Gartner's Magic Quadrant for IT Event Correlation and Analysis (ECA), 2007 (see Figure 1) evaluates vendors' abilities to execute and their completeness of vision relative to a defined set of evaluation criteria regarding current and future market requirements. A Magic Quadrant should not be the only criterion for selecting a vendor, because the right solution for a given situation can be in any quadrant, depending on the specific needs of the enterprise. Enterprises considering the purchase of an ECA product should develop their own list of evaluation criteria and functional requirements in the categories of event collection/consolidation, processing/correlation and presentation. Large enterprises should consider a multitier event management hierarchy, pushing some event processing and correlation out to the managed IT element at the bottom of the hierarchy. These enterprises should use specialized event management tools in the middle and should place a "manager of managers" on top.

When investing in event management, prospects should understand how the product will fit with their overall event-to-incident/problem resolution processes, including workflow, escalation and integration with service desk tools.

ECA products help IT operations personnel contend with the deluge of events that come in from the IT infrastructure by eliminating duplicate event signals, filtering events according to operational or business priorities and analyzing events to determine root cause. The desire is to also associate events with potential business impact, although this is more of a "wish list" and not necessarily included in ECA tools. The goals are to improve the mean time to isolate and repair problems, and to prioritize IT support efforts according to business process value. The core value proposition of these products is to achieve management by exception. This requires an understanding of "normal" behavior in the IT infrastructure and alerting the IT operations staff only when an exception occurs, such as an outage, a failure or a threshold breach, indicating that the IT infrastructure is no longer behaving "normally."

IT organizations invest in ECA tools to improve the productivity of the IT operations staff and to reduce the time it takes to troubleshoot problems by consolidating events from various devices, applications and other management tools. Without proper event management, the IT operations group can be deluged with event storms, numerous false positives and a "sea of red" on their consoles.

The vendor positions on the ECA Magic Quadrant are based on the evaluation of information gained through vendor interviews, ongoing client inquiries, reference checks and Gartner's knowledge of requirements in the market. Although the Magic Quadrant provides a picture of a vendor's ability to execute, as well as its vision, it should not be the only criterion for making a selection. Enterprises often use Magic Quadrants to formulate their shortlists and look only at vendors in the Leaders Quadrant. Few enterprises will be successful finding the best vendor for them with this method.

Enterprises should determine their functional and support requirements and should use these to drive their selections. These requirements will be specific to the individual enterprise and will be key for vendor evaluation and eventual selection. For example, a vendor in the Niche Players quadrant could be ideally suited to an enterprise's needs. Similarly, the vendors in the Leaders quadrant may have executed well and outpaced the market in vision, but this does not necessarily mean that they have the functionality needed to meet an enterprise's specific requirements.

Enterprises should understand that some solutions are better-suited for large businesses (more upfront complexity and reliance on problem management process maturity) and others are better-suited for small or midsize businesses ([SMBs] easier installation and lower cost, but typically less capabilities for complex event correlation). The Magic Quadrant is not designed as a substitute for client inquiry — Gartner inquiry is the best way for enterprises to resolve specific questions about event management vendors.

ECA products:

• Support the acceptance of events from elements in the IT infrastructure (including hardware, software, server, virtual machines, operating system, network, storage, security, database, application and mainframe elements).
• Process events using consolidation, filtering, normalization, enrichment, correlation and analysis techniques.
• Notify the appropriate IT operations personnel of critical events.
• Automate corrective action, where possible.

Definition of Events

There are two types of event categories that need to be accepted by the ECA product:

• Discrete state change in a managed element, sent asynchronously from the managed element, an agent installed on the managed element or another IT event-monitoring or ECA product.
• Threshold breaches indicating that a managed element is no longer operating within "normal" parameters, sent asynchronously from the managed element, an agent installed on the managed element or a separate performance-monitoring product. "Normal" can be based on a pre-defined, default, out-of-the-box threshold; a customer-defined, customized setting; or a dynamic, measured baseline.

See "Event Correlation and Analysis Market Definition and Architecture Description, 2007" for a detailed description of the varying roles an ECA product can play in a potentially multitier event management architecture.

To be included in the ECA Magic Quadrant evaluation, a vendor must have at least three referenceable enterprise customers with production deployments and a shipping product as of December 2006 that runs on Unix, Linux or Windows, with functionality in the following three key event management disciplines: event collection/consolidation, event processing/correlation and event presentation.

