Gartner's Magic Quadrant for IT Event Correlation and Analysis (ECA), 2009 (see Figure 1) evaluates vendors' ability to execute and their completeness of vision relative to a defined set of evaluation criteria regarding current and future market requirements. A Magic Quadrant should not be the only criterion for selecting a vendor, because the right solution for a given situation can be in any quadrant, depending on the specific needs of the enterprise. Enterprises considering the purchase of an ECA product should develop their own list of evaluation criteria and functional requirements in the categories of event collection/consolidation, processing/correlation and presentation. Large enterprises should consider a multitier event management hierarchy, pushing some event processing and correlation out to the managed IT element at the bottom of the hierarchy. These enterprises should use specialized event management tools in the middle, and should place a "manager of managers" or a business service management (BSM) product on top.

When investing in event management, prospects should understand how the product will fit with their overall event-to-incident/problem resolution processes, including workflow, escalation and integration with service desk tools.

ECA products help IT operations personnel contend with the deluge of events that comes in from the IT infrastructure by eliminating duplicate event signals, filtering events according to operational or business priorities and analyzing events to determine root cause. The goals are to improve the mean time to isolate and repair problems, and to prioritize IT support efforts according to business process value. The core value proposition of these products is to achieve management by exception. This requires an understanding of "normal" behavior in the IT infrastructure and alerting the IT operations staff only when an exception occurs, such as an outage, a failure or a threshold breach, indicating that the IT infrastructure is no longer behaving "normally." With the 2009 Magic Quadrant, the desire to associate events with potential business impact has transitioned from a "wish list" item to something that's required for current product execution, although not all ECA vendors offer this function.

IT organizations invest in ECA tools to improve the productivity of the IT operations staff and to reduce the time it takes to troubleshoot problems by consolidating events from various devices, applications and other management tools. Without proper event management, the IT operations group can be deluged with event storms, numerous false positives and a "sea of red" on their consoles.

How to Use the ECA Magic Quadrant to Assist in Vendor Selection

The vendor positions on the ECA Magic Quadrant are based on the evaluation of information gained through vendor interviews, ongoing client inquiries, reference checks and Gartner's knowledge of requirements in the market. Although the Magic Quadrant provides a picture of a vendor's ability to execute, as well as its completeness of vision, it should not be the only criterion for making a selection. Enterprises often use Magic Quadrants to formulate their shortlists and look only at vendors in the Leaders Quadrant. Few enterprises will be successful in finding the best vendor for them with this method.

Enterprises should determine and prioritize their own functional and support requirements, and should use these to drive their selections. These requirements will be specific to the individual enterprise, and will be key for vendor evaluation and eventual selection. For example, a vendor in the Niche Players quadrant could be ideally suited to an enterprise's needs. Similarly, the vendors in the Leaders quadrant may have executed well and outpaced the market in vision, but this does not necessarily mean that they have the functionality needed to meet an enterprise's specific requirements.

Enterprises should understand that some solutions are better-suited for large businesses (more upfront complexity and reliance on problem management process maturity), and others are better-suited for small or midsize businesses (SMBs; easier installation and lower cost, but typically fewer capabilities for complex-event correlation). The Magic Quadrant is not designed as a substitute for client inquiry — Gartner inquiry is the best way for enterprises to resolve specific questions about event management vendors.

ECA products:

• Support the acceptance of events from elements in the IT infrastructure (including hardware, software, server, virtual machine, operating system, network, storage, security, database, application and mainframe elements).
• Process events using consolidation, filtering, normalization, enrichment, correlation and analysis techniques.
• Notify the appropriate IT operations personnel of critical events.
• Automate corrective action, where possible.

Definition of Events

There are two types of event categories that need to be accepted by the ECA product:

• Discrete state change in a managed element, sent asynchronously from the managed element, an agent installed on the managed element or another IT event-monitoring or ECA product.
• Threshold breaches indicating that a managed element is no longer operating within "normal" parameters, sent asynchronously from the managed element, an agent installed on the managed element or a separate performance-monitoring product. Normal can be based on a predefined, default, out-of-the-box threshold; a customer-defined, customized setting; or a dynamic, measured baseline.

See "Event Correlation and Analysis Market Definition and Architecture Description, 2009" for a detailed description of the varying roles an ECA product can play in a potentially multitier event management architecture.

To be included in the ECA Magic Quadrant evaluation, a vendor must have at least three referenceable enterprise customers with production deployments and a shipping product as of February 2009 that runs on a Unix, Linux or Windows platform, with functionality in the following three key event management disciplines: event collection/consolidation, event processing/correlation and event presentation.

Event Collection/Consolidation/Deduplication

Vendors/products must have the ability to accept events from two or more of the following types of IT elements:

• Server (hardware and operating system)
• Virtual machine
• Network
• Storage
• Security
• Database
• Application (packaged, off-the-shelf or custom applications)
• Mainframe (hardware and operating system)

Event Correlation and Analysis

Vendors/products must have the automated, out-of-the-box ability to process or correlate events through one or more of the following techniques:

• Deduplication/filtering (for example, when multiple, repetitive events are received for the same problem on the same element, store the event once and increase a counter indicating the number of times it has been received, rather than flooding the user's screen with redundant events).
• State-based correlation at the element level (for example, if a "link down" event is received for a router interface that corrects itself and generates a subsequent "link up" event, then the ECA product correlates the two and clears the original link-down event).
• Topology-based correlation (for example, suppress the sympathetic events that occur when elements downstream from a known problem are unreachable).
• Correlation based on causal rules (for example, suppress events that are determined to be completely dependent effects of events taking place elsewhere, based on the product's built-in domain knowledge of how systems interact).

In addition, vendors/products must support the user's ability to add custom event processing or correlation rules.

Event Presentation

Vendors/products must have the ability to present event data to the IT operations staff in one or more of the following ways:

• On the console screen using color and sound (visual and audible alarms)
• Through a Web interface
• By e-mail, pager, PDA or smartphone
• By logical groupings (presenting groups of events that relate to business processes, IT services, departments, geographic regions or any other arbitrary, user-defined grouping)

Six vendors, Augur Systems, eG Innovations, GroundWork Open Source, ScienceLogic, Tango04 and uptime software have been added to the 2009 Magic Quadrant based on client inquiries regarding these vendors in this market — an indication that buyers see these vendors as players or potential players in the ECA market.

Two vendors have been dropped from this year's Magic Quadrant. ASG was dropped based on changes in its product delivery and market focus, and Cittio was dropped as it is no longer in business.

The Ability to Execute (vertical) axis is focused on current product and market capabilities, and represents Gartner's view of the strength of a vendor's corporate management; the vendor's products, services and support; and its overall stability and viability. The ECA market includes several mature products from market-share-leading enterprise management vendors with large installed bases and robust cash flows, which sets a high bar for getting beyond the halfway point on the Ability to Execute axis, and to be placed in the Leaders or Challengers quadrants. However, revenue (part of the overall viability evaluation) and customer count (part of the sales execution/pricing evaluation) are not the only criteria for achieving a high ability-to-execute score. Vendors must also demonstrate product and marketing execution, as well as positive customer experience.

