Server Apps Go on Record

Mutek Solutions Ltd.s AppSight 3.5 changes the investigation of server applications from a guessing game to a forensic study—almost.

eWeek Labs used AppSight 3.5 to collect vast amounts of step-by-step application activity leading up to an application error, but it usually took quite a bit of sleuthing on our part to get to the root of the problem. However, application problems—for example, in one of our tests, a crucial file was located in the wrong directory—almost always require a lot of rooting around, and AppSight will likely be a useful aid.

AppSight 3.5, released last month, is available only for Windows NT and Windows 2000 systems. The product costs $2,500 for the central management server and $100 per managed node. Various consoles for use by developers and help desk staff are also available. Component prices vary widely, depending on configuration and number purchased.

Application management products, such as NetIQ Corp.s AppManager, monitor application performance areas such as response time and memory usage. In contrast, AppSight and competitors, such as OC Systems Inc.s RootCause, record all the actions of an application, including file writes and opens. During our tests, we were able to watch—literally—the step-by-step progress of applications, including Microsoft Corp.s SQL Server 7.0.

AppSight also records the actual appearance of the target systems screen, providing a visual replay of what has happened on the system. This could be especially useful for help desk staff, who could see, for example, user responses to dialog boxes.

Select Few

This detailed analysis could be a drag on performance, so, with the help of Mutek support staff, we tuned the product to monitor only suspect processes. For example, we set up a filter to track registry and file activities on a system running Microsoft Exchange 2000.

Company officials said Mutek-assisted initial installation and training are routine for first-time users and cost $2,000 per day plus expenses.

AppSight works better when operators are methodical about tracking down problems. We heeded the advice of Mutek staffers and kept our focus on the messages screen.

During our tests, it was simple to install AppSight on various Windows NT and Windows 2000 systems and to access “crash data” from those systems using the central Black Box Management console.

AppSight can record the actions of at least 10 aspects of a program, including starting application of threads and directories, loading specific files, and creating objects.

AppSight has a sophisticated trigger system that allows it to capture information only when a problem occurs. In our tests, for example, the trigger was set off when a process ended. We then used the central management server to retrieve the data for analysis. AppSight uses a cyclical buffer to house recently recorded information.

When applications fail, AppSight highlights the failures in red. However, even under normal conditions applications make requests that go unfulfilled.

We often encountered a jumble of “false positive” indications in the AppSight console, and it took us several days to gain the ability to quickly sort through the dross for the kind of useful clues that would lead us to effective problem identification.

Mutek officials said they are pursuing integration deals with help desk and system management vendors. We hope these relationships come to pass so the valuable data collected by Muteks AppSight can be put to better use.

AppSight 3

.5″>

AppSight 3.5

Mutek Solutions AppSight 3.5 records application actions and stores information when AppSight senses a problem, such as a system crash. IT managers will likely be able to use the system to quickly diagnose and sometimes prevent problems but at a hefty cost (especially in maintaining the product).

SHORT-TERM BUSINESS IMPACT // AppSight requires substantial setup and training investment to ensure that the product doesnt unnecessarily impede server performance and to learn how to sort out relevant clues to system problems.

LONG-TERM BUSINESS IMPACT // Intimate knowledge of application and operating system behavior should provide IT managers with the ability to keep systems running with fewer interruptions.

Provides detailed, blow-by-blow application and operating system tracking; sophisticated triggers ensure that relevant data is collected.

Captures many “false positives”; requires extensive training to use collected data to find problems; little integration with help desk or management tools.

Mutek Solutions Ltd., Westwood, Mass.; (781) 407-5863; www.mutek.com