MTTR is king in any environment. Having tools that enable you to drop that is very important. One of the things that we like to strive for is to give the operators the best chance of solving the problem as fast as possible. If you look at the life cycle of an instant, you've generally got four pieces to it, detect, diagnose, recover and restore. Almost invariably, the longest pole in the tent there is the diagnose.
An event that's been received, we know something is wrong. How do we then go and identify in a large heterogeneous environment where that could be? There's generally two approaches. The first one is a very myopic approach that people take sometimes because you have very highly skilled people that are CCIE's that are running these ops teams.
They will dive straight in, right down, and try and isolate a particular area of the problem. The issue with that is they're not seeing the big picture. If I use an analogy that I plagiarize from somebody else, I'll admit to that. Imagine you're watching a football game and you've got a really powerful pair of binoculars and you can see the quarterback, and you can see his helmet and you can see his facial expressions, and you're right down and you're so focused on what he's doing. That's great, but you've got no idea what's going on in the rest of the play.
What it's very important for these tools to do is to be able to give that 10,000 foot view of the entire playing field, and then at best case it's going to give you the recourse straight away. You'll see an obvious spike, you can drill down, you can get it. Worst case it's going to make the haystack a lot smaller so that it's going to be much easier to find the needle.