Minimizing the impact of Alarm Storms...

I was working with a client today that just converted to dopplerVUE from a “traditional" log system that uses an event viewer to display each individual event. This was a big problem because he could not see how many different types of problems were occurring. The screen refreshed so fast leaving him with a new batch of alerts that he was unable to read or interpret since the last batch of alerts displayed. Let me show you an example of the screen and the problem:

In the below screenshot, identical copies of alarms are displayed in a new row.

Example 1: syslog event viewer

This type of event viewer becomes nearly useless when you are getting a large volume of alarms. Often times, the most valuable alarms are hidden in the clutter and are off the screen before you can react. You can only see the last few alarms and they may not be the critical ones.

These systems provide filtering to help you go back and search the log history. This is good if you want to get more detail about an old alert and you were able to write down or memorize the syntax. But, an even better way exists…

The dopplerVUE and NeuralStar displays are designed to consolidate identical alarms into a single row and display the total count and the first and last time when these alarms began occurring.

Alarm grid from dopplerVUE (http://www.dopplerVUE.com)

In this picture, you can clearly see what the different types of alarms are, how many of them have occurred and when they started occurring. Now, real time monitoring of alarm conditions has value and is actionable. In this display, you even have syslog, snmp performance, snmp traps aggregated side by side for a complete picture.

Welcome to the Network Zone…Let’s Talk About Network Management Needs

Thanks for coming by to read this blog. I look forward to hearing your views and comments on this post and future ones. I’ll keep the posts fun and helpful.

I read a great article on SearchNetworking by Shamus McGillicuddy. It discussed the state of the market for network management products and more importantly, some of the top issues network management staff are facing. Here are some of my take aways from reading it...

There is a clear need for network management that lets engineers move away from spreadsheets, manual processes and tools that simply require too much overhead to use. The proof is in the IDC research that shows the market is growing in these tough times, and it looks like more specialty vendors are becoming both competitors and complementary players in the space.

The article references the network management space as still being part of the Wild West. The growth in new products and modules is staggering. One vendor actually boasts their core product has over 45 utilities (I can only handle about 5-6 tools then its overload).

Often so many tools are being used that it creates a new problem...

"Too many tools can lead to a lack of integration," said Steven Guthrie, director of product marketing at CA. "The success of low-end niche tools in the enterprise tells us that these point products come in for good reasons. But then they outlive their usefulness, and they end up stalling mean-time-to-repair. That data source [in the niche tool] may not sync up with other data sources you may have."

As network engineers, we’re bombarded with new information all the time and simply don't want or have the time to keep learning and finding the right application when a crisis occurs. A central point of management is necessary. Shamus was right on when he wrote...

"But, clearly, IT pros would love to consolidate the number of management tools they use on a daily basis, if for no other reason than to save money and make their operations more efficient."

Tools that have a single database, can consolidate multiple sources of information and have a low maintenance overhead will ultimately win out. In the long run they make your life simpler.

To read the full article on SearchNetworking.com http://searchnetworking.techtarget.com/news/article/0,289142,sid7_gci1355151,00.html