A recent visit to a customer site demonstrated how OpTier BTM can be a valuable complement to the load testing process. For the past several years, our customer, a large manufacturer, has been using OpTier BTM to reduce rollout risk as new patches and functionality are released into production.

On this occasion, the QA team had planned four different load tests designed to ensure that changes made to the backend system had improved, rather than degraded performance as expected. An hour and a half into the first load test, OpTier BTM detected a spike in the execution time of two transaction types – Order Item and Add Order. OpTier BTM showed that during the spike, there were several instances of the problematic transaction running concurrently. This was reported to the team, along with instance data showing the exact time the spikes were detected.

OpTier BTM clearly shows the sudden spike in the elapsed time of the Order Item and Add Order transactions:

The transaction had a typical end-to-end execution time of approximately 5 seconds. By drilling down into the transaction instances, we saw that during peak load, there were several instances running at once, and they were each running for over 3 minutes:

OpTier BTM was critical to enable a quick analysis of the source of the problem. In just two clicks it demonstrated that the problem was a deadlock issue within the EJB layer. OpTier BTM also showed what was not problematic so that the team would not waste time on the parts of the application that were working well. It showed that the WebSphere Commerce Suite side of the application performed within acceptable ranges, including the DB2 calls. It also showed that the load balancing between the 2 WebSphere servers appeared to be functioning properly. The customer used (and continues to use) OpTier BTM not only to measure transaction performance, but also to gain insight into the part of the transaction that was causing the slowdown, and the root cause of the problem.

By using OpTier BTM during the load testing process, our customer was able to drill down from a broad view of the overall system performance to a specific analysis of the individual transaction instances that were performing poorly.  As a result, the application developers were able to understand the circumstances and root causes of the performance degradation and to resolve them rapidly.

A recent incident at a customer site illustrates how OpTier BTM can play a crucial role in detecting, isolating and remediating performance issues before business-critical services are severely affected.

At a large UK bank, OpTier BTM is used to monitor the central internet banking application. With 4 million business customers using the bank’s site, OpTier monitors over 40 million transactions every day. During a recent Friday morning, OpTier BTM detected a marked increase in application response times as well as a large number of errors. It was absolutely critical to address the issue right away, because not only was it the peak time of day, it was also the last Friday of the month – payday for many people – and the last work day before a 3-day bank holiday weekend.

As you can see in the graph above, OpTier BTM showed an increase in average service time (the blue line) and errors (black area) after 9:50 am. Because the timing was so critical, the bank decided to switch over to their remote contingency data center. As you can see in the graph, the performance improves after 10:50 when switch was made. Even after the switch, we still see some errors because a public-facing internet application it is constantly hit by incorrect URLs – from end user typos to automated Trojans and hack attempts.

While the failover was taking place, the team used OpTier BTM to isolate the cause of the problem. In the graph below, the OpTier dashboard shows a marked increase in service time for User Identification and Verification database calls from the application server. Since nearly every transaction in the application makes a call to this database – even after the user is logged in – nearly all application functionality was affected by the slowdown.

In the drill-down to an individual transaction instance, we can see that calls to the identification and verification database were taking almost 2:30 minutes to perform.

When we drill down into the topology of another transaction instance, we can see that there is a very large Inter-tier time of 1:41 between Apache and WebSphere, indicating a communication problem. This behavior is usually an indication that the WebSphere resource has been exhausted while waiting for backend availability. This would be a secondary effect of the slowdown of the database service.

With the information provided by OpTier BTM, the bank was quickly able to identify that the source of the problem was in the database, resulting in very fast problem resolution and preventing an all hands call that would have wasted valuable time for all of the silo teams (i.e. not only DBAs but also architects, Java developers, network teams, and representatives from other IT silos). The bank’s DBA quickly pinpointed the source of the problem using OpTier BTM data – one of the nodes in their database cluster had reached its session limit. Without OpTier BTM, even isolating the problem would be like searching for a needle in a haystack.

Thanks to OpTier BTM, the problem was identified, addressed and resolved as efficiently as possible. Customers were able to deposit their pay and – along with the bank’s support teams – enjoy the holiday weekend.

