System, method and model for autonomic management of enterprise applications

• US 20040148138A1
• Filed: 03/06/2003
• Published: 07/29/2004
• Est. Priority Date: 03/09/2002
• Status: Active Grant

• Current Assignee: James E. Van Riper, Katrina Garnett, Prashant Gupta, Robert Hagmann
• Original Assignee: James E. Van Riper, Katrina Garnett, Prashant Gupta, Robert Hagmann
• Inventors: Garnett, Katrina, Hagmann, Robert, Riper, James E. Van, Gupta, Prashant
• Granted Patent: US 6,856,942 B2
• Time in Patent Office: Days
• US Class Current: 702/189
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks

Abstract

Methods, apparatus and system programs are provided for holistic monitoring and troubleshooting an application where the application functionally depends upon a plurality of components on a network system and at least one of the plurality of components being selected from a group consisting of a network component, a hardware component, and a software component. The method includes collecting data from the components and analyzing data collected from the components to discover one or more issues in the components. The analyzing step includes considering domain knowledge of the components and considering the interrelationships and correlations between components working within the application. The method function includes diagnosing the issues in the components to determine an action plan.

Claims

1. A method for holistic monitoring and troubleshooting an application, the application functionally depending upon a plurality of components on a network system, at least one of the plurality of components being selected from a group consisting of a network component, a hardware component, and a software component, the method comprising:

a. collecting data from the components;

b. analyzing data collected from the components to discover one or more issues in the components, the analyzing step including considering domain knowledge of the components and considering the interrelationships and correlations between components working within the application; and

c. diagnosing the issues in the components to determine an action plan.

2. The method as recited in claim 1, wherein the collecting step further comprises:

gathering data directly from at least one of the components.

3. The method as recited in claim 1, wherein the collecting step further comprises:

gathering data using a helper process for at least one of the components.

4. The method as recited in claim 1, wherein the collecting step further comprises:

gathering data using an agent process for at least one of the components.

5. The method as recited in claim 1, wherein the analyzing step further comprises:

testing at least one of the components for at least one threshold value.

6. The method as recited in claim 1, wherein the analyzing step further comprises:

computing a response time of at least one of the components.

7. The method as recited in claim 1, wherein the analyzing step further comprises:

comparing a current state of at least one of the components against stored data.

8. The method as recited in claim 1, wherein the analyzing step further comprises:

determining a state of network traffic.

9. The method as recited in claim 1, wherein the analyzing step further comprises:

computing a statistical value of at least one component.

10. The method as recited in claim 9, wherein the computing a statistical value step includes a computing step selected from the group consisting of:

a. computing a minimum value of the data of the component,

b. computing a maximum value of the data of the component, and

c. computing an average value of the data of the component.

11. The method as recited in claim 1, wherein the diagnosing step is activated by an alert created in the analyzing step.

12. The method as recited in claim 1, wherein the diagnosing step is activated by a user request.

13. The method as recited in claim 1, wherein the diagnosing step is activated periodically.

14. The method as recited in claim 1, wherein the diagnosing step further comprises:

defining the scope of the issues in the components.

15. The method as recited in claim 14, wherein the defining step further comprises:

a. analyzing data from the components with issues;

b. analyzing data from the components related to the components with issues;

c. correlating the data from the components with issues and the related components.

16. The method as recited in claim 1, wherein the diagnosing step further comprises:

finding a root cause of the issues.

17. The method as recited in claim 16, wherein the finding step further comprises:

checking if available data is sufficient to find the root cause of the issues; and

firing tasks related to the issues in the components to gather more data, if the available data is insufficient.

18. The method as recited in claim 16, wherein the finding step further comprises:

using expert systems.

19. The method as recited in claim 16, wherein the finding step further comprises:

using case based reasoning and rule systems.

20. The method as recited in claim 16, wherein the finding step further comprises:

modeling differences between systems in time.

21. The method as recited in claim 16, wherein the finding step further comprises one modeling step selected from the group consisting of:

modeling differences between equivalent components that vary by location,

modeling differences between similar components that vary by location, and

modeling differences between abstractions of groups of components that vary by location.

22. The method as recited in claim 16, wherein the finding step further comprises:

comparing instances of a same type of component.

23. The method as recited in claim 16, wherein the finding step further comprises:

baselining with predictive modeling on data to find the cause of the issues.

24. The method as recited in claim 17, wherein the firing step further comprises:

a. filtering relevant tasks from knowledge modules relating to the components with issues; and

b. executing the tasks from knowledge modules relating to analyzers and correlators with issues.

25. The method as recited in claim 1, wherein the taking action plan further comprises displaying the data relating to the root cause of the issues on a GUI.

