What is performance management?

We think knowledge of real operating parameters is absolutely necessary to master information systems.

There are many metrological tools that measure time, space, audience, etc. With the creation of Sysload, we wanted to offer a versatile metrological tool designed for the data processing field.

This concept was subsequently developed as performance management, and other editors began to offer this type of software.

What needs does Sysload meet?

1. The need to manage costs and evaluate return on investment in order to prepare budgets for and validate the purchase of software and hardware.
   
   
2. The need to provide exact knowledge of real parameters concerning operation of the computer system. This knowledge is used to guarantee quality and continuity of service, which depend on the response time, availability, reliability and capacity of the system. (A lack of quality discourages users and causes a drop in productivity.)
   
   
3. The need to detect and master incidents. Monitoring the system and being able to react rapidly are the main considerations, since computer applications are becoming more and more critical.

When we created Sysload ten years ago no tool fulfilled these three requirements, and certainly not in an open environment.

How does this product work?

It soon became clear to us that a distributed architecture operating in 100% client-server mode would be the best strategic choice.

Sysload is composed of autonomous agents installed on each server analyzed and a display console.

• The agents collect and store information in a historical database located on each server analyzed.
  
  
• The console sends requests to agents and displays the corresponding real-time and historical data, as well as alerts.
  
  
• A third module, Script Monitor, is used to automatically launch corrective action when certain user-defined conditions are met.

Unlike competitors, Sysload delegates most of the processing to the agents located on each server analyzed, and not to the display console located on the observation station.

What are the advantages of this architecture?

A principle well-known to physicists, the uncertainty principle, states that one cannot measure without disturbing. In the computer world as elsewhere, the quality of a metrological tool depends on the pertinence of the information it provides, and its discretion:

• With a CPU load of less than 1%, no generation of network traffic, and consultation possible through a 9600 baud link and thus via the Internet, Sysload is exceptionally discrete.
  
  
• Since historical data is not centralized, a very large number of parameters can be recorded at a high frequency.
  
  
• Since the agents and the console are completely separate, Sysload can monitor very different platforms (operating systems, databases, and application programs) from a single point.
  
  
• Since the display console is not dedicated, the various Sysload users can all have customized consoles on their Windows 95, Windows NT, Motif or OpenLook workstations.

Why associate an expert system with Sysload?

Experience has shown that:

1. Even with Sysload the analysis of several years of past activity, or activity on several dozen servers, is a time consuming operation.
   
   
2. Most information systems today are heterogeneous, and it is hard to find "universal" specialists skilled in every field.

Thus we decided to use artificial intelligence to automate the detection and diagnosis of incidents on many platforms.

How do Sysload and Sysload AES fit together?

Sysload AES is an optional module on the display console. It analyzes historical information collected by all Sysload agents.

What technology is used?

Sysload AES uses a statistics engine and an expert system, or inference engine, developed by NASA. This engine is known as CLIPS.

• In the first phase the statistics engine constructs a model of operations performed on the servers. This model is built dynamically using Sysload historical databases, while of course taking into account hourly and daily fluctuations.
  
  
• The inference engine then compares historical information with the model and detects abnormal operation and its probable causes.

How is this analysis different from an audit made by an engineer?

Sysload AES exactly reproduces the human reasoning used during a classical audit. However:

• Sysload AES is approximately 10,000 times faster than a System Engineer.
  
  
• Sysload AES uses a unique rules base combining the knowledge acquired by all Loan System engineers in ten years of experience working on many different platforms.

Isn't the product a bit complex?

The technology and knowledge implemented are in fact complex, but they do not make Sysload AES any less user-friendly. This product is as easy to use as Sysload, which is reputed for its ergonomy.

Can the analysis be customized?

Sysload AES is a tool to increase productivity that was designed for immediate use and a very short-term return on investment.

You can freely modify incident conditions that are specific to your environment, and that depend on parameters such as server power and number of users. However, all these parameters are taken into account automatically.

How long does an analysis take on average?

It all depends on the number of servers and the period of time analyzed:

• Analysis of the principal parameters of a server over one month, for example, takes about forty seconds.
  
  
• Detailed analysis of a hundred servers over one year would take only a few hours.

In any case, there is no comparison with the time it would take an engineer, no matter how experienced or motivated!

How many servers can be analyzed?

Sysload AES operates in client-server mode. Thus there is no theoretical limit to the number of servers it can manage.

In practice, however, we recommend that very large systems be divided into logical sub-sets to facilitate the use of information.

What is the minimum configuration required?

A Pentium 133 with 32 Mb of RAM is perfectly adequate because the Sysload architecture makes it possible to decentralize processing at the agent level.

What developments are planned for the future?

• In 1998 we are going to automate the detection of recurring incidents, which are typical in the use of certain application programs.
  
  
• Sysload AES will also soon be able to correlate incidents caused by interaction between several servers, a problem that is practically impossible to determine with traditional means.
  
  
• Finally, we will automate the definition of real-time alert thresholds, according to the modelization of the information system. Sysload AES will thus provide the administrator with precious help in mastering incidents in real time.