MOM 2005 and ITIL – Part 2

Having discussed Incident Management in part 1 then Problem Management logically follows.

Problem Management 

A problem is the unknown underlying cause of one or more incidents. It will become a Known Error when the root cause is known and a temporary workaround or a permanent alternative has been identified. Or to put simply – a problem is often identified as a result of multiple incidents that exhibit common symptoms. 

The goal of Problem Management is to minimise the adverse effect on the business of Incidents and Problems caused by errors in the infrastructure, and to proactively prevent the occurrence of incidents, problems and errors. 

As we have seen in Incident Management MOM detects incidents quickly and hence can help ID problems quickly. MOM’s reporting can help you prioritise your resources by supplying you with accurate data on which incidents are occurring most often. These are basically the Most Common Alerts reports. 

You may also want to look at the Alert Tuning Solution Accelerator (http://www.microsoft.com/downloads/details.aspx?FamilyId=F6AC090E-A594-4EB5-96D9-2A5FEB827BCC&displaylang=en) as it has more reports that help in summarising alerts in different views. These are Alert Count by Processing Rules, Alert Count by Device and Alert Count by Date. This solution accelerator is also good at helping tune alerts so that you can get alerts that equate to incidents. 

By seeing which alerts are most common then you can then set the second/third line staff on looking at the most common incidents or the problem that has the highest impact even though it may have fewer incidents. In either case MOM easily provides the evidence of which incidents are occurring and how frequently. 

When problems are resolved MOM has an easily updated and extensible knowledgebase that can be used to make solutions and workarounds readily available to the 1-2 line support people improving the productivity of support staff. If an existing knowledgebase system exists that can be hyperlinked then the process should be setup so that all the information is put into that single system and in the Company Knowledge tab a hyperlink to the relevant information should be added. 

MOM Reporting can also assist in providing relevant information to management. 

Service Level Management 

The goal of Service Level Management is to maintain and gradually improve business aligned IT service quality, through a constant cycle of defining, agreeing, monitoring, reporting and reviewing IT service achievements and through instigating actions to eradicate unacceptable levels of service. 

MOM will not write the SLAs for you but MOM provides the monitoring and reporting capabilities to help in determining if those SLAs are being achieved. In particular the MOM SLA Scorecard for Exchange Solution provides you with an executive dashboard to measure and trend service availability and workloads across multiple server roles in an Exchange Server messaging environment. 

The facilities to be able to do Service Level Management will be greatly enhanced in System Center Operations Manager 2007. 

MOM monitors itself and has a view to show if operations staff are not dealing with alerts in the time frames that have been configured for each resolution state in the global settings. 

As mentioned earlier MOM has the ability to integrate in with a service desk to provide information to the service desk operators. This can be done using the MCF and there is a solution accelerator to help in setting up a bi-directional connection.http://www.microsoft.com/downloads/details.aspx?FamilyId=E795EDF1-C610-467D-A9D5-92D5239232F6&displaylang=en 

Additionally there are connectors for
Tivoli, HPOV and HP NNM in the resource kit.http://www.microsoft.com/mom/downloads/2005/reskit/default.mspx 

And if you want to buy an off the shelf connector with support then there is a list of third party connectors athttp://www.microsoft.com/mom/downloads/momprodconnectors.mspx 

To be continued.

MOM 2005 and ITIL – Part 1

ITIL (IT Infrastructure Library – http://www.itil.co.uk/) was developed by the
UK government as a set of best practices for IT service management and is now recognised internationally and used by the public and private sector. MOF (Microsoft Operations Framework – http://www.microsoft.com/technet/itsolutions/cits/mo/mof/default.mspx) is based on ITIL with more specific focus and recommendations for Microsoft products. As the demand grows for IT organisations to be cost efficient and effective then the use of ITIL/MOF is growing. 

MOM can be used to help in the ITIL process. While no piece of software is ITIL certified (only people can be ITIL certified) there is no doubt that MOM can be used to help with ITIL processes. ITIL can be a big, and sometimes daunting project, for some organisations to embark on. Where do they start? I have also seen organisations put in MOM and then ask what do they do with it? By using MOM and ITIL it helps define where to start on an ITIL project and at the same time as ITIL is going in it focuses the reasons why MOM is being used and how to configure it. 

The four main areas that MOM can help are 

• Incident Management
• Problem Management
• Service Level Management
• Capacity Management

Incident Management  

The goal of Incident Management is to restore normal service operation as quickly as possible with minimum disruption to the business, in order to ensure that the best achievable levels of availability and service are maintained. 

The Incident Management life cycle is  

• Incident detecting and recording.
• Initial classification & support.
• Investigation & diagnosis.
• Resolution & recovery.
• Incident Closure.

Incident Detecting and Recording 

This is pretty much what MOM does out of the box. An alert equates to an incident for the majority of the alerts. Obviously information alerts do not. But by focusing MOM on getting alerts to equal incidents it gives a target for alert tuning. MOM will have an alert with the date, time, server, a level (warning, error, critical error etc) and Product Knowledge to help in the investigation and diagnosis. So the incident detecting and recording is done automatically. Additionally MOM is proactive.  It is looking for events that may affect the IT systems and spot issues before they become incidents – like out of disk space incidents. 