May 12, 2011

Payment Card Industry Data Security Standard (PCI DSS) compliance is an important consideration for thousands of companies and an integral part of their network security strategy. But what about application performance monitoring? You need to make sure that APM, BTM and other monitoring tools are PCI DSS compliant as well.

Recently, a customer approached us about monitoring an application that executes over a million financial transactions per day. The users of the BTM system are application owners and performance specialists that need an end-to-end perspective on all of the business transactions in the application. In this case, the need is especially critical because the system was developed by a different team which is no longer at the company.

The current team needed to be able to manage the performance of business transactions, without exposing sensitive customer information to unauthorized individuals. They were aware of this issue because other monitoring tools in their environment, from respected vendors, also captured protected customer data and did not provide a mechanism for removing it – resulting in a potentially serious compliance issue.

OpTier BTM features a  solution for PCI DSS compliance that scrubs transactions of sensitive data. It masks protected personal information, while leaving the rest of the transaction, which is useful for problem solving, intact. This mechanism is very simple to implement and saves the customer from having to implement a more costly solution for maintaining compliance, such as auditing all BTM users for application access and/or moving the database to a tighter security zone.

Below is an example of how the data would appear without the PCI DSS compliance feature. (The credit card number is circled in red and some of the digits have been blurred.)

And here is an example of a similar transaction with the PCI DSS solution installed. The credit card number is masked, along with names, addresses, and other protected information.

After installing the mechanism, our customer has all of the information they need in order to manage performance and ensure SLAs – while maintaining compliance with the payment card industry standard.

March 7, 2011

We’re proud of the fact that OpTier software powers a variety of critical businesses. Every day OpTier BTM ensures that stock trades execute fast, national train lines keep on schedule, billion dollar procurement systems don’t fail, online bill payments are executed properly, mobile phone service plans are provisioned, and insurance claims are processed. And while it’s not as sexy, we also ensure that citizens are able to pay their taxes on time by managing tax return filing systems.

Our customer, a large, national tax authority, is responsible for collecting all online tax submissions each year. Since few of us prepare our tax forms in advance, it comes as no surprise that most of its traffic arrives in one giant peak just before the deadline.  In fact, more than 80% of its annual traffic occurs during those 3 weeks, and 10-15% of the traffic occurs during the final 8 hours! Of course the annual peak is extremely stressful for the IT department, and in the past, there have been some painful system failures that resulted in submission delays.

This year, (we’re happy to report,) the annual peak was scaled successfully. Our customer used OpTier BTM to monitor all of the key servers, and during the final day, it was processing nearly 5 million transactions per hour.  These transactions are exceptionally complex, with over 200 tiers, and OpTier BTM discovers them all automatically, which is important, since there are changes every year.

During the peak, a customized OpTier BTM dashboard is displayed on a 50” plasma monitor at all times. Around 50 people man the command center 24/7 during the peak, and OpTier BTM is always in focus.

The SOA architecture is developed by a number of different application teams and vendors, so the ability to identify where a problem is occurring and put the resolution into the hands of the correct team is absolutely essential – it saves everybody a lot of finger-pointing and arguing over who’s holding the ball. For example, in the cut-out from the dashboard below, the red block shows a slow-down in the performance of the back-end services. By isolating the problem, OpTier BTM can reduce the time spent on troubleshooting by as much as 90%.

Needless to say, the business impact of any outage is enormous for the authority, the vendors, and the public. So the ability to identify and resolve problems quickly is crucial.

OpTier BTM repeatedly identified significant slow-downs much sooner than other monitors, and proactively identified several different types of incidents. The team also used OpTier BTM to drill down and isolate problems. In more than one case, OpTier BTM was used to halt an all-hands call, and to identify both short-term and long-term solutions.

While OpTier BTM complemented the other monitoring tools in the data center, the team appreciated its business focus and the ability to understand the user impact of IT issues. Where other monitors each showed one piece of the puzzle, OpTier BTM captured the entire picture. To quote one of their operations managers, “We need this stuff! We should be using it to monitor other applications as well. ”

“OpTier, the company that ensures you pay your taxes on time.” As true as it is, we’ll have to mull that one over again as a company slogan…

February 22, 2011

Many companies are developing their strategy for migration of business applications to private and public clouds. During this critical stage, it is vital to ensure that service levels are not impacted by migrating the application from dedicated to shared IT resources. It’s no wonder that according to analyst firm IDC, two of the top three concerns that CIO’s have about private clouds are performance and availability.

