The Most Valuable Person During a Mainframe Incident Isn't the Monitoring Tool
It's That One Guy Who Knows Where to Look
Every mainframe shop has one.
A Sev-1 conference bridge starts. The business demands an update every fifteen minutes, and dozens of people flood onto the call.
Then, someone asks the real question:
| "Has Dave joined yet?"
Everybody knows that once Dave joins, things get resolved faster.
- It’s not because Dave has access to different tools.
- It’s not because Dave has special authority.
Dave looks at the same TMON screens as everyone else. The difference is simple: Dave knows where to look first.
It’s 10:17 AM. The payment application team reports that customer transactions are taking nearly twice as long as normal.
This is where Dave steps in. He starts building a mental checklist.
His first question is always foundational:
| "Are we actually seeing a response time increase, or is this just a perception issue?"
TMON confirms it. Average transaction response times jumped from 70ms to ~2 seconds starting around 09:47 AM.
With the problem validated, Dave branches based on what the data eliminates next:
Path A: Did CPU utilization spike at the exact same time?
Path B: Did transaction volumes suddenly explode?
Path C: If both look normal, shift focus downstream to the application stack or database.
This is simply how experienced operators think: start broad, eliminate the noise, narrow the search space until only a few realistic explanations remain. The expertise isn't knowing how to pull up a metric — it's knowing which question to ask next.
The Multi-LPAR Problem Nobody Talks About
Now imagine the problem isn't isolated — it spans multiple production environments.
Now Dave must mentally correlate data across geographically distributed systems at once, balancing a new set of questions:
- Is this an isolated issue, or is it affecting multiple production environments?
- Did the problem emerge everywhere at once, or did it originate somewhere and spread?
- Are configuration differences or workload distribution contributing to what we're seeing?
Bridge calls drag on not because any individual metric is hard to pull, but because a human is stitching together evidence from five different sites by hand.
An intelligent agent can do that in seconds.
Scaling Dave with EVA
"AI for operations" usually means a chat box. But swapping a menu click for a typed request changes nothing — it only changes how the request is entered. The real question is whether we can capture the reasoning process of an experienced operator like Dave. That is where the value lives: not in the metric, but in the investigation that follows.
That is where EVA comes in. Rocket EVA is an agentic AI platform, built on the Model Context Protocol (MCP), that closes the gap between operational data and operational understanding. Through MCP servers it works with TMON and other Rocket products to gather information from multiple systems, correlate findings, and get users from symptoms to answers without jumping between tools.
You don’t want a tool that waits to be asked questions. You want something that mimics how Dave thinks — which means a secure path to read mainframe data and understand the environment.
So when the 10:17 AM lag hits, the workflow changes completely.
Instead of waiting for Dave to wake up and join the bridge, EVA is already following the same investigative path: checking for similar symptoms across production environments, identifying deviations, and isolating the clues that point to root cause.
EVA pulls the TMON telemetry across all those sites at the same time. It checks the CPU spikes. It looks at the transaction volumes. It isolates the anomalies. By the time the team even opens the bridge line, EVA can investigate the systems and say: "The delays are attributed to DB2 path".
It doesn't replace Dave. It just gives everyone else on the team his ability to know exactly where to look.
Governance and Trust
The AI layer is not the system of record, nor is it the security boundary. TMON remains the authoritative source of operational telemetry, while governance is enforced through Rocket PlanGuard, which sits in the execution path between EVA and the underlying MCP tools. When EVA initiates an investigation, PlanGuard evaluates policies, maps the requesting user to the appropriate backend identity, applies authorization controls, and maintains an audit trail before any tool invocation occurs. In practice, this means EVA doesn't become a privileged super-user with unrestricted access to operational data. It operates within the same governance framework that organizations already use to protect critical production environments. TMON provides the operational intelligence, EVA provides the reasoning, and PlanGuard provides the trust layer.
Looking Ahead
TMON has long provided the operational insight teams rely on every day. Combining it with MCP and EVA opens a new way to investigate and respond. The technology is evolving quickly, but the goal is unchanged: less time searching for answers, faster time to resolution.
