Driven by both digital transformation and localization substitution in China, traditional IT monitoring tools are facing unprecedented challenges. Due to the problem such as weakened manufacturer support, localized service degradation and technology architecture obsolescence, foreign monitoring products represented by IBM Tivoli have been unable to meet enterprises' urgent needs in localization, independent controllability, and cloud-native environments.
As Tivoli core products (such as ITM/ITCAM and Netcool series) gradually stop providing service, stock customers urgently need to find alternative solution that can not only cover Full-stack observation scenarios, but also have in-depth localization adaptation capabilities.
As a Full-stack Intelligent Observation Center designed in Tencent's Large-scale IT Production Environment, CanWay BlueWhale Full-stack Intelligent Observation Center · KingEye (hereinafter referred to as "Full-stack Intelligent Observation Center") relies on integrated design, out-of-the-box support compatibilities with Chinese IT hardware/software ecosystem, cloud-native monitoring capabilities and localized service advantages are becoming a cost-effective choice for enterprises to replace Tivoli.
This article will analyze how the Full-stack Intelligent Observation Center breaks through the dilemma of using traditional monitoring tools and helps enterprises build independent and controllable intelligent operations systems through current situation analysis, scenarios coverage, compatible with Chinese IT hardware/software and so on.
01. Analysis of the current situation of Full-stack Intelligent Observation Center and Tivoli
1) Full-stack Intelligent Observation Center: Deep Integration, Autonomous and Controllable
This Resolution-level Product platform was born in Tencent's large-scale IT Production environment.Whether it is data model, process control, or functional operation and presentation, it is all an integrated design rather than a simple product combination and module stack;
All develpoers，deployers and operation support teams are in China, with continuous iteration of product, rapid service response, and fully autonomous and controllable;
This product is an integrated design that supports different scales of IT environment operations monitoring requirements， container cloud deployment and elastic scaling;
This product uses a Single Agent(GSE Agent) combined with collection plugins to collect and obtain different types of data related to operations monitoring, automate operations (job scripts and commands) and file distribution;
The five major product capabilities of Alerts Center, Monitoring Center, Logging Center, Application Performance Monitoring Center (APM) and Business Monitoring are gathered to form the Full-stack Intelligent Observation Center.
2) Tivoli: Multi-source technology combination hinders localized adaptation
Tivoli's core Product competency is to achieve a technology portfolio through acquisitions of outstanding companies in the industry. For example, its system application Monitoring Product ITM/ITCAM was generated by the acquisition of Candle more than 20 years ago; Netcool Series Product (OMNIbus, Impact, ITNM, NCM, NPM, etc.) is the result of the acquisition of Micromuse more than ten years ago, and Instana was also its new acquisition three years ago;
Although Tivoli's product has strong professionalism, the visualization is relatively ordinary. And it is difficult to operate and use. When users encounter product problem, they may need professional support from the original manufacturer to solve the problem.
Traditional products such as ITM/ITCAM and Netcool series products are monolithic architecture. These products require customization when they are first built, and resilience scaling cannot be achieved. Subsequent expansion also requires users to invest a lot of manpower and time.
Tivoli's local service support teams have shrunk severely in recent years and recently closed its Chinese R&D Laboratory. This also means that they have terminated all localization exploitation and support work related to IBM products in China;
Traditional product such as ITM/ITCAM, Netcool/OMNIbus, etc. have successively announced the cessation of manufacturer support, forcing stock customers to either choose to continue to repurchase escalation or find other monitoring tools as alternatives.
3) Comparison of Tivoli's monitoring capabilities with the Full-Stack Intelligent Monitoring Center.
(Note: Capacity Manage and Server Manage belong to the category of infrastructure operations and are not within the scope coverage of observability capabilities. As a full-stack observable platform, the Full-stack Intelligent Observation Center currently does not have these two types of functional modules. However, CanWay BlueWhale has provided independent resolution, including Intelligent Reporting Systems and Automated Operations Platform, to effectively meet customers' needs. )
The following will further elaborate on the core values and implementation practices of the Full-stack Intelligent Observation Center by comparing specific scenarios.
02. Comparison of monitoring scenarios between the Full-stack Intelligent Observation Center and Tivoli
IBM Tivoli's monitoring tools and event manage typically consist of multiple sub-product's. For example, IBM Tivoli Monitoring (ITM) focuses on infrastructure monitoring, IBM Tivoli Composite Application Manager (ITCAM) focuses on application performance and deeper component Monitoring, and Omnibus (Netcool/OMNIbus) focuses on powerful event manage and correlation analysis. This combination is powerful, but it may also bring high complexity and maintenance costs.
