|
Top Ten Network Management Lies and Deceptions
#1 Simple Network Management Protocol (SNMP) is Simple
This ranks as the number one deception in the industry. SNMP is by no means simple for even a seasoned network engineer. In theory, it is a simple protocol that governs how management data is retrieved and processed from network devices by a Network Management System (NMS) and how network devices send management information back to an NMS. Getting useful and meaningful data for your NMS via SNMP is the real challenge and is where most vendors distort their capabilities and deceive their potential clients.
Most network management vendors claim to be SNMP-capable. What they don't tell you is that what they really offer is simple SNMP GET requests which ask a network device to return the current value of a specific object identifier (OID) such as "packets IN." This simplistic polling yields data such as "packets in = 5,992." What can you do with this information? Not much, of course.
A true NMS assembles appropriate OID values into meaningful statistics such as "Bandwidth Utilization." Most vendors won't be honest and explain their SNMP limitations accurately. The statistic Bandwidth Utilization is not a single OID object, as many vendors will have you believe. The actual statistic is created by using the formula: ((IN pkts in Octets + OUT pkts in Octets) * 8) /1024. There are two OIDs with appropriate mathematics built-in. Many vendors will say they can provide statistics like Bandwidth Utilization, but in truth, they leave it up to you to figure out which OIDs you need, and then how to perform the appropriate mathematics. Be sure to see this functionality demonstrated.
Further, ask your vendor to provide vendor-specific statistics that are important in your infrastructure. If you don't know what is important, it may be that you never implement this powerful monitoring capability. Unless you are a programmer or SNMP expert, be sure to look for an NMS that has the statistics you are looking for built-in.
The difference between SNMP polling and SNMP monitoring is as follows: SNMP polling means that a network management station (NMS) polls (sends SNMP GET requests) to the remote device. In other words, it asks the device for information and the device responds with a value. SNMP monitoring means that the network device is configured to send SNMP traps (messages) to an NMS without a specific request. Again, the problem is, as with most network monitoring information, there may be many, many trap messages and they are usually cryptic in raw form.
#2 Root Cause Analysis
This "feature" means different things to different vendors and places #2 on our list. Delivering true root cause analysis means that your NMS can filter through hundreds (or thousands) of events and point you directly to the root cause of either an outage or performance degrading event, a very tall order.
To separate fact from fiction in this area, we generally like to separate monitoring capabilities into three categories: Component Monitoring, Transaction Monitoring, and Event Correlation. True Component Monitoring means that your NMS is capable of three distinct capabilities:
1. Monitoring all of the individual components ("moving parts") of your application across all of the devices and software on which it depends;
2. Be able to understand and group the relationship of these components; and
3. Represent those components as a single view of your application.
Many NMSes boast their number of "monitors" and can monitor the various devices within your network, claiming that they can then provide Component Monitoring and therefore "root cause" analysis capability. Unfortunately, without #2 and #3 above, the closest you will come to a root cause identification is several individual component alarms that are not correlated to other events or to your specific application. Often, you won't know which event came first and what chain reactions were caused.
Transaction Monitoring means that your NMS has the ability to create actual or synthetic user transactions that exercise every component of an application end-to-end. While Component Monitoring is powerful and valuable, Transaction Monitoring provides a more holistic view from the user's perspective and ensures that even unknown components are exercised. Two examples would be Email and Web Transactions Probes.
|