26. The method as recited in claim 16, wherein the determining an action plan further comprises providing notifying data relating to the root cause of the issues to a user by email.

27. The method as recited in claim 16, wherein the determining an action plan further comprises providing notifying data relating to the root cause of the issues to user by pager.

28. The method as recited in claim 1, wherein the determining an action plan comprises displaying data relating to a recommended solution for repairing the issues in the components on a GUI.

29. The method as recited in claim 1, wherein the determining an action plan further comprises repairing the issues in the components.

30. The method as recited in claim 29, wherein the repairing step further comprises:

a. filtering tasks from knowledge modules for repairing the components with the issues; and

b. executing the tasks from knowledge modules to repair the components with the issues.

31. A computer program product tangibly embodied in an information carrier for holistic monitoring and troubleshooting an application, the application functionally depending upon a plurality of components on a network system, at least one of the plurality of components being selected from a group consisting of a network component, a hardware component, and a software component, the computer program comprising instructions operable to cause a computer system to:

a. collect data from the components;

b. analyze data collected from the components to discover one or more issues in the components, wherein the instructions to analyze data includes instructions to consider domain knowledge of the components and instructions to consider the interrelationships and correlations between components working within the application; and

c. diagnose the issues in the components to determine an action plan.

32. The computer program product as recited in claim 31, wherein collecting data further comprises instructions to:

gather data directly from at least one of the components.

33. The computer program product as recited in claim 31, wherein collecting data further comprises instructions to:

gather data using a helper process for at least one of the components.

34. The computer program product as recited in claim 31, wherein collecting data further comprises instructions to:

gather data using an agent process for at least one of the components.

35. The computer program product as recited in claim 31, wherein analyzing data further comprises instructions to:

test at least one of the components for at least one threshold value.

36. The computer program product as recited in claim 31, wherein analyzing data further comprises instructions to:

compute a response time of at least one of the components.

37. The computer program product as recited in claim 31, wherein analyzing data further comprises instructions to:

compare a current state of at least one of the components against stored data.

38. The computer program product as recited in claim 31, wherein analyzing data further comprises instructions to:

determine a state of network traffic.

39. The computer program product as recited in claim 31, wherein analyzing data further comprises instructions to:

compute a statistical value of at least one component.

40. The computer program product as recited in claim 39, wherein computing a statistical value includes instructions to compute selected from the group consisting of:

a. compute a minimum value of the data of the component,

b. compute a maximum value of the data of the component, and

c. compute an average value of the data of the component.

41. The computer program product as recited in claim 31, wherein diagnosing the issues is activated by an alert created in the analyzing step.

42. The computer program product as recited in claim 31, wherein the diagnosing step is activated by a user request.

43. The computer program product as recited in claim 31, wherein diagnosing the issues is activated periodically.

44. The computer program product as recited in claim 31, wherein diagnosing the issues further comprises instructions to:

define the scope of the issues in the components.

45. The computer program product as recited in claim 44, wherein defining the scope further comprises instructions to:

a. analyze data from the components with issues;

b. analyze data from the components related to the components with issues;

c. correlate the data from the components with issues and the related components.

46. The computer program product as recited in claim 31, wherein diagnosing the issues further comprises instructions to:

find a root cause of the issues.

47. The computer program product as recited in claim 46, wherein finding a root cause further comprises instructions to:

check if available data is sufficient to find the root cause of the issues; and

fire tasks related to the issues in the components to gather more data, if the available data is insufficient.

48. The computer program product as recited in claim 46, wherein finding a root cause further comprises instructions to:

use expert systems.

49. The computer program product as recited in claim 46, wherein finding a root cause further comprises instructions to:

use case based reasoning and rule systems.

50. The computer program product as recited in claim 46, wherein finding a root cause further comprises instructions to:

model differences between systems in time.

51. The computer program product as recited in claim 46, wherein finding a root cause further comprises instructions to model selected from the group consisting of:

model differences between equivalent components that vary by location,

model differences between similar components that vary by location, and

model differences between abstractions of groups of components that vary by location.

52. The computer program product as recited in claim 46, wherein finding the root cause further comprises instructions to:

compare instances of a same type of component.

53. The computer program product as recited in claim 46, wherein finding the root cause further comprises instructions to:

baseline with predictive modeling on data to find the cause of the issues.

54. The computer program product as recited in claim 47, wherein firing tasks further comprises instructions to:

a. filter relevant tasks from knowledge modules relating to the components with issues; and

b. execute the tasks from knowledge modules relating to analyzers and correlators with issues.

55. The computer program product as recited in claim 31, further comprising instructions to display the data relating to the root cause of the issues on a GUI.

