IBM and Cisco help networks self-diagnose

IBM and Cisco Systems want to make it easier to diagnose and solve problems in an enterprise's IT infrastructure, even to the...

IBM and Cisco Systems want to make it easier to diagnose and solve problems in an enterprise's IT infrastructure, even to the point where it can do that by itself.

Initial aims of IBM's and Cisco's programme include coming up with a common way for parts of the system to log events and providing software for an administrator to see and analyse problems. The two companies intend to offer these and other technologies over time, but they also are making all the technology available openly to other players and will seek to have it adopted by industry standards bodies.

The IBM-developed Common Base Event (CBE) specification defines a standard format for event logs, which devices and software use to keep track of transactions and other activity.

All the components of systems typically have different formats for the information they collect about events. For example, if an IS team needs to figure out where something went wrong with an e-business application, they may need to understand 40 different event log formats, he said. Root cause analysis of the problem could require several different administrators - database, network and so on - getting involved.

As a common format, CBE can simplify that process. Future products should use CBE as their native log format, but "log adapters" can define mappings between current proprietary log formats and CBE. IBM now has a team of about 24 engineers developing log adapters for core IBM products, including hardware, software and storage products.

In August, IBM proposed CBE as a standard to the Organization for the Advancement of Structured Information Standards (Oasis).

Another piece of the puzzle is a log and trace analyzer, a visual tool for administrators to study log files in various views. IBM has already made a log and trace analyzer available in its WebSphere Studio application development platform, where developers can use it to work out problems before a product is deployed.

For IT administrators using production versions of software, IBM probably will ship a log and trace analyser as part of its Tivoli system management software sometime in the future.

Other things that could be standardised include correlation mechanisms - ways of associating events with one another - and filters for sifting out the events that are relevant.

Depending on who at IBM, Cisco or other companies develops methods of doing that, such methods could be proposed to Oasis or another standards body for approval.

In the second phase of the initiative, Cisco will integrate the technologies into its products with the aim of correlating events in a router with those in middleware, for example. 

Between technical and political disagreements, Wohl Associates industry analyst Amy Wohl believed it was unlikely all suppliers will sign up, but even having co-ordination among some systems should save IT departments time and money.

The kinds of capabilities IBM and Cisco are pushing are likely to become pervasive, but there are sure to be competitive offerings, she added. Hewlett-Packard and Sun Microsystems already offer some software that does things similar to IBM's autonomic computing concept. And as is typical, political battles may loom on the path to industry standards, she said.

However, Wohl sees such technology ultimately benefiting most users, consumer as well as enterprise. Any place with a stretched IT staff or none at all should welcome the idea of a system fixing itself, she said.

Stephen Lawson writes for IDG News Service

Read more on IT strategy