Today's mainframeanything to new 558

Of course there is measurement and security overhead; but you are in error about performance and security monitoring being contrary. They are different views of the same observations. The challenge is to build the reference model, and describe what is "normal" and what is "abnormal"; and to also define dependency chains. If your power is out you will have lots of other alarms, which should be ignored by the on-site troubleshooters until power is restored. (but off-site troubleshooters want to see them, as they may have alternate facilities).

Likewise, you don't want to see noise from attacks you know you are immune against going up the chain of escalation. But there is still lots of chatter from old virii and worms on the Internet. For some unknown chatter you just want to block the IP address with just a routine message to operators-logs.

The point about being unobtrusive in monitoring is also important. Use of statistical methods is important.

No, it is not a catch-22. It is a field that has put priority into pretty graphs and proprietary "all sing and dance" stations and has not done their theory.

-- mrr