In our interconnected world of distributed business operations, it is vital to have an overall “Wood from the Trees” view of the state of the operational infrastructure.
Seeing the big picture allows for better informed decisions, resource optimization, and a reduction in the impact that problems have on our customers and user communities.
Software and equipment in computing and telecommunications infrastructures are instrumented to generate status events. Operating systems, Networking equipment and even applications such as SAP and Oracle, produce log messages and SNMP Traps indicating state changes and problems.
In isolation these messages are often meaningless, languishing in operations Silos who are aware of their own state and blissfully unaware of their impact on other areas of the infrastructure and business.
An Event Management system, also known as: Event Console, Enterprise Console and Event Correlation System, consolidates all messages from systems, networks, applications and element management systems (such as HP OpenView) into a unified management view. Gartner Group defines Event Management as:
Beware though, not all Event Management systems are equal. See the How does your Event Management System Stack Up section for more detail.
The Value of an Event Management System
When a problem occurs there is an impact to the business. The cost of the impact depends upon the duration of that problem, and the value of the services that are impacted.
The value from an Event Management system is realized through its ability to reduce the cost impact of a problem or issue.
The Impact Time, or, time taken to resolve a problem, has distinct phases:
The ability to more quickly identify that a problem has occurred and subsequently isolate that problem enables a reduction in Mean Time to Resolve which reduces the cost of the problem to the business and leads to happier customers.

The diagram above shows the relative benefits of an effective Event Management system. An effective Event Management system can reduce the MTTR by as much as 80%.
Not all Event Management systems were created equal, and, not all Event Management systems were designed to reduce your Total Cost of Ownership.
Rivermuse Lore: Only implement a fault management solution if the value returnable is greater than the Real projected Total Cost of Ownership investment.
(Some unscrupulous companies out there have some hidden charges, or, give you a friendly startup price but make out like bandits when it comes to maintenance, upgrades and administration services)
There are essentially three categories of Event Management System in the market today:
The Manager of Managers is a specific type of Event Management platform. Typically these products were designed purely to consolidate events from various sources. To allow operators to view those events from a central location.
Their performance is characterized with a high level of configuration and customization to actually deliver any value. Often professional services work needs to be carried out just to ‘describe’ the events that the MoM will be capable of receiving, known as the ‘Inclusive Management Paradigm’ because you have to tell it what to include.
The reason MoM solutions used the Exclusive Management Paradigm was simple. The vendors took the view that there would be too many events presented to an operator if all events were included in the system and so they thought it would be easier to only show operators specific events. You gotta love Software Engineers!
Our view is that the Inclusive Management Paradigm is a bizarre way of operating a management tool. Think about it, you create rules to ensure that the events you want to know about will be presented to your operations staff, however, it is unlikely that we will actually ever know all the events that our infrastructure is able to produce, and so, we will miss a high proportion of events – we just simply will not see them – and that means we’ll be running blind.
MoM tools are very expensive to implement, and it’s our contention that in reality, they can never become operational, because by the time you have created rules for all the events you might want to see, those events have changed due to equipment upgrades so you have to start again. It’s like painting the Golden Gate Bridge in the San Francisco Bay.
These products have often been marketed at discrete market segments such as Microsoft Windows, Telecommunications, and Mainframe operations. Examples of Manager of Manager tools include: Microsoft MoM, HP OpenView TeMIP, BMC Event Manager, HP OpenView Operations and Tivoli TEC.
The Event Correlation System was originally commoditized some 15 years ago by Micromuse (now IBM Tivoli Netcool) back in 1993 with its flagship core product Netcool Omnibus heralding the innovation of the ‘Exclusive Management Event Paradigm’.
The idea was simple; point to a source of events and begin receiving them all, however to ensure that operations staff were not overwhelmed by the volume of messages, automatically filter repeated events (known as ‘de-duplication’) to enable operators to see the wood from the trees and quickly identify problems, secure in the knowledge that no unknown events will be missed.
Prior to Netcool's exclusive paradigm, manager of manager products required a filter to be configured for every event to be included within the system: The Inclusive Management Paradigm.
