1
1
2
IT Situational Awareness
Jeff Hart
M2 Technology
2
2
Situational Awareness
Theoretical model of situation awareness, Dr. Mica Endsley, 1995
Perception of Elements in Current
Situation
Comprehension of Current
Situation
Projection of Future Status
3
3
Gathering Perception
Baseline Discovery
Inventory
Hardware
Discover
Identify
Inventory
Recognize
Environment
Devices
Software
Applications
Track
Usage
4
4
Perceiving Current Status5
Combining Top Down and Bottom Up Metrics
Status
Organization
Organization
Mission
Mission
Probe1
Probe2
N/W
Probe3
SYS
APPS
r
Othe
N/W
SYS
APPS
Other
ProbeX
Switch1
5
Server1
Process
DNS
Perceiving Context
Beginning to define service models
6
6
7
Automating Application Mapping
Automated mapping of what you have and how it relates
Business Process Model
Accounting
CSO
B2B
Ordering
Retail store
Accounts
Accounts
Customer Order_app Shipping_app
payable_app receivable_app support_app
Layer 2-7 of the OSI Model
Physical Data Center
7
Foundation of Comprehension
Building comprehension from perception
Application Performance
Management
Run-time
Service Model
Infrastructure
Performance
Management
Integrated/Federated
HP CMS
8
3rd party
CMDB
8
Creating Context
9
Event mapping to CI‘s in the Run-Time service model
– Relationship of events to dynamically updated CIs
• Events and discovery / topology data are brought together
•BSM
End-to-end
Platform visibility of infrastructure and alerts by showing
relationships of events to CIs and business services that
are impacted
• Shows CIs in context
Event consolidation through OMi
9
Run-time
Service Model
hosts autodiscovered CIs
Bringing Clarity to Complexity
10
TBEC – Topology Based Event Correlation
Efficiency gains per advanced event causal correlation
Cause
Cause and
Symptom
Symptom
Use case addressed by TBEC:
1. Something goes wrong in your environment
2. Monitoring reports multiple problems via events
3. Usually just one of the events describes the CAUSE
of the problem
4. Others are just SYMPTOMS
5. Fix the CAUSE and also the SYMPTOMS go away
Automating Correlation &
Service Model Management
The “T“ in TBEC - rules based on topology
– Adaptive correlation – support for dynamic environments without adding
administrative burden
Current discovered
Topology utilized to
correlate related events
Related events analyzed
to determine SYMPTOMS
and CAUSE.
Cause
Symptoms
As new CIs and relationships are automatically discovered, the
TBEC rules are automatically applied. Experts define the rules
ONCE and do NOT have to go back and update when the
infrastructure changes
1
11
12
Automatic prioritization of Events
Based on Business / Mission Context
Event Priority
is calculated based
on severity and
business / mission
impact.
Business
Criticality
Values: 0..5
0 = lowest
5 = highest
CI business impact
is calculated based on Business Criticality of all affected business
services, applications and business process CIs and eg. SLAs.
Event that affects business service of criticality 4 gets higher priority than
event that affects business service of criticality 2.
1
Customized console
Optimize use of staff resources
– Optimized use of operations staff resources
Mash-up UI:
Gallery allows user to
compose new pages
using provided
components
Role based
consoles
Operator Perspectives: Operator can configure his own operator
console with the information he needs for his daily tasks
1
1
3
Projection of Future Status
HP Service Health Analyzer (SHA)
Predictive Analytics
1. Anticipate problems before the
business is impacted and prevent
downtime
2. Automatically correlate information
from multiple domains
3. Reduce cost of handling events by
proactively investigating anomalies
4. Self learning system
1
14
15
Operational Analytics
Proactive Risk Reduction by fusing IA and Ops
SECURITY
User Provisioning
Identity & Access Mgmt
Database Encryption
Anti-Virus, Endpoint
Firewall, Email Security
#1
SEE
EVERYTHING
#3 Act Appropriately
#2
Provide
Context
IT
OPERATIONS
User Management
App Lifecycle Mgmt
Information Mgmt
Operations Mgmt
Network Mgmt
15
#1
SEE
EVERYTHING
© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.
Proactive
Risk Reduction
Operational Analytics
Proactive
Monitoring
A unified approach to solving IT Operations Management
(ITOM) problems
Advanced Correlation
Advanced Analytics
Reactive
Monitoring
Operations Analytics
1
Event Triage
Log Management
Known Problems
Unknown Problems
16
Service Health Analyzer
powered by RTSM
Application
Performance
Management
•
•
•
•
End-User Experience
Transactions
App Diagnostics
Business metrics
Run-time Service Model
Comprehensive, automated and up-to-date
model for dynamic services
Infrastructure
Performance
Management
1
•
•
•
•
Server
Network
Virtualization
3rd party
17
Projection of Future Status
1
SHA detected a
problem and sent
alert one full hour
before the service
failed
Early morning:
Metric
performing
within baseline
3
2
1
10:30am - SHA detects an
anomaly and sends out an
alert\event
11:00am: Metric
violates
threshold
4
11:30am: Service
is now
unavailable…
18
Implementing the Ops Bridge
1
9
Value to the Organization
Experts
Can focus on mission / business
initiatives
Experts
 Spend less time
working on day to
day operations
 Spend less time
maintaining
operational
solutions
Efficiency
Workload
 Reduce false
alarms.
 Work on causes
and not symptoms.
 Enable cooperative crossdomain working
 Focus on what
matters to the
business
 Handle a higher
proportion of incidents
without escalation
 Fix issues more
rapidly
Streamline incident
management activities
Tier 1 Operators
1
• Less time spent on day to day
operations tasks
• Less time spent on administration
• Are able to add incremental value to
operations more rapidly
 Optimize time
engaged in evolving
operational
solutions
 Maximize time
spent on strategic
activities
Operations
Are more effective at day to day
operations activities
• Continued control of OpEx
• Higher efficiency – lower MTTR
• Higher Service levels
Questions?
Contact Information:
Jeff Hart, M2 Technology Enterprise Software Specialist
Jeff.hart@m2ti.com
© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.
202-595-1917
Thank you
Contact Information:
Jeff Hart, M2 Technology Enterprise Software Specialist
Jeff.hart@m2ti.com
© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.
202-595-1917