Logcasters Flexible Windows Watching

By Andrew Garcia  |  Posted 2001-04-23

Logcasters Flexible Windows Watching

Heeding the cry for rock-solid availability of crucial corporate applications and services, Ripple Technologies Inc.s LogCaster 3.1 provides excellent centralized monitoring and alerting capabilities for Windows NT and Windows 2000 servers as well as TCP/IP hosts. NT-based networks of any size will benefit from LogCasters automation and alerting capabilities on their servers, but Ripples inflated NT workstation licensing fees make LogCaster 3.1 tougher to swallow for widespread deployment.

Not intended as a replacement for such network management solutions as Hewlett-Packard Co.s OpenView or Tivoli Systems Inc.s Tivoli, LogCaster 3.1, instead, provides granular details on Windows 2000 and NT hosts. Using client agents that report to an EDS (Event Dispatcher Server), LogCaster provides a centralized view of performance counters, event logs and service status markers across the network. However, unlike NetIQ Corp.s similar Operations Manager, LogCaster does not detect exceptions to security rules.

This version of LogCaster implements an InterBase SQL database from Borland Software Corp.; previous versions used Borlands FoxPro. LogCaster 3.1 also provides enhanced filtering, scheduling and reporting capabilities, plus a number of useful templates and plug-ins for common NT-based applications as well as Citrix Systems Inc.s MetaFrame and CheckPoint Software Technologies Ltd.s Firewall-1.

LogCaster 3.1, released last month, can be downloaded for a free 30-day trial. Permanent licenses cost $795 per server and $95 per workstation, although were not sure why someone would pay $95 to monitor a workstation with coverage more appropriate for servers. The optional yearly support contract ($195 per server, $25 per workstation) includes upgrades as well as e-mail and phone support. Round-the-clock support is not available.

Snap to It

Installation of LogCaster 3.1s management Console and EDS was surprisingly easy, as the database is integrated into the installation package. LogCaster now also supports the use of other OBDC (Open Database Connectivity)-compliant databases, but Ripple recommends that their support personnel prepare this installation.

From the Management Console, its a snap to push the agents to the clients, but the console must be restarted to begin monitoring the new additions. If multiple administrators are accessing the console, the system will kick everyone out to recognize the new clients, so such installations must be coordinated.

Agents install as two services that use up to 10MB of RAM when active. Ripple recommends at least 64MB of RAM for all clients. To protect the agents communications with the EDS, all transmissions are encrypted using the Blowfish encryption algorithm.

The console divvies up its administrative tasks into four main applications: Live Events Watcher, Live Service Watcher, Live Performance Watcher and Live TCP/IP Watcher. The first three allow administrators to customize reports, alerts and actions according to predefined rules and thresholds.

With user-defined filters, Live Events Watcher combs event logs and reports (or drops) any events that match a top-down set of rules.

Live Service Watcher monitors the service status of all systems and alerts the administrator of state changes. LogCaster can be configured to automatically restart the service, reboot the host or run a batch file as a response.

With Live Performance Watcher, an administrator can access and compare multiple systems using any of the performance counters available in Windows Performance Monitor. We created a rule to monitor CPU utilization levels of all our systems and to e-mail a notification if any processor achieved 80 percent utilization.

Live TCP/IP Watcher imparts the ability to monitor any IP-based host on a network. The tool provides a rudimentary ping test as well as heartbeat monitors for several common network ports; it can be used on an unlimited number of unlicensed hosts.

Regrettably, LogCaster still lacks a Web-based console for remote administration. Although this feature has been promised for over a year, remote administration remains a hassle with Version 3.1, as the console application must be installed on a Windows 2000 or NT client.

LogCaster 3


LogCaster 3.1


Ripples LogCaster update provides flexible monitoring and alerting system for sites running Windows 2000 or NT, and it offers basic monitoring support for any TCP/IP-based server. LogCasters alerting skills, plus its ability to respond to its findings, guarantee increased server availability and uptime, but Ripples upfront workstation licensing costs makes widespread system development a tougher sell.

SHORT-TERM BUSINESS IMPACT // Easy setup ensures immediate relief in monitoring mission-critical applications and services, decreasing server downtime.

LONG-TERM BUSINESS IMPACT // LogCaster scales well as the number of monitored servers increases. Its ability to restart services or run applications and batch files as responses to user-defined conditions will free administrators from attending manually to every problem.

Can monitor any TCP/IP device; integrates well with Syslogs; ODBC- and Unicode-compliant.

Lacks a Web-based remote console; workstation licensing fee is too high; no 24-by-7 support.

Ripple Technologies Inc., Washington Crossing, Pa.; (215)321-9600; www.rippletech.com

Rocket Fuel