Netcool Omnibus allows filtering out of known, irrelevant event message types, reducing the noise, and to apply correlation rules that related specific event scenarios together. When a problem occurs, highlight known symptomatic events, and when the problem has cleared, the system can clear all the symptomatic events.
In a stroke, Micromuse invented an Event Management system that could be deployed rapidly and offered value in a very short amount of time.
Let’s face it, those in the know recognize that Netcool is the best of the best of the legacy Event Management systems, but it comes with a huge Achilles Heel. Netcool's owners added configuration modules and components like Sarah Winchester added rooms to her Winchester House. As a consequence Netcool comes with a startup price northwards of $500k and an annual TCO in similar proportions.
Just like the Winchester House, each of the Netcool components is administered using a different configuration language with no integrity between its Event Filtering, Event Correlation, Event Escalation, Event Enrichment, Service Views and Business Service Management components.
In fact, although Netcool offers the highest value of all the legacy Event Management systems, its cost of ownership is often as huge as its legacy competitors due to its Achilles Heel.

The diagram above illustrates the issue. Over time, the benefits derived from an Event Management system are wiped out by the increasing total cost of ownership of the platform itself. The longer you own Netcool its economic viability diminishes.
There is a third factor that also impacts the economic viability of the legacy platforms today and that is their vendor’s own software licensing pricing and professional Services Heavy deployment methodology. The vendors of the legacy Event Management systems are without exception large vendors who like protect their revenues with large projects with long tails, maximizing revenues for as long as possible.
Value of MTTR Reduction > Outright Cost + TCO of Enterprise Console
There is a classic advert on British TV whose message has stood the test of time. It is for a tin of clear lacquer/varnish called “Ronseal Quick Drying Varnish”. The advert slogan goes: "It does what it says on the tin, it’s Quick Drying Varnish!"
Well, let us just be plain and clear here, let’s not use any ‘marketing speak’, with no talk about Service Level Management, Service Assurance, BSM, etc etc. RiverMuse does what it says on the Tin; RiverMuse is an Enterprise Event Correlation and Console solution. And you can own it Free of Charge. Simple.
We took the concept of the best of the best Event Management systems, and then we fixed the Achilles Heels, oh, and then we built it on a thoroughly modern technology platform.
Although the headline benefit of an Event Management solution is its ability to reduce MTTR, the relevant feature to base value upon is its Total Cost of Ownership.
RiverMuse is the only Event Management platform designed from the ground up to offer class leading MTTR reduction while also offering the lowest total cost of ownership of any available platform.
RiverMuse’s Event Management system offers the functionality of traditional Event Management platforms but uses a thoroughly modern architecture and a single configuration language throughout the entire platform.
RiverMuse is simply designed to be the best performing and lowest total cost of ownership Event Management system available.
CRAFT
The Configuration Resilience Administration Framework Tool is at the core of the low total cost of ownership of RiverMuse ProCool edition. CRAFT ensures configuration integrity across the entire platform, from deployment maintenance to filtering and correlation configuration through to user administration. High availability is built into the core of the platform. If communications between components are lost for a period of time, no events are lost, and when the connectivity is restored, all those events will make it to the core. RiverMuse monitors all states of TheOS components in real time.
CORE
The Central Object Repository Entity represents the data infrastructure for the platform. CORE maintains each event as an Object. Any application of filtering, correlation, enrichment and containment does not change the original Object. The data architecture protects the integrity of every event in received by the system. This architecture allows for applications in Telecoms and IT event management a well as in RFID, SCADA and Security since no core data is ever removed or changed in any way. Standard out of the box filters include De-Duplication and Failure-Recovery Correlation.
SEED
The Status Event Encapsulation Daemon is an optimized implementation of the rsyslog daemon. SEED supports event interfaces from a wide range of sources including Syslog, Windows Event Log, Applications, Databases, TCP & UDP Sockets, Files, SNMP and other sources. The platform is resilient to communication failures, allows for encrypted data transmission, and filtering and complex mediation, along with an extensible API.
VIEW
Visual Interface Events Window. RiverMuse is an event management system and VIEW represents the standard user interface framework. VIEW is an emersive operator environment that is supplied with Event Lists, Presence Views, Filtering and Tools components. From an event or a managed object, an operator can use vendor specific tools, SSH or FTP to access the managed object directly from the specific event.
