A prescription for preventing service outages

Configuration management databases can alert managers to dangerous interactions

Editor's note: This story was updated at 3:45 p.m. March 12, 2007. Please go to Corrections & Clarifications to see what has changed.

One of the most elusive aspects of overseeing information technology operations is understanding the effect of routine and not-so-routine system changes so you can minimize any disruptions in IT services. That challenge has become more difficult as IT architectures have grown in complexity.

It’s not that IT organizations don’t understand the technology they manage. Each pocket in an IT organization has its own favorite management tools and databases. What each is missing, however, is a holistic view of the complex environment for which it is responsible. For example, how might adding a software patch to one server affect other servers? Because IT staff can’t see how all the components interconnect within their organization, tracing the root causes of IT problems and planning system changes are difficult and time-consuming tasks.

The purpose of configuration management databases is to simplify that challenge. A CMDB is a repository of system configuration profiles and information about how they relate to one another and the business processes they support.

CMDBs are like the software that alerts pharmacists to dangerous drug interactions. Used properly, a CMDB supplements the best practices that many agencies are adopting for incident, problem and change management, such as those outlined in popular management improvement schemes such as the IT Infrastructure Library (ITIL).

However, the technology that might help agencies build a CMDB is still relatively new. Companies — with the exception of BMC Software, which has been in the market for a few years — began offering commercial CMDB solutions only about six months ago, said Ronni Colville, a vice president at IT research firm Gartner. “We’ll see some real maturity within three to five years,” she said.

But some IT executives are interested in what the technology has to offer now. Here are frequently asked questions that address some basic issues.

What exactly is a CMDB, and why might I need one?
A CMDB is a database containing information about your organization’s hardware components, software versions and settings, and the relationships among them. It compiles its data from other management databases, which is why some people refer to it as a federated database. 

A CMDB moves organizations away from the practice of using fragmented toolsets to solve service delivery-problems and toward better decision-making about how potential changes in the infrastructure might affect services. “Taken as a whole, it’s an enabler to support consistent processes across IT, so that basically everyone sees consistent, accurate and trusted data, and draws from the same kinds of information,” said Dennis Drogseth, vice president of IT at analyst firm Enterprise Management Associates.

The CMDB also supports configuration management activities such as auditing and verification that are are central to how IT departments support systems. “Configuration management is a service that serves all the other service management processes,” said Joe Lithgo, chairman, chief operating officer and operational excellence program director of North Carolina’s Office of IT Services.

The state launched its ITIL program in 2004 to improve the efficiency and effectiveness of its services, and now it plans to create a CMDB.

“In itself, configuration management provides no value to the organization — its only value is in its relationship to processes like change management, service desk and incident management,” Lithgo said.

But that value can’t be underestimated when you consider how system changes can affect productivity, experts say. Disruptions from planned or unplanned changes account for as much as 80 percent of IT downtime, some studies show. “CMDB is a vehicle to mitigate the risks of change by giving [organizations] an understanding of the elements and relationship of elements within the infrastructure,” said Dustin McNabb, vice president of marketing at business service management vendor Managed Objects.  

Can I buy a CMDB, or do I build one?
Most people will end up doing a little of both. “The worst thing is to think you can buy something that is a CMDB,” Drogseth said. “A CMDB is not something that you have. You evolve a CMDB system.” Organizations can invest in CMDB software from companies such as IBM, BMC, Hewlett-Packard, CA or Managed Objects to get started. That software will be a component of the system but not the complete system, he said. 

Before rushing to buy any new tools, take a close look at what you have, said Lou Hunnebeck, IT services management practice director at ITSM solutions provider CCN. Organizations often are already doing configuration management at some level without labeling it as such. They use tools as part of that effort but not always to their maximum capability.

What are the components of a CMDB?
A CMDB performs federated functions not associated with traditional database or inventory tools, Colville said. A CMDB stores only a subset of detailed configuration data for components in the database. That typically amounts to only about 30 percent of the data people have in their IT domains, she said.

One of those federated functions — linking to other data sources — is tricky.  “All the [CMDB] vendors are pretty good — some really good — at integrating and federating to their own products but not at all not good at integrating and federating to other vendors’ products,” Colville said.

Maintaining federated links can quickly become an onerous job, given the complexity of most IT systems. “For every federated source, you increase the complexity of your CMDB,” said Bill Irvine, executive consultant for IT service management consulting firm Pink Elephant. “You must then manage the spider web of where data comes from and who controls it.”

A second function is reconciliation, which determines which discovery tool will be the data source for the CMDB. “Reconciliation says, ‘You tell me what the trusted source is, I will compare other things against this, reconcile, normalize and only put the right data into the CMDB,’ ” Colville said.

A third function — and one that Colville said is a fairly advanced function for most organizations implementing CMDBs — is synchronization. It refers to a process of updating the CMDB and implementing closed-loop change control.

That process involves sending alerts to domain data-source engineers for remediation when the CMDB detects inappropriate configuration changes.

Visualization is a fourth function of CMDBs, which display peer-to-peer, hierarchical and parent/child relationships among configuration elements.

 “Today the only way to do that without CMDB is in [Microsoft’s] Visio — manually,” Colville said. CMDBs offer real-time integrated views of various data sources.

What comes first — setting up a CMDB tool or defining processes for configuration management?  
“A lot of people get enamored with starting with the tool first,” Lithgo said, adding that “it’s a big mistake.”

