Rollout: ScienceLogic EM7 Appliance

In our latest nwc reader survey, 70 percent of respondents said that no one has ever finished deploying a network-management platform. Although we think that's a slight exaggeration, ScienceLogic has clearly taken note of the prevailing frustration level. Its answer is the EM7 appliance, which provides most core NSM (network and systems management) capabilities: system and network performance management, including monitoring bandwidth usage and availability; asset and configuration management; and helpdesk. The device can handle IP usage and allocation duties, and can accurately autodiscover network devices and TCP port availability. Better yet, these apps work together out of the box, eliminating the configuration and integration woes that typically plague NSM products. Don't need all the applications? Disable them with a click of the mouse.

Pick Your Size

ScienceLogic is looking to attract small and midsize enterprises while still keeping large enterprise IT groups happy. To broaden the appliance's appeal, ScienceLogic offers four images on the EM7, tailored to various size companies. In addition to the all-in-one image, for small enterprises, ScienceLogic provides collection, database and visualization images to distribute functions in larger environments. This architecture allows for centralized management of EM7 boxes, even in a global setting.

Also attractive to larger shops is the pricing structure, which is based on size and type of appliance, not number of nodes monitored. The EM7 starts at $25,000 for a single all-in-one box that can manage a few hundred devices. The cost climbs to $100,000 or more for a large, distributed environment that requires beefier appliance hardware. Although nothing to sneeze at, that's competitive compared with alternatives: CA, Hewlett-Packard and IBM offerings easily hit $250,000 and up when you combine fault and performance management, trouble-ticketing and configuration management.However, you can't please all the people all the time. While ScienceLogic positions the EM7 as an enterprise-class product, it lacks some features we consider table stakes at this level. It doesn't support Windows WMI, for example. It can't collect network-flow information, like sFlow or Cisco Systems' Netflow do. It doesn't provide an overall topology map, nor can it correlate network and systems outages.

These shortcomings will cost ScienceLogic a few enterprise sales, but most SMEs will gladly take ease of deployment, an integrated feature set and simplified pricing in lieu of high-level correlation, making the EM7 a welcome addition to the NSM landscape.

Fast Times

We loaded up a test environment with several dozen Windows, Linux and Unix servers and apps, plus a core Cisco network infrastructure, and synchronized our watches. ScienceLogic delivered our test appliance at 9 a.m. Forty-five minutes later, we'd configured the appliance, discovered our network and had an integrated management solution that was ready to go--without breaking a sweat. We only needed to configure an IP address on the physical machine and install the system in our rack.

Once that was complete, we used a Web browser to finish the setup--entering the IP range for discovery, turning on event notification, configuring the e-mail gateway and creating an organizational group for reporting.The autodiscovery feature handily found all the devices in our lab and added each to the configuration database, complete with device data. For servers that had SNMP agents installed, the EM7 gathered detailed application information. It also supports Dell's OpenManage or HP's InsightManager system agents. The EM7's robust GUI offers device pop-up menus and is easy to navigate. We consider ScienceLogic's GUI on par with those in major enterprise-class management applications.

Managing The Network

With configuration complete, we began collecting critical events. ScienceLogic includes native event de-duplication, so we weren't flooded with alarms, always a welcome situation. In our test environment, the EM7 alerted on system problems, including a full disk and CPU spikes. We could examine overall device status, memory, disk, CPU utilization, errors, bandwidth and latency. Even on servers without SNMP agents installed, the EM7 determined the existence of the device, the IP address and open ports in addition to overall availability and latency.

On the reporting front, ScienceLogic includes a number of dynamic performance gauges and can easily export reports into Excel. We could create availability reports for the entire network or specific logical groups of devices, organizations or systems.

For application-port monitoring, ScienceLogic includes definitions of all IANA well-known ports, as well as many other registered and application-specific ports. The EM7 monitors ports to gather information on application availability and device latency. After we defined global port policies, the EM7 triggered events when ports opened on monitored devices. It also searched for any new ports opened on monitored devices during scheduled discovery and can monitor specified ports for availability.The EM7 had a few other useful tricks up its sleeve: It can monitor changes to Web page content to track freshness, or to ensure that pages haven't been defaced. We could track round-trip delivery time for e-mail messages to Exchange using an included agent. Tools are also available to define policies for usage-based billing and to generate reports or bills for those monitored interfaces.

On the downside, EM7 offers a device map, but it doesn't correlate application, device and network relationships, so we didn't find that feature very useful.

Incident creation was a breeze with a preconfigured helpdesk. We could track incident history and comments, and ScienceLogic provides a nice interface to monitor the overall queue of incidents and their status. The EM7 can also receive e-mail and automatically create incident tickets. We then could escalate incidents based on policies, or notify specific personnel based on time and organizational rules. We would like to see ScienceLogic incorporate Ajax to make the interface even more dynamic and let users create incidents from the event screen.The 4.2 release adds trap forwarding, so our EM7 could be used as a collection station to forward events to a manager of managers, such as CA|eHealth, HP OpenView or IBM Tivoli/Netcool. ScienceLogic also provides for collection of performance and statistical information for any application that's running on common databases, including MySQL, Microsoft SQL, Sybase, Oracle or PostgreSQL. n

Michael Biddick is a contributing editor for network computing and executive vice president of solutions for windward consulting group, a firm that helps organizations improve it operational efficiency. write to him at [email protected].