Under product execution, we evaluate vendors on their products' scalability and breadth of coverage to enable the collection of events from all parts of the IT infrastructure, including virtual machines. Vendors also must provide correlation functionality (both out-of-the-box and customizable) to reduce the event stream presented to the IT operations staff, including correlating events in light of the transitory nature of virtual versus physical relationships. However, customer experience shows that the more powerful the correlation tool and the more customization required to adapt the tool to a specific enterprise environment, the less likely an enterprise will be in successfully deploying it, thus ease of use and automation are also evaluated. Traditional, general-purpose, rule-based event correlation engines are being challenged by new, focused vendors whose products are easier to deploy because they have strong out-of-the-box event correlation functionality, although they have a limited ability to support customized event correlations. In some cases, customers are accepting the fact that the easy-to-deploy solution is "good enough," or they are using two tools: one for broad, but shallow, coverage of most of the IT infrastructure and one for deep, sophisticated correlation for a few critical components.

Increasingly, Gartner clients are expecting BSM (the ability to understand an event's impact on a customer-facing, business-oriented IT service) as an integral part of their ECA products. In previous ECA Magic Quadrants, this was evaluated as part of the product strategy under Completeness of Vision. As the market has progressed, we have moved this to a factor contributing to the current product evaluation criteria under Ability to Execute for 2009. BSM links the availability and performance status of underlying IT infrastructure and application components to business-oriented IT services that enable business processes. BSM has been a natural evolution from previous market requirements for event management and IT component monitoring, as IT organizations attempt to become more business-aligned in their service quality monitoring and reporting. However, progress toward this goal is impeded because many event management customers are still struggling with the basics of instrumenting the distributed infrastructure and enabling proactive monitoring. As well, many do not have any end-to-end IT service definitions or documentation on how these relate to business processes.

As part of the product criterion, we evaluate vendor progress in simplifying deployment by automatically baselining the IT environment, dynamically setting variable thresholds and setting off an alarm only when current results deviate from normal baseline values. Reporting is also evaluated under the product Ability to Execute criterion because this function can aid clients in monitoring and improving the event management process.

The size of the installed base, the number of new customers gained in 2008, the pricing/licensing model and the cost to manage a sample configuration supplied by Gartner, along with the number of sales and support "feet on the street," contribute to a vendor's sales execution/pricing rating on the Ability to Execute axis. We rated the total installed base and growth in new customers separately, giving a heavier weighting to the number of new customers to distinguish a large, but possibly stagnant, customer base from a growing customer base. Industry partnerships through OEM relationships, value-added resellers and system integrators increase a vendor's ability to reach the market without increasing its internal investment in a direct sales force. Visibility in competitive situations and consistently making enterprises' shortlists demonstrate marketing credibility and brand awareness, contributing to a vendor's marketing execution rating. Successful vendors match their marketing messages to the market's requirements, and ensure that their direct and indirect sales channels, partnerships and alliances are effective.

During these challenging economic times, we have heavily weighted overall vendor viability, sales execution/pricing and marketing execution in this evaluation. Past consolidation and acquisition activity continue to wreak havoc with ECA vendors' portfolios; therefore, when determining a vendor's ability to execute, we evaluate customer experience, especially in terms of migration and graceful architectural change (see Table 1).

On the Completeness of Vision (horizontal) axis, we evaluate how well a vendor or product will do in the future, relative to Gartner's scenario for where a market is headed, which is based on our understanding of emerging technologies and requirements of leading-edge clients.

Under the offering (product) strategy category, we evaluate a vendor's potential for advancing the state of the art in event correlation and automated root cause analysis and its flexibility to adapt to changing requirements. We examine build-versus-buy strategies for augmenting product functionality, knowledge of core competencies and the ability to partner to fill gaps in the product portfolio. ECA products do not stand alone in an enterprise management deployment. Vendors with a strong product strategy rating demonstrate an understanding of and a road map for integration with other management applications and associated areas, such as the problem management process (including Information Technology Infrastructure Library [ITIL] methodology and integration with the IT service desk tool), security information and event management (SIEM), and configuration management databases (CMDBs), defined in this context as containing IT service relationship and dependency mapping information.

Higher product strategy vision ratings are accorded to vendors that have a credible strategy to achieve alignment between IT component events and business-oriented, end-to-end IT services. In the future, the ability to discover and document relationships between IT components and business-oriented IT services, as well as to keep the IT service dependency mapping updated in real time, will be necessary to automate the business impact analysis of events. Whether the IT service dependency mapping is documented in a BSM tool, a CMDB or some other implementation, Gartner believes that it will not be possible to have an effective ECA without processing events against an up-to-date IT service dependency model to determine business impact and assign support priority. CMDB and the discovery of IT service dependency mapping are (generally) separate from the ECA product and, therefore, would not be part of this Magic Quadrant's ability-to-execute evaluation of a vendor's current product. However, under Completeness of Vision, we are evaluating each vendor's product strategy to leverage IT service dependency mapping details to help improve event correlation and impact analysis.

Under the market understanding and marketing strategy evaluation criteria, Gartner evaluates how vendors' visions align with industry trends and evolving market requirements, their understanding of technical and market issues, their ability to differentiate their products and grow their businesses, and their emphasis on best practices and the ease of deploying the event management solution, not just on product features. Industry perception and market recognition by prospects, partners and competitors based on a compelling and consistent marketing message is included. A vendor can succeed financially without a vision, but it will not become a leader without a clearly defined vision or strategic plan. This should include plans for articulating the vision and plans to differentiate the vendor's offering from competitors' offerings.

To rate highly on innovation, a vendor should show evidence of delivering continuous product improvement, adequate R&D resources to pioneer new functionality that differentiates its product in the market, and, in the case of acquired innovation, the ability to retain key (acquired) personnel to assure continuing innovation (see Table 2).

Vendors positioned in the Leaders quadrant possess a large and satisfied installed base and have a high degree of visibility within the market (for example, frequent consideration on clients' shortlists and success in competitive situations). They offer highly scalable, robust applications that can prioritize events to business impact, and they have the strategic vision to address some or all the evolving enterprise requirements in the areas of ITIL version 3 event management process, root cause analysis, CMDB with IT service dependency mapping, integrating security events, and optimizing the event-to-incident/problem resolution processes, including integration with service desk tools.

Vendors in the Challengers quadrant are solid and can perform well for many enterprises. Some are significant vendors in terms of size and financial resources, but they may be lacking in vision, deployability, ongoing innovation or an overall understanding of market trends.

Vendors in the Visionaries quadrant are forward-thinking and often technically focused. They have recognized and responded to longer-term event management market trends, such as root cause analysis and leveraging a CMDB with IT service dependency mapping to prioritize events to business impact, but they may lack the recognition, sales and marketing strength, or overall size to compete and execute with consistency.