GATE
Generic Access To Externals represents the Business Process Integration and High Availability plaform for RiverMuse. GATEs allow management hierachies to be implemented and ensure that RiverMuse integrates seamlessly with external tools, technologies and processes.
UCS
Rivermuse's patent pending Universal Conditioning Service is a modern innovation in network management message filtering, correlation, conditioning, enrichment and business process escalation. By combining innovations including a Transportable Business Logic descriptor language and Universal Event Tag mechanism with a global Universal Event Tag Directory, RiverMuse enables the Network Management community to shake off the shackes of perpetual custom event rules development. UCS is a TCO reducing revolution.
RiverMuse is here to challenge the Network Management status quo: where our industry has seen no real innovation since 1998. Our strategy is to offer a core technology framework and application tools that allows a Community of commercial, social and amateur developers to deliver quite simply the optimum operational support system software solution.
This Community delivered solution will find a user-base in organizations who are disillusioned with the legacy players and their lack of innovation and anti-competitive marketing strategies, and specifically with MSPs and Enterprise customers who cannot realize economic value from the procurement of the legacy solutions available.
The delivery of a solution as a free core platform combined with:
RiverMuse is built upon a robust core platform but takes advantage of open source components that are proven to be reliable, scalable and resilient.
One of these components is rsyslog which has a natively scalable, secure and resilient architecture and, works with any source of event data, for example:
RiverMuse is highly scaleable, not simply through our thoroughly modern software platform, but also due to our use of MySQL as the database platform. Not only does MySQL perform significantly better than the proprietary memory resident databases of the legacy event management tools but, MySQL is thoroughly modern, being able to take advantage of multi-threading and multiple processor cores.
rsyslog is an enhanced multi-threaded syslogd with a focus on security and reliability. It offers support for on-demand disk buffering, reliable syslog over TCP, SSL, TLS and RELP, writing to databases (MySQL, PostgreSQL, Oracle, and many more), email alerting, fully configurable output formats (including high-precision timestamps), the ability to filter on any part of the syslog message, on-the-wire message compression, and the ability to convert text files to syslog. It is a drop-in replacement for stock syslogd and able to work with the same configuration file syntax. Its advanced features make it suitable for enterprise-class, encryption protected syslog relay chains while at the same time being very easy to setup for the novice user. Find out more about rsyslog here.
The MySQL database has become the world's most popular open source database because of its consistent fast performance, high reliability and ease of use. It's used by many of the world's largest and fastest-growing organizations to save time and money powering their high-volume Web sites, business-critical systems and packaged software — including industry leaders such as Yahoo!, Alcatel-Lucent, Google, Nokia, YouTube, and Zappos.com.
Not only is MySQL the world's most popular open source database, it's also become the database of choice for a new generation of applications built on the LAMP stack (Linux, Apache, MySQL, PHP / Perl / Python.). More information about MySQL can be found here.
The RiverMuse user interface builds upon best practice in the Event Management sector. We’ve listened to both Telecoms and IT operations staff and included some of the most basic items that the traditional platforms have ignored for so long.
Take ‘Time’ for instance. There’s the timestamp in the original event, the timestamp for when the event was received by the RiverMuse mediation (SEED), and the time that the message was inserted in the RiverMuse database – we keep them all and we allow operators to quickly relate to their customer’s experience.
Then there’s Presence. One of the major flaws of Event Management tools is an actual knowledge of what is present in the infrastructure and sending event messages. RiverMuse shows all the nodes that messages have been received from, and, allows operators to be notified should messages not have been received within set time parameters. We call it Presence Management.
Of course, one of the highest cost of ownership items is the integration with external Business Processes; Problem, Incident and Release such as advocated by ITIL. RiverMuse’s Business Process Integration Framework has been architected to simplify the automated escalation to and notification from external business processes, ensuring that RiverMuse fits snugly into your operations organization.
RiverMuse offers SNMP, SQL, and specific application interfaces.
RiverMuse achieves the lowest total cost of ownership of any Event Management system through its CRAFT system which offers a simple user interface to all configuration and management functions.
