Adaptive and generalized status monitor

• US 20030046271A1
• Filed: 09/05/2002
• Published: 03/06/2003
• Est. Priority Date: 05/07/1999
• Status: Active Grant

• Current Assignee: NetApp, Inc.
• Original Assignee: Network Appliance Incorporated (NetApp, Inc.)
• Inventors: Eastham, Paul
• Granted Patent: US 6,965,901 B2
• Time in Patent Office: Days
• US Class Current: 707/1
• CPC Class Codes: G06F 11/2257 using expert systems
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3055 Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available error or fault processing without redundancy G06F11/0703; error detection or correction by redundancy in data representation G06F11/08; error detection or correction by redundancy in operation G06F11/14; error detection or correction by redundancy in hardware G06F11/16
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: Y10S 707/99932 Access augmentation or optimizing
• CPC Class Codes: Y10S 707/99943 Generating database or data structure, e.g. via user interface

Abstract

The invention provides a method and system for monitoring status in a relatively continuous consistent and intelligent manner. A status monitor receives monitoring data, and adaptively and dynamically associates those known combinations with assessments of the monitored devices, systems, or networks. From an initial set of selected knowledge (or even no knowledge at all), the status monitor develops a database of information regarding anomalous conditions, and measurements of likely causes and faults and learns which of those anomalous conditions require response. Appropriate responses can include informing a system operator, taking remedial action, and altering or terminating the monitored device, systems or network.

Claims

1a. a. A method including steps for

receiving monitoring data;

in response to said monitoring data, adaptively and dynamically building a database of known combinations of said monitoring data;

in response to said monitoring data, adaptively and dynamically building a database of associations between said known combinations and selected monitoring assessments;

taking action in response to said selected monitoring assessments.

1c. c. In a monitoring apparatus, a computer program including

a database having a plurality of sets of comparison values, each said set of comparison values having a monitoring assessment associated therewith;

and

a vector comparator, coupled to said comparison values for said comparison elements, and coupled to said database, and providing a selected group of said plurality of sets in response thereto.

2. A method as in claim 1, wherein said database includes a non-null initial set of said known combinations.

3. A method as in claim 1, wherein said database includes a null initial set of said known combinations.

4. A method as in claim 1, wherein said database includes at least one said known combination associated with a non-fault monitoring assessment.

5. A method as in claim 1, wherein said monitoring data includes SNMP data or email text.

6. A method as in claim 1, wherein said selected monitoring assessments include at least one of

diagnostic information of a fault;

message information for presentation to an operator;

or

remedial action to be taken in response to said selected monitoring assessment.

7. A method as in claim 1, wherein said steps for receiving monitoring data include steps for receiving selected monitoring data having a new data format.

8. Apparatus including

a plurality of monitoring data input ports, each providing a sequence of monitoring data;

a plurality of comparison elements, each one coupled to an associated one of said input ports, and each providing a sequence of comparison values;

a database having a plurality of sets of comparison values, each said set of comparison values having a monitoring assessment associated therewith;

a vector comparator, coupled to said comparison values for said comparison elements, and coupled to said database, and providing a selected group of said plurality of sets in response thereto; and

a fault response element, coupled to at least one said monitoring assessment, and providing a response thereto.

9. Apparatus as in claim 8, wherein at least one said sequence of monitoring data includes SNMP data or email text.

10. Apparatus as in claim 8, wherein said data input ports each include an element for recognizing monitoring data having a selected data format, whereby said apparatus can receive a new said data input port having a new said data format.

11. Apparatus as in claim 8, wherein said database includes a non-null initial set of said comparison values.

12. Apparatus as in claim 8, wherein said database includes a null initial set of said comparison values.

13. Apparatus as in claim 8, wherein said database includes at least one said known set of comparison values associated with a non-fault monitoring assessment.

14. Apparatus as in claim 8, wherein said selected monitoring assessments include at least one of

diagnostic information of a fault;

message information for presentation to an operator;

or

remedial action to be taken in response to said selected monitoring assessment.

15. Apparatus including memory storing a computer program, said computer program including

a database having a plurality of sets of comparison values, each said set of comparison values having a monitoring assessment associated therewith;

and

a vector comparator, coupled to said comparison values for said comparison elements, and coupled to said database, and providing a selected group of said plurality of sets in response thereto.

16. A program as in claim 15, wherein said database includes a non-null initial set of said comparison values.

17. A program as in claim 15, wherein said database includes a null initial set of said comparison values.

18. A program as in claim 15, wherein said database includes at least one said comparison values associated with a non-fault monitoring assessment.

19. A program as in claim 15, wherein said selected monitoring assessments include at least one of

diagnostic information of a fault;

message information for presentation to an operator;

or

remedial action to be taken in response to said selected monitoring assessment.

20. Apparatus including memory storing a data structure, said data structure including a plurality of sets of comparison values, each said set of comparison values having a monitoring assessment associated therewith.

21. A structure as in claim 20, including at least one said known combination associated with a non-fault monitoring assessment.

23. A program as in claim 22, wherein said database includes a non-null initial set of said comparison values.

24. A program as in claim 22, wherein said database includes a null initial set of said comparison values.

25. A program as in claim 22, wherein said database includes at least one said comparison values associated with a non-fault monitoring assessment.

26. A program as in claim 22, wherein said selected monitoring assessments include at least one of

diagnostic information of a fault;

message information for presentation to an operator;

or

remedial action to be taken in response to said selected monitoring assessment.

27. In a monitoring method, a data structure including a plurality of sets of comparison values, each said set of comparison values having a monitoring assessment associated therewith.

28. A structure as in claim 27, including at least one said known combination associated with a non-fault monitoring assessment.