Monitoring a system using weighting

• US 20060095569A1
• Filed: 12/15/2005
• Published: 05/04/2006
• Est. Priority Date: 04/04/2002
• Status: Abandoned Application

• Current Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Original Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Inventors: O'Sullivan, Patrick Charles
• Application Number:
  US11/300,943
• Publication Number:
  US 20060095569A1
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 2012/5628 Testing
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 41/0879 Manual configuration through operator
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 43/50 Testing arrangements

Abstract

Methods, systems and computer program products for collecting data processing system status information monitoring network communications with the data processing system to observe transaction(s) associated with the data processing system. The transaction(s) is analyzed to determine if the transaction(s) complies with a quality standard and a trigger is generated based on the analysis of the transaction(s). System status information is collected responsive to the generation of the trigger. The collection of system status information may be provided by collecting system status information so that collection of the system status information automatically time correlates the collected system status information with the trigger.

Claims

1. A method for monitoring, comprising:

determining that an event occurred in a data processing system;

assigning a particular weight to said event based on a user identity associated with said event; and

acting on said event based on said particular weight.

2. A method according to claim 1, further comprising:

assigning another weight to said event based on a transaction identifier associated with said event, said acting on said event is based on said particular weight and said another weight.

3. A method according to claim 2, further comprising:

assigning an additional weight to said event based on an event class identifier associated with said event, said acting on said event is based on said particular weight, said another weight and said additional weight.

4. A method according to claim 3, further comprising:

combining said particular weight, said another weight and said additional weight.

5. A method according to claim 3, further comprising:

combining said particular weight, said another weight and said additional weight by multiplication of said particular weight by said another weight and said additional weight.

6. A method according to claim 3, wherein said acting on said weight includes:

determining whether said particular weight, said another weight or said additional weight indicate immediate correlation;

immediately correlating said event and creating a particular trigger if said particular weight, said another weight or said additional weight indicate immediate correlation;

correlating said event to other events and determining whether a threshold has been exceeded based on said correlating if said particular weight, said another weight and said additional weight do not indicate immediate correlation;

generating a new trigger if said threshold has been exceeded based on said correlating; and

collecting data processing system status information in response to said particular trigger or said new trigger.

7. A method according to claim 1, wherein:

said particular weight is an absolute weight.

8. A method according to claim 1, wherein:

said particular weight is an integer.

9. A method according to claim 1, wherein:

said particular weight can be an automatic trigger weight, a never trigger weight or an intermediate weight.

10. A method according to claim 1, wherein:

said particular weight is a monetary amount related to said event.

11. A method according to claim 1, wherein:

said assigning said particular weight is based on a table mapping of said user identity to a preconfigured weight.

12. A method according to claim 1, wherein said determining that an event occurred includes:

gathering network communications using an intermediate entity, said network communications include a plurality of data units;

grouping said data units into multiple groups based on one or more identifiers; and

parsing said groups to identify said event.

13. A method for monitoring, comprising:

accessing transactions in network communications for a system;

identifying that events occurred based on said transactions;

weighting said events based on transaction identities associated with said events; and

acting on said events based on said weighting.

14. A method according to claim 13, wherein:

said weighting can include assigning an automatic trigger weight, a never trigger weight or an intermediate weight.

15. A method according to claim 13, wherein:

said weighting includes assigning a monetary amount related to said event.

16. A method according to claim 13, wherein said accessing transactions includes:

gathering network communications using an intermediate entity, said network communications include a plurality of packets; and

grouping said packets into said transactions.

17. A method according to claim 13, wherein:

said weighting said events is based on transaction identities and event classes.

18. A method according to claim 13, wherein:

said acting on said events includes determining whether to trigger a data collection process based on said weighting.

19. A processor readable storage device having processor readable code embodied on said processor readable storage device, said processor readable code for programming a processor to perform a method comprising:

accessing network communications for a system;

identifying that an event occurred based on said monitored network communications;

assigning a particular weight to said event based on a user identity associated with said event; and

acting on said event based on said particular weight.

20. A processor readable storage device according to claim 19, wherein:

said particular weight can be an automatic trigger weight, a never trigger weight or an intermediate weight.

21. A processor readable storage device according to claim 19, wherein:

said particular weight is a monetary amount related to said event.

22. A processor readable storage device according to claim 19, wherein said accessing network communications includes:

gathering network communications using an intermediate entity, said network communications include a plurality of packets; and

grouping said packets into said transactions, said identifying an event is performed by parsing said transactions.

23. A processor readable storage device according to claim 22, further comprising:

assigning another weight to said event based on transaction identity, said acting on said event is based on said particular weight and said another weight.

24. A processor readable storage device according to claim 23, further comprising:

combining said particular weight and said another weight prior to said acting.

25. A processor readable storage device having processor readable code embodied on said processor readable storage device, said processor readable code for programming a processor to perform a method comprising:

monitoring network communications for a system;

grouping said monitored network communications into transactions;

parsing said transactions to determine if events occurred;

weighting said events based on transaction identities associated with said respective events; and

acting on said events based on said weighting.

26. A processor readable storage device according to claim 25, wherein:

said monitoring network communication includes gathering packets from at an intermediate entity; and

said grouping includes grouping packets into flows and grouping flows into transactions.

27. A processor readable storage device according to claim 25, wherein:

said weighting can include assigning an automatic trigger weight, a never trigger weight or an intermediate weight.

28. An apparatus, comprising:

a communication interface;

a storage device; and

a processor in communication with said communication interface and said storage device, said processor performs a method comprising;

monitoring network communications for a system,

grouping said monitored network communications into transactions,

parsing said transactions to determine if events occurred,

assigning weights to said events based on transaction identities associated with said respective events, and

acting on said events based on said weights.

29. An apparatus according to claim 28, wherein:

said weights are based on monetary amounts associated with said events.

30. An apparatus according to claim 28, wherein:

said weights can be an automatic trigger weight, a never trigger weight or an intermediate weight.

31. An apparatus according to claim 28, wherein:

said processor assigns weights to said events based on user identities associated with said respective events.

32. An apparatus according to claim 31, wherein:

said processor assigns weights to said events based on event class identity associated with said respective events.

33. An apparatus, comprising:

a communication interface;

a storage device; and

a processor in communication with said communication interface and said storage device, said processor performs a method comprising;

monitoring network communications for a system,

identifying that an event occurred based on said monitored network communications,

assigning a weight to said event based on a user identity associated with said event, and

acting on said event based on said weight.

34. An apparatus, according to claim 33, wherein:

said assigning a weight can include assigning an automatic trigger weight, a never trigger weight or an intermediate weight.

35. An apparatus, according to claim 33, wherein:

said weight is a monetary amount related to said event.

36. An apparatus, according to claim 33, wherein:

said acting on said event includes determining whether to trigger a data collection process based on said weight.