In early 2005 as I started Akorri I knew I’d have to somehow discover and collect information from resources within the enterprise data center. Initially my plan was to partner with vendors that already did collection and layer the Akorri value on top of that without reinventing the wheel. Great idea huh? So I began the discussions to partner with a couple of the SRM vendors for our discovery and collection needs. The plan was we would augment their agents to collect the performance centric data that we needed. Everything was moving along nicely until both of the vendors I was talking with got acquired. Shortly afterwards I found out that the acquiring companies had no plans to offer API’s for these services. Not such a great idea now! I made the decision to develop our own discovery and collection service. Although it added to the demands on my engineering team it gave us the control to develop a premier agentless discovery and collection system for performance management. That was one of the best decisions I’ve made. As development of our discovery and collection engine started I asked my engineering team to support SMI (Storage Management Initiative). In late 2005 SMI looked promising and I was a huge advocate. Having a standard interface for management of storage components makes a lot of sense. The networking guys figured that out decades ago and it’s served them well. Anyway, my Engineering guys came through and developed an SMI collector that was one of the best in the industry.So roll forward 12 months. Our BalancePoint product is now Generally Available and we are deployed in a number of enterprise data centers. Each time we engage a customer we try to use our SMI collector where ever possible. The problem is it very rarely works. We’ve found that in a lot of cases the incumbent systems vendors haven’t deployed their SMI solutions in these accounts, or if they have, the SMI technology is very slow or worse yet it doesn’t respond at all. It’s become clear to me that the vendors are paying lip service to SMI but in reality aren’t supporting it.Recently we deployed into a customer site that contained a fair number of storage arrays from a vendor that has traditionally been a strong supporter of SMI. My field guys took this as another opportunity to try SMI. I figured it was worth the effort; if we were going to have success with SMI anywhere it should be with this equipment. Wrong. It worked as well as other implementations I’ve come across, meaning it didn’t! Queries took hours to complete! After trying to get it to work for a couple of days we were put in touch with the equipment vendors field guys. His advice was to give up on the SMI interface and use their proprietary API. We made the switch and things began to work much better.  I’ve been in technology for 25 years and I’ve seen this story before. SMI is a great idea but great ideas very rarely win in the marketplace. Good enough at a reasonable cost is what usually wins. In order to succeed the equipment vendors and customers have to be convinced that SMI brings real value. Right now though it’s the good enough custom implementations for management interfaces that are winning. So my question is whether SMI is dead or just in the deep trough of disillusionment? I think it’s dead. I can’t see the magic bullet that’s going to cause the equipment vendors to change their views and truly start supporting SMI. Customers aren’t yelling at them, vendors like Akorri don’t pull enough weight with them, and the heavy implementation costs associated with SMI aren’t very attractive. SMI can join other great technologies like Beta Video Tape on the List of Great Technologies That Didn’t Make It.

One thing I’m not an expert on is data center security. A story was relayed to me by one of my Sales Engineers that really got me thinking about the topic though.

A while ago we were installing BalancePoint in a new customer site. The customer has a fairly large data center with hundreds of servers. As he began with the installation he requested username / password credentials in order to collect data from a particular set of servers. The customer was eager to get us going so instead of waiting to go through a process to get us Akorri credentials he said we could use the same credentials they use for another product. He asked a coworker if knew the username / password combination. Unfortunately he didn’t remember but offered to go get it. Now my Sales Engineer was expecting him to log into some database or other application to retrieve the need information but instead he got up and walked over to a corner of the room where there was a safe. Yes, a real safe. He opened up the safe, riffled through a number of envelopes, retrieved one and brought it back. Opening the envelope he removed a slip of paper that had the handwritten username/password combination. He entered the information into BalancePoint and then returned the envelope to the safe.

As this story was being told to me I was chuckling. I was thinking to myself how low-tech nobody would want to manage credentials that way. On my drive home from work that day I began to think about the story again. I do most of my best thinking on my 12 mile commutes to and from work! I was still thinking wow, such a low-tech solution but I was beginning to also think maybe it’s not such a bad solution. Just because it’s low-tech doesn’t mean it’s a bad solution. As a matter of fact it’s probably more secure than the high-tech alternatives. Credentials stored on shared media, no matter what type of encryption is used, can still be hacked and accessed. With the physical security of the safe the access control is very well understood. Also, backups of the data aren’t really needed. It’s much harder for slips of paper to get destroyed in a fire proof safe than it is for bits to get destroyed or corrupted on a computer system. I was beginning to convince myself that the credential security scheme they employed may not be so ridiculous afterall. It’s ok to be low-tech. Right?

As I stated at the beginning, data center security issues isn’t something I’m an expert on. I’d be interested in hearing from the experts their thoughts on the topic. I might just go out this weekend and buy a safe for storing my own username / passwords in!