Sunday, March 19, 2017

Network Devices - In SCOM...uhh..SolarWinds...Service Manager?

8:52 PM Posted by A No comments


IT Worker 1:

I'm an experienced network engineer. I've used SolarWinds tools because as far as I and my peers can remember, this is the standard when it comes to network monitoring. Our network. Our tools.


IT Worker 2:

I'm an experienced IT professional. I love all things System Center and I love their interconnectivity even more. Email notifications are so yesterday - SCO automates. SCOM alerts. SCSM triages Incidents. Our environment. Our tools.



Can you feel the tension in the air right now? I know I can!


No use running around in circles arguing, time to evaluate. But before we do, you may be asking yourself "SCOM? SolarWinds? I thought this was a Service Manager blog?" To which I say "OH BUT IT IS. JUST YOU WAIT!"


SCOM - A little late to the network monitoring game...
Operations Manager's biggest criticism is that it's a very Microsoft centric approach to monitoring. If you aren't a big Microsoft shop, you are going to struggle investing configuration/development efforts into SCOM. But it's not to say this is a Microsoft only tool. NetApp, Cisco, the former BlueStripe and even SolarWinds feature management packs to tie themselves into SCOM and help you centralize your monitoring/alerting solution. What's more, Microsoft builds network monitoring tools natively into SCOM. So really, what SCOM can't do these 3rd party integrations can extend their help with via management packs.
Enterprise tool. All of the things.

SolarWinds - The standard in network monitoring...
They run this game! You wanna do network monitoring right you gotta go through me! Well...you have to go through SolarWinds. But you get what I'm saying. These products feature intuitive, well thought out UIs, with a heavy emphasis on making you work as little as possible to get what you're after. If you're a SolarWinds user, viewing SCOM is probably a rather jarring experience to you. It's easy to see why this tool is chosen over the other as an experienced network professional.
Network tool. Network Devices.


Well this blog post is clearly over! SolarWinds is the victor here. If I want SCOM integration I'll just use the SolarWinds management pack.


Well, just wait a second...
The presentations and more importantly my own personal results I've seen on the SolarWinds SCOM management pack seem to gloss over almost all of the important details. In fact, I would argue that the information available seems squarely aimed at a single group of individuals - those who do not understand SCOM or the goal of System Center at large.

The flexibility of SCOM/SCSM is management packs...

SolarWinds in its three leading headers of their Orion platform (and integration with SCOM) would have you believe that Management Packs are unruly, difficult to use/upgrade, and it would seem that in the "worst case" - you need them!

All three of these points in my opinion pray on a single, rather common misconception - SCOM is difficult.

Management Packs as I've shared previously are the fundamental cornerstone of the houses that are SCSM and SCOM. One of the most awesome points of this architectural design is to allow the flexibility to only touch/modify select pieces of the SCOM/SCSM infrastructure without fear of disrupting ANY of the other parts of it. So let's break that down header by header...

Dependent on 3rd-party management packs: Monitoring business critical non-Microsoft applications requires expensive 3rd-party management packs and add-ons
Maybe I'm reading in to this too deeply, but this point feels like a criticism, even though it's nothing but a genuinely true statement. Although I am deeply curious what is considered "expensive" ?
  • Citrix - Do you have Platinum Citrix licensing? You get the Citrix MPs for free with your purchase. Don't have platinum licensing? Good news, your Netscalers admin settings page feature a download link for at least Netscaler monitoring...free. They even have a freely available PowerShell module whether or not you use the SCOM MP
  • Cisco UCS Chassis - Do you have these in your environment? You get these for free with your purchase
  • NetApp SAN/Storage Controllers - Do you have these in your environment? You get these for free with your purchase along with an IP for Orchestrator, a PowerShell module, and SCVMM integration
  • Linux/Unix/AIX systems - Microsoft makes these, I kid you not, and they ship with SCOM. Have a blast! Speaking of which, remember that time PowerShell went open source and now in very early builds works on Linux?
  • Amazon AWS - Do you use AWS and not Azure? No problem, Amazon has you covered...for free. They too let you control their cloud with a PowerShell module in addition to the SCOM MP
  • Network Devices - Do you have enterprise gear (i.e. Cisco and others) in your environment? No problem, Microsoft has you covered. Custom network gear in your environment? You won't get memory, cpu, or fan speed of the device but you will most certainly get up/down (availability).
And what makes all of the above listed things better? The ability to play with all of it through the SCOM PowerShell module.