Vendors/products must have the ability to accept events from two or more of the following types of IT elements:

• Server (hardware and operating system)
• Virtual machines
• Network
• Storage
• Security
• Database
• Application (packaged, off-the-shelf or custom applications)
• Mainframe (hardware and operating system)

Vendors/products must have the automated, out-of-the-box ability to process or correlate events through one or more of the following techniques:

• Deduplication/filtering (for example, when multiple, repetitive events are received for the same problem on the same element, store the event once and increase a counter indicating the number of times it has been received, rather than flooding the user's screen with redundant events).
• State-based correlation at the element level (for example, if a "link down" event is received for a router interface that then corrects itself and generates a subsequent "link up" event, then the ECA product correlates the two and clears the original link-down event).
• Topology-based correlation (for example, suppress the sympathetic events that occur when elements downstream from a known problem are unreachable).
• Correlation based on causal rules (for example, suppress events that are determined to be completely dependent effects of events taking place elsewhere, based on the product's built-in domain knowledge of how systems interact).

In addition, vendors/products must support the user's ability to add custom event processing or correlation rules.

Vendors/products must have the ability to present event data to the IT operations staff in one or more of the following ways:

• On the console screen using color and sound (visual and audible alarms)
• Through a Web interface
• By e-mail, pager, PDA or smartphone
• By logical groupings (presenting groups of events that relate to business processes, IT services, departments, geographic regions or any other arbitrary, user-defined grouping)

Two vendors, ASG Software Solutions and Cittio have been added to the 2007 Magic Quadrant based on client inquiries regarding these vendors in this market — an indication that buyers see these vendors as players or potential players in the ECA market.

Three vendors have been dropped from this year's Magic Quadrant. Micromuse was dropped because it was acquired by IBM Tivoli, which already appears on the Magic Quadrant. Rocket Software and Entuity were dropped based on changes in their product delivery and market focus.

The Ability to Execute (vertical) axis is focused on current capabilities and represents Gartner's view of the strength of a vendor's corporate management; the vendor's products, services and support; and its overall stability and viability. The ECA market includes several mature products from market-share-leading enterprise management vendors with large installed bases and robust cash flows, which sets a high bar for being placed in the Leaders and Challengers quadrants. However, revenue and customer count are not the only criteria for achieving a high ability-to-execute score.

Vendors with a strong ability to execute must have scalability and breadth of coverage to enable the collection of events from all parts of the IT infrastructure, including virtual servers and virtual machines, which is a new extension to this evaluation criterion for 2007. Vendors also must provide correlation functionality to reduce the event stream presented to the IT operations staff. However, customer experience shows that the more powerful the correlation tool and the more customization required to adapt the tool to a specific enterprise environment, the less likely an enterprise will be in successfully deploying it.

Traditional general-purpose, rule-based event correlation engines are being challenged by new, focused vendors whose products are easier to deploy because they have strong out-of-the-box functionality, although they have a limited ability to support customized event correlations. Customers are accepting the fact that the easy-to-deploy solution is "good enough," or they are using two tools: one for broad, but shallow, coverage of most of the IT infrastructure and one for deep, sophisticated correlation for a few critical components.

A new product execution evaluation criterion on alarm thresholds explores vendor progress in simplifying deployment by automatically baselining the IT environment, dynamically setting variable thresholds and setting off an alarm only when current results deviate from normal baseline values. Reporting is another new product execution evaluation criterion for 2007, because this function can aid clients in monitoring and improving the event management process.

The size of the installed base, the number of new customers gained in 2006 and the first half of 2007, and the strength of sales and marketing capabilities, along with the number of "feet on the street," contribute to a vendor's ability-to-execute ranking. We ranked the total installed base and growth in new customers separately, giving a heavier weighting to the number of new customers to distinguish a large, but stagnant, customer base from a growing customer base. Industry partnerships through OEM relationships, value-added resellers and system integrators increase a vendor's ability to touch the market without increasing its internal investment in a direct sales force. Visibility in competitive situations and consistently making enterprises' shortlists demonstrate marketing credibility and brand awareness. Successful vendors match their marketing messages to the market's requirements and ensure that their direct and indirect sales channels, partnerships and alliances are effective.

