Real-time monitoring of operations support, business service management and network operations management systems

• US 20080288634A1
• Filed: 05/25/2007
• Published: 11/20/2008
• Est. Priority Date: 05/26/2006
• Status: Abandoned Application

• Current Assignee: Abilisoft Ltd.
• Original Assignee: Abilisoft Ltd.
• Inventors: Onacko, Andy, Charles, Dave
• Application Number:
  US11/805,953
• Publication Number:
  US 20080288634A1
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5032 Generating service level reports

Abstract

The invention relates to a system and method for monitoring the availability and performance of an organisation'"'"'s Business/Operational Support System (B/OSS) and Business Service Management Systems (BSM) which are referred to as a target platform. The invention gathers data from that monitored OSS/BSS/BSM arising from a distinct knowledge of the OSS/BSS/BSM'"'"'s anatomy including its behaviour, log messages, configuration and public APIs and analyses that data to determine the OSS/BSS/BSM'"'"'s run and configuration state, and performance, so as to report on these and other system events detected. This will allow the operational impact of the monitored OSS/BSS/BSM to be ascertained.

Claims

1. A system for monitoring the availability and performance of a target platform, the system being arranged to acquire data from the target platform leveraging a distinct knowledge of the target platform anatomy including its behaviour, log messages, configuration and public Application Programmer Interfaces (API), the system comprising:

a data collection agent that, through a distinct knowledge of the target platform'"'"'s anatomy, acquires data pertaining to each target platform component from the operating system hosting the target platform and any public API provided by the target platform.

an acquisition module that loads and processes a descriptive model representing the target platform to be monitored and a plurality of component definitions describing the anatomy of each target platform component to be monitored, wherein the acquisition module is adapted to distribute the processed model and the processed component definitions data in the form of a manifest to the agent in order to enable the agent to perform specific data collection tasks, the collected data being transmitted to the acquisition module for further processing prior to further analysis;

an analysis module that loads;

(i) the descriptive model representing the target platform to be monitored and extracts data pertaining to location specific parameters that are required to process the component definitions and data passed to the analysis module by the acquisition module, and

(ii) the plurality of component definitions, that define the analysis steps to be performed to detect the status on each target platform component;

wherein the analysis module further comprises means for examining the acquired data and determining the current state of each monitored platform component, the performance of the each component in terms of data propagation and performing calculations to establish;

(i) the rate of change of scalar measurements taken as specified in the descriptive model;

(ii) whether any threshold has been breached as specified in the descriptive model,

(iii) the deviation from a benchmark value as specified in the descriptive model;

an alerting module that obtains data from the analysis module that will elicit an alert for a user and perform alert escalations to propagate the alert to another system; and

a user interface (UI) module that obtains data from the analysis module and the alerting module and displays the data acquired.

2. The system of claim 1 wherein the data collection agent is adapted to:

(a) initialise the agent by receiving and processing a manifest from the acquisition module so that an agent toolkit may be configured according to the monitoring requirements at the agent'"'"'s location.

(b) perform a first data collection task by interrogating the operating system to obtain process information and configuration information pertaining to the monitored component.

(c) perform a second data collection task by connecting to the component via its public APIs.

(d) package all data collected to include the time the data was obtained and the identification of the monitored component it relates to;

(e) make packaged data available in an output buffer so it is collected by the data acquisition module.

3. The system of claim 2 wherein the initialisation task comprises:

(a) creating a platform component instance (PCI) object as defined in the manifest to represent the target platform component to be monitored, where the PCI defines all sampling that will performed;

(b) creating sampler objects for each sampling activity of a component as defined in each PCI in the manifest that represents the individual sampling activities that must be performed at the specified periodicity and using the specified tool from the agent toolkit; and

(c) setting the tool parameters in the sampler object as defined in the sampling activity for a PCI.

4. The system of claim 2 wherein the first data collection task comprises code for:

(a) invoking a sampler object according specified periodicity so that it executes the configured tool from the agent toolkit.

