WHITE PAPER

RiverMuse Architecture
Breakthrough Event and Fault Management for the New IT
 WHITE PAPER

RiverMuse Architecture
Breakthrough Event and Fault Management for the New IT

Why is a new event and fault management architecture so important?

The technical architectures of legacy network management platforms have not evolved significantly since
their introduction nearly two decades ago. In part, this is because of the perceived need to maintain backward
compatibility with earlier versions of the software. It is also in part a consequence of the fact that the real
cost of changing management vendors has historically been quite high for IT organizations—which meant that
those vendors have not had to invest in full-blown architecture overhauls to retain their customers.

These outdated legacy platforms may have once provided IT organizations with adequate functionality. They are,
however, quite demonstrably inadequate for the challenges now being faced by IT organizations. This is because:

They can’t support the continuous change that characterizes today’s networks. When legacy management
platforms were conceived, IT environments were relatively static. Today, in stark contrast, they are
highly dynamic. IT organizations are constantly modifying infrastructure to respond to changing business
requirements. Virtualization further contributes to this fluidity by allowing server instances to be moved, added,
and deleted with just a few keystrokes. SOA, cloud computing, and other adaptive technologies produce a
similar effect by allowing IT to implement resources with unprecedented flexibility. IT organizations simply
can’t update the business logic within their legacy management platforms quickly enough to keep pace with
this incessant change.

They leave critical IT services vulnerable to blind spots and silent failures. As business performance has
become increasingly dependent on IT services, legacy fault management architectures have actually left IT
more vulnerable to blind spots and silent failures than ever. Much of this vulnerability is again due to the
fact that legacy platforms can’t keep up with the pace of change in the IT environment. Another reason is
that these platforms don’t provide any means of maintaining the integrity of event message content when
business logic is changed. When this event message content is lost or corrupted by changes in business
logic, IT staff can wind up with zero visibility into potentially critical infrastructure problems.

They fail to sufficiently insulate IT staffs from the size and complexity of IT infrastructure. The sheer size,
complexity, heterogeneity, and interdependencies of IT infrastructure are straining the ability of IT to prevent
service interruptions, fix problems, and respond to issues according to business impact. Legacy platforms
require IT staffs to invest a tremendous amount of time and energy into the definition and management of the
business rules that allow them to manage by exception—that is, to extract legitimate alerts and impending
 WHITE PAPER

issues from the hundreds of thousands of events that the computing environment generates every day. They
still lack the consistency, automation, and model integrity necessary to streamline event management and
align it with the current state of the business.

They force IT departments to work in isolation from each other. While IT professionals in different companies
may be able to share management insights and best practices at a high level through online forums and
industry associations, they are unable to exchange actual work product and intellectual property. Given
the new and extraordinary pressures these professionals now face, they could clearly benefit from a closer
collaboration with their peers that would eliminate the need for each company’s IT staff to constantly “re-
invent the wheel.” Unfortunately, because vendors of legacy management architectures operate under a
proprietary model, they offer no practical way for the management community to engage in such collaborative
exchanges. This results in an inefficient dependency on trial and error, unnecessary expenditures of time and
money, and chronically delayed time-to-benefit.

They cost too much. Inertia and limited competition in the network management market have led to exorbitant
pricing for legacy platforms. Service and support for these platforms has driven up the cost even further. IT
organizations, however, are no longer in a position to allocate an inordinate percentage of their budgets and
staff resources to the safeguarding of service levels. These resources are too limited, and it has become a
strategic imperative to allocate a larger proportion of them to the kind of innovation that can directly advance
the interests of the business. So, while it may have been acceptable in the past for network management to
consume a disproportionate amount of time and money, this is no longer the case.

Simply put, the useful life of legacy management architectures is now at an end. IT organizations that
continue to use platforms with these architectures will put their companies at a competitive disadvantage as
they overspend on management while failing to optimize delivery of critical services to internal and external
constituencies. It is thus essential that IT implement a new architecture that can effectively support service
level optimization in a world of constant change, extreme complexity, and constrained resources.