As with our 2006 ECA Magic Quadrant, vendor viability, current product functionality and marketing execution are heavily weighted in this ranking. Past consolidation and acquisition activity continue to wreak havoc with ECA vendors' portfolios; therefore, when determining a vendor's ability to execute, we placed increased importance on customer experience, especially in terms of migration and graceful architectural change.

On the Completeness of Vision (horizontal) axis, we evaluate how well a vendor or product will do in the future relative to Gartner's scenario for where a market is headed, which is based on our understanding of emerging technologies and requirements of leading-edge clients. Business units are pressuring IT organizations to provide more business-relevant information regarding how well IT services are performing. Traditional event consoles, in turn, are expected to accommodate this new demand by displaying the status of end-to-end services and by analyzing events for their business impact. Many enterprises originally invested in event management with the hopes of correlating disparate IT infrastructure data and delivering some business-relevant results. Progress toward this goal is impeded because many event management customers are still struggling with the basics of instrumenting the distributed infrastructure and enabling proactive monitoring. They do not have any end-to-end IT service definitions or documentation on how these relate to business processes. Nonetheless, enterprises are looking to ECA vendors for a vision of integration and for optimization with the entire problem management process, including the proactive prioritization of events based on business impact through the dynamic creation of incidents and escalations.

Gartner evaluates how vendors' visions align with industry trends and evolving market requirements, their understanding of technical and market issues, their ability to differentiate products and grow their businesses, and their emphasis on best practices and the ease of deploying the event management solution, not just on product features. We examined build-vs.-buy strategies for augmenting functionality, knowledge of core competencies and the ability to partner to fill gaps in the product portfolio. Industry perception and market recognition by prospects, partners and competitors based on a compelling and consistent marketing message is included. A vendor can succeed financially without a vision, but it will not become a leader without a clearly defined vision or strategic plan. This should include plans for articulating the vision and plans to differentiate the vendor's offering from competitors' offerings.

Under product strategy, we evaluate a vendor's potential for delivering continuous product innovation, advancing the state of the art in event correlation and automated root-cause analysis, and its flexibility to adapt to changing requirements, such as the need to provide management of virtualized environments (for example, servers, storage and databases) and understand the transitory nature of virtual vs. physical.

ECA products do not stand alone in an enterprise management deployment. Vendors with a strong product strategy vision demonstrate an understanding of and a road map for integration with other management applications and associated areas, such as the problem management process (including Information Technology Infrastructure Library [ITIL] methodology and integration with the IT service desk tool), security information and event management (SIEM), business service management (BSM) and configuration management databases (CMDBs), defined in this context as containing IT service relationship and dependency mapping information. Higher vision rankings are accorded to vendors that understand the alignment needed between IT component events and business-oriented, end-to-end IT services. High rankings are also awarded to vendors that have a credible strategy to achieve that alignment. In the future, the ability to discover and document relationships between IT components and business services, as well as to keep the service dependency mapping updated in real time, will be necessary to automate the business impact analysis of events.

Whether the service dependency mapping is documented in a BSM tool, a CMDB or some other implementation entirely, Gartner believes that it will not be possible to have an effective ECA without processing events against an up-to-date IT service dependency model to determine business impact and assign support priority.

BSM, CMDB and the discovery of IT service dependency mapping are (generally) separate from the ECA product and, therefore, would not be part of this Magic Quadrant's ability-to-execute evaluation of a vendor's current product. However, in the completeness-of-vision category, we are evaluating each vendor's product strategy to leverage IT service dependency mapping details to help improve event correlation and impact analysis.

Vendors positioned in the Leaders quadrant possess a large and satisfied installed base and have a high degree of visibility within the market (for example, frequent consideration and success in competitive situations). They offer highly scalable, robust applications, and they have the strategic vision to address evolving enterprise requirements in the areas of mapping and prioritizing events to business impact and optimizing the event-to-incident/problem resolution processes, including integration with service desk tools.

Vendors in the Challengers quadrant are solid and can perform well for many enterprises. They are significant vendors in terms of size and financial resources, but they may be lacking in vision, deployability, ongoing innovation or an overall understanding of market trends.

Vendors in the Visionaries quadrant are forward-thinking and often technically focused. They have recognized and responded to longer-term event management market trends, such as root-cause analysis and BSM, but they may lack the recognition, sales and marketing strength, or overall size to compete and execute with consistency.