Niche players are a combination of new entrants to the event management market, vendors with limited vision or execution, and vendors that focus on a small segment of the market and do it well. The narrow focus often reduces their vision rating and limits their addressable market, making them unable to achieve a high ability-to-execute rating. However, the narrow focus may enable them to achieve great depth of functionality in their chosen areas.

Argent has established itself as a player in the ECA market, showing both company growth and healthy increases in its installed base. Customer references comment on Argent's Guardian product being rapid and easy to deploy. Argent continues to broaden its IT operations management capabilities and now includes Atlas, Argent's version of an introductory CMDB. (However, Gartner has yet to see Atlas in clients' CMDB bids or hear about it in CMDB inquiries.)

• Provides a straightforward product, addressing the needs of IT operations groups that do not have the time, budget or need for larger, more-complex ECA products.
• Argent Guardian can monitor a broad range of IT elements, including virtual servers via a number of different architectures: no agents, some agents, all agents.
• Argent's BoardRoom interface provides an integrated presentation manager to convey ECA information to busy IT administrators and managers.

• Argent focuses on providing an easier-to-use and heterogeneous alternative to Microsoft System Center Operations Manager; however, Argent will find it increasingly difficult to differentiate itself as Microsoft expands its market coverage through partnerships and OEM relationships.
• Limited product depth means that Argent is used for its broad coverage across the wide variety of infrastructure elements with other tools on this Magic Quadrant used for deep analysis of critical devices.
• Argent will continue to find increasing competition from vendors that have entered the market delivering similar ease-of-use attributes, as well as advancing the state-of-the-art in event correlation, automated root cause analysis, aligning IT component events to business impact on end-to-end IT services, and technology specifically designed for managing the growing complexity introduced with virtual IT infrastructures.

Augur Systems is a new entrant to the 2009 ECA Magic Quadrant. Augur is a small, U.S.-based vendor focused on midsize IT organizations needing to monitor the health of their Unix and Linux platforms, with Windows platforms handled via syslog, and other elements covered using a variety of protocols or by Augur acting as a manager of managers for more specialized IT infrastructure and event-monitoring tools. Augur 4 is a new product in its portfolio, with functionality that can be classed as an entry-level ECA product supplemented by a very attractive low price point. With limited production deployment experience for the new Augur 4 product, the product has only been sold in Europe and Asia; however we expect to see Augur Systems' market presence increase when it gains entry into its home market in North America.

• Low price point.
• Easy to use, with simple interfaces that take the mystery out of ECA, providing, for example, a built-in trace for every alert that shows Augur's event evaluation steps, including built-in thresholding, event clearing, and event suppression.
• Augur 4 components (e.g., event collectors, ECA rule extensions, integrations, etc.) are implemented as graphical user interface (GUI) plug-ins, and Augur Systems is encouraging partners to build and sell their own plug-ins to augment Augur's R&D capabilities.
• Augur 4 employs a cluster approach to add capacity linearly without the requirement for a central hub that could cause bottlenecks. The GUI automatically gathers data from across Augur's network, appearing to the end user as a single hub.

• Limited breadth of coverage, focused on monitoring Linux and Unix servers, with Windows servers covered via syslog. However, using a range of common protocols, Augur 4 can receive information from other sources.
• Augur 4 does not have built-in, topology-based correlation, and supports few out-of-the-box event correlation rule sets, although the company is hoping to encourage value-added resellers (VARs)/system integrators (SIs) to create and sell rule sets in their domain of expertise.
• Augur 4 does no business in North America at this point, but plans to expand geographic coverage.
• Very small installed base.

BMC continues to demonstrate strong market understanding and the ability to craft and communicate a cohesive marketing message that captures current market needs. Customers "get" BMC's strategy, and find that it aligns with their current requirements and long-term plans. BMC's customer experience execution rating has significantly improved now that it is not only through the migration from Patrol Enterprise Manager (PEM; which was based on the Boole & Babbage CommandPost technology that BMC acquired in 1999) to its new BMC Event Manager (BEM; which is based on the IT Masters MasterCell technology that BMC acquired in 2003), but has taken the leadership step of combining its ECA product with its BSM product. Some other vendors in this Magic Quadrant are just entering the challenging period of migration that BMC has already come through.

• BMC has recombined its separate BEM and Service Impact Manager (SIM) products into the new BMC Event and Impact Manager (BEIM), leading the charge to integrate ECA and BSM, and responding to market expectations that Gartner has observed that increasingly see BSM as an integral part of ECA products. (BEM and SIM were one product when BMC acquired them from IT Masters, thus they already share the same code base, installation and interfaces.)
• Good breadth of coverage, including mainframe support, and the flexibility to use both BMC agent-based and agentless approaches, as well as other major vendors' agents.
• BMC achieved high marks for completeness of vision because of its end-to-end IT service management vision, its understanding of ITIL v.3, and its credibility to integrate its ECA product with its Remedy Service Desk and its Atrium CMDB.
• BMC has differentiated itself and established thought leadership for ECA autobaselining, threshold analysis and anomaly detection with its acquisition of ProactiveNet. Although ProactiveNet is an add-on product separate from BEIM, it can nonetheless improve event management by automatically determining bands of normalcy and adjusting alert thresholds accordingly, thus reducing the number of events — specifically, false positives — that are sent to a central event console.

• Execution lags behind marketing vision, resulting, for example, in some products that may not yet be able to fulfill the vision, or that require appropriate expectations to be set regarding the high level of effort and IT management process maturity necessary to achieve the vision.
• Except for network configuration and change management functionality, BMC only offers network management through a reseller agreement with Entuity or through integrations with other vendors' products such as HP Network Node Manager, resulting in the inability to draw any profound information from the network infrastructure, which limits the capabilities of BMC's ECA toolset.
• Limited consulting and professional services, although the number of specialized BEIM consultants globally is increasing.

CA's strategic product submitted for this Magic Quadrant is CA Spectrum Infrastructure Manager, replacing the long-standing CA NSM product, which was evaluated in the previous ECA Magic Quadrant. The timing of this research caught CA midstream, before it completed plans to integrate the capabilities of CA NSM and CA Spectrum with its new CA Spectrum Service Assurance Manager (SAM) product. Our evaluation of CA takes into account CA's vision of expanding CA Spectrum to include service impact and assurance capabilities deliverable in the new CA Spectrum SAM, but its ability to execute is based on the CA Spectrum product that was shipping at the February 2009 cutoff point for this research. CA Spectrum, a product CA received as part of the Concord acquisition, was focused on network management and is often combined with eHealth network performance reporting, and that is still where we see a majority of its installed base today, even though it can fulfill a greater cross-IT infrastructure role. CA has developed CA Spectrum SAM to provide a greater holistic role spanning IT operations, including network and systems administration, as well as BSM. However, from an installed-base perspective, execution on the CA Spectrum SAM strategy is nowhere near complete, with some CA customers using just CA NSM, others using just CA Spectrum, and some using a combination of the two in various subordinate and superior roles. CA is not the first (nor will it be the last) vendor to go through a change in ECA product strategy, with both BMC Software (PEM to BEM) and IBM Tivoli (IBM Tivoli Enterprise Console [TEC] to IBM Tivoli Netcool/OMNIbus) experiencing similar challenges in the past five years.

