• Sidebar: Operations Manager Overview
• Sidebar: What's in an OM 2007 Management Pack?
• Illustration: Health Explorer
• Illustration: New Unified Console
• Illustration: Operations Manager 2007 Architecture

Operations Manager (OM) 2007 is the first of Microsoft's System Center management products to embrace "model-based management"—a key pillar of the company's Dynamic Systems Initiative (DSI). Use of models allows the product to perform functions difficult or impractical with its predecessor, such as monitoring applications or OS services distributed across multiple computers, and makes it easier and thus more likely for developers and partners to create management packs (MPs) that enable OM to monitor their applications, OS components, and hardware devices. However, OM 2007 still requires substantial and difficult fine-tuning to eliminate false alarms.

This release is a major update to Microsoft Operations Manager (MOM) 2005, the company's product for monitoring computer and application health, and its formal product name has been changed to Systems Center Operations Manager 2007. This article assumes readers have a basic understanding of the MOM 2005 product; readers unfamiliar with it should see the sidebar "Operations Manager Overview".

More Capable Management Packs

Of all the new capabilities in OM 2007, its new management pack architecture is the most significant.

To monitor one or more instances of a system component—which could be an OS service, such as Active Directory (AD) or the domain name system (DNS), an application, such as Exchange, or a hardware device, such as a computer, storage array, network printer, or router—OM requires an MP for that class of component. The MP models the way it ought to function and provides other information useful to operators when troubleshooting problems.

Microsoft's Systems Definition Model (SDM)—a new, advanced format for expressing model data—coupled with better authoring tools makes it possible to create OM 2007 MPs that are far more capable than their MOM 2005 predecessors. (For more on models and SDM, see "Modeling Framework Key to Microsoft's Management Strategy". For an overview of the contents and functions of OM MPs, see "What's in an OM 2007 Management Pack?").

The OM 2007 MPs and MP infrastructure are superior to those of MOM 2005 in the following respects:

• Operators can identify specific symptoms of a problem much more easily
• System services or applications distributed across multiple computers can now be monitored
• Less fine-tuning is required to ensure that OM generates alerts only when something is truly wrong
• Because MPs are versioned and signed, MP administration and customization is easier
• A library of core models and new authoring tools makes MPs easier and less costly to build.

OM 2007 comes bundled with MPs for monitoring itself; Windows Server OSs; Windows services such as AD, IIS, and Terminal Services; Microsoft server applications, including Exchange, SharePoint, and SQL Server; and even for monitoring Windows client OSs and applications such as Office on critical desktops (typically, unmanned kiosks). Other Microsoft products that had MOM 2005 MPs will get new OM 2007 versions that will be available for download before the end of 2007, and all Microsoft server products released after June 2007 will be accompanied by OM 2007 MPs for those products.

Zeroing in on the Underlying Problem

OM 2007 is generally better than MOM 2005 at helping operators identify specific symptoms in unhealthy component instances, which can help identify the underlying problem.

MOM 2005's primary method for component health monitoring is a set of health checks, called rules, which operate independently from one another. In the MOM 2005 approach, a single underlying problem often triggers many different rules, forcing operators to sort through the clutter of multiple errors and warnings in a search for the underlying cause.

OM 2007 introduces a new object type, called a monitor, which keeps tabs on some aspect or set of aspects of each monitored instance of a component. Unlike rules, monitors organize health states into a multilevel hierarchy, where the health states of lower-level elements roll up into the overall health state of the instance. For example, the health of an AD domain controller's replication service constitutes one element of the domain controller's health, which in turn constitutes a portion of the health of the overall AD service.

OM 2007 presents a new view, the OM 2007 Health Explorer, that allows operators to drill down into a problem on an instance of a computer, distributed service, or distributed application. The Health Explorer presents a tree view hierarchy of all the monitors for the component instance selected by the operator, and it automatically expands the tree to show any specific problems that are contributing to the instance's unhealthy state. Although drilling down to specific unhealthy monitors does not constitute true root-cause analysis, nonetheless, it narrows down the possibilities and presents more relevant knowledge to the operator. (For an illustration, see "Health Explorer".)

