IT Needs Help Finding Root Causes

Computerworld - Ever stay awake at night wondering about the cost of network downtime? In 2004, Infonetics Research put that figure at 3.6% of a company's annual revenue. After studying more than 80 large corporations, Infonetics found that companies experience an average of 501 hours of network downtime per year. That number translated into millions of dollars in lost productivity and revenue, and it hasn't gotten any better in the intervening months.
On top of the money they've lost, companies invest millions of dollars each year in various technologies to attempt to solve IT infrastructure problems more quickly. They are, however, no closer to the Holy Grail of automated root-cause analysis and problem resolution.
In order to understand why that's the case, it's necessary to understand the five steps in the IT problem management process.
1. Detection. The ability to know what's happening in your infrastructure is a crucial first step in managing problems.
Most of the new technologies we have seen in this area in the past five to 10 years have been designed for detection. Network management systems such as IBM Tivoli, HP OpenView, CA Unicenter and many others were first designed to monitor the enterprise infrastructure by polling network devices and servers periodically. If the polling fails a predetermined number of times, a problem is detected, and an alert is sent to the administrators. In the security world, network and host intrusion-detection systems have been developed to identify problems on the network and servers. None of those technologies, however, can tell you where the problem is or what caused it.
2. Identification. After a problem has been detected, IT administrators must spend a lot of their time identifying where it actually occurred. These IT administrators either use the most basic network tools, such as ping and traceroute, simply rely on domain knowledge of their own networks or analyze network traffic using sniffers to locate the problem.
Products such as EMC Smarts are designed to accelerate identification. Smarts starts by mapping out an infrastructure using various automated tools as well as human knowledge. The mapping will identify, for example, which switch ports are connected or which servers are behind an individual router or switch. Once the mapping is complete, Smarts uses its proprietary Codebook Correlation Technology, SNMP traps and logs messages from routers, switches and servers to identify where the problem might have occurred.
3. Determination. Even though some of these newer technologies help IT administrators identify where the problem might be, they are still very limited in determining the