System and method for correlating and diagnosing system component performance data

• US 20020184065A1
• Filed: 04/02/2002
• Published: 12/05/2002
• Est. Priority Date: 03/30/2001
• Status: Active Grant

• Current Assignee: Clouding Corporation (Marathon Patent Group, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Menard, Cody, Murthy, Raghavendra K.
• Granted Patent: US 7,237,023 B2
• Time in Patent Office: Days
• US Class Current: 705/7
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: H04L 41/0233 Object-oriented techniques, for representation of network management data, e.g. common object request broker architecture [CORBA]
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls

Abstract

The system and method for correlating, predicting and diagnosing system component performance data includes capturing knowledge about system behavior, deploying the captured knowledge as baseline system behavior files, evaluating system performance data against the baseline system behavior files, performing predictive and diagnostic analysis when received system performance data exceeds thresholds in the baseline system behavior files, and notifying a user when an analysis result is generated. The method of capturing knowledge about system behavior includes defining problems to be solved, creating datasets that correspond to defined problems, constructing problem scenarios, associating data patterns modules with the problem scenarios, and generating XML definition files that characterize system behavior in terms of the scenarios, modules, and datasets. The system has the capability to activate corrective scripts in the target system and to reconfigure the target system.

Claims

1. A computer-implemented method for correlating and diagnosing system performance data, comprising:

capturing knowledge about system behavior;

deploying the captured knowledge as baseline system behavior files;

evaluating monitored system performance datapoints against the baseline system behavior files to identify datasets that have changed states;

performing real-time prediction and diagnostic analysis on the datasets that have changed states; and

notifying a user of a prediction and diagnostic analysis result.

2. The method of claim 1, wherein the capturing step comprises;

defining problems to be solved;

creating datasets that correspond to the defined problems;

constructing problem scenarios;

associating data patterns with the problem scenario cases; and

generating XML definition files that characterize system behavior in terms of the scenarios, modules and datasets.

3. The method of claim 1, wherein the deploying step further comprises characterizing the captured system behavior knowledge as XML files.

4. The method of claim 1, wherein the deploying step comprises:

loading XML definition files that characterize system behavior in terms of the scenarios, modules and datasets;

receiving system domain, component and datapoint information;

creating relationships between components; and

evaluating and creating domain and component instances in each domain to form instances of datasets.

5. The method of claim 1, wherein the evaluating step comprises:

receiving system performance datapoints from data collectors;

comparing the datapoints against a threshold value to determine a state of the datapoints;

analyzing the received performance datapoints when a state changes or exceeds a threshold;

correlating the datapoints that exceeded the threshold values with stored datasets in the baseline system behavior files to identify related datasets; and

sending the correlated datasets to a reasoning system for prediction and diagnostic analysis.

6. The method of claim 1, wherein the performing step comprises:

receiving correlated datasets by a reasoning system;

performing prediction and diagnosis analysis by the reasoning system to determine if the received datasets match problem patterns in a knowledge base; and

generating an analysis result based on analysis of the received datasets and problem patterns.

7. The method of claim 6, wherein the generating step provides an analysis result that identifies a problem and a probable cause of the problem.

8. The method of claim 6, wherein the generating step provides an analysis result that predicts an incipient system component failure.

9. The method of claim 6, wherein the generating step provides a best estimate of a problem and probable cause of the problem.

10. The method of claim 4, wherein the evaluating step comprises:

parsing XML files into a tree representation;

traversing the tree representation and taking actions on specific tree elements;

creating and updating domain, component, datapoint, relationship and dataset objects specified by a given tree element;

instantiating derived objects by processing newly created components to determine if new relationships need to be created; and

instantiating datasets by processing newly created relationships and components to determine if new datasets need to be instantiated.

11. A computer-readable medium containing instructions for controlling a computer system to carry out the steps of claim 1.

13. The data structure of claim 12, wherein a system manager instantiates the objects in a repository from XML files.

14. The data structure of claim 12, wherein:

the domain objects are defined by DomainDef XML definition structures that include a type, category, and attributes of component and datapoint objects;

the component objects are defined by ComponentDef XML definition structures that include a type and attributes of datapoint objects;

the datapoint objects are defined by DataPointDef XML definition structures that contain a name and attributes;

the dataset objects are defined by DataSetDef XML definition structures that include attributes of components objects and datapoint objects;

the relationship templates are defined by RelationTemp definition structures that include identification of related components;

the scenario objects are defined by the Scenario definition structures that include the problem description, probable cause and suggested solutions; and

the module objects encapsulate knowledge.

15. The data structure of claim 12, wherein:

domain objects comprise one or more component objects;

component objects comprise one or more datapoint objects; and

dataset objects comprise one or more component objects and one or more datapoint objects.

16. The data structure of claim 12, wherein dataset objects contains datapoints belonging to one or more component objects.

