IBM SevOne Network Performance Management (NPM) Reviews

We primarily use SevOne for performance management. We're managing an internal corporate network for a large Canadian telco. This includes the data centers, the branch offices, media locations, retail stores, and all of those kinds of connections. We use it obviously to monitor performance, and we also use it to do some performance alarming, and things like that.

We use it extensively to help us communicate with other teams, and with executives so that we can present valuable network data in a pleasing way. It's also accurate, easy to read, and easy to digest for non-network teams, executives, and others.

It was very successful during the pandemic because there was a lot of focus on things like capacity, work from home, and VPN capabilities. It really allowed us to highlight those metrics very easily, and communicate that up to the executives on a daily basis in the early days of the pandemic. It helped to bring that sense of wellbeing that we were not in any danger in terms of system capacity, or things like that. When everybody was sent to work from home, a lot of companies tipped over because they weren't prepared for it, but we didn't have that problem.

SevOne was initially installed on a VM on my network, and then another network within the organization implemented it a couple of years later. As the value was identified and other parts of the organization began consuming it, other networks began implementing it.

We don't use much of the flow data but other than that, the data it collects is very comprehensive. It's as comprehensive as you want it to be. You can glance over the surface, or you can dig really deep. It all depends on how you configure it out of the box, including what you want to look at and what you want to measure.

Having this depth is really important if you want to get ahead of the problems and head them off before they become customer-impacting. One of the things that happened in our organization was when the pandemic hit, a lot of our customers also went to work from home. Consequently, it drove a lot of traffic volume onto our customer-facing networks. Having SevOne in place prior to that identified a lot of critical choke points that weren't necessarily identified by other traditional monitoring techniques. Other vendors weren't picking them up.

I am not responsible for the customer-facing networks but I know that when we installed SevOne and got it working on some of them, it identified a lot of choke points, and it led us to fix a lot of capacity issues before the pandemic hit. This allowed us to continue to do business in a big BAU fashion as opposed to reacting to a crisis. We were ready for it because, in part, SevOne helped us to find those problems before they became critical. When people went home to work, and all that traffic volume hit our network, we had already rectified the problems.

SevOne's collection abilities cover multiple vendor's equipment, which absolutely is important to us. On my network specifically, we have a vast number of different platforms, more so than most. That's probably reflective of our corporate network, so things become somewhat less standard over time. As a result, SevOne's ability to work with just about any vendor's equipment was definitely valuable for us. The other networks in the organization are a bit more uniform but ours had a lot of different platforms, different kinds of load balancers, different kinds of switches, and there are many different kinds of firewalls. There is no question that this flexibility and compatibility were important.

SevOne can certainly bring together its analytics, reports, and workflows in a single dashboard. For example, the Data Insight overlay is great, and it comes with a lot of built-in dashboards and reports that have that analysis already included. You can take something like that and you can edit it to repurpose it to your needs, or you can use it as an app to build something for yourself. It also drills down really nicely. You start at a general level and then you can drill down to the specifics. You can start with a group, you can drill down to a device, you can get down to an interface, and so on. It's a good tool in that sense because you can look at it with as much detail as you like.

It's pretty easy to use. It's intuitive and menu-driven. It's got the familiar menu across the top as well, that you can tab through. If you know how to use a mouse and a keyboard, you're not going to be lost. But again, with a bit of training and a bit of insight from the developers of the platform, it can really unleash a lot of new ideas and new abilities, but right out of the box, it's pretty easy to use and pretty easy to figure out.

Using SevOne has enabled us to detect network performance issues faster, and before they impact end-users. You can just look at the capacity, and the ability to identify those interfaces that are being over-utilized, over time. Whether you're looking at the last weekend or the last week, or the last month, finding over-utilized links is important. It allows you to either offload that traffic somewhere else or augment that capacity. Importantly, SevOne allows you to get ahead of that. You can anticipate reaching a capacity issue in advance of it impacting your customers.