CRAFT, the Configuration Resilience Administration Framework Tool, provides: a unified user interface to all data conditioning; event source mediation, event content filtering, event correlation and enrichment, and; monitors and manages the health of the RiverMuse deployment; administers user access, and; offers programmer interface ensuring that any third party add-ons to the RiverMuse TheOS can be monitored, managed and administered using CRAFT.
CRAFT works in concert with the RiverMuse Updater Service which uses Redhat’s RPM (Remote Package Management) and YUM (the Yellowdog Updator) to automatically update and maintain the installed RiverMuse platform without user intervention.
Our goal is to provide an Event Management offering that surpasses traditional commercial offerings in terms of features, functionality, scalability and benefits to its user community, and a customer experience that reflects:
and that
RiverMuse is supplied in multiple editions: as a source code bundle (CoolSource), a free packaged platform (RiverMuse FreeCool), and a premium version (RiverMuse ProCool). All editions can be downloaded here.
Both the RiverMuse FreeCool and RiverMuse ProCool editions come with a 30 minute Installation and will be generating value within 8 hours.
RiverMuse provides free access to versions of our source codeline to allow developers in end user corporations, integrators and enthusiastic individuals to build upon the platform.
RiverMuse FreeCool delivers an initial experience of a 30 minute installation and 8 hours to generate real value, while your lasting experience will be the lowest total cost of ownership of any enterprise event console.
RiverMuse FreeCool offers similar functionality to IBM Tivoli Netcool Omnibus but without any software license, professional services and maintenance costs.
FreeCool includes SEEDs for Microsoft Windows, Unix Syslog, Log Files, TCP and UDP Sockets and SNMP.
RiverMuse FreeCool automatically de-duplicates repeat event messages and correlates ‘failure and recovery’ pairs of event messages.
The innovative web based user interface is a fully authenticated multi-user, event management environment designed around the specialist requirements of operations departments.
RiverMuse’s FreeCool is the commoditization of Event Management.
RiverMuse ProCool edition adds the Universal Conditioning Service (UCS) to the value of RiverMuse FreeCool to change the economics of event management systems administration and maintenance. UCS represents a major innovation in Event Management. We think the first major innovation in over 10 years. UCS includes the following patent pending innovations:
Transportable Business Logic (TBL) is a standardized definition for event conditioning that enables diverse implementations of RiverMuse ProCool to share the same filtering, correlation, conditioning, enrichment and business process escalation rules.
Universal Event Tags (UET) enables a single Event or Alert message tag to be mapped to any number of descriptions allowing re-use within a single implementation of RiverMuse or across diverse and distributed implementations. Universal Event Tags enable any implementation of RiverMuse to share message translations reducing the cost of administration and maintenance.
The Universal Event Tag Directory (UETD) represents a global resource and single point of truth for event message tag translations. Just as a can of Coke has a Universal Product Identifier, discrete event message tags will have a unique identifier tag. The UETD delivers the mechanism for low cost sharing of translation effort and Event Tag Definitions across the community.
Through the use of the Transportable Business Logic protocol, Universal Event Tagging mechanisms, and an enriched RiverMuse CRAFT administration system, RiverMuse ProCool offers the lowest total cost of ownership of any commercially supported Network Management platform available.
At RiverMuse we understand that your Event Management system represents the core of your mission critical operational support system.
FactoryCare is a fully accountable support and maintenance service. RiverMuse has a range of packaged support and maintenance offerings or we can create a custom service to meet your specific requirements.
FactoryCare is there to protect your operations when they need it.
CommunityCare is an innovative program designed to enable customers, implementors and developers of RiverMuse Marketplace solutions to deliver a community support network. CommunityCare works in conjunction with the Marketplace to connect demand with supply.
RiverMuse offers value to any category of organization, large, medium or small, Telecommunications or enterprise, Public Service or Utility.
It’s all about Cost of Ownership. RiverMuse offers an Event Management platform with the same and better functionality than their existing tools while significantly lowering their bottom line investment and value proposition.
The incentive to migrate to RiverMuse is driven by the platform’s ability: to integrate with any of the Service Provider’s legacy platforms; reduce the complexity of the event management instrumentation, and; simplify the management and maintenance of business process integration.