We see in the market that enterprises are forming new cloud teams and internal committees, with a diverse set of skills, to plan for an effective organizational cloud strategy. One of their mandates in the organization’s journey to cloud is to plan for how to monitor and manage the performance and behavior of applications after deployment. These organizations undoubtedly have a range of infrastructure monitors in the data center. And most cloud service providers, whether internal or external, will provide services for monitoring cloud resources. Yet these tools typically do not provide an accurate picture of what end users are truly experiencing and how to quickly isolate and fix performance issues in application components located inside and/or outside the cloud.

This blog entry points out a few of the key application performance challenges that you are likely to encounter when pursuing a cloud strategy, so that you can address them proactively. I hope that during my session in the Cloud Performance Summit at CloudConnect (Instrumenting Applications When Access Goes Away on Monday March 7) the esteemed panel will address some of these challenges with a variety of perspectives – it should be informative and thought-provoking!

1. How do you know if an application is ready for the cloud?

Not all applications are ready for “cloud time”, and sometimes one part of an application is cloud ready while other components are not. You need to identify the best components for migration as well as potential problems such as chattiness and latency that are amplified in the cloud.

2. How do you find server-related root causes when performance issues arise?

In fully-dedicated environments, we sometimes use infrastructure metrics and events to diagnose performance issues. But inferring application performance from tier-based statistics becomes challenging – if not impossible – when applications share dynamically allocated resources. In the cloud, you must be able to understand application performance and its correlation with the underlying physical and virtual components.

3. How can you minimize the risk of change to the cloud infrastructure or the application?

In a shared environment, any change to the application, or to the infrastructure, is high risk. Cloud owners, operations staff and application teams must be able to test the impact of change on service delivery – whether that change is in an application before deployment, or in the cloud infrastructure.

4. How do you implement or verify chargeback?

Traditional application performance monitoring (APM) tools do not collect resource utilization per transaction to enable business-aligned costing and chargeback paradigms. For the cloud, you need a solution that monitors consumption for every service across multiple applications and tiers, so you can accurately cost services, decide on appropriate chargeback schemes, and tune applications and infrastructure for better resource utilization and lower cost.

5. How do you ensure that services are allocated according to business priority?

To ensure that SLAs in the cloud are met, you must be able to prioritize the allocation of resources based on measurements of real end user performance and an accurate view of where additional resources can truly alleviate SLA risks. To make that possible, you need a clear picture of resource consumption at the transaction level and business intelligence about the impact of each infrastructure tier on performance.

6. How can you maintain a real-time up-to-date view of how each service flows through the cloud when VMs are moving around dynamically?

In the cloud more than ever, you need a real-time picture of service dependencies that does not need to be manually updated. The environment is simply too dynamic (e.g. so called “VMotion sickness”) to make it feasible to keep manual models and static infrastructure dependency maps up to date.

7. How can you right-size capacity and prevent over-provisioning that undercuts ROI?

In the cloud, a complete history of all transaction instances, including precise resource utilization metrics and SLAs, is essential for making intelligent decisions about provisioning. And with an accurate picture of resource consumption for each business transaction, cloud owners can plan future capacity requirements (e.g. servers, storage, VMs, databases) in the most cost-efficient manner possible.

I hate clouds, they generally deliver cold weather and make life dull. I especially hate them even more because they’ve recently made my job more difficult (and working in product management it’s not exactly plain sailing at the best of times). I did try my best to avoid Cloud Computing by simply pretending it was all madness. Sadly, this naive approach didn’t work and here I am writing a  blog on the subject.

For anyone whose tried to decipher cloud computing I will hereby explain what the Mary Poppins is going on and how it’s going to impact IT management and specifically BTM over the next few years. I will start by saying that things are going to get more complex and significant challenges are ahead for vendors who are looking to provide next generation IT management software. There are several acronyms you need to understand as well so I’ll get cracking:

Private Clouds – think of these as on-premise utility/grid computing with the virtualization of OS and application run-time environments across the enterprise. An example might be a grid of 500 J2EE servers which are virtualized and shared across hundreds of different applications within an enterprise.

