ABNORMALITY INDICATOR OF A DESIRED GROUP OF RESOURCE ELEMENTS

• US 20070025389A1
• Filed: 07/29/2005
• Published: 02/01/2007
• Est. Priority Date: 07/29/2005
• Status: Active Grant

• Current Assignee: BMC Software Incorporated (KKR & Co., Inc.)
• Original Assignee: ProactiveNet, Inc. (KKR & Co., Inc.)
• Inventors: GANAPATHY, Bopana, HANUMAPPA, Anil Kumar, RAO, Dasari, RAGHAVAN, Girish, GARG, Atul, SCARPELLI, Joe
• Granted Patent: US 7,502,844 B2
• Time in Patent Office: Days
• US Class Current: 370/449
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/16 Threshold monitoring

Abstract

A monitoring system provided according to an aspect of the present invention enables a user to specify one or more resource elements as a group, and compute an Abnormality Index that represents the deviation from a baseline operation of these selected resource elements. In an embodiment, the Abnormality Index is computed as a single number. The user may include any desired attributes of each resource element to be considered in determining deviations. The Abnormality Index represents the number of deviations, the seriousness of deviation (e.g., more serious if deviation relates to unavailability of the resource element), and the extent of deviation (i.e., whether the deviation is based on expected operation for hourly, daily or weekly duration).

Claims

1. A method of monitoring a plurality of resource elements of interest, said method comprising:

receiving from a user, data representing said plurality of resource elements;

determining deviations from corresponding baseline thresholds in operation of each of said plurality of resource elements; and

computing an Abnormality Index for all of said plurality of resource elements from the determined deviations.

2. The method of claim 1, wherein said Abnormality Index comprises a single number.

3. The method of claim 1, further comprising:

receiving data representing a set of attributes and corresponding limit value corresponding to each of said attributes, wherein said limit values represent said baseline thresholds; and

polling each of said plurality of resource elements to determine present value of each of said attributes,

wherein said determining comprises comparing the present values with a corresponding limit value to determine whether said deviation is present.

4. The method of claim 3, wherein said computing comprises:

receiving an event interval for generating said Abnormality Index;

checking whether deviation is present for a first attribute at the end of an event period determined by said event interval, wherein the corresponding event is determined to be active if said deviation is present at the end of the corresponding event period; and

calculating a plurality of parameters for said first attribute if said event is determined to be active,

wherein said Abnormality Index is determined based on said plurality of parameters for said first attribute if said event is determined to be active.

5. The method of claim 4, wherein said plurality of parameters comprise a rank value, wherein said rank value is higher if said attribute is directly related to availability compared to if the attribute is merely related to performance.

6. The method of claim 5, wherein said plurality of parameters comprises a severity index, wherein said severity index has a positive correlation with the duration of deviation within said event period.

7. The method of claim 6, wherein said threshold value is based on one of hourly baseline, daily baseline or weekly baseline, wherein said severity index is highest if said threshold value is based on weekly baseline and lowest if said threshold value is based on hourly baseline.

8. The method of claim 7, wherein each of said hourly baseline, daily baseline and weekly baseline is based on an expected behavior that is based on historical data for the corresponding duration.

9. The method of claim 7, wherein said Abnormality Index is computed with said severity index being given half weight and said rank value being given half weight for each of said attributes.

10. The method of claim 7, further comprising displaying values computed for said Abnormality Index and also a number of attributes contributing positive value for corresponding value of Abnormality Index.

11. A computer readable medium carrying one or more sequences of instructions for causing a network monitoring system to monitor a plurality of resource elements of interest, wherein execution of said one or more sequences of instructions by one or more processors contained in said network monitoring system causes said one or more processors to perform the actions of:

receiving from a user, data representing said plurality of resource elements;

determining deviations from corresponding baseline thresholds in operation of each of said plurality of resource elements; and

computing an Abnormality Index for all of said plurality of resource elements from the determined deviations.

12. The computer readable medium of claim 11, wherein said Abnormality Index comprises a single number.

13. The computer readable medium of claim 11, further comprising:

receiving data representing a set of attributes and corresponding limit value corresponding to each of said attributes, wherein said limit values represent said baseline thresholds; and

polling each of said plurality of resource elements to determine present value of each of said attributes,

wherein said determining comprises comparing the present values with a corresponding limit value to determine whether said deviation is present.

14. The computer readable medium of claim 13, wherein said computing comprises:

receiving an event interval for generating said Abnormality Index;

checking whether deviation is present for a first attribute at the end of an event period determined by said event interval, wherein the corresponding event is determined to be active if said deviation is present at the end of the corresponding event period; and

calculating a plurality of parameters for said first attribute if said event is determined to be active,

wherein said Abnormality Index is determined based on said plurality of parameters for said first attribute if said event is determined to be active.

15. The computer readable medium of claim 14, wherein said plurality of parameters comprise a rank value, wherein said rank value is higher if said attribute is directly related to availability compared to if the attribute is merely related to performance.

16. The computer readable medium of claim 15, wherein said plurality of parameters comprises a severity index, wherein said severity index has a positive correlation with the duration of deviation within said event period.

17. The computer readable medium of claim 16, wherein said threshold value is based on one of hourly baseline, daily baseline or weekly baseline, wherein said severity index is highest if said threshold value is based on weekly baseline and lowest if said threshold value is based on hourly baseline.

18. The computer readable medium of claim 17, wherein each of said hourly baseline, daily baseline and weekly baseline is based on an expected behavior that is based on historical data for the corresponding duration.

19. The computer readable medium of claim 17, wherein said Abnormality Index is computed with said severity index being given half weight and said rank value being given half weight for each of said attributes.

20. A system for monitoring a plurality of resource elements of interest, said system comprising:

means for receiving from a user, data representing said plurality of resource elements;

means for determining deviations from corresponding baseline thresholds in operation of each of said plurality of resource elements; and

means for computing an Abnormality Index for all of said plurality of resource elements from the determined deviations.