Monitoring Distributed Services and Applications

OM 2007 is much more adept than MOM 2005 at monitoring distributed OS services and applications composed of multiple component types spread across multiple computers, as can be the case for AD, Exchange, and database-driven Web applications such as SharePoint and most line-of-business applications.

MOM 2005's rule-based health modeling architecture was focused on individual computers and provided no means to aggregate the health of distributed components so that they could be monitored as a whole. The only means available for diagnosing the overall health of a distributed service was for MOM 2005 to periodically submit synthetic transactions to the service and check whether or not it responded back correctly. However, when synthetic transactions fail, they provide little help in identifying the component of the service that caused the failure.

Unlike MOM 2005 MPs, OM 2007 MPs can be written to discover instances of subcomponents that comprise a service or application distributed across multiple computers and then to monitor them as a whole. These MPs roll up the state of the various servers and components involved and provide an overall health state of the service as well as a hierarchical view of the components comprising the service.

OM 2007 comes with several prebuilt MP models for discovering and monitoring distributed Microsoft applications, namely AD, Exchange, and OM itself, and also includes tools that allow customers to create high-level MPs for monitoring distributed services, such as Web-based business applications, SharePoint farms, and Terminal Server farms.

Although the OM 2007 Exchange MP supports service-level monitoring of Exchange 2003 and 2007 servers, OM allows customers to go even further and manually add Exchange's dependencies on other components, such as client connectivity, directory services (AD), network services (such as DNS), storage, and network hardware, such as load balancing devices.

Less MP Tuning Required

OM 2007s new MP architecture is designed to reduce the amount of post-installation fine-tuning required to eliminate false positives. Microsoft's ultimate design goal is that every alert that OM generates should be "actionable"—that is, either an operator should have to do something, such as issue a trouble ticket or a change order, or OM itself should take some automated response, such as restarting a service. Although OM 2007 is still far from this goal, it is better than MOM 2005. A new feature—Self-Tuning Thresholds (STT)—is responsible for much of this improvement.

Many times, OM evaluates the health state of a component instance by comparing certain performance counters, such as a process's CPU utilization, against a range of acceptable values provided by the MP. With MOM 2005 MPs, the MP author had to set static limits on these ranges, and if these ranges were too narrow, the MP would generate excessive alerts; but if ranges were set too broad, the MP might not catch an unhealthy condition until the problem became severe. Unfortunately, because MP authors often have no idea of what hardware resources will be available and what other components must share those resources, they can make only best guesses at performance thresholds. As a result, customers often had to tailor their MP settings for each monitored computer.

OM 2007's STT feature allows MP authors to have OM automatically determine optimal alert thresholds. When a health model with STTs is first instantiated, OM 2007 monitors performance counters over a period of time specified by the MP author, and then automatically creates baselines representing normal activity for the counters. These baselines are not simple average values but can take into account certain patterns, such as spikes in processor utilization on Monday mornings at 9:00 a.m. No alerts are generated until the baselines have been established.

Although the STT feature should more accurately reflect an organization's use of its IT infrastructure by taking into account normal variations in usage and will help reduce false alerts over time, if the system is unhealthy from the beginning, an improperly calculated baseline could mask an unhealthy state.

Sealed and Versioned MPs

As noted earlier, customers need to be able to adjust the behavior of MPs to eliminate false positives. However, doing so created several problems in MOM 2005. Although an administrator was free to modify or override individual MP objects (rules, tasks, scripts, views, and reports), MOM did not track which objects had been modified. Furthermore, once a MOM 2005 MP was imported into the MOM database, its objects lost their identity as part of a discrete, versioned MP. Although objects of each particular type were grouped by the name of their source MP (which made it possible to find what MOM 2005 objects were associated with a particular managed component), it was not possible to associate objects with particular versions of the MP from which they came.

