outtasking managed services -...

Out-Tasking Management Services with Microsoft Operations Manager 2005

Prepared for

Microsoft

Monday, 11 April 2005

Version .1 Draft

Prepared by

Dean Gardiner

Consultant

Out-Tasking Management Services with MOM 2005

[email protected]

The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication and is subject to change at any time without notice to you. This document and its contents are provided AS IS without warranty of any kind, and should not be interpreted as an offer or commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS DOCUMENT.

The descriptions of other companies’ products in this document, if any, are provided only as a convenience to you. Any such references should not be considered an endorsement or support by Microsoft. Microsoft cannot guarantee their accuracy, and the products may change over time. Also, the descriptions are intended as brief highlights to aid understanding, rather than as thorough coverage. For authoritative descriptions of these products, please consult their respective manufacturers.

This deliverable is provided AS IS without warranty of any kind and MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, OR OTHERWISE.

All trademarks are the property of their respective companies.

©2005 Microsoft Corporation. All rights reserved.

Microsoft and Windows are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.

The names of actual companies and products mentioned herein may be the trademarks of their respective owners.

Page ii


The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication and is subject to change at any time without notice to you. This document and its contents are provided AS IS without warranty of any kind, and should not be interpreted as an offer or commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS DOCUMENT.

The descriptions of other companies’ products in this document, if any, are provided only as a convenience to you. Any such references should not be considered an endorsement or support by Microsoft. Microsoft cannot guarantee their accuracy, and the products may change over time. Also, the descriptions are intended as brief highlights to aid understanding, rather than as thorough coverage. For authoritative descriptions of these products, please consult their respective manufacturers.

This deliverable is provided AS IS without warranty of any kind and MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, OR OTHERWISE.

All trademarks are the property of their respective companies.

©2005 Microsoft Corporation. All rights reserved.

Microsoft and Windows are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.

The names of actual companies and products mentioned herein may be the trademarks of their respective owners.

Page iii


Table of Contents

Out-Tasking Management Services...................................................................................................1

Managing the Dynamic Environment..............................................................................................2

The Out-Tasking Value Proposition................................................................................................4

Planning Management Services Offerings.....................................................................................6

Developing a services portfolio.......................................................................................................6Availability monitoring..................................................................................................................6Service desk system integration..................................................................................................7Proactive notification................................................................................................................... 7Trend analysis............................................................................................................................. 8Performance tuning..................................................................................................................... 8Troubleshooting........................................................................................................................... 9Asset management..................................................................................................................... 9SLA monitoring............................................................................................................................ 9Security policy compliance........................................................................................................10

Determining Service Levels..........................................................................................................11Types of applications................................................................................................................. 11Criticality of systems.................................................................................................................. 11Geographic boundaries.............................................................................................................11Redundancy and availability of systems....................................................................................11Cost of ownership...................................................................................................................... 12

Determining Customer Requirements..........................................................................................13Level of trust between the customer and the partner organization............................................13Infrastructure ownership............................................................................................................13Network availability.................................................................................................................... 13Security policies........................................................................................................................ 13

Architectures.................................................................................................................................. 14

Scenario 1 – Remote Client..........................................................................................................14

Scenario 2 – Trusted Remote Access..........................................................................................16

Scenario 3 – DMZ Remote Access...............................................................................................17

Scenario 4 – Enterprise................................................................................................................19

Scaling the Enterprise Scenario...................................................................................................21

Service Offerings for SQL 2000........................................................................................................22


OUT-TASKING MANAGEMENT SERVICES The purpose of this paper is to provide guidance for partner organizations that wish to provide services for managing customer’s infrastructure environments. The scenarios envisioned in this document are best described as “Out-Tasking” services.

Partner organizations should create unique individual service offerings that will be appropriate to the types of services that customers demand. In this way service offerings can be customized based on the partner organizations individual strategic strengths while catering to individual customer needs. Service organizations can provide unique value add services by leveraging unique strengths such as;

Staff skill specialization Vertical industry specialization Existing investments in skills and infrastructure, for example call centers, mobile field

technicians, consulting teams, etc. Existing customer relationships, for example leasing arrangements, network monitoring

services, etc.

In addition to the framework for building service offerings this document includes an example of how to apply the process for managing Microsoft SQL Server 2000. This provides an example of how managed services can be built and operated in a practical scenario that can be leveraged by partners in a service offering practice.

This paper assumes a prerequisite knowledge of the Microsoft Operations Framework and preferably a good understanding of the Information Technology Infrastructure Library (ITIL) published by the UK government. This document provides information that is in addition to the practices and procedures published in the Microsoft Core Infrastructure Solutions series. In particular the Service Monitoring Solution Accelerators based on MOM 2005 and the Management Architecture guides are referenced extensively.

The practices and process guides utilized in this solution can be found on the Microsoft web site at the following locations; Microsoft Operations Framework (MOF) Version 3.

http://www.microsoft.com/mofThe Microsoft Operations Framework defines best practices for managing the operations environment. MOF is derived from the Information Technology Infrastructure Library (ITIL) published by the UK government. MOF adopts ITIL processes and delivers them in a practical and targeted framework suitable for a Microsoft based operating environment.

Microsoft Solutions for Management http://www.microsoft.com/msmThe Microsoft solutions for Management team provides detailed solution guides for implementing Microsoft technology. All MSM solutions are extensively tested in the Microsoft labs and are fully supported through Microsoft Premier Support Services.

