Magic Quadrant For IT Event Correlation And Analysis

Magic Quadrant for IT Event Correlation and Analysis

13 December 2010

David Williams, Debra Curtis

Gartner RAS Core Research Note G00208774

This Magic Quadrant addresses mature and emerging products that help IT organizations consolidate, analyze and respond to component-level IT infrastructure events, improve event-to-incident/problem resolution processes, and improve alignment between events and business-oriented IT services.

What You Need to Know

Gartner's Magic Quadrant for IT Event Correlation and Analysis evaluates vendors' Ability to Execute and their Completeness of Vision relative to a defined set of evaluation criteria regarding current and future market requirements. A Magic Quadrant should not be the only criterion for selecting a vendor, because the right solution for a given situation can be in any quadrant, depending on an enterprise's specific needs. Enterprises considering the purchase of an event correlation and analysis (ECA) product should develop their own list of evaluation criteria and functional requirements in the categories of event collection/consolidation, processing/correlation and presentation.

Large enterprises should consider a multitier event management hierarchy, pushing some event processing and correlation out to the managed IT element at the bottom of the hierarchy. These enterprises should use specialized event management tools in the middle, and should place a manager of managers (MoM) or a business service management (BSM) product on top.

When investing in event management, prospects should understand how the product will fit with their overall event-to-incident/problem resolution processes, including workflow, escalation and integration with service desk tools.

Return to Top

Magic Quadrant

Figure 1. Magic Quadrant for IT Event Correlation and Analysis

Source: Gartner (December 2010)

Return to Top

Market Overview

ECA products help IT operations personnel contend with the deluge of events that comes in from the IT infrastructure by eliminating duplicate event signals, filtering events according to operational or business priorities, and analyzing events to determine their root causes. The goals are to improve the mean time to isolate and repair problems, and to prioritize IT support efforts according to business process value.

The core value proposition of these products is to achieve management by exception. This requires an understanding of "normal" behavior in the IT infrastructure and alerting the IT operations staff only when an exception occurs, such as a failure or a threshold breach, indicating that the IT infrastructure is no longer behaving "normally." With the 2010 Magic Quadrant, the desire to associate events with potential business impact has transitioned from a "wish list" item to something that's required for current product execution, although not all ECA vendors offer this functionality.

IT organizations invest in ECA tools to improve the productivity of the IT operations staff by reducing the time it takes to troubleshoot problems by consolidating events from various devices, applications and other management tools. Without proper event management, the IT operations group can be deluged with event storms, false positives, a "sea of red" on their console and an inability to reduce the impact an IT event has on the business.

How to Use This Magic Quadrant to Assist in Vendor Selection

The vendor positions on this Magic Quadrant are based on the evaluation of information gained through vendor interviews, ongoing client inquiries, reference checks and Gartner's knowledge of requirements in the market. Although the Magic Quadrant provides a picture of a vendor's Ability to Execute, as well as its Completeness of Vision, these factors should not be the only criteria for making a selection. Enterprises often use Magic Quadrants to formulate their shortlists and look only at vendors in the Leaders quadrant. Few enterprises will be successful finding the best vendor with this method.

Enterprises should determine their functional and support requirements and prioritizations, and they should use these to drive their selections. These requirements will be specific to individual enterprises and will be key for vendor evaluation and eventual selection. For example, a vendor in the Niche Players quadrant could be ideally suited to an enterprise's needs, because it may cost less and provide support for a narrower set of needs. Similarly, the vendors in the Leaders quadrant may have executed well and outpaced the market in vision, but this does not necessarily mean that they have the functionality needed to meet an enterprise's specific requirements.

Enterprises should understand that some solutions are better-suited for large businesses (those with more upfront complexity and reliance on problem management process maturity), and others are better-suited for small or midsize businesses (SMBs), because of their easier installation and lower cost, but, typically, fewer capabilities for complex event correlation. The Magic Quadrant is not designed as a substitute for client inquiry — Gartner inquiry is the best way for enterprises to resolve specific questions about event management vendors.

Return to Top

Market Definition/Description

ECA Products:

• Support the collection of events from elements in the IT infrastructure, including hardware, software, server, virtual machine (VM), operating system, network, storage, security, database, application and mainframe elements

• Process events using consolidation, filtering, normalization, enrichment, correlation, and statistical or model-based analysis techniques

• Notify the appropriate IT operations personnel of critical events

• Suggest remedial steps and, where possible, initiate corrective actions

Definition of Events

Two types of event categories need to be accepted and supported by ECA products:

• Discrete state changes in a managed element, sent asynchronously from the managed element, agents installed on the managed element, or another IT event-monitoring or ECA product.

• Threshold breaches indicating that a managed element is no longer operating within "normal" parameters, sent asynchronously from the managed element, an agent installed on the managed element or a separate performance-monitoring product. "Normal"

...