This architecture created three problems. First, when a vendor released an updated version of a MOM 2005 MP for their component, the customer could either completely replace all existing objects for that component, which meant that all customizations were lost, or it could merge the objects from the newer version with those of the existing MP version, which still overwrote customizations on items that changed between releases of the MP. Second, MP vendors could not restrict customer customizations, which could cause difficulty for vendors when a customer called for support. Third, after an MP was imported, it was not possible to identify all of the objects associated with it should the customer want to remove the MP entirely.

In OM 2007, MPs from Microsoft and other vendors are versioned, signed, and sealed with a certificate. After a MP is imported into OM 2007, all of the MP's objects retain their identity as part of that versioned MP. Because they are sealed, customers cannot make changes to the MP's original logic or scripts, and any customer overrides are saved to a separate, unsealed MP. As a result, when a new version of a sealed MP becomes available, the original MP can be replaced without affecting existing customizations. Versioning of OM 2007 MPs also makes it possible to remove an entire MP if no longer needed.

MPs Easier to Build

In addition to being more capable, OM 2007 MPs are easier to build when compared with MOM 2005 MPs.

When MP authors (typically developers) built a MOM 2005 MP, they had to start from scratch for each MP, and it had to be self-contained, i.e., the health state of one component could not be linked to the health state of another component on which it depended. Although Microsoft provided some rudimentary guidance on how to build a health model, the MOM 2005 architecture made it unfeasible for Microsoft to supply standard models or templates to jump-start the authoring process.

Structurally, OM 2007 MPs are much different than MOM 2005 MPs. Each OM 2007 MP consists of one or more XML documents that conform to the SDM Version 2 specification and use an object-based schema. MP authors use familiar object-oriented development concepts, such as classes, class libraries, instances, inheritance, references, and relationships.

OM 2007 includes a class library of core models that is used to declare common types of objects, such as computers, applications, users, and printers, as well as samples of various generic objects. The abstract models provide a starting point for MP vendors, who then extend them to create the actual model for their component. All OM 2007 MP classes ultimately inherit from the Entity base class defined in the core library. (It is not possible to define a new class that has no inheritance.)

Once an MP author creates a new class, it can be made available to customers and other vendors for further extension.

Because of OM 2007's adoption of SDM, its modular, object-oriented architecture, its uniform set of core models, and the new monitor object type, the MP authoring process is now easier and allows MP authors to leverage and extend work done by Microsoft and other MP authors.

In addition to the MP architectural changes, development and authoring tools for OM 2007 are far more extensive than those for MOM 2005, which required authors to use the MOM 2005 administrator console for all MP development. Although any tool for working with XML, including Visual Studio, can be used to view or author OM 2007 MPs, the product includes several other developer and MP authoring tools.

Authoring Console. Unlike MOM 2005's restriction to authoring MPs from the administrator console, OM 2007 provides a completely separate tool intended for building commercial or sophisticated custom MPs from scratch. Currently in beta, the Authoring Console will be available for download in the third quarter of 2007 and provide a graphical interface that shields MP developers from delving into raw SDM.

Operator's Console. The OM 2007 Operator's Console includes templates from which customers can build simple MPs that can monitor Windows services or generate synthetic transactions to test ASP.NET applications and Web services, Web applications, OLEDB database sources, TCP port availability, and the status of Windows services. The operator's console is also the place for making small changes—called overrides—that disable specific monitors and rules or alter their parameters. A new Distributed Application Designer wizard allows OM administrators to create models of distributed applications from existing component models. This wizard includes templates for creating MPs for Web-based business applications, SharePoint farms, Terminal Server farms, and complex Exchange infrastructures.

OM 2007 SDK. An OM 2007 SDK can be used to build more complex MPs and to build software that integrates with or extends OM 2007. It contains an MP authoring guide, SDM schema, samples, and base classes for MP development. It also defines the OM 2007 APIs so developers can build products that deeply integrate with and automate OM 2007. Since all of the OM 2007 Operations Console is actually built with the SDK, it means that developers have full programmatic access to the capabilities of OM 2007, including all the functions exposed in the console. The OM 2007 APIs can also be accessed remotely through Microsoft's Windows Communications Framework.