Microsoft Solutions Framework (MSF) Version 3.http://msdn.microsoft.com/msfThe Microsoft Solutions Framework is a project methodology that defines an iterative approach to project delivery. Although primarily aimed at software development the methodology is equally applicable to infrastructure projects. All of the solution guides that Microsoft develops are prefaced on an understanding of the MSF.

Page 1

http://msdn.microsoft.com/msf

http://www.microsoft.com/msm

http://www.microsoft.com/mof


MANAGING THE DYNAMIC ENVIRONMENTThe concept of Service Orientated Architecture (SOA) is the core idea behind the development of the next generation of business applications. All of the major software and hardware vendors have published strategies based around leveraging the benefits of building loosely coupled applications that share standards based interfaces.

The dependency on a flexible and agile infrastructure is of critical importance for the next generation of Service Orientated Architecture based business applications. One of the key benefits of SOA is the ability to build and deploy applications quickly, and to be able to add new functionality, increase performance and availability to meet demand dynamically. Business applications and the infrastructure platform that supports them are always interdependent. Unless the infrastructure can be as flexible and agile as the applications that they host then SOA will never be able to achieve the full range of benefits that the business expects.

Microsoft has announced the Dynamic Systems Initiative (DSI) in order to address these challenges. The core philosophy of DSI is about enabling full application life cycle management. DSI is about designing and architecting manageable applications right from inception through to operations. DSI introduces the Systems Definition Model (SDM) which is a new technique for describing infrastructure architecture for the benefit of the application architects.

One of the great challenges of managing a dynamic environment is how to build deploy and operate the infrastructure. The time required in the effort involved to bring new services online or to increase the capacity of existing services is rapidly diminishing. The ability to be able to respond to these challenges will require the ability to constantly monitor and respond to the current state of the environment.

In a dynamic SOA environment it is no longer possible to assess the state of the system simply by monitoring the performance and availability of single systems that the applications reside on. While this was possible the applications for monolithic this became increasingly difficult when multi-tier applications were developed and has now become impractical in a distributed application environment.

Business applications may consume services from many different sources that may be both internal and external to the organization. In many cases it may not be possible to determine the state of the underlying platforms that these services reside on. Therefore monitoring systems will need to be able to assess the state based on expected business functionality or service levels of the application as it is used by the business.

This changes the way that we respond to issues. In the event of a service outage the best option may be to automatically bring another service online rather than to try and fault find or troubleshoot the original service failure. A similar strategy may be appropriate in the event of performance failing to meet the required service levels. In a dynamic environment it is essential to differentiate between incident resolution and problem resolution, and to develop strategies appropriate for each of these processes.

It is important to ensure that best practice operations processes are adopted when managing complex, dynamic environments. Microsoft is committed to developing and promoting best practice operations processes through the Microsoft Operations Framework, which details processes for operations management.

Microsoft Operations Manager 2005 (MOM 2005) is Microsoft's enterprise server solution for monitoring and maintaining information about Microsoft applications and platforms. MOM 2005 is an event alert monitoring and notification tool that assists operations staff in understanding the state of

Page 2


their infrastructure and application environments. In the event of an incident, MOM 2005 can be used to alert operation stuff when an incident occurs and assist staff in locating the problem and provide information on how to rectify the situation. In a proactive capacity MOM 2005 can assist in performing root cause analysis of problems. MOM 2005 also provides the ability to track capacity, performance and compliance against service levels.

MOM 2005 is a key component of the Dynamic Systems Initiative. MOM 2005 utilizes management packs to determine the state of an application or a system and to provide detailed information about the systems state. The MOM 2005 management packs can contain information obtained from a variety of sources. Management packs include knowledge about the product gathered from the applications development team and custom information entered by operations staff about ongoing practices and processes.

Microsoft recommends an iterative approach to software development which is defined in the Microsoft Solutions Framework (MSF). MOM 2005 can assist in iterative development by providing knowledge collected throughout the application life cycle. This knowledge can then be assimilated into the requirements gathering phase prior to development of the new release of the application. In this way MOM 2005 assists in building knowledge around a full life cycle for application development efforts.

Microsoft releases management packs for all applications that Microsoft releases. The management packs are actually developed by the development teams that are responsible for creating the product. In this way, the knowledge that is released in the management pack benefits from the combined experience and knowledge of the application development team. When customers build their own applications the MOM 2005 SDK can be used to assist customers in instrumenting their applications, providing the same types of management and monitoring services are available in the Microsoft released management packs.

As customers adapt their business processes to take advantage of a distributed approach to the business applications it is inevitable that customers will start to question why they cannot get the same levels of flexibility and agility with infrastructure services.

Traditionally, the types of services offered for infrastructure by service providers were quite limited. The Application Service Provider model where his internal business applications were hosted by a service provider has not proven to be a model that has gained much acceptance. The whole of business outsourcing model has been quite successful, but in practice, the result is that there has not really been a great difference in the way that infrastructure is managed compared to the customer managing their own environments. Hosting services have proven popular for applications that are intended for end customers outside of the organization, but are much less pervasive for applications designed for internal users.

The Out Tasking model compliments a service-oriented view of the word. Out-tasking as the effect of componentizing services and it is a way that SOA componentizes business applications. Once customers get used to the idea of consuming services as small discrete component of functionality than Out Tasking simply becomes another mechanism in a range of services they consume. It is only after services are broken down into discrete blocks of functionality that true competition can emerge, and that service providers can differentiate themselves through providing exceptional value.

