MOM has always been a great tool out of the box because it sort of FORCED you to implement an Incident Management Process to deal with Alerts, as described here:
http://ianblythmanagement.wordpress.com/2006/07/27/mom-2005-and-itil-part-1/
In fact, Alerts had to be actually set to “Resolved”, and this had to be done manually.
I have now been wondering for a while: “How is OpsMgr2007 going to affect this?” I refer to the fact that now OpsMgr2007 does something customers have been asking for a while: it can auto-resolve alerts as soon as the incident/issue is fixed, by monitoring the state of the component rather than waiting for people to resolve it!
Practically, people were often the bottleneck, due to a missing Incident Management Process. MOM has tried for nearly 8 years to push them to implement one… and I feel that it finally gave up even trying.
All the other stuff described in the other two articles of Ian’serie do still apply.
For Capacity Management nothing substantially changes.
Availability Management is greatly improved, with the generic “availability report” and the state roll-up feature provided by the new Health Service and the new ways object are discovered and instantiated and the way their health models work.
Problem Management can also still be done, and Alert tuning will be still required (but it should be slightly easier now, with the improved “overrides” kind of thing).
Service Level Management can also be done – this will actually be done much better: if the system knows you’ve fixed the incident and it closes the alert for you, SLA calculations will be done on the REAL down/up-times of services, not on people keeping the Alerts open forever like I have seen in many places.
This means it will be done better, WITHOUT relying on people.
All in all there are substantial changes in OpsMgr2007, most of them are for the good…. but still, I think, I will be missing the fact that people have to actively look at their consoles and manage Alerts the way they were asked to do before. I will miss all the talks I used to do about “you HAVE to manage your Alerts/Incidents”, now.
I was so wrong. How much Alert/Noise tuning is still required!