When Microsoft System Center Operations Manager 2007 was released, it provided a range of new and enhanced features and functions, including increased performance and scalability, compared with prior versions. However, in a heterogeneous, multivendor, multiplatform IT world, Operations Manager 2007's advantages and strengths are managing single-vendor Microsoft Windows server and software (such as Exchange and SharePoint) environments. This research describes the evolution of Operations Manager 2007, how it has been adopted and whether it's ready to become an alternative to multivendor enterprise event correlation and analysis (ECA) products.

• Operations Manager 2007 has more features and functions, delivering a major advance over Microsoft Operations Manager (MOM) 2005. Operations Manager 2007 provides availability and performance-monitoring capabilities, including fault and performance monitoring and end-user response-time monitoring, in one product.
• Operations Manager 2007’s core features and functions aren't unique, compared with more-established ECA products. However, its capabilities for managing Windows servers and its low-price apply competitive pressure, especially in companies with large Microsoft Windows infrastructures.
• Operations Manager 2007's value diminishes when managing non-Microsoft IT elements, whether management is provided by Microsoft or a third party.

• IT organizations using MOM 2005 should consider upgrading to Operations Manager 2007 to gain better usability, features, functions, and performance and scalability.
• IT organizations with large or growing Windows infrastructures should learn the value of Operations Manager 2007 and consider using it to supplement ECA tools.
• IT organizations with a heterogeneous IT infrastructures (including operating systems, databases and applications) considering Operations Manager 2007 as their primary event console must plan to use Microsoft technology partners to extend the product.

MOM 2005 was a low-cost, "good enough" product for managing Windows-centric IT environments. Operations Manager 2007 has moved to rival many of the capabilities provided by more-established and more-expensive ECA tools. Operations Manager 2007 should be considered by IT organizations with large Windows IT infrastructures, especially those that continue to use the older MOM 2005 product; however, they need to carefully evaluate how it applies to heterogeneous environments.

This document was revised on 17 October 2008. For more information, see the Corrections page on gartner.com.

In March 2007, Microsoft released System Center Operations Manager 2007 and revealed a product with some significant changes over its predecessor, MOM 2005 (which was released in August 2004). Since the release of MOM 2000, which was aimed at small companies with 20 to 30 servers, Microsoft has continually enhanced its availability and performance management product to address some of the largest enterprise IT environment challenges. With Operations Manager 2007, Microsoft strove to provide a management product that would be a serious alternative to ECA tools from such companies as BMC Software, CA, EMC Smarts, HP Software and IBM Tivoli.

Gartner has been monitoring the adoption, use and progress of Operations Manager 2007. Gartner's "Magic Quadrant for Event Correlation and Analysis, 2007" documented Microsoft's progress and resulted in Microsoft gaining ground on many of its competitors. Operations Manager 2007's positive Magic Quadrant trajectory can be attributed to several factors, including a high adoption rate (Microsoft claims more than 17,500 implementations, which include MOM 2005 and Operations Manager 2007), improved client satisfaction, increased capabilities and a vision that includes extending the functionality to network management through the partnership with EMC Smarts.

Operations Manager 2007 has been available since May 2007, and, to date, this has resulted in 4,000 licenses. Sixty percent of the Operations Manager 2007 licenses were new, with the remaining 40% upgraded from MOM 2005 for no charge through Microsoft’s Software Assurance (SA) program. Of the 13,500 MOM licenses still active, 11,000 (85%) have access to a free upgrade to Operations Manager 2007 through SA, and this continues to be an active process. Although the data provided is approximate, a sizable portion of the MOM customer base has not yet been upgraded, which may reflect that large enterprises are more likely to demand the added features and functions offered by Operations Manager 2007. Smaller Windows-centric IT organizations — such as small or midsize businesses — may be content with the functionality provided by MOM 2005 and may see no urgency to upgrade to Operations Manager 2007.