5. The system of claim 1 wherein the component definitions describe the anatomy of each target platform component and what methodology the agent should use to acquire data from the particular type of target platform to be monitored and what methodology the agent should use to format the data acquired.

6. The system of claim 1 wherein the acquisition module is adapted to:

(a) receive the collected data from a plurality of agents.

(b) look up the relevant component definition so as to determine a program method that must be executed with the collected data as argument;

(c) invoke the relevant program method and transmit the resulting data to the analysis module (140) for further processing.

7. The system of claim 1 wherein the descriptive model represents the target platform to be monitored by extracting data pertaining to the parameters required to perform the analysis functions;

and

the plurality of component definitions, describe the analysis steps that should be performed to detect the status on each target platform component.

8. The system of claim 1 wherein the analysis module is adapted to examine each sample data item received from the acquisition module and dispatch it to a relevant analysis sub-system based on its type as defined in sample data and the loaded component definition.

9. The system of claim 8 wherein the analysis module is adapted to process data propagated to it when the sample is indicated as a static data sample.

10. The system of claim 9 wherein the analysis module a static data analysis module which is adapted to:

(a) parse the static data sample, using the parser as specified in the loaded component definition, into the static data model format;

(b) process the static data model formatted data using a processor as specified in the loaded component definition to determine if a static data event should be raised;

(c) propagate any raised static data events to the observation engine.

11. The system of claim 8 wherein the analysis module is adapted to process data propagated to it when the sample is indicated as a synthetic data sample.

12. The system of claim 11 wherein the analysis module comprises a latency engine module (147) which is adapted to:

(a) process a plurality of synthetic data samples to ascertain which samples belong to the same latency check activity and calculate the overall transmission time of the synthetic sample;

(b) propagate the latency check result, if defined in the descriptive model, for a rate of change calculation to be performed;

(c) propagate the latency check result, if defined in the descriptive model, for a threshold evaluation to be performed;

(d) propagate the latency check result, if defined in the descriptive model, for a benchmark calculation to be performed.

13. The system of claim 8 wherein the code for an analysis module is adapted to process data propagated to it when the sample is indicated as a dynamic scalar sample.

14. The system of claim 13 wherein the analysis module comprises a threshold breach module which is adapted to:

(a) determine from a plurality of samples, if a threshold has been breached given the parameters specified in the descriptive model the parameters including;

(i) an upper threshold limit,

(ii) a lower threshold limit,

(iii) if a breach is considered when the values are within the bounds specified by (i) and (ii) or outside the bounds specified by (i) and (ii),

(iv) the number of samples that must breach the threshold,

(v) the period in which that number of breaches must occur;

(b) propagate the result of the breach test to the UI;

(c) propagate breached threshold events to an observation engine.

15. The system of claim 8 wherein the code for an analysis module is adapted to process data propagated to it when the sample is indicated as a dynamic scalar sample.

16. The system of claim 15 wherein the analysis module comprises a rate of change calculation module which is adapted to:

(a) calculate from a plurality of samples, whose timestamps fall into a time window as specified in the descriptive model, the current rate of change of the scalar value of the data collected from the monitored platform component;

(b) propagate the result to the UI;

(c) propagate the result to the threshold engine for threshold analysis.

17. The system of claim 8 wherein the code for an analysis module is adapted to process data propagated to when the sample is indicated as a dynamic scalar sample.

18. The system of claim 17 wherein the analysis module comprises a benchmark calculation module which is adapted to:

(a) calculate for each sample, if specified in the descriptive model, the current difference of the scalar value of the data collected from the monitored component and the benchmark specified in the descriptive model.

(b) propagate the result to the UI.

(c) propagate the result to a threshold engine for threshold analysis.

19. The system of claim 8 wherein the analysis module is adapted to process data propagated to it when the sample is indicated as a dynamic aggregate sample.

20. The system of claim 19 wherein the analysis module comprises an observation engine module which is adapted to:

(a) process dynamic aggregate sample data wherein such sample data is compared given the parameters defined in the component definition related to the collected data, namely;

(i) the value to compare the sample data with;

(ii) if the comparison is for equality;

(iii) if the comparison is for inequality;

(b) propagate static data analysis module elicited static data events to the condition engine module;

(c) propagate threshold breach module elicited threshold breach events to a condition engine module.