Page 3


THE OUT-TASKING VALUE PROPOSITIONOut-Tasking is a type of outsourcing arrangement where selected services are provided by an external service provider. Out-Tasking can be differentiated from conventional whole of business outsourcing arrangements by their scope and by the responsibilities of each of the parties involved.

IT infrastructure operations management has many processes and tasks that are suitable for Out-Tasking. Ideally Out-Tasking services will be standardized and targeted for standard processes as defined in the Microsoft Operations Framework. The closer that both customers and providers align to the MOF the greater the effectiveness and applicability of the services that can be provided.

Out-Tasking can provide significant benefits over traditional outsourcing arrangements for both the customer and the service provider. Out-Tasking can be used strategically or tactically to assist customers in managing their ongoing operations of all to provide short-term and services that they are to be required for specific projects. The most appealing aspect of an out tasking arrangement is that there is a very low barrier to entry. As the contracts are usually quite simple and initially can be short term arrangements there is a much lower level of due diligence required prior to engaging in an out tasking contract.

Out-Tasking benefits from the Customer Perspective

Supplement customer skills, no negative impact on current staffOne of the complications of outsourcing is that the service provider is responsible for the staff required to manage the technology. In an Out-Tasking arrangement the customer maintains their own staff and supplements their skills are as required from the service provider. This provides the benefits of skills transfer, knowledge and experience for the customer. A major consideration here is that there is no threat to the internal staff so that resistance to you the Out-Tasking engagement is minimal. Staff often see in this situation as an opportunity to improve skills.

Get access skills of best specialists in the business For large customers the outsourcer’s staff tend to be dedicated to a single account and do not get the broad experience that can be attained by servicing multiple customers. With service providers that specialize in Out-Tasking it is much easier to obtain very high levels of skills in specialist areas that are required to service a large and diverse customer base.

Competition between vendors supplying servicesBecause Out-Tasking arrangements tend to be fairly specialized and specific arrangements. It is easier for the customer to choose services from different vendors based on price, and to renegotiate or change service providers when the contracts expire. It is expected over time that many basic services will become almost commodity and that service providers will need to add value to stay competitive. With outsourcing, all services tend to get lumped together, so it tends to be an “all or nothing” arrangement where it is very difficult to take advantage of price competitive services.

Retain ownership of infrastructure or lease from service providerRetaining the ownership of infrastructure is an issue for many organizations. Customers have varying needs in relation to the deployment and consolidation flexibility, aligning to business cycles, balancing depreciation, year-on-year, controlling capital expenditure, etc. In fact, many of the reasons that make outsourcing compelling for some customers can make outsourcing equally as problematic for other organizations. For customers that choose to retain ownership of their own infrastructure the Out-Tasking model offers the ability to capitalize on leveraging services without tying up with infrastructure ownership issues.

Page 4


Shorter term contracts than traditional outsourcers Out-Tasking is fundamentally much more competitive than outsourcing. Competition leads to increased flexibility in addition to the benefits of competitive pricing, which is a critical factor in operating dynamic and flexible infrastructure environments. One problems that most outsourcers face is the ability to provide to adapt to the customer's needs when they are dealing with dynamic changing businesses. Out-Tasking is ideally suited for dynamic organizations that tend to undergo a great deal of change. For organizations that are heavily dependent on technology there is always a requirement to maintain flexibility due to be rapid cycles of change that technology is currently undergoing.

Out-Tasking benefits from the Service Provider Perspective

Provide only the services that make good business senseService providers can concentrate on the skills and processors that they specialize in, so that even small service providers can gain benefits from economies of scale. In a large outsourcing arrangement, as everything is lumped under one big bucket there is really no reason to differentiate between different services. However, with Out-Tasking the service provider can offer the services that they are confident that there is going to be a good return on their investment. This will make services far more competitive, and prices will more accurately reflect the value of the service provided.

Leverage expensive skills across large customer baseService providers that specialize in high-level skills can leverage their investment across a large customer base. Depending on the services offered the service provider can support small or large customers, irrespective of geography, to maximize the utilization of their key resources. Outsourcers on the other hand need to maintain large contracts, and therefore tend to dedicate resources to particular customers. In this respect, outsourcing engagements usually reflect arrangements the customer would make internally if they managed their own environments. Although many outsourcers retained specialist teams, they tend to act more as consulting services, rather than then as specialized operations staff.

Low resistance to entry, particularly compared to outsourcing dealsThe effort required to enter into an outsourcing arrangement is usually expensive and therefore outsourcing contracts need to be large enough and long enough to ensure that the effort to establish the contract in the first place is recouped through the term the contract. Out-Tasking contracts are much easier to establish due to their low cost of entry and the minimal amount of risk to the customer.

Leverage relationship once engagedThe service provider can leverage existing arrangements once they are engaged. In this environment, as long as the service provider is satisfying customers expectations and providing good value, that it is inevitable that their value and presence within the customer organization can only continue to improve.

Leads to supplementary opportunitiesService providers can supplement low margin monitoring services with higher margin consulting services. It is a very effective practice to include an amount of consulting time as part of the out tasking contract arrangement. In this way, the service provider can maximize value, even when the original out tasking arrangement has become commodity and highly competitive.

