[m0nastic]

I used to design and build NOCS as a network management consultant, and we found one thing to be universally true at every NOC we designed:

1.) Even though the person who hired us fell in love with the set of NORAD from the movie Wargames with walls of giant monitors, not one of the NOC analysts sitting at their desks ever once looked up at the big screen (unless it was late at night and they replaced the network map with a first-person shooter) to do their job. They always look at the event viewer at their desk.

The big wall of screens is purely to impress customers/investors during visits.

[jcurbo]

As a former military NOC watch officer I agree. We hardly ever used the video wall, it was mostly for higher-ups that came in and would glance at it. Everything else was on my desktop or was alerted to me by other people that had stuff on their desktops.

[wizard_2]

I currently work at a NOC. We've built a pretty nice setup to do our jobs (mostly software) but I've got no idea what others do. As for hardware, I don't know how I could use more then 3 or 4 screens or how the team could use a big one.

(Though we do want one but only because they're cool.)

I'd love to hear some war stories and see how you work with other teams.

[m0nastic]

edit: I typed this on my phone while waiting at the airport, so it's a little looser grammatically than I'd like.

I've been out of the network management space for about a decade, but ostensibly the big screen was pitched as a way to look at overall network health or identify a large-scale outage. There'd be a big-ass network topology map that would suddenly start showing red dots.

For the big topology map, that was usually done using Spectrum or Openview Network Node Manager (the only use we had for NNM for that matter, it sucked at everything else).

The reason I said "ostensibly" though, is because if you're relying on noticing red dots appear on the map to tell there's an outage, it means you aren't doing proper event correlation.

Most systems we built focused on the event viewer (Netcool for the most part, but it was just for deduplication as it didn't do actual correlation); so that's what would generally be on screen for an analyst. Their other screen would have their ticketing system (usually Remedy, but occasionally Vantive, which I vastly preferred).

The actual correlation engine was Nervecenter for the most part (which was a consultants dream as it took like 6 months to build all the rules), although we tried out a bunch of the "code book"-based correlation engines (SMARTS I believe was the name of one of the more egregious ones).

I worked on one project to build a NOC for Raytheon that 6 months into it they decided to make the whole thing automated (as in, not have any analysts actually working in the NOC) and that was interesting. We ended up having to write logic to handle all the notifications and queuing.

Like I said though, all of this was the Cretacious period for network management, so I really hope things have gotten better in the interim.

[bigohms]

Obviously. Its not built for function but coolness with the general intarwebZ and visiting customers and execs. I very much doubt that anyone at Stack is going to use that as well with the fonts as small as they are.