Behavior learning technologies are becoming recognized as one of the key next steps on the road to Business Service Management. Quickly growing in popularity with the emergence of virtualization and the cloud, behavior learning automatically discovers what IT should be doing to get the job done.

“Behavior learning tools use a statistical process method to solve data analysis problems, collecting data from multiple performance and event sources, and establishing a set of behavioral patterns,” according to Gartner. “Once patterns of normalcy are established, the behavior learning tool looks for deviations from normal behavior, interpreting the symptoms for diagnosis and appropriate alerting.”

Gartner named behavior learning technology “transformational” in two Hype Cycle reports this year, which means this leading analyst firm sees the technology as enabling new ways of doing business across industries that will result in major shifts in industry dynamics.

“Once behavioral tools have learned the infrastructure, you're going to get a very consistent set of data that doesn't need constant nurturing and policy setting,” explains David Williams, Research VP at Gartner. “The more it gathers, the more it understands, the better the information.”

One point to remember is that behavior learning tools are about normal and abnormal, which is translated into good and bad. So on the front end the value is greater when the user trains the tool on performance expectations. In addition, the tool learns what is normal by analyzing the actual performance of the infrastructure and sets baselines. This starts happening within minutes after deployment.

In the long term, the technology pays off because it gains a heightened sense of what is normal expected behavior within the IT environment and can identify anomalies, even very slight deviations, that signal a potential problem down the road. Obviously the advantage here is early detection, getting the problem before it gets you.

A Guiding Technology

Williams says behavior learning is a much more proactive technology, compared to the traditional fault and performance tools which are much more reactive-based.

The Gartner Hype Cycle for IT Operations Management 2010 states, “When using existing IT operations availability and performance management tools, many IT organizations continue to struggle to deliver a proactive monitoring capability due to the vast amount of disparate data that needs to be collected, analyzed and correlated.”

“Behavior learning tools gather event and performance data from a wide range of sources, identifying behavioral irregularities, allowing IT operations to understand the state of the IT infrastructure in a more holistic way,” the Gartner report continues.

“The traditional tools will give you a yellow or a red based on a threshold being exceeded,” says Williams. “These behavioral tools can pick up very subtle changes within an infrastructure and make you aware of something before it actually exceeds a threshold.”

Behavior learning tools are not intended as standalone monitoring tools, however. They rarely have their own agents, and the current tools available do not intend to replace the current monitoring infrastructure, at least for the time being. But they present a new way of looking at the data a company is already collecting from its existing monitoring tools. These tools position themselves as the high level view, and the first place a user can look when analyzing IT performance.

“You might have a dozen technologies that provide all the performance and event data at the server, network and other layers,” says Williams. “The behavioral learning tool sits on top of that and can become your primary dashboard, your initial point of entry to understand the state of your infrastructure. It is the guiding technology.”

Other dashboards are still used, nevertheless. Williams points out that when there is a potential issue, the user may need to do a deep dive into the infrastructure using another tool. The challenge for users is to get the dashboards and alerts in front of the right stakeholders, and truly harness the power of this new technology, without being overwhelmed by the additional information.

Another challenge that Williams cites is the familiar “garbage in, garbage out” dilemma, because these tools currently depend on the existing monitoring systems.

“If you have a poor set of policies and your collection mechanisms are poorly set, that has the potential to provide poor behaviors,” he explains. “You still need to focus on making sure your collection mechanisms are working well, and this will make the behaviors and the patterns that are established on top of the data much more accurate.”

Visibility in a Virtual World

“The primary reason people are adopting these technologies today is that behaviors and patterns are very strategic to a lot of companies, particularly because they can no longer ‘herd all the cats’ on an element-by-element basis in a highly contention-based virtual infrastructure,” says Williams. “There are too many things occurring and these pattern-based behavior technologies provide a much better understanding based upon a holistic view.”

Behavior learning addresses a core problem of virtualization and cloud management: it is humanly impossible to understand and manage the thousands of changing and interrelated metrics that represent the overall health of applications running in multi-vendor, cloud-based infrastructures.

The Gartner Hype Cycle for IT Operations Management 2010 confirms that the adoption of behavior learning tools is being driven by the virtualization and the need to gain a holistic understanding of the virtual IT infrastructure state - for example, the ability to understand the health of a dynamic virtual server environment based on behavior patterns and not static thresholds.

“IT organizations with increasingly dynamic virtual IT environments will benefit from behavior learning tools, especially when there are many performance and event sources to track and understand, as they provide IT operations with a new way to comprehend the overall state of the IT infrastructure,” Williams adds.

Williams says one of the companies he hears about most in the behavior learning space is Netuitive, which claims seven of the world’s top 10 banks as customers. Netuitive has built an analytics platform powered by behavior learning technology, which is designed to provide enterprises with end-to-end performance and capacity management in virtual and cloud environments.

“Cloud management is about service-level visibility, automated problem diagnostics and predictive analytics enabling organizations to manage their performance proactively and end-to-end,” says Daniel Heimlich, Netuitive VP. “As virtualization makes manual rules-based processes obsolete, behavior learning technology is driving a paradigm shift in the enterprise’s ability to manage virtual and cloud environments.”

According to a Gartner case study, one of the world’s largest telecommunications firms is using behavior learning technology to analyze more than a million metrics simultaneously, allowing the company to eliminate 3,480 hours annually in service degradation representing a business savings of $18 million.

On the Road to BSM

This same high-level view that makes these tools valuable in the virtual environment also is a key to BSM. In fact, Behavior learning tools are viewed as essential gear for the journey to complete end-to-end Business Service Management, because the tools ensure that potential issues can be investigated and remediated before they impact the business.

For this reason, the Gartner Hyper Cycle states, “Behavior learning tools have the potential to massively improve business service performance and availability.”

“Where behavior learning tools can really have an impact is when they can provide a Business Service Management approach, looking at the infrastructure like a business,” Williams adds. “You can really start to cut and slice the data in a way that enables you to be much more business oriented.”

Williams concludes, “We are going to see a definite increase in the adoption of technology that is much more behavioral-based.”