In-Depth

MOM is still Watching You

It takes a powerful server to watch over an entire network. Is Microsoft Operations Manager up to the task?

• By Bill Heldman
• 12/01/2001

8:05 a.m. It’s Gloria in purchasing. She can’t log on to the network. She phrases the problem to you this way: “The Internet must be down because I can’t sign on. It just won’t accept my password.”

8:10 a.m. You pull up your Microsoft Operations Manager (MOM) console in order to see if any new alerts have been put up for the network. Sure enough, after drilling into the MOM hierarchy a bit, you find that the DHCP service is reporting that it’s out of IP addresses.

8:15 a.m. You add IP addresses using the DHCP admin console and ask Gloria if she’s now able to log on. She is. You lean back in your Sam’s Club BackSaver chair and let out a satisfied sigh. You’re a hero.

Well, not quite a hero. Gloria expects the network, including her logon, the Internet, Internet e-mail and regular e-mail, and all of her applications to be up 24/7. You’re glad MOM was there to alert you that you were out of IP addresses. But how could you use MOM to help you proactively if this problem crops up again—perhaps by automatically creating some new addresses for you?

Unfortunately, you can’t do that with this first release. MOM’s current function is event and performance monitoring, rather than proactively handling crisis situations. MOM can collect and analyze system events, compile them until a pre-configured threshold counter is met and then alert you, but it can’t actively solve problems you’re having with your network. (MOM alerts can execute scripts—but there might not be any action that you could script to handle the case of DHCP running out of IP addresses.)

Systems Management vs. Operations Management
As network implementations grow and become more complex, a plethora of management issues surface—things like how to make sure thousands of PCs are all running the same version of software or how to know when a server crashes. Today we have a very robust product, Microsoft Systems Management Server (SMS) that allows us to solve the former problem, but the tools we have to monitor the latter aren’t as granular as we’d like. SMS handles change and configuration management. But what it doesn’t do—and never has—is monitor things like non-SMS server services, printing functions, server hardware and other key elements of your network, and then report back to administrators via some alerting mechanism that a system is in trouble. This latter capability is called operations management.

The folks at Microsoft had the change and configuration management thing handled with SMS, but weren’t doing anything with operations management. Now they’ve plugged this hole in their systems management software with MOM. Microsoft purchased the code that underlies MOM from NetIQ (www.netiq.com), a vendor actively involved in Windows NT- and 2000-based metrics and operations management monitoring.

MOM System Requirements
You can install MOM on a single computer or distribute its components among multiple computers. When you do a single-computer installation, you install the MOM administrator console (which, of course, uses MMC as its interface); MOM reporting; and the Web console (which allows administrators to pull up the MOM information from a browser on any computer). A MOM server configured in this manner has some minimum recommended hardware requirements:

• 550 MHz Intel Pentium III processor.
• Minimum of 5GB of free disk space.
• 512MB of RAM.
• Video adapter capable of rendering 256 colors or more at 800x600 resolution.
• Minimum of 10MB/second network speed.
• Windows 2000 Server or Advanced Server running Service Pack 2.

Microsoft minimum requirements are just that—bare minimums. As such, they need to be beefed up by at least 50 percent. If I were building a production MOM box, I’d put it on a two- or four-way Pentium III 1GHz or better with at least a full gigabyte of RAM and as much disk space as I could cram into the box. Better yet, I’d consider splitting the load out to multiple servers. There’s no need to install the software on a domain controller—Win2K Server running as a member server is fine for MOM.

You also need to tell MOM what to monitor. MOM’s monitoring rules are contained in knowledge modules—software components that run atop the MOM engine and contain Knowledge Base articles, preset threshold values, event IDs and other pertinent information designed to keep track of a particular component. I’ll review the included and optional add-on knowledge modules later in this article.