RiverMuse Architecture
RiverMuse’s breakthrough event-and-fault management architecture is specifically designed from the ground
up to address the issues of change, complexity, collaboration, and cost—ensuring that IT can continually
maintain the infrastructure visibility necessary to optimize service levels.

Key attributes of the RiverMuse architecture include:

Two-tier data model

In legacy management platforms, data captured from the enterprise environment becomes part of the same
database in which filtering rules, correlation logic, and other operations are performed. As a result, original
event data is quickly lost.

Copyright © 2010, RiverMuse Inc. All Rights Reserved. | Legal. Page 2

 WHITE PAPER

RiverMuse’s architecture preserves content integrity by separating management data into two separate tiers.
The Events tier stores all original content received from the network—including SNMP traps, demand poll
results, syslogs, Windows Messages, etc. The Alerts tier stores all modified content (or “states”) that results
from the application of business rules or other operational logic to the original Event content.

RiverMuse natively uses a MySQL database, and in the future may be used with other popular database
management systems. All replication, federation, and acceleration are performed within the database itself.

Protection of content integrity

In legacy platforms, existing data is constantly modified and corrupted as network elements change, business
rules are modified, and logical operations are performed on the database.

In addition to using a two-tier data model, the RiverMuse platform further ensures content integrity by
protecting all data in both tiers from subsequent inputs. Alert data created by additive business logic—such
as automation and conditioning—is also retained and protected from subsequent changes. This ensures that
all existing business logic will continue to work on all existing data, even as multiple successive changes
occur in both the enterprise environment and in the management system itself.

In legacy platforms, new business logic generally replaces existing logic. This can make it difficult to “roll
back” rules and/or perform forensics on previous network states—which, in turn, can have a chilling effect
on the introduction of new business logic that may be needed to optimally manage service levels. RiverMuse
addresses this problem by protecting existing business logic. New logic can therefore be freely added and
applied as required—because the risk of permanently losing or corrupting previous logic is fully mitigated.

Unified conditioning service

Legacy management platforms condition different data sets from the enterprise in highly fragmented ways.
This is because vendors of these platforms have been unable to unify the multiple engines inherited from
their earliest versions and/or acquired over many years of their piecemeal expansion through acquisition. The
result of this fragmented architecture is that technicians have to learn a variety of proprietary languages and
scripts in order to perform even the most basic customization tasks.

With RiverMuse, on the other hand, all automations, transpositions, enrichments, and correlation rules are
applied to a common service layer using a single business logic configuration language based on pure
ANSI SQL. This radically simplifies customization of the environment and greatly streamlines change
management—since it is much easier to document all actions performed on a system when those actions are
performed in one place in a common manner.

Copyright © 2010, RiverMuse Inc. All Rights Reserved. | Legal. Page 3

 WHITE PAPER

Use of dynamic variables in business logic

With legacy management platforms, it is essentially useless to create business logic for highly dynamic
network elements such as virtual infrastructure, SOA application paths, or MPLS network connections—since
the configuration of those elements inevitably changes faster than new corresponding rules can be manually
created. So IT organizations can never really adequately safeguard the availability of any critical business
service that utilizes virtual infrastructure.

RiverMuse solves this problem by allowing business logic to be written using “dynamic variables” that are
linked to external sources such as CMDBs or change management tools. When infrastructure changes occur,
they can thus be automatically reflected in the operative logical statement. This adaptable business logic
enables IT organizations to reap the benefits of adaptive infrastructure without sacrificing the day-to-day
manageability of the enterprise environment.

Automatic management by presence

Legacy management platforms typically provide some type of automated element discovery that enables IT
staff to immediately detect any new resources added to the environment. The process of responding to that
discovery with appropriate business logic, however, tends to be a manual one. This retards the ability of IT
to properly address the management data received from new resources—especially in the context of the
specific business services such new resources support.

