Proving the adage that beauty is only skin deep, NetView from Tivoli Systems still has the most appealing user interface but is lacking when it comes to exception management and network performance. Tivoli is still very much a frameworks vendor, with lots of add-ons, such as the Tivoli Enterprise Console, for correlation of events; Tivoli Decision Support; and Performance Monitor, for performance management. None of these was included in our test setup, and given the price of the basic NetView package and our budget limitations, it's a good thing.

Not assessed but given a short test drive was version 1.2.1 of Tivoli's new Comprehensive Network Address Translator. Not only does this product perform NAT (network address translation) by IP address, it performs NAT on SNMP packets, enabling users to manage networks with duplicate private address spaces.

MIB statistical data collection is well done in NetView, even though we had trouble getting all the statistics we wanted. Included is a nice engine to point at and collect specific MIB instance information, by device or by smartset. MIB expressions come predefined and are easy to understand, modify or create. Poll frequency and thresholds with re-arm values are easy to set as well. The version we were running displayed some errors, which Tivoli said it has addressed.

The Web console for this release of NetView has been reworked to have the same look and feel as the standard client. It is read-only and, like NNM, requires that a map be running on the standard client. The console froze and left orphaned windows when running in Internet Explorer 5.5, even though we had the correct JRE version. We opted to install the Java applications locally, which resolved the problem.

Breakneck Discovery

We kept pumping the brakes, but we couldn't stop NetView's discovery. Like Spectrum, NetView will aggressively discover and then back off, and it will use seed lists and community string lists. After installing and firing up the product, we went and got coffee. By the time we got back, NetView had discovered more than 2,000 nodes. Pump! We blew the database away, tweaked the discovery to look at a range of network addresses, drank a bit of coffee and quickly had another 2000-plus nodes. Pump, pump! Thank goodness, like most administrative tasks in NetView, getting rid of the database takes only a couple of clicks. Click, click. We then directed discovery to look at the seed list and discover only the subnet, went to get more coffee (it was cold), and came back to again find more than 2,000 nodes. Pump, pump, pump!

But wait a minute. As it turns out, the NT version of NetView doesn't support subnet lists, even though the seed file indicates otherwise. It also turns out that the community string list, which we filled with only two specific strings, seemed to be totally disregarded, and devices set with public communities were added to the database. Time for a brake job.

Inventory data can be viewed from the traditional map (a major pain in a large network) or with an IE-like browser that Tivoli calls the Submap Explorer. This is a good example of why NetView is such a pleasure to use. The right navigation bar lists devices, networks and smartsets, and the left displays different properties, which can be selected via a drop-down menu. Selections include IP address view, health view, last event view, TCP connections view and availability view, to name just a few.

Topology is Layer 3 only; no attempt is made to place mod/port with MAC addresses. Inventory of our Cisco 6509 showed the router but didn't correctly identify the switch.

Events are displayed in a separate browser with good filtering through predefined filters, which are also easy to use, accessed via a drop-down menu. Included are event filters for application, error, topology, critical, threshold and custom events. Filter creation and inclusion in the drop-down list are trying procedures.

Event correlation capabilities, while included, do very little good when running on Windows NT. The product ships with predefined rule sets, which are correlation rules created using a graphical Boolean rules editor when running NetView on Unix. We have used this interface before, and it simplifies the edit and, to some degree, the documentation rule sets function, but not the correlation logic. This is no different from any rules-oriented correlation: It offers granular control but very brittle management -- change something, and you'll break a rule for sure.

On NT, however, we didn't have the graphic Boolean editor and so were unable to determine the desired effect of the supplied rule sets. The included documentation and, for that matter, the Unix system documentation were of no help explaining why we saw no effect in our events lists, even though we applied all the rule sets.

NetView 6.0.1. Available: Now. Tivoli Systems, (800) 284-8654; (512) 436-8000; fax (512) 794-0623. www.tivoli.com