There has never been an effective, affordable Event Management system with a low total cost of ownership available to the enterprise. RiverMuse changes the economics for Event Management for enterprise customers, whether Large, Medium or Small, offering a low cost of acquisition, low cost of ownership, and Service Provider grade scalability, resilience and performance.
Interestingly, implementing an effective Event Management solution, for example: RiverMuse, offers higher value to the Enterprise than an SNMP oriented management tool such as HP OpenView.
The advent of Smart Metering, broadband over power networks has brought a renewal of Utilities’ infrastructure with Service Provider grade network and systems. This has led to the need to manage the new with the legacy, and to integrate SCADA control systems telemetry. RiverMuse offers better value than traditional Event Management platforms while also providing a versatile SCADA telemetry management platform that supports the requirements of regulatory authorities.
Effective Event Management offers a significant value proposition to Defence and Government and Public Service organizations, however, in the case of the legacy Event Management platforms, while neither the economics and the inherent insecurity of the platforms stacks up, the legacy platforms do not offer the forensics required meaning that additional expensive security infrastructures are needed to bolster the platform itself.
No only does RiverMuse offer the lowest total cost of ownership of any Event Management platform, but RiverMuse has data encryption built into its communications architecture, protecting the value of the customers’ data as well as their fiscal budgets.
Why separate Investment Banking from the general Enterprise? Because Investment Banking operations organizations typically develop more software inhouse than general enterprise companies, and typically, their custom software is instrumented to create performance metrics which are logged to files and syslogs. Most investment banks have implemented an Event Management strategy with one of the traditional legacy platforms.
Over time, the banks have found that their Event Management vendor has increasingly reduced the economic value from their offering by a lack of investment in performance and features combined with an increase in license, maintenance and professional services charges, however due to the development investment in custom instrumentation by the banks, a form of lock in exists.
RiverMuse allows the investment bank to freely take on the ownership of the components of RiverMuse that they will embed into their custom applications, while procuring support for the core RiverMuse components that make up the commodized offer.
The Investment Bank benefits in the form of better functionality and a lower total cost of ownership all without the lock in of a traditional Event Management vendor.
Many innovations in operations management have been driven by the needs of Education and research organizations, for example, ITIL was conceived of and implemented in Universities and has led to a range of management technologies, especially in the area of CMDB.
RiverMuse FreeCool enables Educational organizations to take advantage of the outright procurement and total cost of ownership advantages of RiverMuse, but since the source code and programming interfaces to the CRAFT, SEED, CORE, GATE and VIEW freely allow operations innovators in the Educational facilities to add specific and generic components to their platforms, they can improve their own management infrastructure while making their components available to the RiverMuse Marketplace, either for free, or for profit.
Additionally, since the source code is available and RiverMuse is commercial grade software, the application can be used as a development platform for the coursework of students engaged in software engineering disciplines where a useful outcomes can be demonstrated.
The RiverMuse CoolCommunity is being launched to support unfettered innovation upon the RiverMuse platform across all disciplines of Operational Support Systems and the greater Network Management discipline.
Rivermuse is committed to advancing the use of open source in the Network Management. In order to further that goal we are creating the RiverMuse CoolCommunity, founded to enable any party to take advantage of our platform, whether for commercial of social purposes.
The RiverMuse CoolCommunity will help bridge the gap between organizations using the RiverMuse derived software and the committers and contributors who develop and maintain the platform and projects. The RiverMuse CoolCommunity will be chaired by a group of software developers from commercial and social backgrounds who are committed to the success of a community inspired platform representing a network manage operating system. Rivermuse will provide the financial assistance required to maintain the community facilities and cooperation.
RiverMuse for IBM Tivoli TEC Owners
So you're a Tivoli TEC owner. That means you fit into one of two profiles:
Profile 1: Your business has spent significant time and resource on configuring TEC to deliver functional value.
Profile 2: You have tried to configure the product to work for you but found that benefit equation does not offer value to your organization.