• Strong out-of-the-box, model-based event correlation and root cause analysis capabilities.
• CA's vision rating has improved thanks to the path it is taking in integrating the capabilities of CA Spectrum, CA eHealth Performance Manager, CA Wily Application Performance Management and CA NSM with the new CA Spectrum SAM.
• Significantly improved virtualization management, compared to last year, with the ability to discover and monitor the logical relationships between physical servers and virtual machines, detect and automatically update the virtual topology when virtual machines are dynamically reallocated, and deliver root cause alarms and downstream event suppression on logical virtual machines when physical servers fail.
• CA has established a focus on ITIL and on improving IT management process maturity, delivering what it calls Integrated IT Flows, which consist of automated IT process workflows (such as event to resolution), strengthening CA's problem management process vision rating.
• The CA Spectrum companion product, CA eHealth, provides a "Deviation From Normal" function, where thresholds are dynamically adjusted using historical data to reduce alarm noise.

• CA elected to submit its CA Spectrum product for evaluation in the 2009 ECA Magic Quadrant, which is a change from the previous Magic Quadrant, where it submitted CA NSM as its strategic event management product. CA Spectrum has a significantly smaller installed base, which is partially responsible for CA's lower ability-to-execute ratings this year compared to the previous year.
• Although CA has made progress integrating events from CA NSM up to CA Spectrum, and updating CA Spectrum to leverage the CA CMDB and its IT service dependency mapping discovered by CA Cohesion, CA's long-term strategic product in this area is the CA Spectrum SAM, announced in November 2008, but not shipping by the February 2009 cutoff point for this analysis, thus it didn't qualify for evaluation.
• As part of the product evaluation criterion under Ability to Execute, CA received reduced scalability and breadth of coverage ratings with CA Spectrum, compared to last year's evaluation of CA NSM, which included mainframe support.
• CA's historical reputation sometimes excludes it from getting on shortlists; however, CA is relentlessly focused on this issue, and is transforming its reputation one customer at a time.

eG Innovations is a new entrant to the 2009 ECA Magic Quadrant. The company has been in the market since 2003, but has not gained significant market adoption and has a small, although global, customer base. Its ECA product, eG Enterprise, uses out-of-the-box event correlation logic to analyze service performance and identify the root cause of IT infrastructure issues. In addition to providing both agent-based and agentless monitoring for general IT infrastructure components, eG Innovations receives high marks for its understanding, focus and capability to manage virtual server environments. This takes into account virtual machine migration technologies such as VMware's live migration technology.

• Management of virtual IT infrastructures, including the ability to automatically detect and update application-to-virtual-machine mappings and virtual-machine-to-physical-machine relationships in real time.
• Good breadth of coverage using both agent-based and agentless approaches, with support for five virtualization platforms, 10 operating systems and over 85 common applications.
• Ability to observe baseline of "normal" behavior and to automatically set thresholds for each of the collected performance metrics, minimizing the incidence of false alerts.
• Flexible agent licensing policy where a single agent can monitor all the applications executing on a server. Agent licenses are not tied to operating systems or node-locked, thereby allowing operators to pick and choose where they want to deploy the agents.

• Although eG Enterprise uses a scalable architecture, its scalability remains largely untested, with its largest enterprise deployment monitoring 2,500 servers.
• The service topology of interdependencies between applications that are part of a logical business service is not autodiscovered and must be created manually through a "drag and drop" interface. eG Enterprise can integrate with various CMDBs and IT service dependency mapping tools via internal application programming interfaces (APIs), but professional service efforts are required for this.
• eG Innovations has little awareness in the market, and is not regularly mentioned by Gartner clients as being on their shortlists for ECA investments.

Even prior to its acquisition by EMC, Smarts' marketing execution had succeeded in moving what was previously academic research to the forefront of awareness with network managers. Customers associate the "codebook correlation" with Smarts' automated root cause analysis capabilities, so it has achieved some brand awareness and a differentiated message. The acquisition by EMC gave Smarts more field sales and support resources, providing a "comfort factor" to buyers in terms of risk, thus improving its ability-to-execute ratings. EMC has successfully leveraged and extended the Smarts "codebook correlation" model to EMC's storage domain. Other vendors have recognized Smarts' excellence in this area, with Microsoft licensing a portion of the EMC Smarts technology to discover network topology and monitor network devices.

• The EMC Smarts "codebook correlation" approach enables IT operations to discover topology relationships, and to automate event correlation and root cause analysis without expending a significant amount of customization effort.
• Deep network domain knowledge, including continuing development in new network technologies (such as voice over IP [VoIP], Multiprotocol Label Switching [MPLS] and native Internet Protocol [IP] v.6 environments).
• New EMC Smarts Server Manager provides discovery and root cause analysis for the virtual server environment, enhancing Smarts' capabilities for the VMware infrastructure to enable customers to discover the relationships between virtual machines and their physical hosts, as well as the relationship from the physical host to the network.

• Although strong in network and storage, EMC Smarts shows no particular depth of domain knowledge in event management and automated root cause analysis of databases and business applications.
• Before EMC can fully leverage its extensive storage sales channels and installed base to sell a sophisticated ECA software product, continued sales training is required to learn about a new buyer and gain access to a different part of the IT organization.
• EMC Smarts has put marketing emphasis on extending the value of its products to provide more business-oriented results — for example, EMC Smarts Business Impact Manager; however, it remains predominantly a network management product in most production deployments, rather than being the manager of managers.

GroundWork Open Source is a new entrant to the ECA Magic Quadrant. It provides a product called GroundWork Monitor, which was first released in September 2005. It is built by combining GroundWork's own code with several open-source monitoring projects, such as Nagios, RRDTool, SNMPTT and others. This has brought an open-source community that enables GroundWork users to benefit from enhancements that the community creates. GroundWork provides an alternative for IT organizations that would like the benefits of open source, but prefer to purchase a product with a support and maintenance contract. GroundWork supports a wide range of IT elements, and customers can use adaptors developed through the Nagios exchange. GroundWork is aimed at providing an alternative to much larger and more-established IT operations management vendors; however, it's primarily being adopted by companies with small to midsize IT infrastructures.

• A group of open-source products integrated and supported by a commercial IT operations management vendor.
• Enhancements created 24/7 by the open-source development community.
• ECA capabilities offered at a very low price point.