Another thing to consider is that we have a very large WAN. Canada is a big country, so my network end-to-end is from coast to coast. With such a large network, having real-time information on those links and how they're being utilized, or whether they are up or down, allows us to find and address issues before they become serious problems. You know, if you have two links and one's a primary and one's a backup, and your backup goes down, SevOne helps you understand that there is a gap and that you can get that addressed before the primary fails and you find yourself in an outage situation.

These are the ways that we use it on a daily basis. I am in operations but I know that in our engineering teams, they do the capacity planning and the network planning, so they use it too. You can easily set up a threshold, as well, to alert you when certain links get over-utilized or become highly utilized. Again, you can get ahead of the impacts and ahead of the customer complaints.

In 2020, we went for 11 months on my network without a major incident. We didn't have even one P1 or P2 incident, which is something that we'd never done before, and I credit SevOne with that success. A lot of the issues that we found and fixed with SevOne, prior to going into the pandemic mode of working, may have caused us problems. Our ability to detect and address issues ahead of time, which included monitoring, capacity planning, reviewing those numbers regularly, and paying attention to the alerts of critical links when the pressure increased in terms of capacity, allowed us to stay ahead instead of being purely reactive. It's been a godsend and has brought us 11 months of stability, the likes of which I'd never seen before in 15 years with the company.

In terms of speed, SevOne makes it so that we're faster than the NOC. As a company, we're supposed to rely on the NOC to find these faults, get the alarms, and respond. That's how it works with the other networks in the company, generally speaking. But with us, because we're so deeply integrated with SevOne, we tend to know these things immediately, or within five minutes of something happening on the network because of our chosen five-minute interval.

The bottom line is that it's five minutes or less before the operations group is alerted to a critical situation on the network. Whether it is a hardware fault or something else, we know the issue and the impact of it almost immediately. We find ourselves informing the NOC, "By the way, this happened and you guys should get organized because there's something coming." This means that as an operations manager, I'm quicker on the draw than the NOC, which puts me ahead of most networks.

Generally speaking, we use SevOne as a central data collector for network components, routers, switches, load balancers, WiFi, and SDN. We also use it for server databases, cloud integration, and all the scenarios where we collect information.

SevOne produces a number of solutions for carriers and enterprises. The ones we use right now are software-defined networks, which are similar to Cisco ACI. We also use the WiFi solution to support Cisco WiFi and some other vendors. There's also a SevOne product for SD-WAN that we'll probably deploy in the next year. SevOne provides resources to come in and set those up. The solutions are basically visualizations and sometimes custom collections that combine the data insights product with SevOne NPM.

The two solutions provide a series of dashboards that give you insight into how your environment's working. We have full visibility into the health of Cisco ACI, including what's running on it, errors, performance, etc. It's the same with WiFi. We can track every access point, look at each connected station, and see the various metrics relevant to each connection. SevOne ensures everything is configured and operating properly.

SevOne monitors multiple technologies from different vendors. We're primarily a Cisco network, but Cisco has adopted some technologies from other vendors, and we've had no problem incorporating them. We also do F5 and other standard vendors that everybody uses. We manage everything on the network and infrastructure with SevOne. We have integrations with numerous products, third-party applications, and data from external sources. SevOne is fairly flexible as long as we can bring the information back into the system.

We get the most benefit from SevOne's ability to forecast capacity planning trends. We can look at growth in particular values and combine them to see how they interact with each other to improve our accuracy. We don't just base things on a single metric. 

If I'm looking at CPU, I'm also looking at queue length. The new company we work with is incredibly lean, so we've done a massive amount of work between SevOne and our other products to reduce the number of alerts that go out. It's not a matter of just filtering—it's also about making the network work smarter.  With SevOne, we're able to combine things and provide information out of the same platform. For example, if I have high utilization taking place, I see the packet drops in my critical applications by looking at QLS.