RiverMuse will radically accelerate management of new networked resources by automatically instantiating
business logic for those resources as soon as they are identified in any incoming management data. RiverMuse
users will have the option either to activate this logic without any operator intervention or to immediately
present it to an operator for approval. Either way, this automatic “management by presence” will enable IT to
respond to infrastructure change much more nimbly than legacy fault management architectures.

Reusable and transportable business logic

Legacy management platforms do not enable the user community to share work product. Each organization
must duplicate the work of every other organization, except insofar as an integrator or third-party developer
may make certain intellectual property available to multiple organizations on a proprietary basis.

RiverMuse’s architecture is designed to provide a powerful alternative to this closed, inefficient model by
enabling business logic to be reused internally throughout the organization—and even transported between
organizations if customers choose to do so. A class-based abstraction layer allows business logic to
be anonymously uncoupled from any originating instance and shared with any other RiverMuse user or
organization—where it can then be plugged into the local management environment and applied to the
same class of resource. RiverMuse will maintain all publicly available business logic in a secure, searchable
repository that all registered users can access via the web.

Copyright © 2010, RiverMuse Inc. All Rights Reserved. | Legal. Page 4

 WHITE PAPER

Open, unified monitoring layer

Today, most IT organizations use a legacy fault management application to capture and respond to events that
are passively received by their management platform—and a separate set of performance management tools
to handle poll-driven trending. This siloed monitoring drives up ownership costs and impedes quick visibility
into the state of the enterprise environment.

RiverMuse offers a superior architectural approach by providing an open monitoring layer that handles both
passive data (SNMP traps, Windows Event Log, WMI, UNIX and Cisco syslog messages, etc.) and data gleaned
from the platform’s native active, policy-based polling engine. Passive data can also be imported into the
platform via an XML/SOAP API, making it easy to integrate other management data sources. An intelligent data
management mechanism mediates all incoming data—handling tasks such as de-duplication, registering all
events, and determining whether data should escalate to the alert tier of the database. All imported and
native content (both passive and polled) is thus uniformly time-stamped and kept in one place, where its
integrity is protected and it always remains available for compliance, analytics, and forensics.

Multi-tenancy architecture
Deployment of legacy management platforms has historically been monolithic. An organization deploys the
platform to manage its infrastructure across the enterprise. Responsibilities and workflows may be divvied
up to different users and classes of users as necessary from an operational perspective, but the deployment
remains inherently that of a single business entity.

This type of deployment does not make sense for constituencies such as managed service providers, large
enterprise with a shared service model, and cloud providers that need to give their customers secure,
independent visibility into discretely segmented resource territories. RiverMuse has therefore been designed
to intrinsically support multi-tenant deployment. Mediation, for example, can be bounded and distributed on
a per-tenant basis to provide customer-centric views of alerts and actions. This allows management services
to be appropriately tailored to a variety of current and emerging business models.

RiverMuse provides a variety of other features and functionality that streamline IT operations by making
ownership of management technology far less cumbersome than has been the case with legacy platforms.
These include:

•• DIY feature development. RiverMuse uniquely enables IT organizations and their partners to develop additional
functionality for the platform. This is a compelling alternative to legacy platforms that keep customers waiting
years before providing needed new capabilities—and that often fail to deliver such capabilities at all.

•• Self-updating platform. Using RPM Package Manager and YUM, RiverMuse automatically prompts users when
new or updated components of the platform become available. This significantly eases platform maintenance.

Copyright © 2010, RiverMuse Inc. All Rights Reserved. | Legal. Page 5

 WHITE PAPER

•• Automated health checks. RiverMuse continually monitors all platform components, alerting operators
immediately to any state change. As new platform components are added, they are automatically registered with
the health check system.

