Liveexception system

• US 20020049838A1
• Filed: 06/21/2001
• Published: 04/25/2002
• Est. Priority Date: 06/21/2000
• Status: Active Grant

• Current Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Original Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Inventors: Iglesias, George, Lauer, Will C., Stabile, Lawrence A., Sylor, Mark W., Wolf, Jay B.
• Granted Patent: US 7,490,145 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/0829 Packet loss
• CPC Class Codes: H04L 43/0852 Delays
• CPC Class Codes: H04L 43/087 Jitter
• CPC Class Codes: H04L 43/0882 Utilisation of link capacity
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 43/16 Threshold monitoring

Abstract

A method of monitoring an element in a computer network including monitoring a preselected variable relating to that element; defining a threshold for the monitored preselected variable; establishing a sliding window in time; repeatedly generating a time above threshold value, the time above threshold value being a measure of an amount of time during which the monitored variable exceeded the threshold during the sliding window of time; detecting when the time above threshold value exceeds a condition window value; and in response to detecting when the time above threshold value exceeds the condition window, generating an alarm.

Claims

1. A method of monitoring an element in a computer network, said method comprising:

monitoring a preselected variable relating to said element;

defining a threshold for the monitored preselected variable;

establishing a sliding window in time;

repeatedly generating a time above threshold value, said time above threshold value being a measure of an amount of time during which the monitored variable exceeded the threshold during the sliding window of time;

detecting when the time above threshold value exceeds a condition window value; and

in response to detecting when the time above threshold value exceeds said condition window, generating an alarm.

2. The method of claim 1 further comprising after generating an alarm, maintaining the alarm at least as long as the time above threshold value exceeds a clear window value.

3. The method of claim 2 wherein said clear window value is equal to said condition window value.

4. The method of claim 3 further comprising:

monitoring a plurality of variables relating to said element, said preselected variable being one of said plurality of variables; and

for each of the plurality of monitored variables, defining a corresponding threshold for that other variable, wherein the time above threshold value is a measure of an amount of time during which any one or more of the monitored variables exceeded its corresponding threshold during the corresponding sliding window of time.

5. The method of claim 1 wherein the step of defining the threshold for the preselected variable comprises:

computing an average value for the preseleted variable based on values obtained for the preselected variable over a corresponding prior period;

defining an excursion amount; and

setting the threshold equal to a sum of the average value plus the excursion amount.

6. The method of claim 5 wherein the corresponding period of time is less than a day.

7. The method of claim 6 wherein the corresponding period of time is a particular hour period of a day.

8. The method of claim 6 wherein the step of computing the average comprises computing a mean value for the preselected variable using values obtained for that preselected variable for the same hour period of the same day of the week for a predetermined number of previous weeks.

9. The method of claim 5 wherein the step of defining an excursion amount comprises:

computing a standard deviation for the preselected variable based on values obtained for the preselected variable over a predetermined period of time; and

setting the excursion amount equal to K times the computed standard deviation, wherein K is a positive number.

10. The method of claim 9 wherein the step of computing the standard deviation comprises computing the standard deviation using values obtained for that preselected variable for the same hour period of the same day of the week for a predetermined number of previous weeks.

11. The method of claim 1 wherein the step of defining the threshold for the preselected variable comprises:

defining an excursion amount; and

setting the threshold equal to H less the excursion amount, where H is a positive number.

12. The method of claim 11 wherein the step of defining an excursion amount comprises:

computing a standard deviation for the preselected variable based on values obtained for the preselected variable over a predetermined period of time; and

setting the excursion amount equal to K times the computed standard deviation, wherein K is a positive number.

14. The method of claim 13 further comprising after generating an exception, maintaining that exception at least as long as the time above threshold value exceeds a clear window value.

13. A method of monitoring an element in a computer network, said method comprising:

defining a profile for that element, said profile including a plurality of different alarm rules, each of said different alarm rules establishing an alarm test for a corresponding one or more variables;

detecting when the alarm test for any one or more of the plurality of different alarm rules is met;

repeatedly generating a time above threshold value, said time above threshold value being a measure of an amount of time during which any one or more of the alarm tests has been met during a preselected prior window of time;

detecting when the time above threshold value exceeds a condition window value; and

in response to detecting when the time above threshold value exceeds said condition window, generating an alarm.

15. A method of displaying on a computer display screen historical performance of an element on a network, said method comprising:

monitoring performance of the element;

for each of the plurality of time slots, deriving a measure of performance for the element from its monitored performance;

for each of a plurality of time slots, computing an average value for the measure of performance of the element;

for each of the plurality of time slots, computing a variability for the measure of performance; and

on the computer display screen and for each of the plurality of time slots;

(1) displaying a first indicator of the computed average value for that time slot;

(2) a second indicator of the computed variability for that time slot; and

(3) a third indicator of the derived measure of performance for that time slot.

16. A computer program stored on a computer-readable medium for causing a computer system to perform the functions of:

monitoring a preselected variable relating to an element of a computer network;

defining a threshold for the monitored preselected variable;

establishing a sliding window in time;

repeatedly generating a time above threshold value, said time above threshold value being a measure of an amount of time during which the monitored variable exceeded the threshold during the sliding window of time;

detecting when the time above threshold value exceeds a condition window value; and

in response to detecting when the time above threshold value exceeds said condition window, generating an alarm.

17. A computer program for monitoring an element in a computer network, said program stored on a computer-readable medium for causing a computer system to perform the functions of:

defining a profile for that element, said profile including a plurality of different alarm rules, each of said different alarm rules establishing an alarm test for a corresponding one or more variables;

detecting when the alarm test for any one or more of the plurality of different alarm rules is met;

repeatedly generating a time above threshold value, said time above threshold value being a measure of an amount of time during which any one or more of the alarm tests has been met during a preselected prior window of time;

detecting when the time above threshold value exceeds a condition window value; and

in response to detecting when the time above threshold value exceeds said condition window, generating an alarm.

18. A computer program for displaying on a computer display screen historical performance of an element on a network, said program stored on a computer-readable medium for causing a computer system to perform the functions of:

monitoring performance of the element;

for each of the plurality of time slots, deriving a measure of performance for the element from its monitored performance;

for each of a plurality of time slots, computing an average value for the measure of performance of the element;

for each of the plurality of time slots, computing a variability for the measure of performance; and

on the computer display screen and for each of the plurality of time slots;

(1) displaying a first indicator of the computed average value for that time slot;

(2) a second indicator of the computed variability for that time slot; and

(3) a third indicator of the derived measure of performance for that time slot.