I can also look at net flow to tell if their backups run during business hours when they shouldn't. If I combine all that into an incident, my network team knows exactly what's happening when they get it. They can resolve the issue rather than being flooded with tickets that are caused by the utilization exceeding a specific percentage. We get those day in and day out. 

The network is sized to run near capacity, so we get the maximum use of the bandwidth. That also means it'll fluctuate over the threshold periodically and generate alarms, but we're able to combine it with additional data to tell us whether it's a problem or not. We don't need to raise incidents because the utilization went over the capacity anymore. The reason for the high utilization can be identified, so we can make better decisions on what to alert on. SevOne makes our support teams more productive. 

We use SevOne with virtualized next-gen network services because we run Cisco ACI, and we're on AWS and Azure. We can monitor network components on all these platforms. The company is in the middle of a transition because we spun off another company. We started on the cloud, so we never migrated from legacy into the cloud. It's a little different, but we are using it to manage the cloud environment. From a practical perspective, SevOne would give you the ability though to do both, so you don't need to change tools if you move from one to the other. 

SevOne has the ability to transform raw network performance data into actionable insights. Like most products in the network management space, SevOne doesn't have this capability out of the box because networks vary. However, it has the tools to customize it and adjust it as you go along. You get a solid platform that collects information and displays everything you would generally need to see. You can make it more effective by utilizing the data, API, and customization capabilities within the product. 

SevOne looks at indicators. In SevOne's terminology, a "device" is like a router or a switch. An "object" might be a CPU or an interface. It monitors the utilization or dropped packets on an interface. With each of those indicators, the smallest measurement is the baseline, and they do a baseline on everything. The baseline is based on a polling interval over a period of time. That information lets you review and see what's normal.  

They don't aggregate. They keep a year's worth of raw data, so I can do comparisons and see what occurred last month in this particular time period, like the end of the month or fiscal year. I can look at those networks and switches involved in those systems and see how they were performing at any given time each month back to a year ago. I can also set up alerts based on anomalies. I can look for standard deviations or numerical values above or below a threshold.

For example, let's say I'm expecting a certain amount of utilization. If it drops below that baseline, we get alerts that something isn't normal. We combine this in our upper management systems where we apply AI. The manager of managers gives us background information, so the AI can predetermine what might happen next.

We combine anomaly checks with static thresholds. We'll raise an incident for a static threshold breach, but we'll also have the anomaly data so the AI learns what happened before the breach took place. That way it can predict when it will happen again. It's good as a data collector and for feeding the other systems where we apply a bit more intelligence to the data.

We use it for network firewalls, routing, and switch monitoring, including performance monitoring and triggering of alerts.

We have it in our internal cloud. It's an on-premises solution.

SevOne is like a Swiss Army Knife. Because of the architecture and its redundancy, when we acquire a new customer and we are figuring out the optimal monitoring solution for them, we can quickly—within a couple of hours—bring in and start monitoring their devices and showing them data with SevOne. We can monitor CPU, memory, bandwidth utilization, errors, and high octet counts. That is very important for our infrastructure and our business.

And SevOne has helped with the planning of transitioning of our network services. It helped us to know how many objects were involved and what was needed, and let us understand how it was going to impact the installation we had, with respect to installing and using the Universal Collector. We were also able to identify the growth needed for our current infrastructure and to secure and install the licenses. It helped us expand the clusters that we have to support the planned growth.

In addition, the solution enables us to take any network metric and convert it to an insight into what's going on, without having to use a bunch of tools or manually determine things. SevOne's ability to convert that information into insights saves us time and gives us a one-stop-shop.

