Rolling Review: Symantec's Triple APM Threat

Symantec's I3 Suite has the depth and breadth of features required for true end-to-end application performance management. The "i3" moniker refers to a trio of applications dubbed Inform, Insight, and Indepth. Inform's Alert and Foresight components provide predictive analytics and early warning of performance problems. Insight is a dashboard view that displays current performance and system relationships. Indepth agents are to be installed on devices running J2EE, .Net, SAP, Oracle, SQL Server, and Sybase applications. We also tested two additional components, the Application Service Dashboard and Inform Insight, that complement i3.

After surmounting some installation and configuration hurdles, we found the intelligence i3 puts toward problem solving quite impressive. Symantec uses dynamic instrumentation in the Web component, providing client-side data without a client-side software installation. Root-cause analysis, event filtering, and flexible reporting options were also compelling.

If you just need a synthetic transaction tool, Inform Insight has the ability to record and test any Web-based application or Java transaction, and the studio for creating transactions is easy to use. However, Insight Inquire uses a separate database to store performance data, so information isn't directly available through i3.

The Application Service Dashboard, or ASD, is the window into i3's world. We found a wealth of flexibility and customization capabilities for integrating i3 components as well as external data sources into a dashboard, and multiple i3 installations can be observed from one ASD instance.

ROOT OF THE PROBLEM

Indepth provides a drill-down capability to perform analysis from alert to root cause. Once a problem is detected, Inform/Alerts has significant customization capabilities for specifying which alerts should be e-mailed, and where. We could customize the severity of alerts and the monitors that create them.

Inform/Alerts also contains SNMP trap forwarding integration, and we could set up log scraping to create SNMP traps for applications that don't support the protocol. Inform/Foresight can produce predictive analysis, but it also generates standard reports and enables customization. All reports are clearly laid out.

After setup, our SQL Inform/ Alerts instance showed critical alerts within minutes. These included databases not having been properly backed up and the SQL Server agent not running correctly. Within a few days, the Web alerts indicated critical warnings for large numbers of connections from a single IP, indicating a potential security threat.

ASD is a highly customizable dashboard with the ability to integrate Symantec and non-Symantec data--organizations will want to add it to get the true value across infrastructure components. It can generate reports from across technology groups that are segregated within i3, as well as view Insight Inquire data. Because it has its own user and group configurations, ASD can restrict access to data sets and individual dashboard portlets without users having access to i3.

Symantec's was one of the most cost-effective entries from the larger enterprise vendors in this Rolling Review. Pricing for i3 is based on management station CPUs, not on the number of end-device technologies that are managed, so our price as tested was only $17,200. Price per CPU, per managed technology is about $2,000. For example, i3 for SQL Server is $2,100 per CPU. This lets organizations get their feet wet without buying an expensive central management station as a minimum investment. ASD is free with any i3 bundle, and Portlet Packs will run about $1,000 per user per pack.

Of course, we have a few nits. No auto-discovery or remote monitoring capabilities are available, which could make installation challenging for organizations that don't have a handle on their systems inventory or aren't using a configuration management database. For any i3 monitoring to take place, the i3 listener agent must be installed on target servers, and agents are necessary to observe system or network activity.

Moreover, to access any Inform, Insight, or Indepth data, users must first select the technology category, such as J2EE or SQL. Within i3, there's no way to see alerts from two different technologies. To get reports from across technologies, we had to use a specific area of Inform/Alerts to generate the SQL code for a report like the one desired, then manually change that SQL to query for all the technologies we wanted, and run it to have the results export into a spreadsheet or other format. This was cumbersome without using ASD.

Rolling Reviews present a comprehensive look at a hot technology category, including market analysis, product reviews, and wrapping up with a synopsis of our findings. See our kickoff and other reviews in this application performance management series at Rolling Reviews.