Having determined the key service(s) and the required service elements, you now must determine what to measure. Different measurements are needed for different purposes, so it is convenient to group required measurements into categories based on purpose. The five categories of purpose you need to consider are:

1. Services provided. Even if you don't have a defined SLA with your customers, you will still want to measure end-to-end performance of the key service you are responsible for. The specific metrics may have been defined for you in a SLA. If not, you'll want to measure service quality from a customer perspective in terms of both performance and availability. Appropriate metrics might include round-trip response time, percentage availability over a month and mean time to repair.

2. Services used. To provide the appropriate level of service, you rely on the services provided by one or more service providers. The metrics will be similar to those for services provided but may be more specific to a particular transport technology.

3. Capacity planning. The most pure performance management baselining goal is to predict future capacity requirements from current trends. The primary metrics for capacity planning are percentage utilization (how much of the available bandwidth is used) and latency (how much delay is there is transporting data through the service element).

4. Network use. An extension of capacity planning is the analysis of how the use of the network is changing. Such trends can be examined at the network-protocol level or at the application level. For example, you might want to track HTML-related traffic on backbone links to establish whether proxy servers should be deployed at regional headquarters. Determining whether these metrics will actually be a function of how complex/costly the instrumentation requirements are, but at this stage it is useful to consider what such metrics might be of benefit in your organization.

5. Network health. Managers argue whether health-related trending belongs in the category of performance Management or fault management, but regardless, the application of trending techniques and baselining goes beyond just speed and availability measurement. By measuring specific problem indicators it is possible to highlight a trend toward an upcoming problem before the problem occurs. The most common metric for network health is the number of errors associated with a particular link or LAN segment. Specific error metrics vary depending on the technology in question.

Establishing the Baselines

Baselines give meaning to actual measurements by providing a yardstick for comparison. Traditionally baselines have been a single value (usually represented as a flat horizontal line on a graph of metric values over time). That single value was often derived by collecting metric data over a defined period and taking the average as a representation of the current state--for example, the average utilization over a one week period. By comparing the stored average measurements of subsequent periods, it's possible to highlight emerging trends in network needs.

However, in reality, such averaged information can be quite misleading. As any network manager knows, network usage is not consistent. A network that is close to idle much of the time may experience sudden peaks of usage. Consequently the network may be unable to handle its peak use despite apparently performing well against an average-utilization baseline. This problem has led to the concept of the baseline profile. Rather than a single average measurement, the baseline becomes a number of measurements at equal intervals over a defined period (or set of periods). On a graph showing the metric values plotted against time, the baseline is no longer a flat line but itself has peaks and valleys. The premise behind such an approach is that normal operation of networks typically involves peaks associated with normal business activities. Examples of normal predictable traffic peaks over the course of a day might include e-mail traffic peaks in the morning and after lunch, regularly scheduled backups over the network at night, and peaks in the use of network-centric applications based on daily business flow. Over a longer period you might expect peaks at the end of the month or during a seasonal business peak. By using a profile baseline instead of a flat baseline, you can spot not only large changes in average use, but also smaller changes from the normal pattern of use. Such changes can point to new uses of the network or to pending problems. Two companies that utilize a profile approach for networks are Nextpoint Networks, which calls the profiles "traffic signatures" and Proactive Networks ,which uses the term "normal operational envelope."

The disadvantage of the profile approach is that more data needs to be collected to build an impression over time of a trend. The quantities of data involved in baselining and trend analysis can rapidly become very large (for example, 2 KB per router, 30 routers, data every five minutes = 120MB/week). A solution part way between a single flat baseline per metric and profile baselining is the use of multiple flat baselines. For example, if the metric were percent of utilization, you might use as baselines both the average utilization as well as the peak utilization over the period.