• Requires a technically savvy user.
• IT operations departments must be familiar with open-source communities to take full advantage of GroundWork.
• Dependence on the open-source community for some adapters and product enhancements.
• Upgrades can be tricky, with homegrown product enhancements and community developments needing to be documented and supported by the user.

HP's ECA leadership position is due, in part, to its large and growing installed base and to the significant investment it has made in its ECA products, for example, adding Operations Manager i 8.0 (OMi) to its Operations Center suite. OMi sits on top of HP Operations Manager and HP's Business Availability Center (BAC) to provide topology-based event correlation, a CMDB link and an advanced presentation layer. However, the strategic ECA product that HP submitted for evaluation was surprisingly not the new OMi; it was HP Operations Manager (8.31 on Unix, 8.10 on Windows). Product strategy and road map changes and additions can result in customer confusion, requiring assistance in navigating the product portfolio. Nonetheless, HP continues to demonstrate how ECA functionality augments, enhances and leverages other IT management areas, including BSM, problem management, CMDB and storage management.

• HP has a renewed focus on ECA, enhancing its capabilities through organic development (e.g., the addition of predictive analysis), leveraged research (e.g., the causal and temporal event correlation models from Bell Labs), and integration with synergistic products in HP's IT operations management portfolio (e.g., the uCMDB and ServiceManager).
• HP has updated Operations Manager to meet the latest virtualization challenges, gleaning high customer satisfaction and showing that HP has the ability to keep up with some of today's leading challenges.
• HP's Operations Manager product has the second-largest installed base (behind Microsoft), and consistently appears on enterprises' shortlists, demonstrating credibility and market awareness.
• HP has built out-of-the-box domain knowledge into its agents to filter and correlate local events based on predefined policies and default thresholds, along with the templates for automated corrective actions.

• HP's ECA products require a monetary and labor investment that is generally too much to digest for midsize IT organizations looking for basic ECA capabilities.
• HP continues to change and update its portfolio, sometimes making it challenging to understand its road map and plans, especially relative to the new OMi product. Operations Manager customers are entitled to OMi, but must change to new service models and topology-based event correlation to take advantage of its advanced capabilities, or OMi can operate as a manager of managers over the top of a single instance or multiple instances of Operations Manager.
• HP clients and prospects sometimes complain that when they have a specific, narrow set of requirements (for example, ECA), HP brings in multiple adjacent products (for example, BAC, CMDB, ServiceManager), proposing an augmented solution that increases complexity and cost, and causes confusion when trying to compare HP's response to competitive alternatives.
• HP's list pricing for a Gartner-provided sample configuration was the most expensive of all the ECA quotes, although HP states that customers would receive significant volume discounts off the list price. Nonetheless, HP's large installed base and new-customer growth shows that customers are finding value in line with the price.

IBM is a large, global company with sales, support and professional services for its Tivoli software available worldwide. IBM Tivoli Netcool/OMNIbus (acquired from Micromuse) is widely used as a manager of managers because of its strong scalability, and because of its broad and deep capabilities to integrate and consolidate data from a wide range of IT components and third-party management products. IBM Tivoli gets credit for grappling with the complexities of event correlation and for developing a credible plan to address the full breadth of the problem with a three-tier approach:

• 1. Domain-specific management with component-level event correlation, preset thresholds and agent-rule deployment.
• 2. Consolidated operations management, with consolidation and normalization of events from a broad range of sources, event deduplication, filtering and causal analysis.
• 3. BSM with event processing against a service model to determine the service impact.

• Has the most comprehensive breadth of coverage in the Magic Quadrant, with depth of ECA capabilities across server, network, application, database, storage and mainframe, and agentless monitoring alternatives for some operating systems leveraging Simple Network Management Protocol (SNMP), Common Information Model (CIM), and Windows Management Instrumentation (WMI) technology.
• IBM gets high marks for BSM capabilities that map events to business impact, and for going beyond that to incorporate business events through integration between Tivoli event management, BSM and WebSphere Business Event Processing, with production examples as widely varying as a bank customer alerting the IT operations event console when automated teller machine (ATM) cash is low, to a military customer alerting IBM Tivoli Netcool/OMNIbus on the supply of ammunition in tanks.
• Tivoli recently added automated baselining to create bands of normalcy around various periods of time (time of day, on-shift, after hours, etc.) and compute dynamic thresholds as a standard deviation or percentage variance from normal to reduce the number of nonactionable alerts.
• In addition to the out-of-the-box correlation capabilities provided with IBM Tivoli Netcool/OMNIbus, the Netcool Knowledge Library provides event correlation rules for specific configurations or unique environments that customers can download.

• Solving the hardest ECA problems for the biggest of the big customers yields complexity and cost in the solution, not just software license cost, but also cost of deployment and ongoing cost of administration.
• Multiple acquisitions have left IBM Tivoli with a complex portfolio and multiple architectures that need to be rationalized and targeted toward a common objective, which makes it challenging for sales organizations to articulate Tivoli's value proposition, and has left buyers confused and unclear about IBM's long-term strategy and vision.
• Restructured pricing and packaging of IBM Tivoli OMNIbus and Network Manager for the midmarket has gained only limited traction, and is still widely perceived as too complex and costly for this size customer.

Interlink Software's Business Enterprise Server (BES) product is more often used for BSM, integrating results from a number of other multivendor ECA products, rather than being used as the ECA product itself. BSM shifting to become one of the factors contributing to the current product execution evaluation for the 2009 ECA Magic Quadrant has helped improve Interlink's ability-to-execute rating, although its very small customer base and limited growth in new customers serve to constrain this rating. When talking with Interlink clients, we find their satisfaction to be good; however, they also demonstrate a high level of IT maturity enabling them to leverage the value of business-aligned IT event management. Interlink focuses on large enterprises in the U.S. and Europe.

• Interlink Software has a surprisingly comprehensive vision, considering the small company size and R&D investment, and its vision resonates with customers who find that it aligns with their current requirements and long-term plans.
• Interlink's BES product demonstrates a solid understanding of the alignment needed between IT component events and their business impact on IT services, and is often used for BSM.
• Interlink's tightly coupled ECA and BSM solution provides a competitive advantage over vendors that require separate products for ECA and BSM, often with different user interfaces and a different look and feel.
• Interlink is working with Netuitive for real-time anomaly detection to relieve IT operations managers of the burden of manually reconfiguring default warning and alarm thresholds for thousands of parameters in potentially hundreds of thousands of managed objects.

• Interlink's market traction is very slow compared to many other ECA vendors, and demonstrates a need for it to aggressively build its sales and marketing organization, the lack of which significantly limits its ability to execute on its comprehensive vision.
• Interlink does not offer a native capability to autodiscover the IT service dependency map required for BSM and event impact analysis, having found that the available alternatives do not provide the level of granular detail needed to piece together the service model with IT infrastructure monitoring tools. Parent-child service relationships can be imported from spreadsheets, database tables, CMDBs and, in some cases, from IT infrastructure monitoring tools that a customer has purchased separately from another vendor. For customers who don't have resources from which to import the data, the IT service model is constructed manually through a wizard that allows users to assign which configuration items belong to which business services.
• As a small U.K.-based company, Interlink is still challenged in its ability to continue to invest in the development of its product, innovate and differentiate itself against much larger competitors with significantly greater resources.
• Interlink has traditionally invested in technical resources over sales and marketing, which has limited its market visibility.

