CMS Performance Management Systems

This topic provides guidance on using and configuring Performance Management Systems.

Additional requirements and guidance for system logging and alerting, including enterprise logging tools, may be found in the TRA Network Services, Information Security Monitoring.

Event Rules and Situations

Event situations are predefined rules consisting of metrics, thresholds, conditions, and actions that automatically trigger and generate an event. When the conditions of a situation have been met, an event occurs and the IT PM monitoring system triggers predefined actions such as displaying an event indicator on the IT PM portal dashboard.

For each event situation, rule sets may be defined using the following elements:

  • System Platform Distribution specifies the systems to which the situation rules apply.

  • Formulas for conditions being tested may include one or more pairings of metrics and thresholds in a given condition formula.

  • Expert Advice includes comments or instructions the IT PM system will display along with an event in the Event Results workspace.

  • Actions may include:

    • Displaying an alert

    • Generating an issue ticket

    • Sending alert messages

    • Sending commands to managed systems

  • Until conditions close the event after a period of time or when another situation is true.

Performance Data Collection Methods

CMS employs multiple approaches for monitoring applications in the CMS Processing Environment. These approaches are broadly classified as Platform Monitoring and Transaction Monitoring.

Platform Monitoring uses methods and tools specifically developed to monitor operating systems and specific server platform and infrastructure products, including:

  • Operating systems and logs

  • Application servers

  • CICS on z/OS

  • Database management systems (DBMS)

  • Cluster managers and load balancers

  • Messaging servers

  • Business integration middleware to service-enable legacy business applications

  • Energy management devices, server instrumentation, and resources

  • Virtual servers

  • Web infrastructure

Platform Monitoring may be used to monitor the status, resource utilization, and performance of servers and infrastructure products. Platform monitoring methods may also support Transaction Monitoring.

Transaction Monitoring methods measure the response time and availability of transactions, including the end-to-end response time and availability as experienced by end-users of an application as well as the response time and availability of individual components.

Many metrics can be measured using COTS IT PM capabilities. Some application-level metrics, such as the end-to-end response time experienced by end-users of an application, may require application-specific methods, which in some cases may be built into the application. Such application-specific methods may be implemented using various techniques, including:

  • Monitoring web services and web servers directly

  • Executing real or synthetic transactions from multiple locations to test a business service end to end. The application owner and developer must define these transactions. In some cases, the application may have to be modified to ensure the test transaction does not modify or disclose production data. See RP-SC-8: Consider Synthetic Transactions. CMS Cloud supports New Relic synthetics.

  • Enabling an application to report its own performance data to a monitoring server using the standard Application Response Measurement (ARM) protocol, which may require modification of the application software

Security

IT PM data and services require the same protections as other system management data and services. These protections are described in the CMS ARS and the CMS TRA and include Management Zone compliance, encryption requirements, access control policies, and data retention policies.

IT PM data transiting the network requires protection to reduce the risk of unauthorized access or disclosure of sensitive application and business data that could be collected as part of the IT PM process.

It is important to secure IT PM data at REST.

Related CMS ARS Security Controls include: MP-4 - Media Storage and SC-28 - Protection of Information at Rest.