Initial Classification & Support 

What you need to do for initial classification & support is  

• Classify incidents
• Match against known errors
• Assign impact and urgency
• Provide initial support
• Close or route to a specialist support group

You can assign a Resolution State and Owner. Also if you use a helpdesk or service desk package you can forward the alert manually or automatically to a helpdesk or service desk using the MOM Connector Framework (MCF) or via a third party tool to create the incident in the service desk software and keep the changes made in synch between the two packages. Some organisations prefer this as all incidents are recorded in one package for analysis regardless of whether the incident comes from a MOM alert or a user call to the helpdesk. 

It is also possible to modify the rules so that an rule that would normally create a warning alert can be changed to create a critical alert if you have deemed that this alert is important in the organisation. As well as the Product Knowledge tab which is filled in with details on the problem and probable cause as well as potential solutions there is the Company Knowledge tab where additional information, workarounds, company specific knowledge with web links can be added by the organisation to aid in the resolution when this alert happens. The Product Knowledge or Company Knowledge may help in providing the initial support and the operations team may be able to close the incident based on that. Otherwise further investigation and diagnosis is needed. 

Investigation & Diagnosis 

You can use the Resolution State to escalate to another team. This can be customised to suit the organisation. A process should be put in place to have a mechanism to hand over incidents from one team to another and not just rely on someone “looking at the console”. While keeping an eye on the console is a front line task it is unlikely that second and third line support will monitor a console as they should be working on projects and proactive activities as well as responding to requests from front line support when there is an incident that needs to be escalated to them.  

The tasks in the Task Pane help with the investigation and diagnosis as well as recovery. This can be used for simple tasks like pinging a server to more complex tasks like running a script against a server to determine a specific piece of information.  

The Product Knowledge tab and Company Knowledge tab can assist in this phase by providing information and known fixes.  

Resolution & Recovery 

MOM can be setup to automatically alert a specialist group via e-mail for certain incidents or automatically run a script or command line task to fix the problem if it is a known issue with a known fix. This ability to automate these known issues frees up the operations staff to focus on incidents that need manual intervention. Different groups can have different views of the alerts that satisfy their criteria. For example one group may just want to see all alerts for all AD servers, another may just want to see all alerts for Exchange servers in London while another may just want to see all critical errors that have been in that state for more than 30 minutes. 

Once an incident is resolved then additional knowledge or fixes should be added to the Company Knowledge to aid in the resolution and recovery of future occurrences of this incident. 

Incident Closure 

Once the incident is resolved the alert can also be resolved and is removed from the main Alert View. 

To be continued.

Virtualisation

Virtualisation is big and getting bigger. You don’t have to be a top rated analyst to spot that. If you look at it historically then in the early days it was a green screen linked to a mainframe or a DOS PC. In those days you could only work on one application at a time (apart from some programs that could run as a TSR – Terminate and Stay Resident). To see your spreadsheet for results to type into your word processor you had to come out of the word processor program and navigate to the directory where the spreadsheet program was installed and run that. Get the figures (or if you were lucky you could export them as a text file if your wp program could import them) and close the spreadsheet program and then go and open up the wp program and get the figures in. Then Windows came along (I know there was OS/2 and others) and you could run multiple applications at the same time and just cut and past between them. What a time saver that was.

 

At the moment organisations chose a platform based on the applications they want to run. Most use Windows as that is where the majority of applications that they want are and because of that most software houses develop for Windows as it is the largest market. A chicken and egg situation. One of the nice things about virtualisation is that you can run another operating system within your main one. Handy if you have an app that only runs on NT4 or you want to learn Linux or you are a developer that needs to test your new software against multiple OS versions and service packs. The nice thing about virtualisation is that it is just a file on your hard disk that can be copied easily to another machine. It also allows you discard changes. So the developer can test the software against each version of the service pack but just close down and discard changes so that the virtual machine is unchanged and ready for another test.

 

The caveat to this is obviously more memory is needed and a fast hard disk is useful and if it is a server product enough processing power to cope. But the other area is confusion for users. I remember when I originally looked at Citrix thin client technology (WinFrame then MetaFrame) and thinking how clever it was but how confused users became when confronted with two desktops. Citrix helped by just showing the application as it would be in a window. You could say that Citrix was an early version of virtualisation. But just as people have got used to multiple applications then multiple OSes should not be a problem. Especially now as PCs are getting to be dual core with 4 core coming soon. And if you have not discovered the joys of working with multiple screens you should try it. It is hard to go back and there is a lot of evidence to show that multiple screens helps productivity if you need to convince your boss.

 

For an interesting article about where virtualisation may be going in the desktop have a read of Joining Dots post.

http://www.joiningdots.net/blog/2006/06/virtualisation.html

 

There are three major players in the market. VMWare is the acknowledged leader and having been bought by EMC has a lot more clout. Microsoft is there having bought Connectix in Jan 2003 and Xen leads the way for open source.