System Center Operations Manager 2007 (OpsMgr) is Microsoft's strategic ECA product that has moved to challenge the capabilities provided by more-established and more-expensive ECA tools. Its predecessor, Microsoft Operations Manager (MOM), was aimed at the systems administrator managing small numbers of Windows servers. OpsMgr 2007 has increased its features and functions, providing a range of capabilities within a single product (including fault and performance monitoring and end-user response time monitoring). OpsMgr's features and functions are not unique compared to other ECA products; however, its solid capabilities for managing Windows servers in conjunction with its low price will continue to apply competitive pressure, especially in companies with large Microsoft Windows infrastructures. Microsoft's investment in management software is driven from its desire to reduce the total cost of ownership of the Windows operating system and Microsoft applications. Even though OpsMgr provides some limited non-Windows management (e.g., Linux) and Microsoft has done a good job at recruiting IT operations management partners (e.g., Quest and Bridgeways), its value diminishes when managing non-Microsoft IT elements, whether that management is provided by Microsoft or through third-party partners.

• OpsMgr has the largest ECA installed base (although not the largest revenue), and this has contributed to Microsoft's ability-to-execute rating.
• Companies that have a large, growing investment in Microsoft Windows servers are actively investigating using OpsMgr as a manager of managers. Conversely, in companies with a heterogeneous IT environment, OpsMgr is used by Windows systems administrators, and is typically deployed as a subordinate in a hierarchical event management architecture, passing Windows events up to a broader, general-purpose, multivendor event console.
• Microsoft's plans for OpsMgr include extending the functionality to network management through the partnership with EMC Smarts, and to manage a broader range of non-Windows IT elements.
• Microsoft's vision includes a plan to correlate IT infrastructure component events with logical service dependency models by leveraging its Distributed Application Designer, which is intriguing because it enables designers and developers to document configuration relationship and dependency information in models earlier in the application life cycle.

• Microsoft has chosen to focus its event management efforts on its own operating system and applications (such as Exchange, SQL Server, Active Directory and Internet Information Services [IIS]), and even though it is cautiously and tactically extending support for non-Microsoft software, it remains focused on Microsoft's overall strategic Windows-centric objectives, which constrains its completeness-of-vision rating.
• Microsoft continues to lean heavily on its partners to fill some major holes in its product coverage (e.g., monitoring of hardware, storage and non-Microsoft software, including applications, middleware snf databases), which introduces complexity (administration, etc.), costs (software, maintenance and, potentially, another product requiring additional skills) and risk (another vendor with its own support, road maps and priorities) into the equation.
• Existing MOM 2005 customers, especially midsize companies, are not aggressively migrating to OpsMgr, either because they are comfortable with MOM and see no reason to move, or due to OpsMgr's additional perceived complexity or the lack of requirement for this kind of more-mature, service-centric management.

NetIQ, an Attachmate company since 2006, is not specifically focused on ECA; it is treated more as a foundation function to support NetIQ's core competencies of application and operating system management. Nonetheless, NetIQ continues to augment its AppManager product, including, for example, expanding the AppManager Performance Profiler (AMPP) template library of out-of-the-box correlation logic by adding new templates for VMware, Web response time and network devices. These AMPP templates automatically baseline the environment (measuring application performance metrics continuously over time to determine the normal range) and provide dynamic thresholding (comparing current performance against the "normal" workload range to determine anomalies). NetIQ has a large installed base, and, while the number of licensed modules continues to grow, overall license revenue has declined, partially due to price erosion resulting from increased competitive pressures, especially from Microsoft.

• Some innovative ECA functions are included in NetIQ AppManager, such as using conditional logic at the agent level to perform multiple checks, validate errors and reduce the number of events that are generated for a single problem.
• The NetIQ AppManager for VMware product provides a visually pleasing holistic view of the virtual infrastructure, highlighting when one virtual server may impact others, including instances of consuming resources beyond its allocation, and the impact that virtual servers have on the applications running on virtual machines.
• NetIQ has shown some interesting innovation and market understanding with its AMPP product (licensed from Netuitive) to observe server and application performance baselines by time of day and day of week, and to automatically detect anomalous performance. Although AMPP is a separate add-on product not included in the core ECA product evaluated for this Magic Quadrant, AMPPP can nonetheless improve event management by helping to achieve proactive problem management and management by exception, as well as head off incidents before they occur.
• NetIQ has brought to market its run book automation (RBA) product, NetIQ Aegis, which is fully integrated with AppManager, enabling users to extend its value to automate fault management processes (for example, root cause analysis and fault-to-remediation).

• NetIQ is not specifically focused on ECA from a manager-of-managers perspective, and is typically deployed as a domain specialist in the middle tier of a three-tier event management architecture (see "Event Correlation and Analysis Market Definition and Architecture Description, 2009"), feeding results up to a broader, general-purpose, multivendor event console.
• NetIQ is a follower rather than a visionary in regard to articulating its direction and the value it contributes in many of the ECA product strategy areas we evaluated, such as problem management process, CMDB and IT service dependency mapping, and root cause analysis.
• Customer references report that NetIQ AppManager agent deployment, updates and patch management can be labor-intensive.
• Some Gartner clients have expressed a level of dissatisfaction with NetIQ's support and responsiveness, which is a turnaround since the last Magic Quadrant where client satisfaction was very good.

Nimsoft continues to grow as a company, increase its market presence, build its client base, increase its revenue and develop its ECA product. Nimsoft has successfully broken away from the small-vendor pack and has established itself as a viable alternative to the much larger, established ECA vendors. The product comes loaded with out-of-the-box reports and correlation rules for basic event consolidation and filtering across the IT infrastructure, supporting improved fault identification and isolation. New custom correlations can be created using the intuitive GUI. So far, Nimsoft has managed to extend and enhance its capabilities (e.g., performance management and BSM), without introducing more product complexity or significant cost. This will remain a challenge for Nimsoft as it continues to add capabilities to its product portfolio. This year, Nimsoft took the opportunity to rename its Nimbus product to Nimsoft Monitoring Solution (NMS).

