Access as an application vendor from outside a firewall

[marney_hyperic]

I have been tasked by my company to compare system monitoring tools. We are a small Java software development shop. Our product runs on several servers (Windows or Unix) at each of our clients, and has a web front end, file system storage, and database (PostgreSQL, Oracle, or MS SQL Server). We support our software remotely: the clients agree to provide VPN or Telnet access. The VPN access may not be permanent (ie we may have to use a Cisco or Juniper vpn client each time we remote desktop to them). At present we have fewer than 50 clients. We want to monitor basic up/down and disk free type metrics, but also to issue a variety of custom queries against our database and application to check its status.

So, my question is: How much network access would Hyperic require for us to use it to monitor our application? Our clients are sometimes reluctant to open their firewall to a vendor like us. I’d like to know what’s the minimum we need to ask of them so we can get good proactive monitoring of our installations. Ideally we would not even need to ask for more than we have now, but that may not be realistic. We have even toyed with the idea of buying a dual-NIC machine at each client to put inside their firewall just to communicate with our central monitoring server. I don’t know if that would help.

Hyperic appealed to me because it is Java based. But we are also looking into other products, particularly Nagios (maybe also Zenoss and OpenNMS). So any comparisons with them in this regard would be helpful too.

Thanks in advance,
Mike

[excowboy]

Mike,

you need a reliable network connection to monitor your servers properly with Hyperic.
If you use HQ Enterprise Edition you could probably use the Internet for communication, not necessarily a VPN. HQ Enterprise offer unidirectional communication from Agent to server. So you do not need to ask your customers to add any firewall rules, except for outgoing traffic to the Hyperic server. That could work fine if your customers use public, static IP addresses for their boxes. If you do not have static IPs and/or if the machines are being hided this setup does not work.
If you use HQ Open Source your customer need to add some firewall rules, so that the HQ server may connect the Agents.

A VPN access is probably the best way to monitor platforms on different sites.

Cheers,
Mirko