 

On the Microsoft web site

http://www.microsoft.com/presspass/press/2006/jul06/07-17MSXenSourcePR.mspx. 

REDMOND, Wash., and PALO ALTO, Calif. — July 17, 2006 — Microsoft Corp. and XenSource Inc. today announced they will cooperate on the development of technology to provide interoperability between Xen™-enabled Linux and the new Microsoft® Windows® hypervisor technology-based Windows Server® virtualization. With the resulting technology, the next version of Windows Server, code-named “Longhorn,” will provide customers with a flexible and powerful virtualization solution across their hardware infrastructure and operating system environments for cost-saving consolidation of Windows, Linux and Xen-enabled Linux distributions.

 

An interesting development. Thanks to Clive Watson (Technical Specialist at Microsoft
UK) for picking that up.

http://blogs.technet.com/clive_watson/archive/2006/07/18/442252.aspx

 

The market is hoting up with VMWare giving away their GSX product renamed as VMWare Server (but not their money making top of the range ESX product) and creating a player for read only virtual machines. Clever in copying Adobe Acrobat. Microsoft started by making Virtual Server free then Virtual PC and changed the licensing so that with certain versions you can run multiple copies of the OS without having to buy additional licenses. And Xen was always free. J  And you don’t need a reader if the product is free!

 

But Microsoft is not just looking at OS virtualisation but application as well with the purchase of Softricity which will go with SMS (System Center Change Manager).

http://www.microsoft.com/presspass/press/2006/jul06/07-17SoftricityPR.mspx

 

So what has this to do with management? Well one of the big sells of VMWare is some of its management tools and the ability to move VMs from a live server to another server without interrupting users. Microsoft has had a management pack for MOM but that just monitors the health of Virtual Server. Although, very nicely, they have priced the MOM agent per physical device. That means that you can put an agent on every virtual machine running on a Virtual Server but only pay for one license. I think they may realise what a giveaway that was and change that for MOM v3 (System Center Operations Manager 2007)! But if we are lucky they will keep the pricing as is.

 

But currently is beta is System Center Virtual Machine Manager (codename Carmine) which is designed to integrate with SCOM as well. There are a lot of interesting features in it but have a look at the overview at

http://www.microsoft.com/systemcenter/scvmm/evaluation/overview/default.mspx.

With this and SCOM together then provision, monitoring and managing virtual machines should be a lot easier. There is a link on that page to register for the beta.

 

So Microsoft is serious about virtualisation and especially the management of it. It should be an interesting time for organisations looking at virtualisation and management. Especially if they use MOM and Virtual Server.

Where have all the bloggers gone?

As I was setting up this new site I was looking through my old blogs and creating links to make it easier to keep track (for myself and others) and it seemed like that the activity on the MOM blogs has dropped off. 

While blogs seem to proliferate by the minute the number of MOM related blogs has not. Although there have been a few new additions (especially by Microsoft people), but in those that do blog about it there has not been much action. I’ll admit that mine has been free of content for a while but that was because I was off taking a well needed sabbatical. Surely not every MOM blogger is doing the same? 

Has everything that can be said, been said about MOM? I would not have thought so. Or is it just too hard to keep a blog going? I know when I started I was not to trying to do a daily post but to do a post that could add value. It is difficult writing these. I was never keen on a post that said “hey look at this great link” but with no info about what the link was all about or why I should be interested in following that link. I am a technical person not a journalist. But it has given me a new respect for journalists. That they can consistently turn out well written and interesting articles. And I always wanted to make sure my blog entries were accurate so I may have had to go away and test what I had written just to be sure. And that takes time. 

Or perhaps they are all on summer holidays? Or busy answering the forums to get an MVP. Or maybe they are just busy with work. I know that Justin Harter and Pete Zerger have put their efforts into MOMResources.org. A nice site but no RSS. The great thing about RSS is new stuff comes to me in one place and I don’t have to hop from site to site just to see if there is new stuff there. Perhaps Justin and Pete will enable RSS on the site. Although Pete does update his blog and gives updates about the site. 

Perhaps all the MOM bloggers are playing with MOM v3 or as it is officially known System Center Operations Manager 2007. Will that be SCOM or Ops Man or just
OM as that official title is too much. Or perhaps people will still call it MOM for years to come and annoy the marketing people who have spent ages and lots of money on the brand.

System Center – a new blog

This blog is about Microsoft’s managment technologies which have been branded as System Center. This replaces my previous blog on MOM as the technology is expanding.

Previous MOM blog – http://ianblyth.spaces.msn.com/

Products that will fall under the System Center brand. A number of these are still in beta.

System Center Operations Manager 2007 (MOM v3)

System Center Change Management 2007 (SMS v4)

System Center Reporting Manager 2006

System Center Capacity Planner 2006

System Center Data Protection Manager 2006

System Center Virtual Machine Manager

System Center “Service Desk”

System Center Essentials

And the related topics of ITIL/MOF, Dynamic Systems Initiative (DSI) and Infrastructure Optimization Model (IOM).

 A good summary page to overview these is http://www.microsoft.com/windowsserversystem/systemcenter/overview/default.mspx