Public Clouds – this is simply off-premise utility computing provided by a 3^rd party vendor. For example, Amazon EC2 or Rackspace where businesses can buy computing resource on-demand which are accessed remotely across the internet (hence it being public).

SaaS – Software As A Service. Enterprise Applications that are hosted on the internet by a 3^rd party vendor. For example, Salesforce.com, Success Factors or GoogleMail where businesses log into a website that provides them with specific services that aid their business.

PaaS – Platform As A Service. Application Run-time platforms that are provided by 3^rd party vendors across the internet. For example, Google App Engine or Salesforce.com’s AppExchange. The ability for business to build new applications using 3^rd party frameworks or run-time environments. For example, many businesses will store their customer data within Salesforce.com, using AppExchange they can build new applications on top of this data.

IaaS – Infrastructure As A Service. Essentially the same as Public clouds where businesses can buy servers or computing power on demand from a 3^rd party hosting provider.

Hybrid Cloud – combination of all of the above.

Some of the above is probably common knowledge and I’m betting someone will comment on this blog telling me the above descriptions are not entirely accurate. The key problem with the above is that enterprise applications are going to become more fragmented and distributed across multiple deployment platforms which are not all controlled by the customer. To add to this we’ve just had a decade of SOA projects which essentially increased the number of dependencies between applications so when a user executes a business transaction these days it’s likely to pass through several application architectures. Why is this important? It multiples the complexity and demands of IT management software which up until now has still struggled to monitor and manage single applications let alone multiple connected applications. In summary a blackbox application becomes a blackbox of blackboxes with multiple points of failure and dependencies. Visibility of how the business (transactions) executes across these blackboxes therefore becomes key to effectively managing the business and IT. Business Transaction Management solutions will be key to providing this much needed visibility across the many types of blackboxes regardless of whether they’re in a data centre, in a cloud or being managed by a 3^rd party vendor. You can only manage and control what you can see, as many enterprise applications move to the cloud its critical customers maintain their visibility of how their business executes across IT.

One of my favourite sports is Formula 1. For the unfamiliar it involves 22 cars racing flat out at over 200mph with drivers bums 2mm from the ground with many of them crashing and going up in flames (see below). It differs from traditional Nascar racing in the fact it has these things called “corners” which make it more tricky for the drivers to overtake. Formula 1 is a big business with many teams spending over £150 million plus a year to make their car faster than everyone else. It’s a global sport with significant sponsorship, TV revenue and an opportunity for car manufacturers to compete. To say business impact doesn’t occur in  Formula 1 is pretty much the same as saying no-one gets hurt in boxing.

All Businesses can go up in flames

So how do these teams minimize business impact and make their cars finish races? Firstly they have a lot of talented people whose job it is to design, develop, test and support these cars that cost £1.5 million each. Secondly they are experts in monitoring and improving one important metric: performance. Each car has 2,500 metres of wiring and over 250 sensors which continuously monitor the performance of car components in real-time. The data from these sensors is often known as “telemetry” which are fed into a computer and then analyzed by test or race engineers. Over a race distance millions of events are captured from each car and are used by the pit wall to help their cars finish the race. Engine temps, tyre temps, brake wear, hydraulic pressure, tyre pressures, brake temps, clutch wear – the list is endless. The job of the race engineers and their computers is to spot which events matter so they can take pro-active action (Complex Event Processing). They make definitive decisions to directly increase the performance and reliability of their car so it can finish the race as high as it possibly can. For example, if tyre pressures are low it could mean a number of things from a simple slow puncture to a problem with the brakes which is causing tyre temps to drop thus impacting tyre pressure. The last thing a Formula 1 team want to do is pit their car so they need process and analyse multiple events to make the right decision. Just like failing businesses go out of business so does Formula 1 teams with the recent departures of BMW, Toyota and Honda.