The Full-stack Intelligent Observation Center aims to provide a more modern, unified, and out-of-the-box full-stack observable platform. In most monitoring scenarios, the Full-stack Intelligent Observation Center can replace the effectiveness of Tivoli's three sub-Product:
1) Infrastructure and component monitoring
The Full-stack Intelligent Observation Center provides out-of-the-box monitoring capabilities covering basic components such as operating systems, databases, and middleware, and supports plug-in connection with various information technology application innovation environments. Compared with ITM's basic resource monitoring and ITCAM's component-level monitoring, the Full- stack Intelligent Observation Center realizes the integrated collection of metric, log, trace, and alert event through a unified data model, significantly reducing the complexity of multi-system integration. it also provides three access methods: SDK, standard protocol and custom plug-in to meet the needs of enterprise-level full-stack observation.
Business Overview Monitoring
Overview of Business Resources
Resource Details - Metric View
Component Monitoring List
2) Virtualization and container monitoring
Same as Tivoli, the Full-stack Intelligent Observation Center also has virtualization monitoring capabilities and supports monitoring data access on virtualization platforms such as OpenStack and VMware ESX. It also supports integrated management of the cloud environment and supports extended monitoring of public cloud and private cloud platforms in a plug-in manner.
For enterprises which are adopting or planning to adopt container technologies such as Docker, Kubernetes, it's better to choose the Full-stack Intelligent Observation Center than Tivoli. While the former supports container monitoring capabilities that access native Kubernetes and provides a complete monitoring link from the infrastructure to the PaaS layer, and can realize enterprise cloud-native transformation more efficiently. But the latter has a strong dependence on traditional architectures.
Cloud Platform Monitoring Overview
Container Monitoring Resource List
Container Resource Details - Metric View
3) Hardware Device Monitoring
In the field of hardware device monitoring, Tivoli mainly monitors the performance and availability of network devices through the SNMP protocol, and lacks a direct and effective monitoring method for other physical machine devices and storage devices. The hardware monitoring of the Full-stack Intelligent Observation Center supports the docking of multiple out-of-band protocols and the collection of multiple data types, including indicator collection and log collection based on SNMP, IPMI, SMI-S, Trap and Syslog protocols, realizing unified monitoring of hardware equipment metric, log and alerts.
Hardware Monitoring details - Metric View
Network Topology
4) Application Performance Monitoring
Although ITCAM in the Tivoli ecosystem provides APM capabilities, it is often limited to monitoring specific applications, such as SAP and other ERP applications. Compared with other APM tools, ITCAM has very limited integration capabilities, complex installation, and outdated user interfaces, which are difficult to promote in China.
The Full-Stack Intelligent Observability Center, however, adopts a modernized approach via probe instrumentation service processes. It automatically detects end-to-end call chains of distributed services, automatically generates service call topologies, and delves deep layer by layer from four levels—application, service, interface, and call—to monitor the application's health status and call performance. Additionally, it supports correlation and drill-down analysis with basic resources monitoring, assisting in root cause analysis (RCA) of issues, improving the efficiency of issue localization. Meanwhile, it also supports analyzing, viewing and tracking issues from multiple perspectives, such as the application service call view, the application-resource correlation view, the service analysis view, the interface analysis view and the Trace call chain view.
Application View
Application Details-Link Topology
Trace Explore
5) Alert Events Closed-Loop Capability
Tivoli centralizes advanced event processing capabilities (such as deduplication, enrichment, and correlation) in Netcool/OMNIbus. The sub-Product ITM only has basic alerts lists, rules, and processing capabilities, and the configure of event rules requires specialized skills for scripting configure and maintenance.
The Full-stack Intelligent Observation Center integrates full-process capabilities in platform, including alert management, rule configure, handling, automated transfer orders, suppression, blackout, enrichment, correlation analysis,and etc. Its core advantage is that it provides a visual alerts rule configure interface, which greatly lowers the threshold for use, enables operations to easily maintenance, and promotes the continuous optimization and knowledge accumulation of alerts rules, thereby continuously improving the accuracy and effectiveness of alerts.
(Omnibus's retro Configure page, both understanding and Configure barriers are high)
KingEye Alerts Closed Loop Process
Alerts Source Data Rich Configure
Alerts Policy Configure
03. Practical operation of replacing Tivoli event rules in the Full-stack Intelligent Observation Center
Up to now, the Full-stack Intelligent Observation Center team has replaced IBM Tivoli with the Full-stack Intelligent Observation Center product in nearly ten projects. A core and common requirement is to migrate the event rules accumulated over a long period of time in the Tivoli system to the Full-stack Intelligent Observation Center platform. However, this task faces a key challenge: Tivoli's event rules often exist in the form of scripts that often lack clear documentation records and even customer itself cannot fully interpret its complex logic. This opacity directly makes it extremely difficult to accurately and completely reproduce these key rules in Full-stack Intelligent Observation Center.
