Every five minutes, vRealize Operations collects and stores the metric and property data about every resource it manages. The data is kept for six months at full granularity and is used by the Analytics engine to allow the system to understand normal behavior.

Every night, a set of analytics algorithms are run against every metric's historical dataset, to determine the expected behavior of each metric for the upcoming 24 hours. This expected behavior for a metric is called a Dynamic Threshold (DT). As metrics are collected and stored, they are compared against the DT to determine whether the object is exhibiting normal behavior. This is described in more detail in Figure 1.1.

The analytics are designed to look for different patterns of behavior, such as hourly, daily, weekly, monthly, and quarterly.

It will obviously take some time for vRealize Operations to learn all the expected behavior, as it needs to observe at least three data points to start seeing a trend, and many more to predict the trend with greater confidence. For example, a metric exhibiting a weekly cadence of behavior requires at least three weeks of data for a weekly trend to be detected.

Figure 1.1

The preceding simplified example shows how a DT and metric may be measured and tracked. The grey shading is the DT, and the diagram shows that during the early morning it is expecting this metric's value to be 0-10%, then 50-60% during the work day, and then back down to 0-10% for the evening. There is a short peak just before midnight, which is possibly a batch or a backup job. The black line is the observed metric and we can see that normal behavior has occurred; so in this case, there is no alerting to be done as the metric is operating normally.

If an observed metric deviates outside of the DT range, it is classed as an Anomaly and highlighted in yellow in the Metric Selectors and the associated Metric Graphs in the vRealize Operations dashboards.

The number of anomalies observed over time is also recorded for every object, and vRealize Operations uses these derived metrics to determine whether the number of anomalies being observed is significant and if it is required that an alert is generated.

Performance or availability problems are generally caused by something different happening with the resources within an environment, and this "something different" causes associated metrics to breach their DTs. This means that the majority of alerts that are performance or metric related will only be generated when abnormal behavior occurs. This dramatically reduces the number of alerts that IT operations receive and increases the quality of those alerts.

The content baked into vRealize Operations is how the solution creates the intelligent and meaningful alerts. There is a lot of content provided by the solution and much more content will be added with the installation of Management Packs. Custom content can also be created very easily and will be described in Chapter 5, Alerts, Symptoms, Recommendations, and Actions.

An example of one of the out of the box content alerts and how it is constructed is as follows:

Alerting based on metrics, which are outside the range of the calculated DTs, can be considered fairly generic and caused by "things happening differently". They tend to be used to troubleshoot and alert on unexpected behavior.

As well as triggering alerts based on unexpected behavior, much of the content in vRealize Operations Manager is based on specific behavior and documented best practices. For instance, storage latency would generally be considered performance impacting by a storage administrator, when it reaches 20-30ms.

Content within vRealize Operations Manager can also include Hard Thresholds (HTs), such as a figure of 20-30ms for storage latency, which can trigger alerts regardless of the state of the DT for the given metrics.

Content and alerts will be covered in much more depth in Chapter 5, Alerts, Symptoms, Recommendations, and Actions.

Every object or resource in vRealize Operations can have a capacity model configured against it. This describes the metric(s) used to determine the capacity and the other factors, or constraints to be considered, such as vSphere HA. The models themselves are not configurable, however, how they are applied generally is configurable, and is managed within the policies section of vRealize Operations.

The policies governing the capacity management in vRealize Operations are very granular and controllable. This allows the administrator to define what combination of demand or allocation capacity policies are applied against specific resources or groups of resources. This will be covered in detail in Chapter 6, Capacity Planning and Capacity Projects.

As well as understanding the current capacity and the time remaining, many organizations will have ongoing projects that are going to add planned workload or additional hardware to their infrastructure. A new feature, Capacity Projects, introduced in vRealize Operations 6.0, allows the administrator to define these forecasted changes in the workload or resources, and assign a date against them.

The effect on capacity and the time remaining can then be visualized and any capacity shortfalls identified. The projects can be subsequently committed and they will then be reflected in the real-time capacity reporting.

For example, if an infrastructure has the capacity for a further 50 average sized VMs, but a project is planned to implement 20 average sized VMs, the capacity dashboards, badges, and reports will all change to reflect that there is now only capacity for 30 average sized VMs.