A formula 1 car must be fast and reliable for its team to be successful. The same principle can be applied to any business out there that has mission critical applications or business services. Slow performance and outages have a direct business impact. The only difference is that there is probably a lot more wiring (networks) and sensors (agents) used to monitor every angle of an application through the various OSI layers. Complex Event Processing engines add significant benefit to gaining meaningful real-time intelligence from data that is collected. It allowing monitoring solutions to become smarter with the data they collect and present, it also makes monitoring solutions aware of data from other sources that may explain why specific events are being observed. For example, if an application tier goes down the monitoring solution may throw an alert. However, if this was planned downtime or a change request then the tier outage is perfectly valid. With CEP capabilities it’s possible to build simple rules that prevent false positives and alert storming. For example, a CEP engine can process a tier outage event and then query the change management repository to see if downtime is planned, if not it can then alert to say the tier has been verified down. This is just a very simple example of how a CEP engine can significantly enhance traditional IT monitoring solutions.

In fact, the power of CEP is exactly why OpTier recently introduced its Business Events module (BEM) so our customers can gain better intelligence into what is impacting their business.  In the same way we use the market leading Oracle database to persist our data we use a market leading CEP engine to process events from the millions of business transactions we collect each day. For every business transaction captured we know which application, business process, user, location, tiers and protocols it touched along with the KPI such as latency, resource and SLA for those respective entities. So if a user from an unauthorized IP subnet executes a business transaction we can detect it in real-time and notify the application security team. Again, just a simple example of how CEP capabilities can enhance Business Transaction Management.

We've come a long way since the IBM 3270. Or have we?

By Russell Rothstein

December 6, 2010

In today’s economy with sluggish job creation, there’s much talk about the change in skills required in today’s workforce.  Drill down into the world of IT operations management, and there is an even greater shift happening, related not to the economy, but to cloud computing. The rapid adoption of private cloud architectures is creating ripple effects, not only on the way IT delivers services to its customers, but also on the types of skills IT requires to support these new architectures.

Cloud computing is heralding the most significant shift in IT skill sets since we displaced the armies of punch card operators with the IBM 3270. Cloud is a realization of utility computing, where whereby shared resources, software, and information are provided to computers and other devices on demand. As Gartner says in a recent report, private cloud services “will require a cultural and political change inside of IT to see the role of operations move to being more proactive — requiring predefined policies, service levels and automated actions to take on the runtime environment, as opposed to the manual initiation of scripts or workflows. This requires very different skills over time — a shift away from rote work toward more planning, service analysis and a better understanding of service users in order to continually improve how the service is ultimately delivered.” (Source: Gartner “Key Considerations in the Development of a Private Cloud Architecture”, August 23, 2010).

The key phrase used by Gartner is that IT personnel will require “a better understanding of service users”, which means a better understanding the business which is what’s driving the users to consume those IT services. In essence, cloud will necessitate IT to be more business focused. We have been talking about Business/IT alignment for too long now without sufficient progress; with the emergence of cloud models, this is no longer a choice – either IT upgrades to a business-centric service delivery function, or is ultimately to be replaced by outsourced cloud service providers that can provide utility computing services with greater cost efficiencies. That’s why Business Transaction Management, or BTM, must be at the center of your cloud management capabilities, in order to effectively plan for and manage cloud services from a business perspective.  In an upcoming blog post, we’ll get the opinions from CIOs in the industry to understand their plans to address this rapidly changing environment.

To close up, it’s interesting to understand the new roles in IT that Gartner sees as emerging in order to support the delivery of new private cloud services:

• Cloud service architect (new role): Designs and documents the end-to-end cloud platform
• Portal developer: Develops interfaces that cloud consumers use to requisition services
• Workflow specialist: Defines requirements for instantiating automated processes
• Configuration management specialist: Develops consistent packaging and policy-conflict-free service deployment methods

We trust you are already filling these roles in your IT organization. And while these may not be the best the job in the world, but they most certainly beat a career as a roustabout.