Irvine said he agreed that people can easily misuse the tool. “A CMDB is thought of as something technical when in many ways it shouldn’t be,” he said. “It should be treated as more of a services-based project that identifies first and foremost all the services you want to map in the CMDB.”

A service-oriented approach is the way to proceed, said Andy Atencio, manager of information and technology for Greenwood Village, Colo. The city will be using a hosted CMDB to supplement its ITIL best practices.

If a technology component isn’t directly connected to the provision of a specific IT service or business process, it doesn’t warrant being tracked in the CMDB, Atencio said. “You have to be smart because otherwise you are tracking everything,” he said.  

Other experts offer similar advice. “The big key is process first, and let the tool serve the process,” Lithgo said. “Historically, IT organizations have been about heroics, secret knowledge and the select few. That’s hard to give up,” he said. But all secrets about how things work must be shared via the CMDB if the organization expects to achieve repeatable processes and replace anecdotes from the IT trenches with tangible metrics, he added.  

Can I implement a CMDB without subscribing to ITIL?

Organizations don’t have to subscribe to ITIL management best practices to effectively implement a CMDB, but it’s a good place to start, most experts say.
“You’re wrong to do a CMDB without attention to best practices and processes,” Drogseth said. “As a general rule we would recommend spending a lot of time studying ITIL.”

Do CMDB standards exist?
Not yet. “The challenge is that CMDBs today are completely proprietary — there are no standards, so every vendor has created their own little way of doing it,” Colville said.

Vendors typically have proprietary federation and integration techniques, which create interoperability problems for users who prefer not to be locked into a vendor-specific solution and for other vendors whose products must interoperate.

Application, database and Windows management vendor Quest Software is making what its officials said is a substantial investment in automation and adaptability so it can populate CMDBs with data stored in its systems. “The CMDB players say federation is possible and doable,” said Tyler Jewell, senior director of product management at Quest Software. “I would counter and say, ‘The reality is there are very few standards [for] the repository of information in the CMDB itself and, even worse, very few standards that govern interoperability between the CMDB and repositories it may need to get information from.’ ”

However, companies are taking initial steps to develop standards. Last year, BMC, CA, Fujitsu, HP, IBM and Microsoft formed the CMDB Federation Consortium. The group published a white paper in January describing its proposed approach to the federation of management data from multiple repositories.

Zaino has been covering business-technology issues since 1986. You may write to her at jennyzaino@hotmail.com.
Pointers for perfecting a small-scale CMDBIt’s a tall order to serve the needs of 250 city workers with a staff of only five information technology employees. Faced with that challenge, Andy Atencio, manager of information and technology for Greenwood Village, Colo., began using service management best practices four years ago. 

As part of its adoption of IT Infrastructure Library best practices for service management, Atencio’s group is moving away from spreadsheets, flow charts and diagrams and developing a configuration management database (CMDB). The payoff is that Atencio’s group can keep city employees better informed about potential service disruptions. 

Most CMDB tools don’t lend themselves to use by organizations as small as Atencio’s, he said. But that’s not true of a product called Octopus from ESI Technologies. The city pays a subscription fee for access to the software, which ESI developed and hosts.

The Greenwood Village IT organization uses Octopus to support its incident and problem management procedures. It will soon integrate Octopus into its change management procedures. “We’re bringing everything together and drawing all connections in a single tool that will allow us to use a CMDB the way it should be used,” Atencio said.

Small IT organizations such as Greenwood Village’s have unique challenges. Perhaps the greatest is finding the time and resources to work through the processes. “I’ve got five people going in every direction under the sun,” Atencio said. “It’s not like I have three people to set aside to work on the CMDB alone, so it’s probably been a slower process than I would like,” he added.

But being selective in the approach to configuration management helps, Atencio said. “You have to take what makes sense for you and apply that, and not get wrapped up in, ‘We have to do it all.’ ”

— Jennifer Zaino
How to get immediate value from configuration managementInformation technology executives have reason to question the value of configuration management databases. Even companies that sell CMDB tools acknowledge the hesitancy of IT leaders to invest in  additional management tools, especially ones that perform functions as complex as those for which CMDB tools are designed.

“This is a really big problem to try and get your arms around in large agencies,” said David Link, president and chief executive officer of IT management tool vendor ScienceLogic. “It’s almost like [enterprise architecture] or these other massive initiatives that are multiyear that require immense planning and resources.”

Also, CMDB vendors concede that projects can turn into seemingly eternal commitments. “You can get into analysis paralysis where you try to structure and build the ultimate CMDB that does everything, and two years later you sit there with a plan but haven’t done anything,” said Chris Aherne, managing director of federal government business at BMC Software.

But it doesn’t have to be that way, Aherne added. “Getting a functioning CMDB up that contains enough information to do effective change and asset management and run your service desk is something you can do in a matter of months,” he said.

Meanwhile, officials at the vendor Managed Objects prescribed using a top-down implementation methodology to get a portion of the CMDB operating  in 60 to 90 days.

“We tell [them] you don’t have to describe every configuration item in your enterprise within the CMDB all at once,” said Dustin McNabb, vice president of marketing at Managed Objects.

Instead, begin with a single service, such as e-mail, defining all the servers and IT components that comprise that function, he said.

By starting small, McNabb added, “customers can realize fast time to value and also fast ROI against their CMDB investment.”

— Jennifer Zaino

2014 Rising Star Awards

Help us find the next generation of leaders in federal IT.

Reader comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above