Computers that are being monitored must run an agent and, thus, also have minimum requirements. A monitored computer needs to have at least a 200MHz Pentium CPU, 100MB of free disk space, 64MB of RAM, and Windows NT 4.0 SP4 or Win2K. MOM also contains a modicum of Unix support; it can read Syslog files shipped from a Unix computer.

MOM Installation
One of the interesting features you see when you first run the MOM setup program is the Prerequisite Verifier, which takes a gander at your system and says, “Hey, you need to install or upgrade these things before I can install the product.” Figure 1 shows the Prerequisite Verifier in action. One feature of particular interest is the clickable link at the bottom of the Prerequisite Verifier that will carry out the needed configuration actions. The instructions in the details pane of the Prerequisite Verifier are quite good and tell you exactly what you need to do. I simply cut and pasted them into a Word document, then printed out the whole thing.

Figure 1. The Prerequisite Verifier checks a variety of software before it will let you begin a new MOM installation. (Click image to view larger version.)

MOM uses a SQL Server database to store all the information it collects about the systems you choose to monitor. The full edition of SQL Server 2000 is the preferred database solution, but MOM comes with the MSDE version to use for evaluation. MOM uses Microsoft Access 2000 for its reports; you can use the included Runtime edition or install the full product (which you’ll need to modify to create reports).

MOM’s estimated retail price is based solely on the number of processors in each MOM computer, at $850 per processor. There’s an optional Application Management Pack that I’ll talk about in a minute. If you decide to purchase this, you’ll pay another $950 per processor. There’s no need to purchase a license for the computers that you’re monitoring.

What Comes with MOM?
Great question! Remember that MOM’s job is to watch Windows-based computers’ event logs, read the events posted there, and then alert the administrator of that event and possibly even perform some action. Here are the things that MOM brings to the table:

• Event Management. MOM watches multiple computers and aggregates their events into a central database. Because of this capability, it’s possible for administrators to get an overview of how the server farm is performing (metrics) or to drill down on a specific computer to gather more information about an event (alerting).
• Rules. The administrator can create rules that can perform a specified function when an event occurs. A pretty cool thing that rules can do is hook up with a Microsoft Knowledge Base (KB) article referencing the difficulty you’re having. Figure 2 shows a DNS dynamic lookup rule that points to a particular KB article. Some of the KB references in the rules that Microsoft supplies are pretty generic; others are in-depth and right to the heart of the problem.
• Alerts. Administrators may set up alerts that examine a single computer event, a string of events from a given computer, or a string of events from several computers. They can be set up with varying severity levels. Alerts can be drilled down upon to pinpoint the data that led up to the alert, as well as be set up to e-mail or page administrators. They can be set up to send Simple Network Management Protocol (SNMP) traps or be provided with a script that redirects their information to other management systems (such as Hewlett-Packard’s OpenView, CA Unicenter, IBM Tivoli, or BMC Patrol.) You can also view alerts directly in the MOM management console, as shown in Figure 3.
• Performance. MOM can be configured to monitor performance thresholds by using System Monitor counters. This kind of information is not only useful for alerting, but also for capacity planning and historical tracking of system behavior. Thresholds can be set for local events or you can aggregate the events into a system-wide collection.

Figure 2. Some events reference the Microsoft Knowledge Base directly for more information. (Click image to view larger version.)

Figure 3. Some alerts in the MOM management console. Most of these alerts relate to a SQL Server database that was running out of space. (Click image to view larger version.)

Management packs (collections of knowledge modules) are the brains behind the MOM operation. They’re preconfigured rule-sets and Knowledge Base articles that snap into MOM and provide administrators a foundation for their network monitoring. The rules can be modified according to your specific needs. With the base MOM product, you receive Management Packs that can be set up to monitor these components:

• Win2K
• Active Directory
• File Replication Service (FRS)
• DNS
• WINS
• IIS
• DHCP
• RRAS
• Microsoft Transaction Service (MTS)
• Microsoft Message Queuing (MSMQ)
• Microsoft Distributed Transaction Coordinator (MSDTC)
• SMS
• MOM
• Terminal Server
• Windows NT 4.0 systems logs