MOM 2005 had a single management server architecture (the Management Server), whereas Operations Manager 2007 added two server types (the Root Management Server and the Gateway Server) to the Management Server:

• The Management Server manages communication with managed agents, and forwards events and performance data to the operations database.
• The Root Management Server supports clustering and manages role-based security and distributed applications defined in the operations management infrastructure. Services such as the configuration service and software development kit service run from the Root Management Server.
• The Gateway Server is designed to manage devices in "demilitarized zones" (DMZs) or behind firewalls. The Gateway Server aggregates communication from agents and forwards them to a management server inside the firewall.

Operations Manager 2007 uses the same monitoring engine as in the previous version on the Management Server, Root Management Server and agent. Within the architecture, a high-availability capability can be achieved; however, it requires the addition several Microsoft products. The Root Management Server supports Microsoft Clustering on Windows Server 2003, while the database server (the Management Server) uses Microsoft SQL Server 2005, which provides built-in clustering. Operations Manager 2007 continues to support automated agent failover for management servers. If the Management Server fails, then the agents that communicate with it will automatically fail over to another Management Server.

Operations Manager 2007 includes a service-modeling component that enables the modeling of IT services based on Microsoft technologies. Microsoft's Management Packs contain the relationship discovery data, and Operations Manager 2007 comes with a graphical application designer that enables operations personnel to build their own views of IT services through the service models. In addition, Operations Manager 2007 comes with application templates that provide predefined service components and relationships. Templates such as line-of-business Web applications or messaging services are included, enabling IT operations to create their own templates for custom IT services or applications. For example, this will enable system administrators to understand how an element event affects an IT service.

Microsoft Operations Manager 2007 has been enhanced to make the product easier to use. This includes management pack templates, which enable systems administrators to create custom integration for IT components not supported by Microsoft, such as SAP or Oracle applications.

MOM 2005 had two interfaces: one for administration and one for monitoring. Operations Manager 2007 has a single role-based console that enables operations and administrative functions to be granted to specific IT personnel.

To reduce the constant need for threshold tuning, Operations Manager 2007 enables the creation of self-tuning thresholds, which monitor a performance counter and set an upper and lower threshold, based on historical activity. The system can then alert when performance exceeds these established thresholds. As with MOM 2005, Operations Manager 2007 comes with many out-of-the-box capabilities turned on, and users have commented that, when they deployed Operations Manager 2007, a great deal of time is required to tune the monitoring to reduce the amount of data being collected.

A few minor additions have been made to Operations Manager 2007's network management capabilities. These include supporting Simple Network Management Protocol (SNMP) v.2, which involves polling and trap monitoring (there is no SNMP v.3 capability). This enables traps to be received and the leveraging of SNMP for the discovery of devices. A partnership with EMC Smarts (see "EMC Licenses Network Management Functionality to Microsoft System Center Operations Manager") provides the next version of Operations Manager, which is scheduled for release in 2009, to have the potential to significantly increase its network management capabilities, including EMC's network topology discovery and health monitoring capabilities.

Operations Manager 2007 enables synthetic transactions to be defined and deployed to watcher nodes (an additional architectural component). Synthetic transactions perform a sequence of steps defined in the transaction, which is monitored for success/failure and duration, and enable operators to have visibility into an end-user response. Although this is a useful capability, it is one of the most basic methods for gaining an understanding of end-user performance response times.

With Operations Manager 2007, the Audit Collection System (ACS), which was previously a stand-alone tool, became an integral component. Audit collection is a service that gathers real-time Windows security event log entries and consolidates them in a database for access by reporting and data-mining applications. The ACS collects and reports who changed what, what changed, when it was changed and so forth. Even though ACS is available with Operations Manager 2007, it is a separate service that requires a separate installation option.

MOM 2005 had a restricted security model in which a user is assigned as an operator able to view and manage device events or an administrator with complete control over the MOM configurations and management. Operations Manager 2007 has role-based security. Administrators can define user roles with access to specific systems, views and tasks in the console. It's possible to grant access to a user who needs to monitor events from a select group of servers. This user wouldn't see any other systems and could only execute tasks approved for his or her group. Role-based security is enforced for the console, command line and customer client access levels.