No built-in support for VMWare monitoring: Monitoring VMWare requires the installation of management packs
Hey there Wyld Stallyns (and the uninformed), I suppose it's time for a history lesson - VMWare and Microsoft's Hyper-V aren't exactly the best of friends, as it turns out they are fierce. Fierce. Fierce competitors. This means you aren't going to find VMWare building integration points for SCOM nor Microsoft building them. Which means you must turn to a 3rd party company (Veaam runs that game for SCOM). So really, this boils down to a more fundamental question of - is SolarWinds going to be that 3rd party? or is it going to be any number of software companies that develop VMWare integration for SCOM?



Lacks built-in multi-vendor server monitoring: Discovering and monitoring multi-vendor server hardware requires multiple management packs.
Guys. Women. Folks! Come on! You're starting to sound like a broken MP3 here. Of course monitoring multiple solutions requires multiple management packs. You're describing EXACTLY how Operations Manager is architected and works!


Well, Management Packs aren't all that bad. We (SolarWinds) made one for SCOM! So the SCOM people can use this too! We won! SolarWinds for life!


Not so fast SolarWinds. While you most certainly provide a management pack that integrates your product with SCOM, as a long time user of SCOM I have to say it really feels like you cut corners here.
  • The majority of the views are just web views that link you into your locally deployed SolarWinds Orion portal. It feels as though you've achieved SCOM integration on an incredibly superficial level here.
  • Alerts that do cite specific items (switches, routers, etc.) do not feature relationships! You get an alert but no context associated with the actual device having the issue other than a single text name. Wondering exactly what I'm getting at here? Keep reading.
  • Half of the alerts feature next to no context or value when pushed into SCOM. Orion Advanced Alert? The majority of the alerts feature the identical title with varying descriptions. Requiring a lot more investigation into the nature of the Alert than a glance. If anything, requiring someone just to go right back into Orion. I get that's what you want but...
  • SquaredUp, an HTML5 web portal that rides on top of SCOM infrastructure is unable to visualize the data created by the SolarWinds SCOM MP as it fundamentally violates a core tenant of SCOM development - Never ever try to implement dynamic objects and counter names for performance collection rules!  But what does the tech babble translate to? It means the way the MP is written is crazily efficient at querying the SolarWinds database, but it falls on its face trying to insert that data into SCOM because that's not how SCOM is architected to accept data.

Truthfully this MP feels like more of a "view only" thing and less of a "things you could actionably work with"


Hey Adam! I'm a Service Manager admin. Can't I just take the SolarWinds MP, import it into SCSM, and then when SCSM runs its regular Discovery Inventory pull from SCOM I get all the devices anyway? Right? Everyone's happy!


While you are absolutely correct in your guess there SCSM admin, you're going to be really, really, really disappointed at the objects you get. You'll be even more disappointed to learn the single class of "SolarWinds Network Device" does not pass on any of that rich SNMP discovery data it obtained into SCSM.

Not only that - the SolarWinds MP does not feature any Relationship Classes! So your 24 port switch is a single device. The ports on it? Well those don't exist according to the SolarWinds MP once inside SCSM. So when it comes to data, we're unfortunately coming up terrifically short on it.


SCOM
SolarWinds
Network Monitoring SNMPv1 and v2
x
X
Network Monitoring SNMPv3 (AES)
128*
128, 256, 512
Alerting via Email
x
X
Alerting via Text
x
X
Alerting with Automation
x

Deep network analysis/investigation


X
Work Item Integration with SCSM
x


Configuration Item Integration with SCSM
x


*Arguing AES256/512 are better because they are "harder" is a bit moot. AES128 at the time of this writing would take a billion plus years to crack via bruteforce attempts. If and when AES128 becomes trivial, 256/512 probably won't be that far behind.

I put this graph here, because I wanted to highlight some other points you may hear get made. But I also wanted to entertain a scenario in the world of System Center that genuinely cannot exist in SolarWinds (MP or not) - if I have a network switch go down, wouldn't it be neat to alert the network team, automatically create an Incident, and automatically alert all affected machines/users of this? This entire scenario is doable across the spaces of SCSM, SCOM, and SCO (I suppose SCCM if you wanted to get really fancy). Come to think of it, that's not a bad idea for another blog post.

All in all - the SolarWinds MP in my opinion is nothing more than a way to say they integrate with SCOM without truly doing it.



Let's talk about that whole "half of the alerts" point I just made...
And here's the part I've been waiting to get to on this post. If the information passed from SolarWinds to SCOM has almost next to no value, can you imagine what happens if you decided to get creative and forward said SCOM alerts into SCSM to create Incidents? You'll get:

  • Incidents (a majority of the time) with the identical Title
  • Incidents with similar/identical descriptions
  • Incidents with maybe a related Configuration Item?

