Effective Data Collection for Enterprise Monitoring

Effective Data Collection for Enterprise Monitoring It's not about "agent v. agentless" anymore
Executive Summary At the heart of every approach to enterprise management is the need to monitor the IT environment for what is working and what isn't. Today's sophisticated monitoring approaches provide data to help IT operations determine whether a component-level problem is impacting key business services and applications. The most effective products efficiently collect performance data without a lot of setup and overhead, to provide a clear picture of the impact a problem is having (or could have) on a network or the entire enterprise. Data collection mechanisms used by enterprise management products for monitoring are categorized as either agent-based or agentless. This white paper looks at the pros and cons of agent and agentless approaches, and describes Indicative's unique approach that combines the best of both techniques while limiting the liabilities associated with each. Management Tools and the Rise of Agents Agent-based data collection emerged with the decentralized computing model of the 1980s, when networks of servers and powerful desktop computers came into mainstream business use. Such environments were, relative to today's enterprise IT environments, fairly small and simple to manage. This was particularly true if agents- really just a small amount of code written to reside on a given server, network node, desktop or other device-were deployed to help collect and deliver data regarding the operational health of a given device. Such network and system management (NSM) agents are often proprietary to a given NSM vendor's tools; for example, Hewlett-Packard's agents only work with HP management tools, IBM's with IBM tools, and so on. More recently, standards-based agents using the Simple Network Management Protocol (SNMP) are gaining wide acceptance for "open systems" (e.g., Unix and Linux servers, network devices, environmental and security devices) and are often included on the devices by vendors to enable monitoring. Agents have evolved to the point where they've become very good at "seeing" and collecting data about the health of devices on which they reside. After all, they were designed to collect device-specific information that IT administrators need to track performance and availability and be alerted on inevitable problems that arise. The downside of agents in use today is that there are significant costs associated with their use. The average purchase price of specialized agents ranges from $700 - $1500 per system or device to be monitored and there is also a real cost of administration of agent-based monitoring tools. Agents must be installed, configured and maintained on all monitored devices (typically hundreds to thousands in an enterprise IT environment).
Page 1 of 5
Standard (SNMP) agents also have limitations. They collect defined, generic sets of performance, usage and availability metrics and make these available through a standard management information base (MIB) to external monitors. The standard MIBs typically do not include important metrics needed to analyze performance and usage of today's sophisticated application and database servers (e.g. Java platforms like BEA WebLogicTand IBM WebSphere, and vendor proprietary systems like Oracle EnterpriseT, and Citrix). Vendors may add metrics to the standard MIB on their systems but typically don't publish details of custom MIBs for external monitoring. What makes agents even more problematic is that as networks grow (e.g., become linked via the Internet into broader, interdependent enterprise environments), different tools from different vendors require that multiple agents be added to devices in order for the management tools to be at least somewhat effective. A single server, for example, could have several agents to keep it linked with every monitoring tool in use by an IT department. What's worse, any time each management tool needs to be updated, all of the hundreds or even thousands of devices being monitored by a given tool often need to be updated as well. This involves major effort that can cause even bigger problems if they aren't adequately maintained for upkeep. It's a costly effort as well. Because event-based tools depend larg... [download for more]