You can also purchase the optional Application Management Pack that covers various BackOffice and .NET server products:

• Exchange Server 2000
• SQL Server 2000 and 7.0
• Exchange 5.5
• Site Server 3.0
• Proxy Server 2.0
• SNA Server 4.0

Other vendors can write application-management packs that snap into MOM, as well. NetIQ has been actively involved in this area and offers eXtended Management Packs (XMPs) for MOM to monitor Oracle, Web services and antivirus software, as well as extended capabilities for monitoring Windows networks. NetIQ agents use each application’s API to extract more information than is possible from simply reading a system’s event logs and System Monitor counters, which is really all that MOM does today. As a result, NetIQ’s XMPs (as well as other third-party offerings) will be the real added value that makes MOM go over the top.

MOM also includes a Reporting tool with the capability of viewing reports in chart or HTML format. Load-balancing and redundancy are fully supported. MOM’s server/agent architecture keeps network traffic down yet provides a method for central data collection. You can push the agents to targeted groups of computers via an intelligent push and install mechanism, thus reducing the amount of administrative overhead.

When you start MOM to view the alerts for various systems, you’re taken to the default MOM node and given a complete system overview, similar to what you see in Figure 4. In the details pane of this view you’re given an “executive overview” of the status of the system, including the number of alerts you’ve not yet addressed, the performance monitors you’re watching, the events you’ve received, computers you’re monitoring, and so on. Note the excessive number of rules that are processed, by default, within the MOM system.

Figure 4. The default node in the MOM management console, showing an overload of rules to be monitored. (Click image to view larger version.)

Minor MOM Annoyances
There are some annoying things about MOM in this release. MOM is extremely verbose and can generate heavy CPU usage and network traffic, as well as copious output. It’s difficult to manage rules due to the depth of the hierarchy that contains them. And installing a knowledge module enables all the rules in that module, making it easy to swamp yourself in data and bog down your network. My advice: Limit the number of knowledge modules you install.

MOM isn’t integrated with SMS, apart from a knowledge module that can monitor SMS computers. MOM personnel in Redmond tell me that there are plans to allow for the integration of SMS with MOM sometime in the future.

The Long and Short of It
So, should you rush to install MOM on your own network?

If you’ve already invested in NetIQ’s AppManager suite of products, stay there until MOM has been through the second release cycle and some of the third-party offerings have been released and tweaked. AppManager’s current functionality beats that of the just-released MOM.

If you haven’t invested yet in NetIQ and its plethora of Windows-based management products and you have a favorable licensing agreement with Microsoft, such as the Select or Enterprise Agreement programs, then it may be to your benefit to investigate the use of MOM instead of AppManager. Even then, you should consider purchasing XMPs for the applications you want to monitor within your MOM system as they’re released. Be sure to leave adequate room in your budget to cover these additional purchases.

Some Microsoft products are excellent in their first release and get better and better as service packs and new revisions come out. I think Exchange and ISA Server are great examples of this. But other Microsoft code seems to come out the door not quite ready for prime time. SMS 2.0 was a great example of this: Microsoft released the product right at Y2K crush time and it wasn’t until SP2 for SMS (now at SP3) that the product really got to where it needed to be. MOM is somewhere in the middle. It’s not the fully robust code that I’d like to see; but neither is it as buggy as SMS 2.0 was when it first shipped. If you’re anxious to get into the operations management game, then you can safely go forward with MOM, but I’d anticipate fairly fast service pack releases coupled with a rush of XMPs.

Personally, I don’t think MOM buys you a heck of a lot at this juncture because it’s more about event and System Monitor counter consolidation than it is about operations management. That said, let me speak out of both sides of my mouth and say that if you’re willing to invest the time to install, tune and understand what MOM’s telling you, you’ll end up with a system that—in 15 minutes—can give you your entire network’s heartbeat. And that may be worth the price of admission.