In the past, this migration process relied heavily on human analysis and interpretation by professionals with deep Tivoli expertise. This is not only time-consuming and laborious, but also greatly limits the implementation of efficiency, and project cycles are often extended.
Fortunately, with the rise and adoption of Large Language Model (LLM) technology, the Full-stack Intelligent Observation Center team has explored and practiced an innovative set of resolution. We can now use LLM to automate analysis of Tivoli's rule scripts and intelligently generate a detailed and easy-to-understand list of rule descriptions.
The specific operation process has been significantly simplified: Implementation team now only needs to input the Tivoli rule script file provided by customer into LLM for analysis to quickly obtain a clear and structured rule logic description documentation. Based on this documentation, operations can refer to specific instructions to efficiently and accurately complete the configure of the alerts rules in the friendly visual interface in Full-stack Intelligent Observation Center.
(List of rule scripts exported by Tivoli)
(List of script descriptions after automated analysis)
04 More full-stack observable capabilities
As a full-stack observable product that CanWay BlueWhale strives to create and continue to accumulate and iterate, the Full-stack Intelligent Observation Center has currently implemented observable scenarios across multiple domains, including business full-stack system resource monitoring, K8s container monitoring, cloud platform monitoring, hardware device monitoring, synthetics, log unified manage, application performance monitoring, business activity monitoring, alerts closed-loop manage, etc.
In order to achieve the implementation of the above-mentioned various observable scenarios, the product design combines the concept of PaaS+SaaS, abstracts the public capabilities of each scenarios, integrates it into a set of underlying capability frameworks, and can link Integration with the operations system tools within the enterprise to support the upper-layer scenarios expansion to adapt to the enterprise's ever-changing observable scenarios and manage demands.
In the figure, from bottom to top are monitoring objects, data integration, data middle platform, capability center, observation scenarios five layers and external integration modules.
Monitoring Object: According to the hierarchical logic of the business system, divide and summarize the required monitoring objects in the enterprise, including data center computer room cabinet dynamic environment objects, hardware equipment such as computing, storage, network, and security, virtualization, cloud, OS, container and other system resources, database, middleware and other general basic components, business, application scene, service and other business applications;
Data integration: Based on agent, Plugin, SNMP, Script, JMX, JDBC/ODBC, OT protocol, SDK probe, dial test, data reporting pipeline and other data access channels, realizes centralized access of performance Metric data, Log data, Trace link Data, Event data and alerts data.
Data middle platform: Provides data format, data transmission, data storage, data explore, and data computing capabilities centrally;
Competency Center: Provides different data processing capabilities by data type. For example, the ability to detect, predict, correlate, and retrieve indicator data; the ability to parse, keyword, cluster, and retrieve log data; the ability to analyze the links, topology, relationships, and functions of trace data; the ability to deduplicate, converge, correlate, and perform root cause analysis on alert data; and the ability to provide user-facing dashboards, reports, and data retrieval views.
Observation Scenarios: The five core scenarios are divided according to the observable fileds: monitoring center, logging center, application observation center, business monitoring, and alert center. Including data linkage analysis scenarios based on five general scenarios, as well as scenarios constructed by users based on their observation capabilities;
External Integration: It can be considered in two parts:
The first is to collect data from external systems, such as obtaining the corresponding data from third-party monitoring,alert and logging systems for centralized manage;
The second is to connect to external systems for linkage manage, such as connecting to external CMDB manage observed objects, and connecting to external automation system and work order systems for alert disposals.
05 Conclusion
In general, under the trend of localization substitution and cloud native transformation, the Full-stack Intelligent Observation Center relies on integrated cloud native architecture, full-stack end-to-end observability capabilities and the compatibilities with Chinese IT hardware/software to comprehensively break through O&M bottlenecks of IBM Tivoli which due to the obsolescence of architecture, insufficient localization adaptation, and multi-product fragmentation. And it also helps enterprises quickly realize the operations model escalation from "passive fire fighting" to "intelligent prevention" by prioritizing the replacement of Tivoli weak links such as container monitoring, cloud platform monitoring and business monitoring, laying the foundation for digital transformation.
Welcome to download the "Enterprise One-Stop Observability System Best Practices Guide (2025)", meticulously crafted by CanWay
BlueWhale.
Click the banner below to obtain it free of charge and embark on your journey towards advanced observability.