Bottom-line advantages for the present and the future

The architectural features that distinguish RiverMuse from legacy management platforms are not mere
technical niceties. They are fundamental differentiators that generate substantial, tangible advantages for IT
organizations seeking to deliver highly reliable business services in an increasingly dynamic and resource-
constrained world. These advantages include:
Full, uninterrupted visibility into dynamic IT environments. Technologies like virtualization and SOA offer the
ability to respond more quickly and cost-effectively to changes in business requirements. But organizations
can’t take full advantage of this adaptability if every change in the infrastructure creates another “blind spot”
for IT operations—and thereby puts services at risk. By virtue of its ability to accommodate and tolerate
change, RiverMuse is a core enabler of adaptive infrastructure.
Lower IT overhead. Legacy management platforms cost a lot of money and require substantial investments
of time and effort to maintain. In contrast, RiverMuse doesn’t put undue strain on limited IT budgets and its
automated functionality makes it much less of a workload strain on IT staff resources.
More reliable business services. Despite all the resources that IT organizations pour into their legacy
management platforms, they still find that infrastructure can “fail silently” without their knowledge—
jeopardizing critical business services. By better ensuring full visibility into infrastructure health, RiverMuse
enables operations staff to better safeguard service levels by more easily discovering problems that can
potentially impact services and more quickly troubleshooting problems that already have.
More aggressive ongoing innovation. The rapid pace of change in technology and business continues
unabated. So no organization can afford to be saddled with management tools that remain stagnant and are
demonstrably headed towards obsolescence. RiverMuse overcomes stagnation and obsolescence by delivering
an architecture designed to meet today’s challenges and to generously accommodate change.
Easier integration. In multi-vendor environments, it is essential to make integration as seamless and easy to
do as possible. RiverMuse’s unfragmented architecture and use of standardized XML/SOAP interfaces fulfills
these integration requirements, allowing IT organizations to quickly and inexpensively leverage necessary
third-party tools.
Reduced business risk. Risk mitigation is a central issue today in business management generally and
technology management particularly. Legacy platforms leave organizations exposed to all kinds of risks—
including the risk of failed services, the risk of compliance shortfalls, and the risk of inadequate long-term
returns on huge investments in the platform itself. RiverMuse radically reduces the cumulative magnitude of
these risks by lowering costs, maintaining content integrity, facilitating change, and providing better visibility
into ever-changing enterprise infrastructure.

Copyright © 2010, RiverMuse Inc. All Rights Reserved. | Legal. Page 6

 WHITE PAPER

With all these advantages, RiverMuse is a compelling alternative for SMBs and large enterprises alike. For
SMBs, RiverMuse offers the ability to acquire true “manager of managers” capability at a far lower cost-of-
entry than conventional platforms—and with much, much more rapid time-to-benefit. By building on this
foundation, SMBs can secure a clear growth path for their future.

For larger enterprises, RiverMuse offers significantly more effective management of complex, dynamic
infrastructure with dramatically reduced overhead—a genuine competitive advantage in today’s technology-
dependent marketplace.

In fact, with the introduction of RiverMuse, there are really no viable reasons to continue using the over-
priced, underdeveloped proprietary management platforms left over from previous decades. RiverMuse’s
breakthrough architecture makes it ideal for IT organizations looking for the best way to optimize service
levels to the business and its customers, to drive down the total cost of infrastructure ownership, and to
ensure ongoing adaptability to an incessantly evolving technology ecosystem.

London Office About RiverMuse

The Foundry Established in 2008, RiverMuse delivers next-generation real-time
157-168 Blackfriars Road IT operations management software that uniquely enables service
providers and enterprises to maintain the health of their increasingly
London, SE1 8EZ UK
complex and adaptive environments so they can optimize service levels,
+44 (0)870 141 4514 drive down costs and respond more nimbly to the changing needs of the
business. The company was founded by the serial entrepreneurs who
launched Micromuse and RiverSoft, which assure a majority of all public
Silicon Valley Office
and private internet infrastructures in use today.
805 Veterans Blvd, Suite 309
Redwood, CA 94063 USA
+1 877 771 MUSE (6873) For more information, please visit www.rivermuse.com.

Copyright © 2010, RiverMuse Inc. All Rights Reserved. | Legal. Page 7