21. The system of claim 20 wherein the observation suppression logic is adapted to:

(a) process each observation given the parameters specified in the descriptive model defining the number of times an observation should occur in a given period before the observation is elicited from the observation engine.

22. The system of claim 20 wherein the analysis module comprises a condition engine module which is adapted to:

(a) examine a plurality of observations given the parameters pertaining to a local condition as defined in the component definition for the relevant component;

(b) annotate an observation as one that in full or in part contributes to a local condition if it is defined as an observation that contributes to that local condition in the component definition for the relevant component;

(c) elicit a local condition if all relevant observations have occurred as defined in the component definition for the relevant component and that the observations have all occurred within a time window as defined in the descriptive model;

(d) propagate a local condition to a state analysis module;

(e) propagate a local condition to an alerting module.

23. The system of claim 22 wherein the analysis module is adapted to process local conditions propagated to it.

24. The system of claim 23 wherein the state analysis module is adapted to:

(a) examine a plurality of component definitions to obtain the state transition table for each state category for every component type;

(b) examine each local condition propagated to it from the condition engine module (163) to ascertain the new state of a related monitored component given its existing state and a related local condition received;

(c) propagate updated monitored component states to the UI for display.

25. The system of claim 1 wherein the analysis module comprises a condition engine module (163) which is adapted to:

(a) examine a plurality of local conditions given the parameters pertaining to a global condition as defined in the descriptive model;

(b) annotate a local condition as one that in full or in part contributes to a global condition if it is defined as a local condition that contributes to that global condition in the descriptive model;

(c) elicit a global condition if all relevant local conditions have occurred as defined in the descriptive model and that the local conditions have all occurred within a time window as defined in the descriptive model;

(d) propagate a global condition to an alerting module.

26. The system of claim 25 wherein the alerting module is adapted to:

(a) load a plurality of alert definitions as specified in the descriptive model which define the local conditions and global conditions that are related to an alert, and the escalation rules for each alert;

(b) examine each local condition propagated to it from the condition engine module to ascertain if that local condition is related to an alert definition;

(c) examine each global condition propagated to it from the condition engine module to ascertain if that global condition is related to an alert definition;

(d) propagate an alert to the UI should a contributing local condition be detected;

(e) propagate an alert to the UI should a contributing global condition be detected;

(f) implement the escalation rules for the alert given the escalation rules for that alert as defined in descriptive model.

27. A computer implemented method of monitoring the availability and performance of a target platform, the method comprising the steps of:

a) acquiring data pertaining to each OSS component from an operating system hosting the target platform and any public application programmer interface provided by the target platform;

b) loading and processing a descriptive model representing the target platform to be monitored and a plurality of component definitions, describing the anatomy of each target platform component to be monitored;

c) distributing the processed model and the processed component definitions data in the form of a manifest to the agent in order to enable the agent to perform specific data collection tasks, the collected data being transmitted to the acquisition module for further processing prior to further analysis;

d) loading;

(i) the descriptive model representing the target platform to be monitored and extracts data pertaining to location specific parameters that are required to process the component definitions and data passed to the analysis module by the acquisition module, and

(ii) the plurality of component definitions, that define the analysis steps to be performed to detect the status on each target platform component.

e) examining the acquired data and determining the current state of each monitored platform component, the performance of the each component in terms of data propagation and performing calculations to establish;

(i) the rate of change of scalar measurements taken as specified in the descriptive model;

(ii) whether any threshold has been breached as specified in the descriptive model,

(iii) the deviation from a benchmark value as specified in the descriptive model;

f) obtaining data from the analysis module that will elicit an alert for a user and performing alert escalations to propagate the alert to another system; and

g) obtaining data from the analysis module and the alerting module and displaying the data acquired.

28. A computer readable storage medium storing a program which when executed on a computer performs the method according to claim 27.