17. The data structure of claim 14, wherein the DataSetDef objects comprise;

a DataSetDef name;

a list of DsComponentDef objects, each object including;

a pointer to the component definition used in the dataset;

subset of DsDataPointDef objects included in the component definitions needed in the dataset;

list of child DsComponentDef objects related to this component;

parent DsComponentDef object;

the DsDataPointDef objects include;

pointer to a DataPointDef object used in the dataset;

a trigger flag for specifying whether this datapoint triggers analysis;

a trigger threshold at which point analysis is triggered;

an analyze flag for specifying whether this datapoint participates in analysis; and

a label to uniquely identify the datapoint.

18. The data structure of claim 17, wherein the trigger threshold is selected from the group consisting of good, fair, warning and critical.

19. The data structure of claim 17, wherein the DsComponentDef object further includes a constraint selected from the group consisting of possible candidates for this component based on its host, the domain instance, and the component instance.

20. The data structure of claim 12, wherein the relationship templates specify a rule to create relationships between components, the relationship template including the following attributes:

Type for identifying method of creation;

OwnerDomainType for identifying owner domain type;

OwnerCompType for identifying owner component type;

MemberDomainType for identifying member domain type;

MemberCompType for identifying member component type;

OwnerComp for identifying owner component instance;

MemberComp for identifying member component instance;

OwnerDomainInst for identifying owner domain instance;

MemberDomainInst for identifying member domain instance; and

flags to specify that owner and member should be part of same domain, same component and same host.

21. The data structure of claim 12, further comprising an engine template for associating analysis with a dataset, the engine including one or more modules that address a specific dataset.

12. A computer readable medium containing a data structure for storing objects for correlating and diagnosing system component performance data, comprising:

domain objects that identify distinct areas of a system environment;

component objects that identify parts of the domains of the system environment;

datapoint objects that identify monitored characteristics of system components;

dataset objects that comprise logical collections of datapoint objects;

relationship templates for connecting two or more components related to one another;

scenario objects that identify possible causes for the problem; and

module objects that encapsulate stored knowledge.

22. A computer-implemented system for correlating and diagnosing system performance data, comprising:

an extension environment comprising means for capturing knowledge

about system behavior;

a system manager comprising;

means for deploying the captured knowledge as baseline system behavior files;

means for evaluating monitored system performance datapoints against the baseline system behavior files to identify datapoints that have changed states;

a reasoning system comprising;

means for performing real-time prediction and diagnostic analysis on the datasets; and

means for notifying a user of a prediction and diagnostic analysis result.

23. The system of claim 22, wherein the capturing means comprises;

problems to be solved;

datasets that correspond to the defined problems;

problem scenarios;

data pattern modules with the problem scenarios; and

XML definition files that characterize system behavior in terms of the scenarios, modules and datasets.

24. The system of claim 22, wherein the means for deploying further comprises XML files that characterize the captured system behavior knowledge.

25. The system of claim 24, wherein the system behavior knowledge is stored in a repository, encapsulated in XML files and built into the engine and module.

26. The system of claim 22, wherein the means for deploying comprises XML definition files that characterize system composition and behavior in terms of:

the scenarios, modules and datasets;

domain information;

datapoints and components; and

relationships between components.

27. The system of claim 22, wherein the means for evaluating comprises:

system performance data from data collectors;

domain, component, datapoint and relationship instances from received data;

relationships based on pre-defined templates based on component instances;

datasets based on relationships and component instances;

evaluated performance data to determine if a threshold value is exceeded;

identified datasets containing datapoints that exceed a threshold value; and

a reasoning system for receiving the identified datasets.

28. The system of claim 22, wherein the means for performing real-time prediction and diagnostic analysis comprises:

a reasoning system for receiving identified datasets;

a prediction engine and a diagnostic engine in the reasoning system for determining if the received dataset matches a problem pattern in a knowledge base; and

an analysis result from the prediction engine and diagnostic engine.

29. The system of claim 28, wherein the analysis result identifies a problem, a probable cause of the problem, and suggested solution.

30. The system of claim 28, wherein the analysis result predicts an incipient system component failure.

31. The system of claim 28, wherein the analysis result is a best estimate of a problem and a probable cause of the problem.

32. A method for correlating and diagnosing system performance data, comprising:

entering knowledge about system behavior data into a repository;

receiving system performance data from a target system;

comparing the system performance data values with system behavior data values in the persistent store to determine if threshold values have been exceeded, indicating a problem;

correlating the performance data that exceeds threshold values with datasets in a repository to identify related datasets;

performing predictive and diagnostic analysis of the identified datasets; and

notifying a user of a result of the performing predictive and diagnostic analysis step.

33. The method of claim 32, wherein the system behavior data and the system performance data are stored in the persistent store.

34. The method of claim 32, wherein the performing step further comprises analyzing the identified datasets with stored problem scenario datasets to determine a cause and correction for the data values that exceed threshold values.

35. The method of claim 32, further comprising activating a corrective script based on a result of the performing predictive and diagnostic analysis step.

36. A computer-readable medium containing instructions for controlling a computer system to carry out the steps of claim 32.