OM 2007 continues support for the Microsoft Operations Manager Connector Framework (MCF). The MCF is an extensible framework and Web service API for exchange data between OM and other technologies, such as help desk or configuration management tools.

What Else Is New in OM 2007?

Although the MP changes are the most significant, many other changes in OM 2007 deserve attention from prospective customers or partners.

Role-Based User Interface

OM gathers and stores a great deal of data, which poses a major challenge for human operators, who need the software to deliver clear, efficient, and intuitive views of the data. Furthermore, administrators who must configure the product and developers who author MPs place their own demands on the interface. In MOM 2005, Microsoft approached this problem by splitting the operational and administrative aspects of the product into two separate consoles: an administrative console built on the traditional Microsoft Management Console (MMC) framework and a separate operational console that used a new multipane user interface fashioned after Outlook 2003. However, this approach required installing and learning two vastly different consoles, and the MMC architecture imposed limitations that made it harder to discover and perform various administrative and authoring tasks.

In OM 2007, use of the MMC has been scrapped entirely and both console types have been merged into a single role-based console that in some way resembles the MOM 2005 operator's console, with its Outlook-like three-pane window, but otherwise is quite different. (For an illustration, see "New Unified Console".)

A user can toggle the console display between different modes that expose screens designed for different tasks—monitoring, administration, authoring, and reporting. Based on their AD user account or group, each console user gets access to only those modes permitted by the various profiles (administrators, authors, operators, read-only operators, report operators, and security administrators) and scopes (which filter out the monitored components which they are not permitted to view and manage) that have been assigned to them. This architecture gives the customer very granular control over access rights. For example, an Exchange specialist could be granted full access to the components of their Exchange and AD infrastructure while limiting them to read-only access to other OM components.

Monitoring mode displays the health of managed systems. In addition to viewing components to which they have been granted access, users can personalize monitoring views according to their individual needs with an associated My Workspace mode. Monitoring mode also gives the user access to the new Health Explorer view mentioned earlier.

Administration mode allows administrators to configure OM, install OM agents on target machines, add and remove MPs, assign users and groups to security roles, set up notifications, and manage MCF Web service connectors to other management products.

Authoring mode allows authorized individuals to override MP parameters, create simple MPs, and use the Distributed Application Designer wizard to create MPs that aggregate monitoring of the multiple component instances needed by a distributed application into a single monitored unit. This mode replaces the MOM 2005 administrative console.

Reporting mode allows users to run and view reports directly from the console against historical data contained in the OM data warehouse. However, users can still access reports by browsing OM's SQL Reporting Services Web site (which was the only way that MOM 2005 users could run or view reports).

PowerShell Support

Although OM 2007 includes a full SDK that enables programmatic access to everything the OM console can do, and the MCF Web service API enables bidirectional data exchange between MOM and other programs, both of these are far too complex for developers who need only a simple, lightweight method to extract some OM data, or for OM administrators who just want to script some repetitive administrative tasks.

Fortunately, OM 2007 can be scripted with PowerShell, Microsoft's new shell-scripting engine. With PowerShell, administrators and developers can run a variety of system and application management tasks at the command line and compose scripts for routine administrative tasks. OM 2007 installs PowerShell commands for various OM configuration tasks and for querying OM health status information.

For example, an administrator can deploy OM agents to a list of servers using a simple PowerShell script. Other commands give developers a simple way to surface the health status of a component instance in their application's user interface, such as displaying a Web application's current health status on that application's home page.

Unlike Exchange 2007 (whose new console is completely built on top of PowerShell), the OM 2007 console is built entirely with the OM 2007 SDK, not on PowerShell. Furthermore, OM 2007 PowerShell commands aren't supplied for every console feature. However, this architecture makes sense for OM, since the main purpose of the OM 2007 console is mainly displaying information to operators, rather than performing configuration tasks that often involve large numbers of users or devices.