Page 5


PLANNING MANAGEMENT SERVICES OFFERINGS

Developing a services portfolioThe first step for service providers wishing to build an Out-Tasking practice is to develop a services portfolio. The services portfolio is a list of services that the service provider is willing to perform. Initially it may seem that the best option is to engage customers to determine what services they require prior to establishing a services portfolio. This is certainly a viable approach that many service providers will adopt, particularly if they have long-standing service arrangements with existing customers. However, in this white paper we take the view that you should choose your services based on your skills and ability to deliver, and then it will be a matter of offering the services to the market and pricing them competitively.

The danger in taking their customer first approach is that you'll tend to build a services portfolio that is tailor-made to a particular customer. In order to provide a flexible service model that can work consistently across various target customer organizations it is strongly recommended that the types of services offered are aligned with best practice processes as defined by the Microsoft Operations Framework (MOF). There is a dual benefit here, firstly, the service provider is building a practice based on standard and repeatable processes that can be leveraged across a wider customer base. Secondly, it helps the customers to adopt Microsoft Operations Framework processes which will in turn benefit the customer by allowing them to leverage competitive services, and from the benefits that flow from adopting best practices.

The more customized a solution is the less likely it is that the service model can be adopted for different target organizations. Where services are developed that are really only suitable for a single customer environment there are few opportunities to leverage skills and infrastructure. Highly customized services are usually more appropriately addressed by an outsourcing model rather than the out-tasking model as presented in this whitepaper.

When developing a service portfolio the optimal services to target will be services that fit into a standard set of operating processes that require skills or infrastructure that are typically expensive or difficult for the end customer to maintain. It is important to realize that by standardizing processes it does not lead to a degradation of the value of the services offered. What this means is that the services offered must be compelling, tightly focused, and offer really good value. In an out-tasking model the services offered should be viewed as supplementing the customer organization with high value services rather than simply replacing low value services.

The following services are typical of the services that may be offered as part of an out-tasking arrangement utilizing MOM 2005 infrastructure. All of the services listed in this guide are based on implementing specific MOF processes. This list is not exhaustive and it is expected that a typical services portfolio will include a range of services that include some or most of the following services.

Availability monitoring Availability monitoring is a service offering that that monitors the availability of the customer’s critical business applications. In a dynamic distributed application environment applications can rely on interactions between many different infrastructure and application components. Systems that monitor the availability of individual components of the system do not ensure that the system is available for business use.

Developing an availability monitoring solution offering can take a considerable amount of effort depending on the type of system that is being monitored. Typically this would require developing a challenge/response application that automatically validates the entire system by providing the correct

Page 6


responses. For example the Exchange 2003 management pack for MOM 2005 includes the ability to send test emails to verify availability of the email system and to measure delivery time. This functionality provides comprehensive availability monitoring that would be very difficult to achieve by simply monitoring different components of the system and trying to consolidate events and alerts.

The following guides provide best practice processes for the availability monitoring function; MOF Service Monitoring and Control Service Management Function guide MOF Availability management Service Management Function guide

Service desk system integrationService desk integration is a complementary service to monitoring services. It is envisaged in different out-tasking arrangements that particular components of the monitoring infrastructure can be integrated into the help desk system.

Help desk integration comprises of generating trouble tickets for help desk management systems from alerts raised in the monitoring systems. There are several aspects of this service, including the consolidation and evaluation of the alerts, the notification flow of the alert to the appropriate team, and finally the generation of the trouble tickets themselves. It can take a significant amount of effort to build a system that will accurately and automatically generate tickets for the vast majority of alerts. Therefore, integral to the process is usually some sort of workflow for evaluating alerts that cannot be easily reconciled with the auto ticketing system.

Microsoft provides solution accelerators that can assist in building a help desk integration services offering. It is worth noting that the auto ticketing solution accelerator is currently based on integration with a Siebel call centre system. Autoticketing solution accelerator Notification workflow solution accelerator

The following guides provide best practice processes for the service desk function; MOF Service Desk Service Management Function guide

Proactive notificationProactive notification is a service offering the alerts are generated based on some predetermined event or situation occurring. The event is not necessarily related to the loss of the service or functionality, but is usually based on setting thresholds with relation to performance or usage. A common example is to monitor storage usage that exceeds certain levels, or CPU utilization that exceeds specific threshold levels over predetermined periods of time.

In the context of a dynamic environment, proactive notification can be used to automatically initiate events. For example, the disk space event may automatically trigger the provisioning of additional storage from the SAN, or the CPU utilization threshold may trigger the provisioning of a new virtual server. These are simple examples used to demonstrate the point, and it is expected that in dynamic environment a range of services may be automatically provisioned from both internal and external resource pools. Notification events are need to be accurate, timely and are directed to the appropriate recipients as required.

The following guides provides best practice processes for managing responses to events based on the proactive notification function; MOF Capacity Service Management Function guide (with particular reference to the Service

Capacity Model) MOF Change Management Function guide

Page 7


The following solution accelerator can assist in building solutions that can respond to notification events; Notification workflow solution accelerator

Trend analysis Trend analysis monitors patterns of usage and performance over a period of time. This can be individual applications, services or functions, and it can include systems and platform components. Trend analysis in MOM 2005 is derived from data imported into the reporting server and there is a dependency that reporting services are used before this service can be offered. It should also be noted that the frequency of updates to the reporting server will determine the types of trending information that can be gathered. For example, the reporting server is usually updated on a daily basis, and therefore trending information that attempts to determine peak periods of usage throughout the day may not be readily available, depending on the capabilities of the management packs.