• Nimsoft has gained visibility and market awareness, coming up regularly in client inquiries, showing impressive increases in the number of new customers in 2008, and successfully leveraging a growing management service provider (MSP) channel, all of which helped raise its ability-to-execute standing.
• Customer references report that Nimsoft's NMS product is easy to install and easy to use, and is a cost-effective, low-complexity alternative to the more established ECA vendors' products.
• The NMS product provides a wide range of reporting, which helps Nimsoft clients show operational efficiencies and business value.
• Nimsoft continues to innovate, extending its capabilities for managing virtual infrastructures and acquiring a company that offers BSM technology, both of which are new factors contributing to the current product execution evaluation for the ECA Magic Quadrant, helping to improve Nimsoft's ability-to-execute rating. It has also acquired Layer 2 and Layer 3 network discovery, topology mapping and root cause analysis intellectual property from Cittio, a vendor that previously appeared in the ECA Magic Quadrant.

• Nimsoft is now competing against much larger vendors with far bigger portfolios and market reach, and it will be challenged to maintain its momentum and the necessary level of investment to meet the growing customer demands as it continues to move further into larger corporate accounts.
• The primary product features from this vendor are focused on broad infrastructure monitoring and service-level management, rather than on the advanced event correlation capabilities that were evaluated for this Magic Quadrant.
• Although Nimsoft has successfully avoided this so far, as it continues to enhance and add to its products, there is a risk that its offerings will increase in both complexity and cost, negatively impacting two of the values that have driven product adoption, and having its product become the very alternative it dislikes.

NerveCenter has been around since 1993 and was regarded as one of the most-respected event correlation engines on the market. OpenService acquired the NerveCenter technology in 2001, after it had gone through a period of stagnation, being passed from owner to owner through a series of acquisitions. OpenService committed to moving the product forward and making the investment that previous owners had not. Subsequently, over the past eight years, there have been a number of infrequent releases (NerveCenter 3.8 released in December 2002, NerveCenter 4.0 released in May 2004, NerveCenter 4.1 released in April 2006 with NerveCenter 5.1, the latest version, released in November 2008). OpenService states that the next release is scheduled for 3Q09. Throughout all these releases, NerveCenter remains a product focused on network management, for which it receives very good feedback. The product family has been extended to include the OpenService log analysis and SIEM products that monitor for events associated with possibly damaged IT service components and that correlate, enrich and determine the level of risk and appropriate response associated with that damage. Even though OpenService has positioned NerveCenter with some of the markets' key initiatives (e.g., BSM, virtualization), its installed base continues to focus on managing the network at the element level.

• NerveCenter is a powerful, flexible product, with a strong event correlation engine, but it is designed as a toolkit.
• Customer references report that NerveCenter is very stable and resilient, and that they successfully use it as an event correlation engine that feeds root cause results up to a broader event console solution, such as HP Operations Manager or IBM Tivoli Netcool/OMNIbus.
• OpenService got a strong rating for security event integration, one of the factors contributing to the product strategy evaluation criterion under Completeness of Vision, based on three things: a well-thought-out strategy, the fact that the company is currently shipping products (thus demonstrating production deployments), and a good understanding of the differentiated requirements for the constituencies of IT operations and security.
• NerveCenter uses a unique thresholding function based on risk rather than on static limits. A risk calculation is performed for every event that it processes, where risk is a function of threat, vulnerability and asset value. As a result, IT operations receives fewer total alerts, and the ones they do receive identify the associated risk level.

• NerveCenter is a network-centric management product with limited capabilities for managing servers, databases or applications (providing support for applications that generate logs, via specific APIs or through SNMP).
• Most domain knowledge has to be provided by the user, entailing a significant investment of time in customization and writing rules to achieve value.
• NerveCenter has a very small installed base of customers, given the number of years that it has been available, likely due to the specialist nature of the tool. However, the installed based does include some of the largest financial services, telecommunications, aerospace and technology companies.

PerformanceIT focuses on midsize companies and delivers an easy-to-deploy, easy-to-configure product that appeals to IT operations environments that need to attain a basic monitoring and event management capability across a breadth of IT infrastructure elements without the cost and effort associated with large, enterprise-class alternatives. In addition to ECA, a basic trouble ticket system is available with PerformanceIT's product ProIT. Enhancements to ProIT (current version, 6.0) since the last ECA Magic Quadrant, published December 2007, include customized reporting services to allow users to create their own reports and integration to FreeMyIT, a smartphone- or PDA-based, remote-access tool for remote diagnosis and remediation of element issues.

• PerformanceIT has included an innovative AutoAnomaly feature that performs statistical-anomaly detection when current results are a standard deviation from normal baseline values.
• ProIT's integration with mobile devices helps free the IT administrator from reliance on a laptop or desktop system for problem resolution.
• Although not focused on sophisticated event correlation rules and automated root cause analysis, PerformanceIT offers some differentiated vision with its agents' ability to take a system snapshot at the moment an event occurs and launch real-time diagnostics, helping to reduce the time it takes to troubleshoot problems.

• PerformanceIT is a small, privately held vendor focused on North America, which limits its addressable market and ability-to-execute rating. Recent expansion to sign European channel partners has yet to show execution results.
• Customer references report that some manual effort is required to deploy and fine-tune agents to eliminate false positives.
• A growing number of ECA vendors focused on midsize companies is entering the market with value propositions similar to those of PerformanceIT, creating challenges and the need for PerformanceIT to provide clear differentiation.

Quest does not specifically focus on ECA, but it invests in ECA as a foundation function to support the primary core competencies of its Foglight product, which are database and application management. Quest's ECA innovations are focused on making its foundation an open architecture with an exposed service layer that customers, Quest professional services and Quest engineers can leverage to monitor data, build browser interfaces and create rules logic using Groovy scripts.

• Quest Foglight gathers data using a combination of software agents, remote (touchless) agents, and passive network packet capture technology, and presents events from the application, database and underlying server/operating system to determine their impact. It then provides an intuitive, graphical-dashboard portal to view availability and performance results.
• Quest has invested in applying ECA to the virtualized environment, providing visibility into the combined health of the physical host and guests within a single view. If a problem exists with a physical host, Foglight can identify which guests are impacted and vice versa.
• Quest demonstrates a good understanding of dynamic thresholding and pattern recognition, using moving averages and standard deviations off a baseline.
• Customer references indicate that the out-of-the-box reporting capabilities can help fine-tune thresholds, improving the event management process, and a GUI-based report builder can be used to create customized reports.

• Quest is not specifically focused on ECA from a manager-of-managers perspective, and Foglight is generally deployed as a domain specialist in the middle tier of a three-tier event management architecture (see "Event Correlation and Analysis Market Definition and Architecture Description, 2009"), feeding results up to a higher-level manager of managers, such as HP Operations Manager or IBM Tivoli Netcool/OMNIbus.
• Quest's list pricing for a Gartner-provided sample configuration was one of the most expensive of all the ECA quotes, although Quest states that customers would receive volume discounts off the list price, and less-expensive tiered pricing is available for customers requiring lower capability levels.
• Although Quest gets credit for some well-stated strategies for CMDB, whose IT service dependency models will be leveraged to assess business impact of IT component events, its vision ranking is constrained due to the lack of autodiscovery of the IT service dependency map. Manual relationship mapping is currently required to document the service chain; however, Quest expects to beta test an automated IT service dependency discovery capability in the near future.