More Support for Network Devices

OM has traditionally been best suited for monitoring Windows OS services and applications. Although MOM 2005 could display events from devices managed by the Simple Network Management Protocol (SNMP) when those events were forwarded to it via the MCF from network monitoring and management software, such as the Hewlett-Packard (HP) OpenView Network Node Manager or the Jalasoft Xian Network Manager, in that capacity MOM only served as a "manager of managers," it could not discover or monitor SNMP network devices directly.

However, OM customers would like to eliminate the cost and complexity of duplicate monitoring systems. Moreover, Microsoft clearly feels that adding native network device monitoring capabilities is critical for OM to become the de facto enterprise health monitoring solution: most applications depend on network infrastructure, and one of the goals of the DSI is to accurately model the interdependencies of all system components so that future versions of OM can accurately perform root-cause problem determination and automatically remediate problems whenever possible.

To this end, OM 2007 adds two new capabilities for monitoring network devices:

Direct SNMP device monitoring. OM 2007 can now discover SNMP-enabled devices, such as routers, switches, network printers, and load-balancing devices. However, to monitor the health of these devices, the customer must create monitors and rules in a custom MP that runs on the OM server and uses SNMP to gather data from the devices (since OM agents cannot run on those devices).

Monitoring via WS-Management. OM 2007 adds support for the proposed WS-Management (WS-Man) standard. WS-Man is a Web service protocol that will likely begin replacing SNMP for managing networked devices. Although devices supporting WS-Man are scarce today, they will likely become more abundant in the future once the standard is ratified by the Desktop Management Task Force (DMTF).

The next release of OM will boast even better capabilities for monitoring networked devices: in Apr. 2007, Microsoft announced a deal with EMC to license some of EMC's Smarts network monitoring technology for inclusion in the next release of OM. (For more on the deal, see "Network-Device Management Partnership" on page 12 of the May 2007 Update.)

Client Monitoring

MOM 2005 introduced both agent-based and agentless health monitoring for small numbers of critical Windows desktop devices—devices intended mainly for public use, such as Internet kiosks or ticket machines.

As with MOM 2005, OM 2007 comes with MPs for monitoring the basic functions of Microsoft desktop OSs (XP and Vista) but also includes new MPs for monitoring Internet Explorer, Media Player, and Office applications as well.

A new type of agentless client-side monitoring—Agentless Exception Monitoring (AEM)—is intended for much broader use across large numbers of Windows PCs assigned to ordinary users.

AEM enables OM 2007 to monitor OSs and applications for exception errors (often called Dr. Watson errors). Administrators configure Group Policy to tell Windows clients to redirect their error reports to an OM 2007 server instead of to Microsoft. By aggregating error reports on an OM server, IT staff can determine how often OS components or applications crash and how many computers and users are affected, and can filter which errors are sent on to Microsoft.

AEM provides the same functionality as Microsoft's Corporate Error Reporting 3.0 tool that is free to customers with Windows client Software Assurance, but it eliminates the need to maintain a separate tool.

Audit Collection in OM 2007

A new feature called Audit Collection Services (ACS) forwards all security log events from designated agent-managed computers to a central OM database separate from OM's operational database and data warehouse. This audit data is useful for historical security analysis of the organization's overall IT environment, such as detecting or determining the scope of security breaches.

However, OM 2007 does not include reports or other tools tailored for analyzing this data. This is an area ripe for third parties, and one such vendor is SecureVantage, who offers a line of reporting, analysis, and archiving tools for ACS.

ACS increases network and storage requirements. Normally, OM health agents on managed systems forward only a tiny fraction of the data they monitor, but ACS causes each agent to forward every single security log event. This can create significant network traffic and places larger workloads on the OM management servers and ACS database server. The size of the database can also grow quite large if many servers are being monitored.