Those of you who read my “Another less is more blog for ITSM and BSM solutions” blog back in October of last year will remember my bitterness around owning a BlackBerry whilst the entire nation around me was stroking their iPhones. Well in the last twelve months I finally managed to come up with a cunning way of acquiring an iPhone. My plan was simple, build an iPhone application for my company’s Business Transaction Management solution and then kindly request an iPhone from my company to perform user acceptance testing on. This plan sounds all very simple but there is a catch, I would have to write the PRD for this iPhone application along with finding a developer to help me build it (my developer days faded back in 2005). Bearing in mind I’ve never used iOS or stroked an iPhone I set out to do some market research to help me define a set of requirements and screen designs.
So where did you think I looked first? www.formula1.com . Yes, I’m mental and obsessed with cars but believe it or not this turned out to be the best bit of research I’ve done. Three hours after visiting the Formula1 website and downloading their application from the AppStore I had the iBTM PRD nailed with use cases, requirements and screen designs. The thing that struck me the most with the F1 app was how easy and simple it was to find the information I was looking for. In a stroke and two clicks I could go from a race to a session to live timing on track, the information was presented so clearly even a goldfish could keep up with what was happening in the race. So my initial thoughts for iBTM were “wouldn’t it be cool to go from an Application to a Business Transaction to its Tiers in two clicks”. In the same way Formula1 delivers timing of drivers lap times and sectors I could do the same with Applications, Transactions and Tier timing along with their SLA status. A user could view a list of their applications, spot an SLA breach, click on an application and view its business transactions, check which business transaction was breaching and click again to view the Tier latency/SLA management to see what was causing those breaches. I could also allow a user to start from an alert so they could go Alert > Application > Transaction > Tiers and understand what caused the alert in seconds. Here is my screen PRD mock-ups for the App:

So how does it work? Simply put, we built the app using the iPhone SDK (thanks to our superstar developer Mark Berner!), then we built a web services API for our BTM management servers (we allow federation) that allows iBTM to communicate so it can query information from OpTier BTM. Connectivity wise iPhone’s now come with comprehensive VPN capabilities that allow iPhones to connect to corporate networks either through 3G or WiFi. We’ve been testing connectivity and response times from all over the world and iBTM is super fast no matter where your accessing it from (it actually doesn’t retrieve that much data). With the recent hype around iPads life got sweeter as iBTM runs just fine with the standard x2 zoom you get for native iPhone applications. Here is a photo of an iPad working with iBTM connecting to one of our test BTM management servers:

iBTM works on the iPad and iPhone

Feedback from analysts, customers and prospects has been very encouraging. We’ve seen several executives get really hyped over a simple application that provides them with powerful visibility and intelligence into their business transactions, infrastructure and application performance. In two clicks an Executive or Application Owner can determine business impact and isolate which part of IT is causing SLA breaches all from the comfort of their iPhone or iPad. We’re already working on v2 of iBTM so stay tuned! Watch my youtube overview of iBTM:

You can download OpTier iBTM from the Apple AppStore.

April 28, 2010

End-User Experience Monitoring. Real User Montoring. The key words here are Experience and Real. When you are choosing a solution for monitoring the experience of your customers, partners and employees, it’s critical to keep their perspective in mind.

What’s important to your users – pages or transactions? When you are banking online, and it’s taking a long time to view that suspicious-looking check that you supposedly wrote last week, do you care about the rest of the page? The page probably includes more information about your account activity and enables you to conduct additional transactions like transferring funds and tracking automatic payments. But you may not even know what page you are on. Your only concern is the business transaction that you are currently trying to complete – viewing your cancelled check.

Yet most end-user experience monitors track pages or page objects. Pages are significant to application developers, but they are rarely meaningful to users or the business. Of course we need to track information about pages in order to isolate and resolve problems. But in order to understand the user experience, and to triangulate that with SLAs and business priorities, you need to monitor and measure the performance of business transactions.

Part of the problem with monitoring pages lies in the definition of a page. Technically speaking, a page is a URI, a Unique Resource Identifier. But what the user views as a page may actually be a container displaying a number of URIs.  When we are monitoring pages, it’s important to be able to track and analyze the page as a transaction – the way the user experiences it – as well as in its component parts. Given all of this complexity, it’s also important to be able to identify, classify and group the page components automatically, while leveraging as much meaningful information as possible. Otherwise, you are going to spend a lot of time manually “recreating” the application your users experience from an assortment of objects and content items with unrecognizable names.

According to one industry analyst, “One of the key goals in deploying end-user monitoring solutions is to move from an IT-centric view to actually realizing how IT is contributing to business goals. The value of end-user experience information significantly increases if organizations have capabilities for translating application performance metrics into business metrics such as lost revenue opportunities, conversions, the value of transactions failed, application utilization, disruptions of business processes, etc.” By using a Business Transaction Management (BTM) approach to End-User Experience Monitoring, you can evaluate your users “real experience” and measure its impact on your business.