This edition is designed for vSphere environments only, and provides the core vRealize Operations Manager platform to deliver the predictive analytics capabilities and associated smart alerts. The alerting framework of symptoms, recommendations, and actions is introduced, as is policy management, so that different SLAs and alerting can be applied to different parts of your environment.

Capacity management of the vSphere environment is also included in the Standard Edition. Within the capacity management framework, capacity projects can be defined to enable you to understand the impact of future workloads changes.

Finally, the first step in configuration management is included, with the ability to assess the compliance of the vSphere hosts and the VM containers against the vSphere Hardening Guidelines.

As well as offering more features as described next, the Advanced Edition provides the additional components, vRealize Configuration Manager, vRealize Hyperic/End Point Operations, and vRealize Infrastructure Navigator.

The key enhancements to vRealize Operations Manager Advanced Edition, over the Standard Edition, is the ability to add infrastructure Management Packs, as well as allowing you to create customized dashboards and reports.

The vRealize Operations Management Pack for Storage Devices is included with the Advanced Edition. This edition also supports third party management packs, including those from Hitachi, EMC, Dell, HP, and Blue Medora (for NetApp).

This ability, to manage performance, health, and capacity of storage in the same place and alongside vSphere Management, is very compelling for the IT administrators I have worked with.

Customized dashboards and reporting mean that you can effectively visualize, report on, and export all the information within vRealize Operations in almost any way and in any context. We will cover this in detail in Chapter 3, Dashboards, Badges, and Widgets and Chapter 4, Views and Reports.

The capability to install additional nodes to provide a High Availability (HA) cluster is enabled with the Advanced Edition.

The capacity projects feature is enhanced with the ability to commit capacity projects. This means that all capacity reporting has the committed projects included in the calculation when they report on available capacity and time remaining.

From a configuration management perspective, the vSphere Hardening Guidelines capabilities introduced in the Standard Edition are enhanced, to allow the reporting of the configuration posture with an additional sub-badge, Compliance, under the Risk badge.

vRealize Infrastructure Navigator is added, which provides application discovery and visualization of dependencies between the VMs within your infrastructure. Metadata about applications running on the VMs and the groupings of the VMs as applications within vRealize Infrastructure Navigator, is exposed in vRealize Operations Manager. This can be used to automate dynamic groupings, or as the basis for the construction of alerts and symptoms. We will look at vRealize Infrastructure Navigator in Chapter 8, vRealize Infrastructure Navigator.

vRealizeHyperic/End Point Operations is also added. This additional solution allows for the collection of the OS metric and property data by vRealize Operations Manager. It also offers the capability to monitor the OS, allowing you through an agent to, for example, monitor specific Windows services and act accordingly if they become unavailable or start to consume too much resource. We will cover the transition of Hyperic to End Point Operations and look at the solution in detail in Chapter 10, End Point Operations.

Finally, vRealize Configuration Manager for vSphere is included, which allows a rich capability to manage the vSphere hosts and the VM containers configuration, including templates to assess against configuration and regulatory compliance requirements, such as PCI-DSS, HIPAA and SOX.

The Enterprise Edition extends the management capabilities into the guest OS and into application management.

It extends the licensing in vRealize Configuration Manager to manage the VM guests (OS and Application) and extends vRealizeHyperic/End Point Operations to manage applications such as SQL and Exchange, and bring their metrics and properties into vRealize Operations Manager.

Additional management packs with an application focus are also made available with this edition.

There are currently six different ways to license vRealize Operations:

Licenses for vRealize Operations can be mixed in some circumstances.

Per-CPU and per OSI can be mixed, as long as every resource being managed has a valid license associated with it.

vRealize Operations Advanced and Enterprise editions can be mixed on a single vRealize Operations Manager cluster. This is to allow you to use vRealize Operations Advanced to manage your entire estate and have a subset, perhaps your business critical applications, managed with the additional functionality provided by vRealize Operations Enterprise.

The latest information on product licensing is available in the VMware Product Guide at http://www.vmware.com/files/pdf/vmware-product-guide.pdf.