Hello, everybody. I'm Bob Plankers, and I'm one of the thwack Ambassadors for the month of March. I'm a system administrator, virtualization architect, ex-programmer, network aficionado, and recovering storage admin. I've lurked around thwack for a long time, and I'm hoping my saying something here, finally, generates some good discussion. I've got a few topics that seem relevant and could be a good start to a conversation. Please feel free to comment, especially to tell me I'm wrong. :)
So, is it possible to have too much monitoring?
Part of me says no. The more you know about a system the better off you are, even if you use that data only infrequently, or never. Instrumenting absolutely every part of a system for status & performance data gathering is crucial to success. Since you can't know what data or alarms you will need in the future wouldn't it be best to have them all, now?
Part of me says yes. A friend of mine once said that people shouldn't test for conditions they're not prepared to handle. And if you test tons of things not only do you need to write & maintain all those tests, but you'll also need to maintain epic amounts of documentation about what to do when a certain alarm goes off, in order to handle them. Isn't that what you pay sysadmins for -- to do the complex things? Why can't we just test to see if a service is up and then leave it to a sysadmin to figure out the rest? Besides, all that monitoring consumes system resources that could be used more productively, like servicing user requests.
As with all things in IT the answer is partly "it depends." Is there some formula for computing what the right amount of monitoring is? How do I describe the right amount of monitoring to a beginning sysadmin?
