At Moogsoft, we have a great fondness for Netcool, especially since our core team is made up of the original founding inventors and go to market team for Micromuse.
Sadly enough however, although Netcool was relevant in the 1990’s, this technology has become irrelevant and inadequate today.
Let me tell you our reasons why…
Netcool was designed for an era when single faults caused impact, networks were not tolerant of failures, and its users were systems and network administrators.
The core value proposition behind Netcool is that it automatically deduplicates repeat events into single alerts. Everything else is a tax. So, the use of filtering rules to reduce noise, custom rules to model or correlate different alerts together, even the new ‘Splunk Like’ NOI, now all require constant maintenance.
The modern service delivery fabric (whether service provider or digital enterprise) is tolerant of failures, so it’s not single faults that cause impact. Today, the consequence of multiple faults in one domain, or across multiple technology domains, leads to capacity and performance degradations, which in turn leads to service, application and customer impact. Furthermore, there is the frequent change, especially in the cases of a highly virtualized and elastic service delivery fabric, or the case where the Operations are serviced by multiple silos or separate operating companies.
So why exactly do we say that Netcool has become irrelevant today?
Because:
- Agility – Modern infrastructures change (especially if they are software defined or virtualized). Netcool is very expensive and resource intensive to change. Netcool hampers business agility. It is virtually impossible (from a cost/resource perspective) to add new Events to a mature Netcool system because it will inundate the operators with noise. You need to first work out which Events are important… and try doing that with App Logs or other solutions.
- Quality – Netcool (whether Omnibus driven Event Lists or NOI querying) requires you – the User – to look and find. However, because of the complexity of the service delivery fabric, most users don’t have an easy view across the entire stack. In turn, 74% of End Users report Service issues before IT / Operations are even aware of the issue (as reported by Forrester). This impacts the ability to deliver consistent, high quality customer experience.
- Productivity – The multiple silos of operations teams lack situation awareness between each other. This leads to significant spam Tickets for Application and Service support teams and increased numbers of escalations in ‘all hands’ war rooms
Sure, Netcool was a great idea, but Netcool:
- Doesn’t offer the benefits or value required by modern Operations and Support processes
- Doesn’t help improve customer experience
- Doesn’t help deliver a more agile business
Modern organizations need the ability to change in real-time, be aware of issues that are likely to impact business services, and have the ability to react immediately, with the appropriate resource response when an issue occurs.
This requires a simple and short list of functionality:
- Real-time “push notification” of issues
- Situation Awareness for the appropriate stakeholders
- Situation enabled processes for optimum resource engagement and customer experience management
Funny, that’s what Moogsoft offers… a unique combination of:
- Patented real-time analytics techniques that industrializes the deterministic inference of anomalies (without the need to train or learn models)
- Push notification of those anomalies to the appropriate stakeholders
- Dynamic teaming of situationally aware resources to facilitate an appropriate timely response
Overall, Incident.MOOG reduces the time to detect, react, diagnose and remediate/restore services… but more about us later!
So, why is Netcool still so ‘sticky’ in its traditional market place?
Because of the amount of money spent on building an infrastructure around it, in an attempt to keep it adequate.
Simply put, Netcool has become “Too Big To Fail,” AKA, a bottomless pit that just keeps sucking in cash.
Although IBM Netcool is the single largest IT infrastructure management tool in the market today, it’s unlikely that you’ll see a greenfield digital enterprise using Virtualized Functions in elastic datacenters, with DevOps Service Delivery processes buying Netcool. After all, why would they? The economics simply do not stack up.
To the outside world, however, Netcool appears to:
- Detect issues. However, the reality is that due to both the lack of situation awareness between technology / operations / organizational silos, along with the fact that Netcool has artificial rules that delay the presentation of serious faults (i.e. don’t show flapping Events unless they have occurred n times in t minutes), often the customer call is the ‘early warning system.’ Ironically, only after the issue has become Service impacting (Talk to any Telco managing an IMS, or Enterprise with SAP!).
- Deliver real-time operations value because ‘all’ the Events go into it and the operators react to those Events in real-time. However, as everyone knows, not all Events do go into Netcool any more – because it is too expensive to ‘pre-work-out’ which of the Events are important to monitor for – so guess what, Netcool leaves operations blind to whole areas of the service delivery fabric, and Operators have to ‘search’ Netcool to identify issues – it does not tell them!
- Provide a Single Pane of Glass for Operations. However, in reality, the Apps teams will have AppDynamics and OpenTSDB, Zabbix, Splunk/ELK, etc. The list goes on… but in reality, Netcool is not the single pane of glass solution anymore!