Niche Players are a combination of new entrants to the event management market, vendors with limited vision or execution, and vendors that focus on a small segment of the market and do it well. The narrow focus reduces their vision ranking and limits their addressable market, making them unable to achieve a high ability-to-execute ranking. However, the narrow focus enables them to achieve great depth of functionality in their chosen areas.

• Provides a straightforward product addressing the needs of IT operations groups that do not have the time, budget or need for larger, more-complex ECA products.
• Provides a product that can monitor a range of IT elements, with new support for virtual servers.
• Rapid and easy to deploy.

• Limited product depth means that Argent is used for its broad coverage across a variety of infrastructure elements, with other tools on this Magic Quadrant used for deep analysis of critical devices.
• Argent's marketing emphasis is on providing an easier-to-use, heterogeneous alternative to Microsoft System Center Operations Manager; however, Argent will find it increasingly difficult to differentiate itself as Microsoft expands its market coverage through partnerships and OEM relationships.
• Argent does not receive a strong completeness-of-vision rating because it has not expressed any road map that aligns with Gartner's scenario for where the ECA market is headed, including advancing the state of the art in event correlation, automated root-cause analysis and aligning IT component events to business impact on end-to-end IT services.

• Strong reporting to analyze event rates and mean time between failures, which can help improve the event management process.
• ASG's Rochade-based MetaCMDB technology and BSM vision will support the allocation of correct event severities based on business impact.
• Interesting threshold functionality that enables the ASG-Sentry administrator to use scripts that compute several metrics and can automatically determine the desired percentage threshold, although this did not receive as high a ranking as other vendors that have innovated with auto-baselining and anomaly detection.

• ASG's Sentry product has a Simple Network Management Protocol (SNMP) network focus and is not commonly used when a "manager of managers" with wide breadth of coverage is required.
• Limited, out-of-the-box event correlation capabilities and no topology-based correlation, although it's on the planned road map for a future release.
• ASG is not regularly mentioned by Gartner clients as being on their shortlist for ECA investments.

• BMC continues to demonstrate strong market understanding and the ability to craft and communicate a cohesive marketing message that captures current market needs.
• BMC achieved high marks for completeness of vision because of its end-to-end IT service management vision and its credibility to integrate its ECA product — BMC Event Manager (BEM) — with its Remedy service desk, Atrium CMDB and Service Impact Manager (SIM) BSM products.
• Previously mired in migration from the old Patrol Enterprise Manager ECA product to the new BEM product, BMC has come through that portfolio rationalization and has moved most of its installed base to the new platform.
• BMC has differentiated itself and established thought leadership for ECA auto-baselining, threshold analysis and anomaly detection with its acquisition of ProactiveNet. Although ProactiveNet is an add-on product and is not currently included in ECA products, it can nonetheless improve event management by automatically determining bands of normalcy and adjusting alert thresholds accordingly, thus reducing the number of events — specifically, false positives — that are sent to a central console.

• Execution lags marketing, resulting, for example, in products that are not yet ready to meet their claimed values, or claiming results without setting the appropriate expectations around the required effort or required IT maturity.
• Network management is only offered through a reseller agreement with Entuity, resulting in the inability to draw any profound information from the network infrastructure, which limits the capabilities of BMC's ECA toolset.
• Limited consulting and professional services.

• Strong scalability rating and breadth of coverage, including mainframe.
• CA has established a focus on ITIL and on improving IT management process maturity, delivering what it calls Integrated IT Flows, which consist of automated IT process workflows (such as event to resolution), strengthening CA's problem management process vision rating.
• Unicenter NSM r11 features an innovative capability to dynamically adjust thresholds based on observed "normal" behavior patterns for time of day, day of the week, week of the month and month of the year.

• The 2006 ECA Magic Quadrant ranking was based on CA submitting a consolidated ECA product, formed from Unicenter NSM and the acquired Concord eHealth and Aprisma Spectrum products. CA's vision rating has declined since the 2006 ECA Magic Quadrant because it has not integrated its multiple technologies into a single ECA offering, and this year's evaluation was based on Unicenter NSM alone.
• The functional overlap between CA Unicenter NSM r11 and CA's network-focused Spectrum product continues to create confusion in market positioning, customer awareness and CA's strategic direction for ECA; therefore, moving forward, it is important for CA to clearly articulate its ECA strategy for its vision rating to improve.
• CA engineering faces steep technical challenges in converging the functionality and architectures of its multiple, acquired event management capabilities.
• CA's historical reputation sometimes excludes it from getting on shortlists.