Typically trending is used for capacity management to plan for when new resources are required. At an application level trending can determine, over time, the usage of application, or it could, for example, monitor average and peak loads over predetermined periods. For example, the Web monitoring management pack can provide detailed information about web site usage.

The following guide provides best practice processes for capacity planning based on trend analysis;

MOF Capacity Service Management Function guide

Performance tuningPerformance tuning is a specialized service with the purpose of optimizing the use of the infrastructure platform. Performance tuning is usually associated with capacity management. The monitoring tool must be capable of reporting on individual performance parameters as well as being able to objectively measure overall application performance based on some predetermined criteria. For example, even though all hardware counters may show that all parameters are within expected ranges this may not ensure that adequate system performance is available. The ability to track performance related issues becomes much more difficult process in the distributed environment.

The standard performance tuning process is in the matter of looking for bottlenecks on systems and eliminating them one at a time until a balance is reached between the available resources. This is particularly valid for database applications, where activities such as indexing can have such a significant impact on overall system performance. For applications, the dependant services may, for example, stress disk subsystems, I/O, CPU or video subsystems.

In a distributed environment the recommended process for performance tuning will be an iterative process performed in small incremental steps. The process itself involves looking at application and platform specific counters, derived as appropriate from the MOM 2005 management packs, and implementing configurations changes with the intention of providing overall better performance. After the appropriate performance tuning, changes have been made there in the cycle is repeated.

The following guide provides best practice processes for capacity planning based on performance tuning;

MOF Capacity Service Management Function guide

Performance tuning also requires careful planning and control through change management processes as this relates to impact on production systems;

MOF Change Management Function guide

Page 8


Performance tuning tasks also affect configuration management processes, and tracking the applied changes will need to be reflected in the configuration management database;

MOF Configurations Management Function guide

Troubleshooting The troubleshooting service offering includes the processes of determining when problems occur, determining the cause of the problems and working with the customer to resolve the problems. In this context we are amalgamating the functions of incident management and problem management, so that the troubleshooting service may provide alerts for services that are unavailable and require immediate attention, as well as for providing information for root cause analysis of the incident, as well as for providing information for solving low priority problems that are not relating to an ongoing loss of service.

Troubleshooting can cover a range of issues including hardware failures, software failures, incorrect configurations, poorly written applications, poorly designed architecture and environmental issues. Some of these issues may not be easy to determine solely through the information gathered by the MOM 2005 console, and therefore there is usually some level of access to the underlying systems required in addition to access to the basic monitoring services.

For custom-built applications this service may include creating management packs, and adding to the management packs on an ongoing basis as information about new incidents and problems is incorporated back into the management packs. For Microsoft management packs this service can provide custom information into the Microsoft supplied management packs.

An excellent resource for assisting in troubleshooting efforts are the Best Practice Analyzer tools. These are currently available for both Exchange and SQL server. Currently, only the Exchange Best Practices Analyzer has been incorporated into a MOM 2005 management pack, however, it is expected that eventually all the best practice analyzer tools will be available as management packs.

The following guides provide best practice processes for problem and incident management; MOF Problem Management Service Management Function guide MOF Incident Management Service Management Function guide

Asset management MOM 2005 is not intended to be a stand alone asset management solution. This is primarily due to the fact that MOM 2005 is exclusively a server management tool. MOM 2005 is capable of providing very detailed information about managed server environments. MOM 2005 can be used to augment existing asset management solutions. From a service provider perspective this may be important if they are currently operating this service through other tools such As Microsoft's Systems Management Server. Microsoft's Systems Centre reporting server will combine the data from SMS 2003 and MOM 2005 discovery processes which will provide a more complete asset management service.

SLA monitoringSLA monitoring is the service is responsible for tracking compliance against defined service levels. This can incorporate the performance monitoring and availability monitoring, depending on the criteria for how SLAs are determined. MOM 2005 can also be used for determining service availability baselines prior to establishing SLAs.

The most difficult part of monitoring SLA is to actually determine what the appropriate counters are to monitor, and whether they are accurately reflect the ability to meet the SLA. For example, monitoring

Page 9


the server's availability by polling heartbeat does not necessarily mean that the application that runs on the server is available for the entire period. However, if the SLA is based on server availability rather than application availability then this may be a perfectly valid counter to monitor.

SLA monitoring is dependent on MOM 2005 reporting services.

The following guide provides best practice processes for SLA management; MOF Service Level Management Service Management Function guide

Security policy complianceThe security policy compliance service offering can incorporate a range of functions based on customer needs. This can include activities such as;

Monitoring of system configuration to ensure that the configuration management tools apply and maintain all appropriate security settings.

Monitoring of audit logs and initiate alerts in case auditing activities trigger predetermined security breach events.

Monitoring patch status of platform, operating system and applications on servers.

Monitoring version information for applications. For example, virus definition versions.

Generate alerts on rules based events as determined by the management packs.

Provide reports for identity life-cycle management, for example accounts that are still valid in the directory but are no longer related to current users (as required by Sarbannes Oxley)

The following guide provides best practice processes for Security management;

MOF Security Management Service Management Function guide

Page 10


Determining Service LevelsIn addition to the types of services that will be offered in the service catalogue it will be necessary to determine the extent or scope of the services offered. For example the service provider may agree with the customer to provide 24 x 7 coverage for critical systems but next business day for noncritical systems. The ability for the service provider to provide different levels of service is a consideration that needs to be taken into account prior to establishing a service contract or prior to developing the monitoring systems design. Scope of the service is determined by factors such as;

Types of applicationsThe types of applications that can be monitored are a crucial component when developing the scope of the services that are intended to be offered. For example monitoring standard commercial applications allow the service provider to use the standard management packs are provided by the software vendor. However, agreeing to monitor custom built or highly specialized applications may result in the service provider having to have developed their own management packs. These different levels of service would usually be reflected by a different pricing structure.

