
of agents still has to be done using the older Win32 console, since this
is one of the few areas of functionality not yet supported by the product’s
newer Web interface. A small glitch in the process was that remote installation
of eQ agents requires Windows Installer v1.11 or higher on the target
machines, so I had to install SP3 on my Win2K servers to upgrade Installer
1.10 to the latest version before the remote install would work, something
that eQ’s Readme file seemed to omit. Note also that if you install agents
locally from the product CD instead of remotely from your management server,
you have to add the machines manually to your list of managed servers
afterwards by specifying their names or IP addresses.
|Figure 3. Version 2.0 of Heroix eQ boasts a well-designed
Web interface that makes managing servers a snap. (Click image to
view larger version.)
Once I had agents installed and routing set up, the next task was to start monitoring something. Every product has its own jargon, and eQ is no different. The fundamental building block of Heroix eQ is the rule, which specifies a particular aspect of an application to monitor, a variable to initialize, an action to perform and so on. Rules are used to define sensors, which consist of one or more rules grouped together for simplified management. Sensors are then categorized into solutions, broad areas of management functionality such as Active Directory, DHCP, IIS or Windows 2000 Server for basic Windows NT/2000 monitoring; and Veritas Backup Exec, Cisco, Exchange 2000 or Unix/Apache for multiplatform and application monitoring. The basic Windows Server solution, for example, includes general sensors like CPU Load, DNS Performance, Paging Load, Printer State and so on. Since eQ automatically detects what components and applications are running on a server once you install the agent, all I needed to do in order to monitor Active Directory was select my domain controller, start the Active Directory solution on it and wait while eQ began collecting management data and checking it against predefined thresholds.
To generate some events, I reconfigured some sensors with tighter thresholds and a more aggressive schedule, and soon eQ was indicating problems that needed my attention. The interface catches your attention when something goes wrong. Server icons are color coded, and severity levels of problems have smiley icons with different colors and facial expressions associated with them—cute, but actually quite effective. You can also configure eQ to use SMTP mail to alert you when problems occur, set up SNMP traps for managed devices, and execute scripts or commands to take corrective action when required. You can also configure solutions on one machine and then copy it to other similar machines to save time.
One really nice feature of the Web interface is that you can set filter conditions based on things like type of event or its severity and then save the filter to your list of favorites for Internet Explorer. Then you can open multiple browser windows on your administrator console and monitor different event conditions in different browser windows, with the windows refreshing every 30 seconds or so depending on how you have them configured.
One small thing Heroix could improve on: The filter conditions you’ve selected could be displayed more clearly. For example, if I filter for Active Directory events of severity 3 on selected domain controllers, this detailed filter information could be displayed in the heading and title of the page so you know what you’re actually looking at and what the filter represents. It took me a minute to realize also that if I wanted to display all events with severity less than or equal to 3, I had to select 1, 2 and 3 in the listbox.
The product uses Crystal Reports for its graphing and reporting functionality. This works great except that in the current release you have to switch back to the older Win32 console to generate a report or graph before you can display it using the Web interface. (You can set it up to run batch reports in the background as well). The next version (2.1), however, will add report and graph generation to the Web interface, and this should be out by the time you read this article. If you’ve been using Heroix’s older monitoring product, RoboMon, you’ll be glad to know that eQ has been built to be backwardly compatible with RoboMon, though some configuration is required to make them work together.
But the best part of the product is the Solution Studio component included
as part of the Heroix eQ Management Suite. The Solution Studio allows
you to develop custom solutions (collections of sensors) for monitoring
virtually any aspect of your systems and applications you need to monitor.
And you can do this using a wizard-based interface that precludes the
need to write code. I played around with this neat tool and created a
couple of solutions for monitoring things like the IIS cache and ASP sessions.
I found it easy to create a custom service, add sensors, define rules,
deploy the solution to managed servers across my network and start monitoring
Network Monitoring Tools Tested
All three of the products I tested were designed with medium to large networks in mind. These networks might have hundreds or thousands of managed nodes together with a mix of platforms and products from different vendors. I evaluated The Argent Guardian from Argent Software Inc., AppManager Suite from NetIQ Corp., and Heroix eQ Management Suite from Heroix Corp. All are rock-solid and reliable in their operation, have user interfaces that are for the most part intuitive and easy to learn to use, have extensible architectures that scale well, and come with highly configurable scheduling options, consolidated event monitoring, extensive reporting features, a variety of alert and notification methods, and customizable mechanisms for taking various corrective actions when things go wrong. They’re also priced well for the functionality they provide.
Although these products all support a wide range of operating system platforms and server applications, for the purposes of testing I focused exclusively on the Windows 2000 platform and installed and tried the products in our lab on an isolated testbed consisting of a domain-based network with a number of servers running in different roles.
Choosing a Product
Like any other field in IT these days, network monitoring is highly competitive
and there are a lot of good products out there—and some turkeys as well.
But there were no turkeys among the products I tested. I was impressed
with all three offerings and also with the level of support provided by
each vendor. Which—if any—of these tools you choose for your network and
server monitoring needs, however, depends largely on the nature and extent
of your needs, your operating budget and your level of experience with
network management solutions. All of the programs I evaluated are excellent.
Hats off to Argent for a great product that gets you up and running a
managed network in no time flat. Kudos to NetIQ for a powerful platform
that can do almost anything but whose depth I barely scratched due to
its fairly steep learning curve. And bravo to Heroix for its snazzy new
Web interface that lets you monitor your servers using a simple Web browser,
a big improvement from the somewhat confusing older Win32 console.