Method, apparatus, and article of manufacture for a network monitoring system

• US 20040030778A1
• Filed: 05/02/2003
• Published: 02/12/2004
• Est. Priority Date: 10/13/1998
• Status: Active Grant

• Current Assignee: RPX Corporation
• Original Assignee: Netarx, Inc.
• Inventors: Kronenberg, Sandy Craig, Johns, David, Nine, Harmon S., Eisele, Fredrick, Cognata, Matthew
• Granted Patent: US 7,490,066 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/065 related to network devices
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: Y10S 707/99945 Object-oriented database structure processing
• CPC Class Codes: Y10S 707/99948 Application of database or data structure, e.g. distributed, multimedia, or image

Abstract

Methods and systems consistent with the present invention solve the limitations of current monitoring systems by automatically and completely monitoring various networks devices and services. Specifically, a network monitoring system monitors all services and conditions on various networks. Moreover, the network monitoring system may provide an advance warning of potential failures and may diagnose an problems that may surface.

Claims

1. A method for monitoring a network with at least one service on the network, executed in a data processing system, comprising the steps of:

spawning a process in a server for monitoring a service, wherein said process is associated with at least one service on the network;

monitoring a service with the process by receiving information from the service;

detecting a problem with the service; and

notifying an accounting server when a problem is detected with the service.

2. The method of claim 1, wherein spawning the process further includes the step of:

querying an engine for the location of the service to monitor.

3. The method of claim 1, further including the steps of:

monitoring a condition, wherein the process monitors a sensor associated with the condition; and

determining a problem exists with the condition based on information associated with the sensor.

4. The method of claim 1, wherein monitoring a service further includes the step of:

transmitting a message from the process to the service to determine if a problem exists.

5. The method of claim 4, wherein detecting a problem with the service further includes the steps of:

determining whether the message was not received within a predetermined period of time; and

determining that the service is nonresponsive when the message was not received within the predetermined period of time.

6. The method claim 4, wherein detecting a problem with the service further includes the step of:

receiving a response from the service indicating the status of the service, wherein the response includes additional information indicating that an anomaly exists.

7. The method of claim 6, wherein receiving a response from the service includes the steps of:

requesting a log file associated with the service;

receiving the log file; and

parsing the log file for information regarding the status of the service; and

determining a status of a security service based on information associated with the log file.

8. The method of claim 1, further including the steps of:

locating an agent on a network associated with the service, wherein said agent is associated with a device and the service;

communicating with said agent using a protocol capable of transmitting messages in real time;

detecting an anomaly with the service using said agent; and

if an anomaly is detected, transmitting information associated with said anomaly to said accounting server.

9. The method of claim 1, wherein notifying an accounting server further includes the steps of:

obtaining a log file associated with the service; and

including the log file in a ticket.

10. The method of claim 1, further including the steps of:

dispatching a message including identification information to the accounting server, wherein said message is in an SGML format;

performing an analysis on the information associated with the message; and

determining a method of dispatch associated with a technician based on results of the analysis.

11. The method of claim 1, wherein notifying an accounting server when a problem is detected with the service further includes the steps of:

receiving a data record in the accounting server by a process associated with the accounting server;

identifying information associated with the data record;

analyzing the information associated with the data record using an expert system; and

storing the data record in a database.

12. The method of claim 11, further including the steps of:

monitoring the database for a new data record; and

spawning a process to dispatch a message to an administrator upon analysis of the new data record.

13. The method of claim 11, further including the step of:

generating a report that includes at least one data record in the database, wherein the said report is graphical and may detect a pattern in problems experienced by a device; and

generating a visualization of a network topology.

14. The method of claim 13, wherein generating a visualization of a network topology further includes the steps of:

displaying objects in the view, wherein the objects represent devices and wherein objects in the center of the view are larger than objects near the edge of the view;

querying a database to determine a current status of device;

displaying said objects in colors, wherein colors represent the status of the device; and

displaying a second visualization of the network topology when an object is selected.

15. The method of claim 13, wherein generating a visualization of a network topology further includes the step of:

generating the visualization topology based on XML files; and

displaying said visualization topology using scalable vector graphics.

16. The method of claim 1, wherein monitoring a service further includes the steps of:

defining a temporal finite state machine, wherein the temporal finite state, machine includes a state-transition model, a temporal store and a condition processor;

determining if a hypothetical state in the state-transition model is false;

if it is determined that the hypothetical state in the state-transition model is false, obtain an alternate hypothetical state and update a database;

update said temporal store each time said state-transition model is activated; and

analyzing said temporal store with said condition processor

17. A computer-readable medium containing instructions, for controlling a data processing system to perform a method for monitoring a network with at least one service on the network, comprising the steps of:

spawning a plurality of processes in a server for monitoring a plurality of services, wherein each spawned process is associated with at least one service on the network;

monitoring a service with a spawned process by receiving information from the service;

detecting a problem with the service; and

notifying an accounting server when a problem is detected with the service by;

generating a data record indicating information associated with the service; and

sending the data record to the accounting server.

18. A data processing system, comprising:

a memory containing a monitoring program that spawns a plurality of processes in a server for monitoring a plurality of services, wherein each spawned process is associated with at least one service on the network;

that monitors a service with a spawned process by receiving information from the service, and in response to detecting a problem with the service, that notifies an accounting server when a problem is detected with the service;

that dispatches a message that includes ticket identification information; and

that updates a database to indicate that a message has been dispatched; and

a processor configured to run the monitoring program.

19. A method for initiating a network monitoring system, comprising the steps of:

determining whether a network monitoring device requests a new image;

if it is determined that the network monitoring device requests a new image, transmitting an image to the network monitoring device, wherein said image updates the network monitoring device;

locating devices on a network associated with the network monitoring system;

updating a database by including located devices; and

monitoring at least one service associated with the located devices.

20. The method of claim 19, further including the steps of:

determining whether the network monitoring device requests a new image by receiving a message from the network monitoring device, wherein the message indicates new services to monitor;

transmitting configuration files to the network monitoring device, wherein said configuration files are based on information associated with the message, and wherein said configuration files including information indicating services to be monitored.

21. The method of claim 20, wherein transmitting configuration files to the network monitoring device further includes the steps of:

obtaining information for said configuration files by accessing information associated with an expert database; and

obtaining information for said configuration files by receiving information from a user.

22. A method for monitoring a distributed network monitoring system, comprising the steps of:

receiving a message from a network monitoring device indicating that said device is functional;

once the message received, incrementing a counter associated with said device;

at predetermined periods, decrementing said counter;

detemining if said counter crosses a certain threshold and if said counter crosses the threshold, notifying an accounting server; and

determining if a new network monitoring device is available and, if it is determined that said device is available, adding a new counter for said new network monitoring device.