What ROI can I expect from an IT monitoring solution?

ROI is always tied to the business case made for the investment.

So, the questions become:

-- What is it that needs to be monitored?
-- What is the business case that supports the monitoring?
-- How large of an investment is being considered for this project?

-ASB: http://xeesm.com/AndrewBaker
Providing Competitive Advantage through Effective IT Leadership

I have specialized in this area for many years and this should get you started. First, quantitative ROI can be determined by knowing three values...

1) Cost of network downtime

2) Employee cost

3) LAN/WAN upgrade/expansion cost

These values can be used to calculate the following benefits of a monitoring solution...

1) Reduction in downtime. This can be both reactive and proactive because a monitoring solution can often identify problems before they occur.

2) Reduction in employee cost. This occurs because technicians can identify and resolve issues in a timely manner. Often a monitoring solution can identify an issue in minutes versus hours or weeks for difficult problems.

3) A network monitoring solution can be used to baseline the network and provide an accurate assessment of where and when upgrades are needed. Often companies unnecessarily expend funds to upgrade expensive WAN circuits because they are unaware of traffic patterns that can often be inexpensively modified to provide additional bandwidth.

Second, there are many qualitative benefits as mentioned by others in this post, not limited to identifying security threats which can lead to lost/compromised company assets. This generally requires a more complex risk analysis be performed to calculate ROI values. However, in almost all cases, I have concluded that network monitoring will provide positive ROI.

ROI is very important. Look for cost effective yet comprehensive solutions. For SOA monitoring I suggest JaxView. We use it to monitor all our service types without installing any agents which is key to having a great ROI. They monitor all protocols for all service types.

Enhanced availability of the Infrastructure due to proactive monitoring is a good metrics to measure and calculate the ROI. Also by having continues monitoring you could do a lot of baselines and trends analysis. Earlier I was handing a team which monitors various components of critical web applications to the business (175 of them) proactively 24x7. The benefits was that they could pull in respective team to work on resolutions the moment they start seeing a degradation or errors from any of the components, ROI was reduction in MTTR and higher availability. And related cost savings

Also you could provide lot of input to Incident, Problem and Capacity management process

If we are looking for Security monitoring the metrics and ROI is all together different

In situations where ROI can not be calculated it is usually justified in terms of its inverse "The cost of Downtime". I have done this on several Hardware projects to justify the cost of redundant hardware. The key fact that is required from the business is "Availability". You need to translate this to a Service Level Agreement (SLA) with uptime, turnaround time, service levels and other attributes of the SLA so that you can justify monitoring of highly available services. This is assuming that there is no fall back mechanism in place. The explanation is that replication of existing services is the cheapest means of providing availability this may not apply to all situations requiring monitoring as a fall back.
Good Luck Monitoring

Even though I agree on many points above, I don't think one can "install oneself" into a better operation or proactive mode.

I have seen to many such installations which didn't succeed - you have to have a plan on what to do with the information you are gaining from such a monitoring. You will have to have people watch / be alerted to thingss which need attention, and you willl need procedures to really make this a success.

And do yourself a favour, keep the people who are supposed to react to information from the monitoring tool, away from managing threshholds or from the "ignore" functions of the tool. Otherwise that tool might just become a little to customized.

Well, ROI should be measured in terms of the core business for an organization. If the core business of an organization is not IT then IT is merely a support engine and an enabler to grow the revenue for that company by creating a robust, seamless, extremely negligible error rates and almost zero downtime systems!

In large organizations, there are multiple technologies being used and because of those interfaces and middlewares there are more breaks than ever be it any reason. It makes absolute sense to go in for end-to-end monitoring for these kind of magnitudes. If the monitoring solution is really good and is able to detect the breaks/lapse in SLAs and may be have quick patches to rectify issues there itself that would be a great thing.

IT monitoring system gives indirect thrust to the core business and has no direct return ( well if you are selling it as a product is a different thing altogether!). Even otherwise, end-user/customer experience and satisfaction are something to be considered when you calculate ROI as nowadays these are powerful factors that can exponentially increase the revenue of core business or steeply decline that! Just an example, If a web portal takes long to load or kicks out many users because of load on the website or a link always says 'page not found', most likely people will switch to an alternate/competitor.