• Cittio's WatchTower has a more-than-adequate range of ECA functionality for the SMB marketplace and some larger organizations.
• Good reporting capabilities with flexible multitenant views and role-based access to information.
• Implementation is straightforward, with support for a wide range of IT and non-IT devices, with packages of pre-defined policies and default thresholds.

• WatchTower's scalability remains largely untested, and no particular architectural provisions have been put in place to support large event volumes or a highly distributed infrastructure. Organizations should validate that WatchTower will support their future growth.
• Cittio has almost no visibility in Europe and the Asia/Pacific region. It must move rapidly in these regions because many SMB-focused competitors have initiated European or even global sales/marketing campaigns. Increasingly, the lack of a global or, at least, a transatlantic presence is being seen as a liability by high-end SMBs.

• The EMC Smarts' "codebook correlation" approach enables IT operations to discover topology relationships and to automate event correlation and root-cause analysis without expending a significant amount of customization effort.
• Deep network domain knowledge, including continuing development in new network technologies (such as voice over IP and Multiprotocol Label Switching).
• Microsoft is licensing EMC Smarts' network management technology, which corroborates Smarts' ability to model and manage the behaviors among IT components.

• OEM relationships with Cisco and Microsoft add to vendor viability, but effectively relegate Smarts to a supporting network management role, rather than being the "manager of managers."
• Before EMC can fully leverage its extensive storage sales channels and installed base to sell a sophisticated ECA software product, continued sales training is required to learn about a new buyer and gain access to a different part of the IT organization.
• EMC Smarts has put marketing emphasis on extending the value of its products to provide more business-oriented results — for example, EMC Smarts Business Impact Manager, EMC Smarts Business Dashboard and EMC Smarts Application Discovery Manager (acquired from nLayers). However, because of certain limitations (such as lack of agents to understand details on the application state), it remains predominantly a network management product.

• HP's Operations Center product has the second-largest installed base behind Microsoft, and consistently appears on enterprises' shortlists, demonstrating credibility and market awareness.
• The out-of-the-box domain knowledge that HP has built into its agents to filter and correlate local events based on pre-defined policies and default thresholds, along with the templates for automated corrective actions, has yielded high levels of customer satisfaction and deployment success.
• HP gets good marks for a BSM vision that maps events to business impact through its Service Navigator functionality, which is included with its Operations Center ECA product, and then up to the Mercury-based Business Availability Center, leveraging dependency mapping automation, which is the link from the Mercury-based uCMDB to Service Navigator.

• HP's acquisitions of Peregrine, Mercury and Opsware have resulted in more focus on architecture and integration, rather than new product features and innovation in traditional management disciplines (such as event correlation and analysis).
• HP has dropped the OpenView brand name, which was a strong, well-known brand, although often associated with network management rather than the general-purpose ECA being evaluated in this Magic Quadrant.
• HP's list pricing for a Gartner-provided sample configuration was the most expensive of all the quotes, although HP states that customers would receive significant volume discounts off list price.

• IBM Tivoli Netcool (acquired from Micromuse) is widely used as a "manager of managers" because of its strong scalability and its ability to integrate and consolidate data from a broad range of IT components and third-party management products.
• IBM Tivoli has reversed the slide away from its aging ECA product, the Tivoli Enterprise Console (TEC), with its acquisition of Micromuse and the introduction of the Tivoli Enterprise Portal (TEP), based on acquired Candle technology, which provides a new common user interface (visualization) and simplified event correlation that can satisfy the bulk of ECA requirements for less-complex enterprise environments.
• IBM Tivoli gets credit for grappling with the complexities of event correlation and developing a credible plan to address the full breadth of the problem with a three-tier approach:
  • Push ECA down to the agents with IBM Tivoli Monitor.
  • Perform cross-system event integration and simpler correlations with TEP.
  • Reserve Netcool for complex, rule-based correlation and automation.