56. The computer program product as recited in claim 31, wherein the determining an action plan further comprises instructions to provide notifying data relating to the root cause of the issues to a user by email.

57. The computer program product as recited in claim 31, wherein determining an action plan further comprises instructions to provide notifying data relating to the root cause of the issues to user by pager.

58. The computer program product as recited in claim 31, wherein determining an action plan comprises instructions to display data relating to a recommended solution for repairing the issues in the components on a GUI.

59. The computer program product as recited in claim 31, wherein the determining an action plan further comprises instructions to repair the issues in the components.

60. The computer program product as recited in claim 59, wherein repairing the issues further comprises instructions to:

a. filter tasks from knowledge modules for repairing the components with the issues; and

b. execute the tasks from knowledge modules to repair the components with the issues.

61. A system for holistic monitoring and troubleshooting applications and components, each application depending upon one or more components, at least one component being selected from a group consisting of a network component, a hardware component, and a software component, the system comprising:

a. a plurality of first software modules for monitoring and troubleshooting individual components;

b. a plurality of second software modules for monitoring and troubleshooting one or more groups of components using interrelationships and correlation between components within the group; and

c. a plurality of data stores for storing data relating to the components.

62. The system as recited in claim 61, wherein at least one component has an attribute selected from the group consisting of a name, a status, a mode, a configuration, a performance, a load, and a capacity.

63. The system as recited in claim 61, wherein the attribute is accessible by other dependant components.

64. The system as recited in claim 61, wherein the first software modules for monitoring and troubleshooting individual components are analyzers.

65. The system as recited in claim 61, wherein the second software modules for monitoring and troubleshooting group of components are correlators.

66. The system as recited in claim 61, wherein one of the first software modules further comprises:

a. a sensor module collecting data from respective component;

b. a software module conducting analysis of data received from the sensor module for discovering issues in the component;

c. a diagnosis module diagnosing issues in the respective component; and

d. a presentation module displaying data related to the respective component.

67. The system as recited in claim 66, wherein one of the first software modules further comprises:

a software module for testing if a threshold limit has been exceeded.

68. The system as recited in claim 66, wherein the diagnosis module comprises a plurality of knowledge modules.

69. The system as recited in claim 68, wherein the knowledge modules comprise a plurality of tasks.

70. The system as recited in claim 69, wherein each of the tasks comprises a codified knowledge of an expert of a particular domain required for repairing a particular issue related to the component.

71. The system as recited in claim 69, wherein the tasks are grouped together into categories based on a type of issue related with the system.

72. The system as recited in claim 66, wherein the diagnosis module filters out the tasks based on a category of the component.

73. The system as recited in claim 61, wherein one of the second software modules further comprises:

a. a sensor module collecting data from at least one component in a particular group of components;

b. a software module for conducting analysis of data received from the sensor module for discovering any issues in the particular group of components;

c. a diagnosis module for diagnosing and holistic troubleshooting issues in the particular group of components; and

d. a presentation module for displaying data related to the particular group of components.

74. The system as recited in claim 73, wherein one of the second software modules further comprises:

a software module for testing if a threshold limit has been exceeded.

75. The system as recited in claim 73, wherein the diagnosis module comprises a plurality of knowledge modules.

76. The system as recited in claim 75, wherein the knowledge modules comprises a plurality of tasks.

77. The system as recited in claim 76, wherein each of the tasks comprises a codified knowledge of an expert of a particular domain required for repairing a particular issue related to the component.

78. The system as recited in claim 76, wherein the tasks are grouped together into categories based on a type of issue related with the system.

79. The system as recited in claim 73, wherein the diagnosis module filters out the tasks based on a category of a particular group of components.

80. The system as recited in claim 73, wherein one of the second software modules uses a finding technique to find a cause of issues in the group of components.

81. The system as recited in claim 80, wherein the finding technique includes expert systems.

82. The system as recited in claim 80, wherein the finding technique includes expert case based reasoning rule systems.

83. The system as recited in claim 80, wherein the finding technique includes modeling and differentiating between systems.

84. The system as recited in claim 80, wherein the finding technique includes baselining with predictive modeling.

85. The system as recited in claim 61, wherein the presentation module displays data using a GUI.

86. The system as recited in claim 61, wherein the presentation module displays an alert using a GUI.

87. The system as recited in claim 80, wherein the presentation module displays a cause of the issues using a GUI.

88. The system as recited in claim 61, wherein the presentation module displays a solution to repair the issues in the particular group of components using a GUI.

89. The system as recited in claim 61, wherein the plurality of data stores include a first data store having a facility for storing information for real time analysis.

90. The system as recited in claim 61, wherein the plurality of data stores include a second data store having a facility for storing information for long-term analysis.