Operations Manager 2007 leverages Active Directory for security, discovery and agent management. Hence, if an administrator adds a new server or client to an Operations Manager-defined organizational unit, Operations Manager 2007 can automatically deploy and configure an agent to talk to the appropriate group of servers. With Operations Manager 2007, role-based security linked to Active Directory groups for membership enables users to sign on once, then have access controlled through a common set of groups and permissions.

To support the move to the System Definition Model, which uses an XML-based language, Microsoft has changed the format of management packs from the proprietary AKM management pack files used by MOM 2005 to the XML format used by Operations Manager 2007. The XML format enables Microsoft partners to develop management packs and extend Operations Manager to non-Microsoft operating systems and applications.

Does Operations Manager 2007 enable Microsoft to play a greater role in managing enterprise IT operations? Operations Manager 2007 provides Microsoft with a product that can compete with established ECA products from BMC, CA, EMC, HP and IBM Tivoli. For enterprises with significant investments in Microsoft software, we've seen increasing interest in Operations Manager 2007 for a larger role in monitoring the entire, heterogeneous IT infrastructure. However, it's not easy to provide a definitive answer as to whether Operations Manager 2007 can provide this capability. The answer depends on:

• How much Microsoft software and how much non-Microsoft software (including on Windows) must be monitored
• How strategic the Microsoft software is to the enterprise and how strategic the non-Microsoft software is to the enterprise — that is, where the mission-critical applications reside, and what they are
• IT organizational skills and structure, including the ability to maintain multiple server management teams
• What other IT management products need to be integrated
• The IT management budget

For most enterprises, IT remains heterogeneous, demanding domain experts in such areas as network management and server administration who can use their specialist tools to manage their portions of the IT infrastructure. However, there is still a need to manage the entire IT infrastructure in a holistic way, showing how IT supports the business. In this environment, Operations Manager 2007 acts as a subordinate event console to an established heterogeneous event console, such as BMC BEM, CA Unicenter NSM r.11, IBM Tivoli Netcool OMNIbus or HP Operations Center (see "The Evolving Role of a Manager of Managers in IT Operations").

Operations Manager 2007 has features and functions with the performance and scalability strength to address the needs of enterprises looking to manage large implementations of Windows servers and Microsoft software. A number of Windows-centric IT organizations (typically, with more than 75% of their infrastructures on Windows) continue to deploy Operations Manager 2007 in a primary manager-of-managers role, using it to consolidate event data across the entire IT infrastructure.

However, Operations Manager 2007's support for several non-Windows operating systems (including HP-UX, Red Hat and SUSE Linux, and Sun Solaris), as well as its partnerships with companies such as Quest and Novell, which provide management packs for non-Microsoft software, haven’t resulted in Operations Manager 2007 taking the primary manager-of-managers role in many large enterprise environments. So, even with Operations Manager 2007's attractively low price, we do not see its role in IT operations management changing. However, in Microsoft Windows-centric environments, its presence will continue to grow, resulting in an overall gain in ECA market share.

• Improvements over its predecessor, MOM 2005, including scalability, performance and usability
• Increased security capabilities, including access and change monitoring
• Additional ECA capabilities, including response time monitoring and auditing
• Support for non-Microsoft operating systems, such as Linux
• When competing with the big four ECA vendors (BMC, CA, HP and IBM Tivoli), Operations Manager 2007 provides:
  • Greater focus on managing Windows Server environments
  • More functionality from a single product
• A significant installed base, with healthy growth, especially in environments with large Microsoft infrastructures
• Compelling prices

• Good-enough features may lack the depth of products developed to address a specific need, such as audit monitoring, network management and synthetic transaction monitoring.
• Microsoft continues to lean heavily on its partners to fill major holes in product coverage (such as hardware monitoring, storage and non-Microsoft software, including applications, middleware and databases). This introduces complexity (for example, in administration); costs (in software, maintenance and, potentially, in the requirement for other products that require additional skills); and risk, including the need to introduce another vendor, with its own support, road maps and priorities.
• In heterogeneous enterprises, Operations Manager 2007 continues to focus on monitoring Windows, playing a subordinate role to ECA products that are able to address a broader range of IT elements out-of-the-box (from a single vendor).
• In heterogeneous IT environments, Operations Manager 2007 lacks compelling value to displace multivendor ECA products.