A second consideration for applications is whether the service provider will monitor the entire business application and an end to end system, or if they will do is monitor individual components of the system. When end-to-end monitoring is required it will be necessary for the service provider to add a layer of analysis and correlation tools on top of the standard service packs. This is usually achieved through third-party manager of manager type products that can correlate event information from a variety of sources including non Windows-based components.

Criticality of systemsNot all systems are equally critical to the business, and therefore it is common practice to have different levels of service for systems that have different levels of criticality. Small specialized service providers may not be able to retain the resources that are required for full-time availability monitoring of highly available critical systems. However, a niche expert in a specialized application can provide troubleshooting, trending and performance tuning services for the same system.

In the case where multiple service providers are providing different services for the same system it is possible to use notification workflow and custom-built reports to provide information to a number of targeted teams that have the best skills in particular areas. The important point is that information is collected and used by the appropriate team, it should never be necessary to collect the same data more than once from different monitoring systems. This adds unnecessary overhead to the system being monitored. Running multiple agents can make a system less stable.

Geographic boundariesThe ability to monitor systems from any global location is a key strength of the MOM 2005 product. However depending on the types of services offered it may be necessary to limit the scope of services to particular geographic regions. There are a number of reasons for this, including the availability of network bandwidth and regulatory requirements of different governments. In environments that require a high level of trust there may be a requirement that on-site access is necessary.

Redundancy and availability of systemsWhen monitoring services that are architected to be highly available it will be necessary to monitor the core systems as well as the backup or redundant systems. Also it will be necessary to provide alerts when redundant systems are brought online. For example, if a customer is monitoring cluster

Page 11


failures it will be necessary for the tools to be aware of the failure and to provide the appropriate responses to bring service back on line. For custom applications that have redundancy and availability built into the systems such as Windows load balanced server farms it may be necessary to write custom management packs or to provide analysis tools outside the MOM 2005 environment.

Most applications built on redundant systems are highly dependent on network services for availability. Network services need to be architected to be redundant and highly available. It is possible for MOM 2005 to consume SNMP traps from network equipment. In practice for reasonably complex network environments it is not practical for MOM 2005 to monitor network equipment. The analysis of both networking and server systems requires a third-party “manager of manager”. Tools that are tied into network traffic, protocol and configuration management can consume MOM 2005 alerts and build a more comprehensive picture of the state of the entire environment.

Cost of ownershipThe cost of monitoring systems is a factor. In extreme cases the cost of monitoring systems may outweigh the benefits that the system of providing. Therefore it is necessary to offer a range of services to meet each situation. Low cost solutions can be built with the included platform services providing that solid processes are adopted. As distributed systems get more complex the more important it becomes to ensure that good systems management tools are in place.

When considering total cost of ownership this is usually a point of differentiation between the different vendors technologies. The cost versus functionality trade-off is at the most optimal when the systems are being monitored are based on standard application packages so that standard vendor supplied monitoring tools can be used. This is where MOM 2005 is particularly effective, as the management packs for Microsoft products are released by the application product teams and available at no charge to MOM 2005 customers.

For custom applications or complex business systems it will be necessary to develop custom management tools. MOM 2005 is a very cost effective tool for building custom monitoring solutions. Management packs are built using standard .Net tools. Management pack development guidance is extensively documented in the MOM 2005 management pack Software Development Kit. There is no requirement to develop SNMP MIBs, configure SNMP domains and trigger SNMP traps. With MOM 2005 it is simply a matter of interrogating the appropriate event logs which most application developers used by default, as the standard repository for application alerts.

Page 12


Determining Customer RequirementsThe ability to provide a particular level of service will be dependent on the number of factors. It is critical that these factors are understood and negotiated prior to the finalization of the Out Tasking agreement. The following list suggests some of the areas that the service provider should do discovery, analysis and due diligence. This list is not going to be comprehensive for all customers in all situations. Service providers are encouraged to spend as much time with the customers as required in order to ensure that they have covered all of the customer requirements.

Level of trust between the customer and the partner organizationTrust will be a significant factor when choosing from the different architectures that are available. Full trust Delegated rights As needed On request Limited access

Infrastructure ownershipInfrastructure ownership is a key factor when developing Out-Tasking arrangements. Ownership issues can affect costs, licensing and dependencies on SLAs. For example, if the underlying hardware maintenance contract is next business day and will not be possible to offer SLAs on the management services that are going to provide better levels of service. All the factors around infrastructure ownership should be known understood and discussed with the customer.