Either way, you have a product that has no life left in it. IBM are offering you Netcool, and although you'll know that Netcool is the best of the traditional enterprise consoles, it's cost of ownership is too high for you, and that IBM’s "Netcool Lite" is like that first offering of an addictive drug, if you accept the offer, you'll be sucked in to a high future Total Cost of Ownership. Let’s face it, IBM has left its Tivoli TEC customer base with a problem. They are in a hole: Transition to Netcool or don’t stay with IBM’s Event Management at all.
The sad thing is that until RiverMuse, TEC customers’ choice of ‘new’ Event Management platform was restricted to an alternate range of legacy solutions; all the traditional platforms were designed at least 15 years ago! Oh, and they all come with a higher total cost of ownership than Netcool.
RiverMuse gives Tivoli TEC customers an alternative, both economic and functional.
There are no license fees with RiverMuse FreeCool, and the transition from Tivoli TEC to RiverMuse will be less complex than with any other platform. Of course, once on the RiverMuse platform, TEC customers will benefit from the lowest total cost of ownership of any Event Management platform. The economics and the functional benefits will all speak for themselves.
RiverMuse for IBM Tivoli Netcool Owners
(IBM Tivoli Netcool Omnibus / Micromuse Netcool Omnibus, Cisco InfoCenter)
What a great product – we think so, we originally conceived, designed and built Netcool as an antidote to the offerings of the day. However, we never finished it and, neither did the people who inherited Micromuse after we left, nor have [or will] IBM. The issue is Netcool’s discombobulated configuration methods that lead to an ownership Tax on you, the customer.
Although Netcool is undoubtedly the best-of-the-best Legacy Event Management system, having invented:
Netcool hobbles around on a major Achilles Heel. Namely, the more filtering and correlation, the more embedded complexity in the platform since Netcool has three different configuration programming languages that have no configuration integrity. Consequently, the more you use Netcool the higher the Total Cost of Ownership gets.
RiverMuse offers the same out of the box functionality as Netcool, however with a thoroughly modern architecture, configuration is easier to perform and maintain offering a significantly lower total cost of ownership. Oh, and did we tell you the core RiverMuse FreeCool is free?
RiverMuse will gradually introduce migration tools for Netcool customers, initially we’ll enable our customers to consuming Netcool Probe events, and in the future, RiverMuse will launch a ‘Netcool Configuration Conversion’ tool to simplify migrations of Probe Rules and ObjectServer Triggers and Actions.
RiverMuse for HP OpenView OVO/Operations / TeMIP Owners
So you’re managing with HP’s OpenView OVO. You either procured the product because you’re an OpenView Network Note Manager [NNM] customer and it the OpenView sales person ‘upsold’ you or, you have an Outsource Services contract with HewlettPackard and HP introduced OVO as part of that contract.
HP OpenView OVO represents the pinnacle of Hewlett-Packard’s event management expertise for its Enterprise customers.
Hold on a moment though, HP OpenView TeMIP represents the pinnacle of Hewlett-Packard’s event management expertise for its Telecoms and Service Provider customers.
This is all rather odd. Does HP believe that Telco and large Enterprise customers need fundamentally different technologies to support their Event Management requirements or, is Hewlett-Packard totally out of ideas, finding itself owning two or more legacy platforms (let’s not forget their Mercury products too!) through acquisition.
Perhaps both of these products generate significant maintenance and services revenues for the company in their respective customer bases that HP has chosen to put profit in place of innovation. From a purely commercial perspective, HP have made the right choice, if they had forced their customers to choose one or the other platform, they would be in the same place as IBM with Tivoli TEC, with their customers forced to take a look at the wider market.
Well, the facts are, more customers have switched from OVO and TeMIP to Netcool than the other way, so if you are a customer of either TeMIP or OVO / Operations, then RiverMuse is here to help you. RiverMuse offers better functionality, better scalability, and easier configuration than either OpenView OVO or TeMIP, while also offering a much lower total cost of ownership.
RiverMuse challenges that three years of ownership of the RiverMuse platform will cost less than 3 months of OpenView TeMIP or OVO ownership, and, additionally, more of the infrastructure will be under effective management using RiverMuse than can be managed by both HP products combined because maintaining TeMIP and OVO is like a painting contract for the San Francisco Golden Gate Bridge!