Difficult Migration from MOM 2005

Although the basic architecture of OM 2007 is similar to that of MOM 2005, the radical changes to the MP format and data schemas made building support for in-place upgrades too unwieldy. Instead, Microsoft expects MOM 2005 customers to build a new OM 2007 server infrastructure, install new OM 2007 agents on all agent-monitored computers, operate the two products in parallel until the OM 2007 is producing acceptable results, and then deinstall the MOM 2005 agents and decommission the associated MOM 2005 servers.

Unfortunately, this approach means that all existing MOM 2005 operational or reporting data cannot be loaded into OM 2007 databases. It also means that trouble-ticket systems and other products that integrate with MOM 2005 using the MCF may have to be modified to work with OM 2007. Because of changes to the reporting database schema, any custom report definitions will need to be rewritten to work on OM 2007.

Furthermore, OM 2007 cannot use existing MOM 2005 MPs directly. Fortunately, Microsoft provides a set of tools that enables customers to export selected groups of MOM 2005 rules, views, and tasks and convert them into OM 2007 SDM-based MPs, which allows customers to preserve their investment in the customizations and overrides they made to their MOM 2005 MPs. While converted MOM 2005 MPs do not exploit any of the new features of OM 2007, they do allow the customer to get their new OM 2007 system performing the same monitoring functions that MOM 2005 was providing before migrating.

Eventually though, for any given component, customers will want to move from commercial MPs originally designed for MOM 2005 to MPs (if available) designed to take full advantage of OM 2007, and also build new OM 2007 MPs for their in-house applications. This move will undoubtedly require customers to manually create new sets of OM 2007 MP overrides.

OM 2007 MPs are already available for many of Microsoft's mainstream server products, and Microsoft plans to reissue more of its MOM 2005 MPs as OM 2007 MPs in the coming six months. As of May 2007, the company has not made clear its strategy for determining which of its 79 existing MOM 2005 MPs will be updated.

Impact on Partners

As was the case with MOM 2005, OM 2007 is a complex product that will no doubt continue to provide integrators and consultants with service opportunities in building, configuring, and fine-tuning OM systems and helping customers author distributed application MPs or MPs for their custom applications. Although the changes introduced in OM 2007 will likely open up partner opportunities in some areas, it may reduce them in others.

Partner opportunity. With MOM and OM undergoing significant growth and gradually becoming the de facto monitoring solution for Windows systems, the demand for MPs that manage hardware and non-Microsoft software should grow along with it. IHVs and ISVs can sell MPs for monitoring their products or include free MPs and market their product as easier and cheaper to manage because of integration with OM 2007, or they can even sell MPs for monitoring other vendors' products.

Partner threat. As Microsoft fills gaps in OM's capabilities, such as SNMP- device support and its stated intention to include EMC Smarts network device technology in a future OM release, partners such as Jalasoft, eXc, and SecureVantage who fill OM's feature gaps with aftermarket solutions will have a harder time convincing customers to spend extra on capabilities that will be partly or completely provided by OM. Furthermore, as OM establishes a foothold, large partners such as BMC, HP, and IBM will find it increasingly difficult to sell their more expensive monitoring solutions into the Windows market.

Much Depends on MP Authors, Promises

While OM 2007 is a very important step forward in Microsoft's overall DSI strategy, it is basically an enabler that improves Microsoft's basic monitoring infrastructure—a great deal of its overall utility depends on the quality of the MPs, which are outside the control of Microsoft's OM product group. Furthermore, OM 2007 still doesn't meet the self-monitoring, self-healing goals of the DSI and will undoubtedly undergo further significant changes in future releases.

Improving MP Quality, Lowering MP Cost

Developers and MP authors will ultimately determine whether OM becomes viewed as essential by most IT managers. Sadly, critical instrumentation is missing from many of today's applications, and there are no generally accepted MP quality and functionality standards. While the OM 2007 MPs created by Microsoft's own product groups are generally good and improved from their MOM 2005 predecessors, they still require substantial tweaking and tuning by OM administrators to eliminate false alerts.

Although Microsoft has created an MP authoring guide for OM 2007, a comprehensive "Designing for Operations" bible (comparable to Microsoft's "Writing Secure Code," but focused on systems management rather than security) that would provide best practices guidance to developers and MP authors does not yet exist.