Customer owns everything Customer leases everything Service provider owns management infrastructure Software licensing

Network availabilityThe service provider will be dependent on the network services in order to meet their SLAs. The performance, availability and redundancy of the network should all be considered. In addition, the availability and bandwidth requirements will influence the architecture choices. Customer full bandwidth available Limited bandwidth – packet shaped Branch office scenarios Service provider owns all bandwidth Latency

Security policiesThe customer's security policies will also play a critical part of the overall systems management services design. Factors that should be considered include; What types of data can pass over public networks What levels of encryption are acceptable Firewalls, VPNs Data domains (ie geographic, legislative) Privacy requirements

Page 13


ARCHITECTURES

Scenario 1 – Remote Client

The remote access scenario is the simplest architecture but in can be difficult to deploy and maintain. Due to the large amount of network traffic the clients generate this scenario only appropriate for a very small number of target customer servers. As clients from different customers all report into the same management group it is recommended to use the notification workflow solution accelerator to direct alerts. In this scenario it is not practical to allow customers to access the MOM 2005 operations console or reports directly, therefore only services that are dependant on the service provider taking action will be feasible.

64Kb minimum network connection for each managed deviceThis is due to the fact that all events flow between the client and the server, not just alerts. If this scenario is to be used effectively there will almost certainly be a requirement to perform an alert tuning exercise to minimize traffic.

Trusted communication between client and server across a firewallBy default clients can communicate to the MOM 2005 server on port 1270 or through a VPN connection. MOM 2005 server needs to be registered in DNS on client side. Communication between the client and the server is always encrypted and digitally signed, certificates will need to be registered.

Clients may need to be manually installedMOM 2005 clients cannot be pushed across the firewall. If the design is to use the single port method then client agents will need to be installed manually. VPN connectivity allows agents to be pushed to client machines in untrusted domains (except for domain controllers).

Client in different forest from management serverThis is a supported scenario but there are some of the major limitations;

o Active Directory management pack not supported

o No mutual authentication

Page 14


Reporting of limited valueDue to the fact that this in this scenario such a limited number of servers can be monitored and that the client agents from different customers will reside in the same management group. Reporting may still be of use for trending and SLA reporting, even if it is limited to a single server in the scope of the report. If reporting is needed then MOM 2005 Workgroup licenses cannot be used.

Agentless monitoring not availableThe main issue here is that no legacy server platforms can be monitored.

Notification workflow Notification workflow can be used to direct email notification to appropriate targets, including customers. It should be noted however that the current version of the notification SA only supports a scenario where an instance of the MOM 2005 management server is installed on the database server. This means that it cannot be used in a clustered database environment.

All licensing models may be possibleMOM 2005 Workgroup edition does not support reporting services. If reporting services are not to be used in this scenario then MOM 2005 workgroup edition can be used. Service Provider Licensing Agreements (SPLA) and standard Select, Open and EA corporate licensing can be used. Please check with your local Microsoft licensing specialist.

Page 15


Scenario 2 – Trusted Remote Access

Ideal for small to medium customers when service provider has a high level of trust

Clients can be pushed In this scenario the MOM 2005 management server can be a member server on the same domain at the targeted servers are in, therefore there are no issues with client deployment.

Simplified CommunicationsThe Web-based operator console and reporting console can be used by the service provider over the Web.

VPN required for administration consoleThe administration console cannot be used over the Web.

Reporting can be installed on the same serverFor small customers it is possible to install MOM 2005 database, management server and reporting services on the same physical server. The requirement to split functionality is largely dependent on load. Please note it is not possible to use MOM 2005 Workgroup edition if reporting services are to be used.

Notification workflow Notification workflow can be used to direct email notification to appropriate targets, in this scenario e-mail messages are sent over the Web to the service provider’s service desk system.

All licensing models may be possibleMOM 2005 Workgroup edition does not support reporting services If reporting services are not to be used in this scenario then MOM 2005 workgroup edition can be used. Service Provider Licensing Agreements (SPLA) and standard Select, Open and EA corporate licensing can be used. Please check with your local Microsoft licensing specialist.

Page 16


Scenario 3 – DMZ Remote Access

Similar characteristics to scenario 2 except for additional security requirements


Multi forest scenarioThe multi forest scenario is where client machines are in a different untrusted forest from the MOM 2005 server. Usually putting the MOM 2005 server in the DMZ means that it will be a member of a different forest in the production forest. It is possible for the MOM 2005 server to be a member of the internal domains, providing that the customer agrees to open the required ports on the firewall for the MOM 2005 server. In are multi forest scenario there are a couple of know limitations;



For large customers the multi forest problem is most appropriately solved by using a two-tiered approach, with MOM 2005 server in both the production environment and in the DMZ, using the MOM to MOM connector to forward alerts from production.

Simplified CommunicationsThe Web-based operator console and reporting console can be used by the service provider over the Web.

VPN required for administration consoleThe administration console cannot be used over the Web.

Reporting can be installed on the same serverFor small customers it is possible to install MOM 2005 database, management server and reporting services on the same physical server. The requirement to split functionality is largely dependent on load. Please note that it is not possible to use MOM 2005 Workgroup edition if reporting services are to be used.

Page 17


Notification workflow Notification workflow can be used to direct email notification to appropriate targets, in this scenario E-mail messages are sent over the Web to the service provider’s service desk system.

All licensing models may be possibleMOM 2005 Workgroup edition does not support reporting services or tiering using the MOM to MOM connector. If reporting services are not to be used in this scenario then MOM 2005 workgroup edition can be used. If the customer maintains a two-tiered system and the service provider only has access to the DMZ MOM 2005 server then Service Provider Licensing Agreements (SPLA) licensing cannot be used for the internal server (because the service provider is not have access or control over the server), and MOM 2005 Workgroup edition cannot be used at all. In a non tiered environment SPLA and standard Select, Open and EA corporate licensing can be used. Please check with your local Microsoft licensing specialist.