The integration of SevOne data with our ITSM has saved a lot of time with SevOne being the source of truth for most network device states in the organization. We're able to aggregate alerts, as the ITSM tools aggregate notifications from other vendors in our infrastructure. And SevOne's ability to clear itself when a condition is retired, and to notify the ITSM tools, is very helpful. It helps with automation as well. For example, when a router interface goes down and SevOne notifies the ITSM tool, it equally notifies the tool to retire the alarm and clear it when the interface goes back up. That is great. The ITSM integration has also helped to automate the creation of tickets for customers and internal groups.

We are primarily using SevOne to monitor bandwidth utilization. We also use it for proactive monitoring of the CPU, memory, and other resources. Our main goal is to monitor the network health and proactively upgrade before any issues occur.

We use the alerting function based on the standard deviation of our network health. When it is beyond the threshold, an alarm is generated and a support ticket is automatically created using the ServiceNow integration. This improves the way our organization functions because we know what we need to upgrade or what issues are in need of attention before they become a problem. It helps us with troubleshooting, as well.

The out of the box reports and workflows are pretty good and they meet our requirements well. Using Data Insight, we can create variables, filtering, and good visualizations. The reporting has improved with Data Insight over NMS.

SevOne brings together its analytics reports and workflows in a single dashboard, and we are able to create a dashboard that contains many tabs and links. From this one dashboard, we can go to other reports and pages.

For DI, it's very easy and clear. For NMS, it is simple, but the visuals are not as pretty as they are with DI, and some of the functionality is missing. There is also a difference in the way that DI exports files, versus NMS.

We have been able to detect issues faster using SevOne, although it depends on how we set up the alerts. When we create them according to the threshold or any of the status change options, it automatically notifies whoever is watching over those devices. It is quite flexible in the way that we can configure alerts.

The alerting has saved us time because the operations team can see them act immediately. Also, an incident ticket is created automatically. We used to have to manually check to see which devices were either having issues, or we could reasonably expect was going to have an issue, and then create a ticket manually. Using SevOne, all of this manual work has been automated.

We haven't done the automation for every case yet but if each was done, we would likely save between 60% and 70% of the time required for each task.

SevOne provides us with continuous, real-time analytics of our network. Over the long term, the data is aggregated. This is helpful because we can see the history of our network. For example, we can see the state of the network before a problem occurs, as well as how and when it happened. For troubleshooting, it's very useful that we can go back and see how our network was doing.

We do not have a complete view of our network using SevOne because we are not using all of the features. Unfortunately, I don't really know all of the functions because we have a limited license and limited resources. This means that we have to combine with other tools that can watch the flow and other characteristics in our environment. Although I cannot speak for all of the features, I can say that it is meeting our requirements to this point and so far, we are happy with it.

We're using SevOne to monitor our network infrastructure. We provide monitoring services and performance capacity management for network gear, including routers, switches, wireless controllers, firewalls, and load balancers, to name a few. We have various manufacturers and different device models that we leverage the solution to monitor in our organization.

Our deployment of SevOne is mostly virtualized. We have gone completely virtual in our environment. We have SevOne deployed in different regions of the world: the U.S., Hong Kong for Asia, as well as in London for Europe. 

We've been able to expand our service with this tool, without the need for additional tools. In addition to being able to monitor network devices, the tool is capable of monitoring server-type devices as well. That means we didn't have to get a separate tool to monitor servers. We're able to ingest system log information and create alert policies on it. Overall, end-to-end, it is very flexible, enabling us to leverage the lessons learned and apply them to all the different component gear, whether it's server gear or database gear. One of the benefits is that we've been able to leverage one tool to do a lot of things.

SevOne also enables us to integrate our network performance management data across our ITSM and business decision-making tools. One component of SevOne is called Data Bus and that allows us to stream and share performance data from SevOne with external applications. We have some use case scenarios where we are sharing the performance metrics being captured in SevOne with other applications in the business. Integrating the network data with other solutions wasn't difficult. The way it works is that we're streaming the database, and small JSON payloads, into a Kafka Messaging Cluster, where external applications can just subscribe to that topic, download the data, and use those metrics as needed.

