MOM puts Windows systems data on tap

It's architected very specifically for Windows-centric environments. Most other products out there are taking a generic approach to managing the enterprise, building generic management for Unix or Windows. MOM can link into heterogeneous environments, but it focuses on Microsoft environments. Because we're focusing on Windows and the services of Windows, the performance is much higher than generic products can offer on Windows. The knowledge that we can provide about Windows environments is far deeper than generic products can provide. MOM is the best tool for managing Windows servers today.

If you just monitor events, you have to collect thousands and thousands of events. Just getting events doesn't solve the problem. For example, our own internal IT group has 5,000 servers and can produce millions of events a day. Those events are there in the local event log for future analysis, and that's fine. You don't want to collect these millions of events back at a central point, because you won't be able to see where the problems are. MOM looks at every event as it is generated. Through a set of rules running locally on a machine, MOM can decide if that's an event that should be forwarded to a consolidation point. If the event is forwarded, then more rules determine whether a human should be told about this event.

In the absence of this (pre-screened) knowledge, we found that customers were using a general-purpose management system and suppressing all events. Then they would select a few to examine. Doing it this way, they had to learn for themselves what to bring up and they were also missing important events. MOM helps them determine the things that are different from every other Windows environment and monitor those. That's better than just taking a guess and choosing 10 things to monitor.

If a problem is happening all over the network, you can set it so you only get one alert. For example, if a DNS server goes down, everyone using it generates an event. You don't want that to happen on the screen of the human monitoring the system. Instead, the manager wants to see that a particular DNS server is down and these people are affected.

Another example is the management of Active Directory or any service that replicates itself. It's easy to see on any one controller the state of the Active Directory. It's very hard to see if the Active Directory is replicating itself, and if it is, is it doing it fast enough for your needs? A standard built-in rule will tell MOM to monitor AD replication services. On a regular basis, it will put a marker in one Active Directory copy and watch that marker replicate itself throughout the network. It will collect information about how fast that replication is happening and log that information in the database. Then, you can set up alerts based on, say, replication slowing down.

I don't understand that comment. This kind of technology -- MOM and the predecessor to MOM -- is used to manage Microsoft.com, a huge industrial-strength system. Is that a criticism that says MOM doesn't really manage Unix? Well, no, we're not. We are working with partners, so that they can extend MOM to manage outlying regions of Unix from MOM in a Windows-centric environment.

Planning is everything. This is not a shrink-wrapped product. This is a system. Plan to roll it out the same way you would roll out a mail system.