Page 18


Scenario 4 – Enterprise

Best option when a single flight desk is used to monitor multiple customers.

Forward alerts to service desk systemAlert forwarding to service desk system can be direct using the auto ticketing solution accelerator or indirectly, using a third-party Manager of Manager tool.

Each customer is a separate management groupMaximum of 10 management groups can report to the 2nd tier. When more than 10 customers need to be managed then a third tier MOM 2005 server can be added and additional second-tier servers used. The maximum number of management groups, for the entire environment is one hundred.


Multi forest scenarioThe multi forest scenario is where client machines are in a different untrusted forest from the MOM 2005 server. Usually putting the MOM 2005 server in the DMZ means that it will be a member of a different forest in the production forest. It is possible for the MOM 2005 server to be a member of the internal domains, providing that the customer agrees to open the required ports on the firewall for the MOM 2005 server. In are multi forest scenario there are a couple of know limitations;



For large customers the multi forest problem is most appropriately solved by using a two-tiered approach, with MOM 2005 server in both the production environment and in the DMZ, using the MOM to MOM connector to forward alerts from production.

Page 19


VPN still required for administrationThe administration console cannot be used over the Web.

Reporting services most appropriate at customer siteBecause reporting is most appropriate when it relates to a particular customer it is most effective when reporting services are installed at the local customer's site. Using reporting services at the service provider site will give consolidated reporting across the entire customer base, which may be a benefit to the service provider.

All licensing models except Workgroup edition possibleMOM 2005 Workgroup edition does not support tiering using the MOM to MOM connector. In the two-tiered system if the service provider only has access to the DMZ MOM 2005 server then SPLA licensing cannot be used for the internal server (because the service provider is not have access or control over the server), and MOM 2005 workgroup edition cannot be used at all. Standard Select, Open and EA corporate licensing can be used. Please check with your local Microsoft licensing specialist.

Page 20


Scaling the Enterprise Scenario

It is possible to combine the scenarios to provide a range of different design options. If the service provider maintains a three tier structure then all client scenarios can be accommodated. For client machines that are managed directly over the net the service provider needs to maintain tier one MOM 2005 servers. For customers that have already implemented a two tier hierarchy it is necessary for the service provider to maintain a tier 3 MOM 2005 server. Three tiers is the maximum supported level of nesting.

For customers that maintain their own single tier MOM 2005 environment it is recommended to have a dedicated middle tier at the service provider to allow for scalability. The maximum number of management groups that can be nested at the next layer is 10, and the total number of management groups that are supported for the entire infrastructure is 100. Therefore nesting at all thee layers provides the most scalability.

It should also be noted that there is a maximum supported limit of 400,000 alerts that can be forwarded in a day cumulatively to the top tier 3 server. A very rough rule of thumb is approximately 1KB of traffic per alert when alerts are tuned and batched.

Page 21


SERVICE OFFERINGS FOR SQL 2000The purpose of this chapter is to demonstrate how a services portfolio can be developed by targeting a specific platform, technology or application. For example service providers that specialize in database management can be greatly assisted by building service offerings based on MOM 2005.

When monitoring a SQL server environment the management packs that will be required are the SQL 2000 management pack, the Base OS management pack and the cluster services management pack . Based on the service catalog then go through the rules that are available in the selected management packs and to determine which rules are required to support each service.

When defining services the first step is to ensure that only the required rules are enabled to keep alert traffic and noise to a minimum. After the management packs are deployed then further tuning of individual alerts will be required to minimize noise. For detailed information about the events that are monitored in each management pack please refer to the management pack guides.

The following table lists the MOM 2005 functionality applicable to the services broken down into the Microsoft Operations Framework processes.

Service type Information Management Pack

Availability monitoring SQL cluster state SQL Server MP

OS cluster state Cluster Server MP

Server availability (platform) Base OS MP

Heartbeat monitoring Base OS MP

SQL service availability SQL Server MP

Test jobs with custom TSQL queries

SQL Server MP

SQL Replication monitoring SQL Server MP

Available disk space SQL Server MP / Base OS MP

Disk performance SQL Server MP / Base OS MP

CPU utilisation SQL Server MP / Base OS MP

Memory usage SQL Server MP / Base OS MP

Network usage SQL Server MP / Base OS MP

Performance tuning Connection response time SQL Server MP

Query response time SQL Server MP

Average wait time SQL Server MP

Blocks and Locks and Deadlocks SQL Server MP

Page 22


Disk performance SQL Server MP / Base OS MP


Memory usage SQL Server MP / Base OS MP

Network usage SQL Server MP / Base OS MP

Stored Procedures – Execution SQL Server MP

Stored Procedures – Compile SQL Server MP

Trend Analysis Available disk space SQL Server MP / Base OS MP


Log growth - temp and db SQL Server MP

Processor – processes and threads Base OS MP

Trouble shooting Database corruption SQL Server MP

Configuration inconstancies SQL Server MP

Failed connections SQL Server MP

Protocol problems SQL Server MP

SQL Jobs SQL Server MP

DTS Jobs SQL Server MP

Backups success/failure SQL Server MP

Security policy compliance System Audit events Base OS MP

Connections, trusted/untrusted – success/failure

SQL Server MP

License compliance SQL Server MP

SLA monitoring Reports- up time SQL Server MP

Average response times SQL Server MP

Peak response times SQL Server MP

Page 23

outtasking managed services -...

Documents