When it comes to detecting network performance issues faster, the tool is very capable. Being able to set up alerts and policies based on baselines, and deviation from baselines, is pretty good, without our having to set hard thresholds on a performance item. We have discovered things that way. Since leveraging SevOne, we see most of the outages or pre-outages in an alert from SevOne, and we can dispatch to troubleshoot the issue. We depend on it a lot at this point.

We are a large enterprise and provider. We use the solution to monitor and capacity plan our network.

We also use it for our cable modem estate. We have about 6 to 7 million customers who aggregate onto devices. We monitor those devices with SevOne NPM on a separate cluster. We also have a customer-facing cluster that we are about to install.

It is our strategic performance monitoring tool. So, it is the only thing that we use to monitor our internal network, which is huge. We plan to extend it and replace our network performance monitoring tool, which is another IBM tool and currently a big customer-facing system. We planned for another fairly large cluster of about 20 virtual machines.

We have both physical and virtual appliances onsite. We don't currently use the cloud.

SevOne’s data collection functionality is very good. From a collection point of view, we pull SNMP data, which is simple. It is easy to manipulate the pull in the estate. It is really simple compared to some of the other products that we have used. However, for deferred data, i.e., things that we import or don't pull directly, we tend to have a preplanned integration. So, its Universal Collector is really useful.

I don't know that we use it, in earnest, but SevOne does give us real-time insights into our network performance. We set thresholds on certain connections that are important to us. Should they trend towards an issue, then our capacity planning team is made aware of it.

SevOne is excellent for transforming raw network performance data into actionable insights. Our capacity planning team has been very pleased with the transition to SevOne because we previously hadn't used Data Insights, which is really good.

It uses a baseline. So, it uses the last six weeks of data. It has days of the week and weeks of the month understanding of network volumetric data. This is good because it can show us things that are out of the baseline. However, it isn't better than anything else I have used from a baseline point of view.

It is really easy to integrate our network performance data with our ITSM. The API is straightforward.

We have quite a few use cases for the SevOne NMS. It's mainly for performance management by our different network teams and we also do performance management of our external customers. That means we offer businesses and schools and others access to a Comcast device for their site to give them internet, or site-to-site connectivity. We also monitor our Comcast Digital Voice in SevOne NMS. For the external customers and the Comcast Digital Voice, we're inputting flat file data into SevOne so that we can get the metrics for that flat file data and provide it to those customers. We're doing SMP and what they call xStats. 

With SevOne DI we allow our external customers to log in and get a report for their data. We give them a subset of the data that we collect so that they can see that we're staying within our SLAs.

I mainly focus on the thresholding capability of SevOne. We configure thresholds on the performance metrics and they send us alerts so that the NOC is alerted about the systems that are having issues. I maintain SevOne and I give the customers what they want. They're the ones who let me know if there's an issue. They're the ones monitoring the health of our network. We have various NOCs, depending on the device type, and they're the ones that will let me know if something needs to be modified or tweaked to enhance that performance management.

We have a SevOne NMS cluster that is also attached to a SevOne Data Insight cluster, and the SevOne NMS system is also sending out the SDB to a set of servers that we maintain for customers for rural data.

We're using the 300K which we've licensed to 200K and we're on version 5.7.22 of the NMS and 3.0 on the SDI.

The main benefit of using SevOne is the fact that we can pull in a new vendor rapidly. With the changing technologies, we can get a new vendor certified and monitored in our system faster than before. With our previous system, we had to wait for them to put it into the upgrade. It could have been months before we would actually monitor new equipment. Now, we can monitor within 10 days. 

Also, with the xStats, we're able to monitor non-SNMP data from various vendors.

SevOne provides us with continuous analytics of our network and that gives us an idea of the health of our network, where our weaknesses are, and what needs to be fixed.

In most cases, SevOne enables us to detect network performance issues faster and before they impact end-users. We've had situations where new issues have come up and we have actually used that to create a new threshold to alert us the next time. But overall, it helps us with early detection.

