If you want to stay ahead of server failures, server capacity problems and server-related network outages, Microsoft Operation Manager 2005 can help. On a small to midsize network with Windows 2000 Server systems and above, MOM 2005 can do a good job of getting and reporting server status and health information.

We recently tested MOM 2005 and found that while it used more bandwidth than expected, and was not useful as a monitoring tool for router- or switch-related infrastructure problems, it did a good job monitoring Windows-based servers.

MOM 2005 is the latest incarnation of a product originally from Mission Critical Software (which was bought by NetIQ and then bought by Microsoft). The latest version of MOM sports several user interface improvements, new monitoring capabilities and a new report generation mechanism.

Eye on Windows Server
On Win 2000 and 2003 servers (but not Windows NT), MOM 2005 agents can track every possible Windows performance and capacity metric you can think of. Microsoft offers separately licensed Management Packs for applications and environments (see graphic, below). Microsoft publishes a programming interface a third-party vendor can use to create a Management Pack for that vendor's server-based software. We found that MOM 2005 integrates well with HP's OpenView and IBM's Tivoli network management systems.

The system can work with agents or go agent-less, via the Windows Management Instrumentation (WMI) and Remote Procedure Call (RPC) interface. The MOM 2005 agents help it detect problems quicker, scale better, and give more information to administrators, planners and trouble-shooters. The agents used less bandwidth than the agent-less WMI environment.

Agents also aren't always optional. For example, the Active Directory management pack requires that you install agents on all domain controllers, and we found monitoring agent-less servers through firewalls problematic because firewalls typically do not allow the passage of RPC messages.

Our test focused on MOM's ability to monitor Windows Server, Exchange and SQL Server (see How we did it). In the Windows Server tests, MOM 2005 indicated when problems arose in an Active Directory database. It alerted us to server CPU utilisation, disk space, low memory and network adapter problems. It monitored the Windows registry, server background programs, printer status and system registry health. The system excelled in checking whether service pack and specific knowledge base patches had been applied.

When monitoring Exchange, the management pack gave a helpful topological view of each server and its configuration. The Exchange Management Pack primarily used WMI to discover server status and health information. When we combined Exchange Server 2003 with Outlook 2003, we were impressed to find MOM's management pack also monitored client Outlook connections. But we were disappointed that the Exchange management pack did not send and receive actual e-mails to know whether Exchange was really up and running.

In our SQL Server tests, MOM 2005 successfully monitored several database parameters and metrics, including connectivity, concurrent users, table and row locks, database space usage, log space usage, CPU utilisation, I/O activity and outstanding queries.

Notifications, reports and ease of use
MOM 2005 notified us of problems via e-mail, pager, log file entries and SNMP alerts. For anticipated problems, such as a runaway server application (infinite loop), we specified scripts that MOM 2005 ran to automatically correct the problem. The corrective action consisted of restarting a stopped service, running an external program or rebooting a server.

Report tools rely on SQL Server 2000 Reporting Services, which let us easily export the reports in several formats, including Excel, Adobe Acrobat PDF, Web page or XML. The built-in reports were generally adequate for analysing problem histories, but we think capacity planners will want to use Reporting Services to create custom reports geared to tracking resource utilisation. Reporting Services, which requires Visual Studio .Net visual design environment, was less flexible than other report tools.


The system uses Microsoft Management Console to provide administrator, operator and reporting console user interfaces. The administrator console configures MOM 2005 and changes the rules for controlling agent behaviour. The operator console has navigation, context, detail and task windows. It will appear familiar to Outlook users, but because it tries to display all MOM's alerting and troubleshooting information in a generic Outlook format, we found it confining and unproductive. The reporting console controls the display of event, alert and performance reports via a Web browser. The topological network graphs are done well, and they help show the big picture of the network. Another plus is MOM 2005's ability to generate Visio diagrams depicting the servers it monitors. If you have Windows servers that need close monitoring and if you have a separate tool for monitoring switches, routers and non-Windows servers, then MoM's your man.