• IBM Tivoli's changing ECA strategy, due to multiple acquisitions, has left buyers confused and unclear about IBM's long-term vision.
• IBM Tivoli spent two years focused on portfolio rationalization, product consolidation and integration, rather than on delivering new features and functionality.
• ECA integration with a CMDB to assess relationships between resources and evaluate the business impact of events changed because IBM Tivoli added to its CMDB's functionality with tools gained from the recent acquisition of MRO.
• Going forward, IBM Tivoli will need to address new ECA evaluation criteria (such as the need to provide ECA for virtualized environments and to introduce dynamic thresholding) or risk losing ground to companies that are able to innovate and meet market demands faster.

• Interlink Software has demonstrated only minimal execution as a stand-alone ECA product, but it has a surprisingly comprehensive vision considering the small company size and R&D investment.
• Interlink's Business Enterprise Server (BES) product demonstrates a solid understanding of the alignment needed between IT component events and their business impact on IT services, and is often used for BSM.
• As with a few other companies on this Magic Quadrant, Interlink is working with Netuitive for real-time anomaly detection to relieve IT operations managers of the burden of manually reconfiguring default warning and alarm thresholds for thousands of parameters in potentially hundreds of thousands of managed objects.

• Must continue to aggressively build its sales and marketing organization, the lack of which significantly limits its ability to execute on its vision.
• Interlink's challenge, as a small company, remains its ability to continue to invest in the development of its product, innovate and differentiate itself against much larger competitors with significantly greater resources.
• Interlink has traditionally invested in technical resources over sales and marketing, which has seriously limited its market visibility.

• Microsoft System Center Operations Manager has the largest ECA installed base.
• Companies that have a large, growing investment in Microsoft Windows servers are actively investigating using Microsoft System Center Operations Manager as a "manager of managers." Conversely, in companies with a heterogeneous IT environment, System Center Operations Manager is used by Windows systems administrators and is typically deployed as a subordinate in a hierarchical event management architecture, passing Windows events up to a broader, general-purpose, multivendor event console.
• Microsoft's plans for System Center Operations Manager include extending the functionality to network management through the partnership with EMC Smarts and to manage a broader range of non-Windows IT elements.
• Microsoft's vision includes a plan to correlate IT infrastructure component events with logical service dependency models by leveraging its System Definition Model, which is intriguing because it enables designers and developers to document configuration relationship and dependency information in models earlier in the application life cycle.

• Microsoft has chosen to focus its event management efforts on its own operating system and applications (such as Exchange, SQL Server, Active Directory and IIS), so its vision continues to be focused on the Windows environment only.
• Support for non-Microsoft IT elements is available only through low-profile Microsoft partners that are generally unfamiliar to enterprise buyers, although Microsoft plans to address this limitation through its acquisition of Engyro.
• Some customers commented that when they deployed System Center Operations Manager, they spent a lot of time tuning the monitoring to reduce the amount of data being monitored.

• Some innovative ECA functions are included in NetIQ AppManager, such as using conditional logic at the agent level to perform multiple checks, validate errors and reduce the number of events that are generated for a single problem.
• NetIQ has shown some interesting innovation and market understanding with its AppManager Performance Profiler (AMPP) product (licensed from Netuitive) to observe server and application performance baselines by time of day and day of week, and automatically detect anomalous performance. Although AMPP is a separate add-on product not included in the core ECA product evaluated for this Magic Quadrant, it can nonetheless improve event management by helping to achieve proactive problem management and management by exception, as well as head off incidents before they occur.
• Since NetIQ's acquisition by Attachmate and the resulting increase in investment, NetIQ clients have reported seeing improved product reliability and customer support.
• NetIQ has brought to market its runbook automation (RBA) product, NetIQ Aegis, which is fully integrated with AppManager, enabling users to extend its value to automate fault management processes.

• NetIQ is not specifically focused on ECA from a manager-of-managers perspective. ECA is invested in only as a foundation function to support the core competencies of application and operating system management.
• NetIQ continues to struggle with differentiating its core ECA product, with many of its innovative developments being peripheral to ECA and not evaluated as part of this Magic Quadrant, such as the correlation technology that is part of NetIQ’s RBA product, Aegis.
• NetIQ gets credit for a strong strategy and vision relative to security event integration, but it is a follower rather than a visionary for many of the other ECA product strategy areas we evaluated.
• Customer references report that NetIQ AppManager agent deployment, updates and patch ma