Furthermore, getting a component's MP and instrumentation just right requires iterative development and close cooperation between the MP developer and the IT administrators who deploy and configure it. However, outside of the beta process, Microsoft has no real conduit in place for reporting corporate IT experiences and change requests back to MP authors on Microsoft's product teams, and it doesn't appear that third-party MP vendors have any better feedback systems in place.

Another major problem is that it is very difficult to calculate the business case for investing in MPs and instrumentation (whether by commercial vendors or by developers of custom corporate applications), which ultimately dictates how much development effort will go into it. Doing instrumentation properly and authoring a good MP is still hard and expensive, and while it may make sense for device and application vendors, such as Microsoft, that sell many thousands of units of product, the payback is harder to prove for corporate developers and smaller ISVs.

Although Visual Studio 2005 provides tools for working with and verifying XML, it does not give developers any special capabilities for instrumenting code and authoring MPs. And although Visual Studio 2005 Team Server introduced design tools that produced SDM models of applications, these models are based on the SDM v.1 specification and reflect dependencies on a manually specified logical data center environment rather than being able to discover real data center resources. Consequently, these models are of no use to OM 2007.

Microsoft's developer tools will ultimately fully embrace DSI—the current OM 2007 MP authoring guide states "eventually the process of building an application in Visual Studio based on a SDM model will have the side effect of creating the OM MP that uses the same model." However, the company is still a very long way from this goal. The next release of Visual Studio, code-named Orcas and targeted for the second half of 2007, will not introduce any new modeling capabilities. The release to follow, code-named Rosario and targeted for release in 2008 or later, will supposedly have more modeling capabilities, but Microsoft has not released details and it's doubtful Rosario will come anywhere close to meeting Microsoft's stated goal.

Automatic Problem Diagnosis Limited

Microsoft originally promised OM 2007 would perform what's known as probable cause analysis, a desirable goal of any system monitoring solution. In reality, the product is still far from being able to perform that function and an even longer way from performing deterministic root cause analysis. Although OM 2007 can find the specific symptoms that cause an unhealthy state within the confines of a single health model, that's about the extent of its automatic diagnostic capabilities.

This problem has two aspects. First, not all of the components critical to the overall health of distributed services are modeled and monitored in OM 2007. The situation is improving as more hardware vendors issue MPs for their products, and integrating the EMC Smarts technology into a future version of OM will help the product model relationships between applications, network topology, and networked devices.

Second, OM 2007 does not automatically assemble all of the component instances needed by an application service into an Übermodel. In OM 2007, even obvious relationships between many managed Microsoft components are not auto-discovered and must be manually configured. For example, nearly all software components that communicate over the network rely on DNS for resolving names to IP addresses, but few of the built-in Microsoft OM 2007 MPs automatically discover the specific DNS server or resolver instances on which their component instance depends, so they cannot tell the operator when an application failure was really caused by a DNS failure.

While OM 2007 is better at determining probable causes than MOM 2005, much still depends on the MP author to model as many dependencies as possible, and accurate root-cause determination won't be possible until all instances of the hardware and software components involved in providing an IT service can automatically discover their relationships with and dependencies on one another and OM can model those relationships properly.

Microsoft hasn't yet made clear how they intend to solve this problem in future releases of OM.

Resources

OM 2007 Pricing and Licensing is described in "Operations Manager 2007 Packaging, Licensing, Pricing".

The OM 2007 home page and links to a 180-day evaluation copy are at www.microsoft.com/systemcenter/opsmgr/default.mspx.

A catalog of all Microsoft and third-party MPs can be found at www.microsoft.com/technet/prodtechnol/mom/catalog/catalog.aspx?vs=2007.

Details of how Microsoft has deployed OM 2007 internally is available at www.microsoft.com/technet/itshowcase/content/scopsmgr.mspx.

MP authors should also check out www.authormps.com and blogs.msdn.com/jakuboleksy.