Configuration Items. The exact kind of thing in a CMDB that we care passionately about. The exact kind of thing that apart from relating to Incidents we'd want to relate to Problems, Service Requests, and Change Requests. Or maybe we just want it for Asset inventory for your companies respective ITAM processes? The kind of thing that we want as much information as possible about! The kind of thing we want to know about along with all of its relationships to ports, VLANs, and more! And it's the exact kind of thing that the SolarWinds MP does not provide whatsoever. What you get is a really distilled object (name, ip address, and a few more things) but not nearly as much information as you'd get with SCOM polling and monitoring these devices (i.e. SNMP version, Location, Primary Contact, and all other SNMP data available on the device).

However, let's be clear about this - this isn't the point of the SolarWinds MP. It was clearly designed for the express purpose of SCOM; to merely provide a view into SolarWinds data, to provide SCOM admins a means to do some overrides and email alerts on but providing almost nothing in the way of doing anything tangible with it via SCSM and SCO/SMA. All things considered, I actually can't blame SolarWinds here. After all, SCSM is a relative new player in the CMDB game so maybe SolarWinds genuinely hasn't gotten around to this? But equally plausible, maybe they won't get around to it. And really, either scenario is entirely ok! Because SolarWinds has never been a product focused around automation. It has never been a product focused around tickets. SolarWinds like so many other products in this space has its place and I don't believe there is any question that SolarWinds is still relevant and has a place in an IT organization but in the face of SCOM and SCSM I must admit - I quickly begin to hedge my bets.

Because when a network device goes down and you get an email about it, isn't it already too late? Wouldn't it be better if SCO/SMA tried several remediation steps first before alarming you? Before flooding your inbox? Before sending another email that you or members of your team are just used to deleting at this point?

Again, I want to be really incredibly clear with what I am saying because I feel like this post is destined to catch flak. I'm laying out counter points to the SolarWinds SCOM MP, these are not an attack or criticism of the SolarWinds platform in and of itself. The platform (as it stands by itself) is genuinely awesome, but when it comes to System Center integration there is certainly a ways to go.

So what's a better solution? Well hopefully you aren't surprised when I say it just might be a...


Better Together Solution
At the end of the day, I'm making my decisions in the name of Service Manager which is why it's best to look at SCOM and SolarWinds as complimentary solutions in your environment. Why?

  • The shortcomings of one product are solved in the other
  • The wants of one product exist in the other
  • SolarWinds can shine as an amazing investigative tool for your Network Team
  • SCOM can shine as this amazing monitoring/alerting tool for a host of things in your environment including network devices!

So this means you'll be performing dual SNMP monitoring of network devices in SCOM and SolarWinds. This is truly and I mean truly...the only way everyone gets exactly what they want. It's the only way you are going to make two different IT teams happy. To look at this as a "one or the other" is to do both products and your internal teams a potential disservice. If you have the means to both of these technologies, then by all means use both of these technologies to their fullest!

However if and I say if you have SCOM and are only evaluating SolarWinds I truly believe your expectation can be met for far less money in the way of SCOM, the future of SCSM, and letting your teams get a good night's sleep when SCO/SMA are fixing issues in the early morning hours.


Getting SCOM Network Devices into SCSM
Depending on where you are on your SCSM/SCOM journey you'll either already know exactly how to do this or need a pointer in the right direction. In short, importing the Network Management pack from SCOM into SCSM will automatically begin syncing those SCOM discovered devices over as SCSM Configuration Items to play with in your CMDB (i.e. SCSM). What's more, providing all of the crazily rich SNMP discovered data into SCSM.

There are lot blogs addressing this very topic, so I won't bore you with my own retelling of them:


With your Network Devices pulled and updated from SCOM into SCSM, you continue to expand and open the possibilities of self-service and automation! Need some ideas?

  • Got a Firewall that controls websites internally? Service Request!
  • Need to shut down ports? Change Request!
  • Switch go down? Incident!
  • Unusual activity on a few ports? Shut em down with SCO/SMA
  • Need to see all the models of a particular switch? Create a view!
  • Want to report on all the Incidents, Changes, etc. about a Router? Glad you have Configuration Items because your Data Warehouse is spilling over with data now!



In conclusion...
I hope I've cleared a few things up. I hope I haven't too deeply offended anyone (again, not my intention for this post), but more than anything I hope I've helped someone out there quickly sift through some pros and cons of these platforms!