ScienceLogic is a new entrant to the ECA Magic Quadrant, and has the only appliance-based product evaluated. Customers report that they appreciate ScienceLogic's appliance form factor and licensing model because it doesn't require a license for each device monitored, so they can pull back on some monitors in order to temporarily add more frequent polling for a problematic device, for example, balancing their appliance capacity any way they see fit. ScienceLogic's ECA product, called EM7, augments industry-standard SNMP with XML and other protocols to access newer, emerging management data sources. Although ScienceLogic EM7 has been in the market since 2004, it has not gained significant market awareness, and has a small, mostly North American customer base, with goals to expand to Europe and the Asia/Pacific region through channel partners.

• The No. 1 reason that customers choose ScienceLogic EM7 is cost. It's inexpensive and doesn't require agents, add-ons or plug-ins to support database or application monitoring.
• Operationally focused on features such as autodiscovery of Layer 2 network topology and automatically mapping parent-child relationships in both physical and virtual infrastructures to determine whether a detected event might affect other components of the virtual infrastructure.
• Thresholds can involve complex Boolean logic, and can dynamically change each poll cycle based on the polling of another object. For example, the number of active users with mailboxes can be used to set the acceptable threshold for number of e-mail messages queued for delivery.
• Customer references reported EM7 was extremely easy to deploy, and the appliance discovered the IT environment and set up monitoring immediately.

• SNMP, although ubiquitous, only provides very basic monitoring, and customers must expose SNMP on their own and must write scripts to enable monitoring of new types of devices.
• Although monitoring templates are included with the product that define default thresholds for various SNMP object identifiers (OIDs), customers report that for best results, time must be spent customizing the SNMP OIDs to be monitored and the relevant thresholds. ScienceLogic's monitoring templates are continually being updated with input from actual customers' operations, which should reduce this requirement.
• Some customer references comment that manual intervention is required to utilize and maintain the out-of-the-box event correlation capabilities that leverage the topology discovery.
• For business impact analysis of events, customers must manually define dependencies and critical paths for key applications and IT services.

Tango04 is a new entrant to the ECA Magic Quadrant. In addition to ECA, Tango04 provides BSM and SIEM. Since BSM is a new factor contributing to the current product execution evaluation for the Magic Quadrant, this has helped improve Tango04's ability-to-execute rating, although its small customer base constrains this rating. Tango04 targets SMBs in Europe and Latin America (where the company is called Barcelona/04 due to trademark issues with the Tango04 name there).

• Tango04's Visual Message Center product is more often used for BSM, rather than for infrastructure- or component-focused ECA, and some customer references have extended beyond BSM to business process monitoring and service-level management.
• Good breadth of coverage with specific agents that provide granular depth for monitoring databases and business applications, and can also integrate with other vendors' agents.
• Presents a real-time, dynamic calculation of the business impact cost of a component incident to the operator to better prioritize support resources, without the need to define weights or costs for each component.
• Tango04 gets credit for strong strategy and vision relative to security event integration, with many production deployments already incorporating SIEM.

• Limited global sales and support, focused on Europe (predominantly, Spain and France) and Latin America (predominantly, Brazil and Argentina), just beginning to invest in North America.
• Vision ranking is constrained, partially due to the lack of autodiscovery of the IT service dependency map. The IT service model required for BSM and event impact analysis is usually constructed manually through "drag and drop" editing, due to the top-down creation from the perspective of the business process, which can't be discovered. Tango04 views CMDB tools as not mature enough at this point to require the import of IT service relationship and dependency mapping information from them.
• Tango04's monitoring and event management of the virtual infrastructure, which is a new factor contributing to the current product execution evaluation for this Magic Quadrant, was not strong. Tango04 currently supports VMware with an SNMP-based agent that's in the midst of a needed update to a native VMware solution. Microsoft's hypervisor technology is not yet supported beyond basic SNMP or WMI metrics collection.
• As a small Spain-based company, Tango04 can be agile and responsive, but it will be challenged to innovate and differentiate itself against much larger competitors with significantly greater global resources.

TNT Software is a small but profitable vendor focused on small and midsize companies that use the Windows platform. It has a large installed base, but TNT Software has significantly smaller revenue per customer relative to many other vendors in this analysis. A healthy percentage of TNT Software's revenue comes through OEM partners, resulting in a stronger sales execution rating than overall revenue would normally indicate, due to the continuing annuity it gains from those contracts. TNT Software's ELM Enterprise Manager product addresses an important market sector, with clients that grow and expand their licenses. Its deployment model is to install service agents on Windows systems that communicate with the central ELM Server via TCP/IP. Support for non-Windows systems is provided only through SNMP or syslog messages, which it receives and converts into Windows event log format. The market segment that TNT Software plays in is becoming crowded, and simply providing a "good enough" agent-based Windows monitoring product is no longer necessarily sufficient to beat increasing competition.

• Customer references commented on the simple installation and ease of use with TNT Software's ELM Enterprise Manager product.
• TNT Software has a considerably larger installed base than most of the other ECA vendors, especially those selling into the same small and midsize market segment.
• The ELM product does a good job of consolidating, sorting, aggregating and filtering events.
• In addition to event consolidation, ELM monitors software inventory, hardware configuration, and quality of service of Microsoft Exchange and Microsoft SQL Server.

• TNT Software is focused on North American SMBs that use the Windows platform, which limits its addressable market and ability-to-execute rating.
• ELM is not focused on supporting complex-event correlation rules or automated root cause analysis, which are significant product execution and strategy evaluation criteria for this analysis.
• TNT Software will be challenged to maintain its momentum if it does not differentiate itself as Microsoft improves its management functions and more vendors appear to target the SMB market.

uptime software is a new entrant to the ECA Magic Quadrant, but its product, called up.time, was released in 2001. The company has a healthy and growing customer base, selling mainly to small to midsize IT organizations. The up.time product is not used as a manager of managers, but can provide a divisional or departmental-level management capability reporting to a manager of managers in a large or distributed IT infrastructure. It is one of a growing number of ECA products that combines both fault and performance monitoring, allowing it to provide availability data that addresses immediate real-time issues and service degradation over time. It also has good capabilities for managing virtual server environments, including the ability to show, in one holistic view, how each virtual server is impacted by the physical server (e.g., percent of usage over a period of time). Uptime software's ability to differentiate, attract channel partners and meet rapidly evolving market requirements (e.g., business-service-aligned availability management) will determine how successful it will become in a highly competitive market.

• Provides a combination of both fault and performance management.
• Very attractive price point.
• Distributed architecture.

• Differentiating itself in a highly competitive market.
• Innovation and new development to keep up with market requirements.
• Attracting channel partners to enable the company to grow and achieve global expansion.
• Integrating with other IT operations management tools in support of key IT operations initiatives (e.g., ITIL best practices, IT service desk, CMDB).