When it comes to having a complete view of our network performance, I would rate it very highly. It's the key piece of equipment that we use for monitoring our performance.

We use it pretty extensively for all of our network performance management needs. It's monitoring Spark core and network performance. It's managing our managed-data customers' equipment on site, and it's also used to look after monitoring our internet links as well. We use it for any performance-related stats or information of that type. It has the capability for that.

It's all on-premise at the moment. We don't have the Data Insight component of the SevOne offering at this stage. We're still looking at that, but we predominantly use the platform to give us collection capability, and we'll use the data and visualize it on other platforms as well. So we have engineers that can use the data directly or natively in the tool, or we'll take the data or the collections and use those for other purposes, including billing.

It does the out-of-the-box reports and workflows to automatically help to understand what is normal or abnormal in our network. We need to see the Data Insight option to get some more of the smart features to the package. We don't have that option but for a baseline and comparisons, it's sufficient for what we need at Spark. And the capacity we use it in is more to do the collection, so we run other analytics over the data as well. The primary benefit is that we have good collection capability, which is what it gives us.

That is critically important to us. It underpins customer reports, which are contractual obligations, but we also use it for billing data. We must have accurate billing data for some of our wholesale customers. It's critical in that regard. We are so confident in SevOne that we even use it for billing.

The solution's out-of-the-box reports generally help to speed up its time to value. It's quite straightforward to get it to generate reports out-of-the-box. We have teams that use it and like that style of the interface. Even though it's an older interface, they can set up things whenever they want with whatever metrics they need to look at. It's very easy to use.

SevOne brings together its analytics reports and workflows in a single dashboard. It's required to have the Data Insight package to properly do that, which we don't have, but the product does offer that. It would require further investment from us to leverage that but it does do it quite well. We're set up in a Splunk shop. So it's very similar in terms of what you can do with Splunk visualizations but just does it much faster and more near real-time.

It provides continuous analytics of our network. The old adage is that you can't manage what you're not measuring. SevOne gives us the capability to measure the things that are important to us. We need that otherwise our operations teams are blind and we can't deliver the value to our customers who have expectations around having a whole bunch of these reports made available to them. It's very critical.

It enables us to integrate our network performance management data across our ITSM and business decision-making tools. We have ServiceNow, so we integrate our network performance alerts up into ServiceNow. It's pretty standard.

It's really straightforward to integrate the network data with these solutions. Our integration architecture is reasonably good to leverage and so we easily integrate. We haven't had any problems with it.

We use SevOne in a troubleshooting capacity for some teams, but I would say the predominant use is more to give those teams a decent quality time series chart at the right level of granularity. They need to be able to troubleshoot and support any work internally and with customers as well. Our internet links, for example, are all monitored at one-minute intervals, which is an absolute minimum requirement. If we have any disruption in internet services in New Zealand, then everyone is impacted. SevOne gives us that level of granularity, which those operational teams use all the time. They're heavily reliant on it.

The integration of network data with our ITSM helps to improve collaboration between operations and support teams. It's just a means of managing the incident, and SevOne provides a source of those, but we don't try to overload our operations teams with spurious alerts based on SevOne. It's only specific criteria that will trigger a ticket for them. It does help our business operations and functionality, but we don't go crazy about how we set it up.

It offers a complete view of our network performance. We have quite an expensive environment and a lot of different technologies. We do use it to give us views across each of the separate technology domains, whether it's a customer network or our core. We don't tend to tie everything together in an end-to-end view because of the way our network is configured, but for the views that we need across the various technology domains, it does a good job at that.

We are enabled to detect network performance issues faster and before they impact end-users. We don't necessarily get full advantage out of it in that regard, because performance alerts are a lot harder to manage than hard volts or up-down problems, but the tool does give us that data. Whether we choose to use it all the time or not is a different question.