TOPOLOGY BASED CORRELATION OF THRESHOLD CROSSING ALARMS

• US 20110161741A1
• Filed: 12/28/2009
• Published: 06/30/2011
• Est. Priority Date: 12/28/2009
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Duggan, Matthew, Berriss, William P., Pennell, David J. SR., Martin, Daniel
• Granted Patent: US 8,423,827 B2
• Time in Patent Office: Days
• US Class Current: 714/47.1
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/16 Threshold monitoring

Abstract

Method, apparatus and computer program product for correlating performance events in a data processing system. A first event is received at one of a first device and a second device of the data processing system, and a second event is received at one of the first device and the second device. A type of a connection between the first device and the second device is identified to form an identified type of connection, and a relationship between the first event and the second event is determined based on the identified type of connection between the first device and the second device.

Claims

1. A method for correlating performance events in a data processing system, the method comprising:

receiving a first event at one of a first device and a second device of the data processing system;

receiving a second event at one of the first device and the second device;

identifying a type of a connection between the first device and the second device to form an identified type of connection; and

determining a relationship between the first event and the second event based on the identified type of connection between the first device and the second device.

2. The method of claim 1, wherein the first event comprises a first alarm and the second event comprises a second alarm.

3. The method of claim 2, wherein the identified type of the connection comprises a direct wire connection between a first port of the first device and a second port of the second device, wherein the first alarm indicates that egress utilization is high for packets transmitted on the first port, wherein the second alarm indicates that ingress utilization is high for packets received on the second port, and wherein the determined relationship comprises that the first and second alarms each indicate a high egress utilization on the first port.

4. The method of claim 2, wherein the identified type of the connection comprises a direct same speed Ethernet link, wherein the first alarm indicates high collisions on the first port, wherein the second alarm indicates a high packet error on the second port, and wherein the determined relationship comprises a duplex mismatch between the first port and the second port.

5. The method of claim 2, wherein the identified type of the connection comprises a direct same speed link connection, wherein the first alarm indicates that transmission errors are high, wherein the second alarm indicates that transmission errors are high, and wherein the determined relationship comprises that a wire connecting the first port and the second port has a problem.

6. The method of claim 2, wherein the identified type of the connection comprises a direct same speed link connection, wherein the first alarm indicates a discard of packets from the second port of the second device, wherein the second alarm indicates congestion at a third port of the second device, and wherein the determined relationship comprises that the discard of packets is caused by the congestion at the third port.

7. The method of claim 1, wherein the identified type of the connection comprises a direct same speed link connection, wherein the first event is an alarm indicating high transmission errors on one of the first port or the second port, wherein the second event is an absence of an alarm indicating high transmission errors on the other of the first port or the second port, and wherein the determined relationship is that the one of the first port and the second port having high transmission errors has a problem

8. The method of claim 1, wherein the first device comprises a first router and the second device comprises a second router.

9. A computer program product in a computer recordable storage medium for correlating performance events in a data processing system, the computer program product having computer usable program code for:

receiving a first event at one of a first device and a second device of the data processing system;

receiving a second event at one of the first device and the second device;

identifying a type of a connection between the first device and the second device to form an identified type of connection; and

determining a relationship between the first event and the second event based on the identified type of connection between the first device and the second device.

10. The computer program product of claim 9, wherein the identified type of the connection comprises a direct wire connection between a first port of the first device and a second port of the second device, wherein the first event comprises a first alarm indicating that egress utilization is high for packets transmitted on the first port, wherein the second event comprises a second alarm indicating that ingress utilization is high for packets received on the second port, and wherein the determined relationship comprises that the first and second alarms each indicate a high egress utilization on the first port.

11. The computer program product of claim 9, wherein the identified type of the connection comprises a direct same speed Ethernet link, wherein the first event comprises a first alarm indicating high collisions on the first port, wherein the second event comprises a second alarm indicating a high packet error on the second port, and wherein the determined relationship comprises a duplex mismatch between the first port and the second port.

12. The computer program product of claim 9, wherein the identified type of the connection comprises a direct same speed link connection, wherein the first event comprises a first alarm indicating that transmission errors are high, wherein the second event comprises a second alarm indicating that transmission errors are high, and wherein the determined relationship comprises that a wire connecting the first port and the second port has a problem.

13. The computer program product of claim 9, wherein the identified type of the connection comprises a direct same speed link connection, wherein the first event comprises a first alarm indicating a discard of packets from the second port of the second device, wherein the second event comprises a second alarm indicating congestion at a third port of the second device, and wherein the determined relationship comprises that the discard of packets is caused by the congestion at the third port.

14. The computer program product of claim 9, wherein the identified type of the connection comprises a direct same speed link connection, wherein the first event is an alarm indicating high transmission errors on one of the first port or the second port, wherein the second event is an absence of an alarm indicating high transmission errors on the other of the first port or the second port, and wherein the determined relationship is that the one of the first port and the second port having high transmission errors has a problem

15. An apparatus, comprising:

a memory storing instructions, and

at least one processing unit for executing the instructions for correlating performance events in a data processing system, the at least one processing unit executing the instructions to;

receive a first event at one of a first device and a second device of the data processing system;

receive a second event at one of the first device and the second device;

identify a type of a connection between the first device and the second device to form an identified type of connection; and

determine a relationship between the first event and the second event based on the identified type of connection between the first device and the second device.

16. The apparatus of claim 15, wherein the identified type of the connection comprises a direct wire connection between a first port of the first device and a second port of the second device, wherein the first event comprises a first alarm indicating that egress utilization is high for packets transmitted on the first port, wherein the second event comprises a second alarm indicating that ingress utilization is high for packets received on the second port, and wherein the determined relationship comprises that the first and second alarms each indicate a high egress utilization on the first port.

17. The apparatus of claim 15, wherein the identified type of the connection comprises a direct same speed Ethernet link, wherein the first event comprises a first alarm indicating high collisions on the first port, wherein the second event comprises a second alarm indicating a high packet error on the second port, and wherein the determined relationship comprises a duplex mismatch between the first port and the second port.

18. The apparatus of claim 15, wherein the identified type of the connection comprises a direct same speed link connection, wherein the first event comprises a first alarm indicating that transmission errors are high, wherein the second event comprises a second alarm indicating that transmission errors are high, and wherein the determined relationship comprises that a wire connecting the first port and the second port has a problem.

19. The apparatus of claim 15, wherein the identified type of the connection comprises a direct same speed link connection, wherein the first event comprises a first alarm indicating a discard of packets from the second port of the second device, wherein the second event comprises a second alarm indicating congestion at a third port of the second device, and wherein the determined relationship comprises that the discard of packets is caused by the congestion at the third port.

20. The apparatus of claim 15, wherein the identified type of the connection comprises a direct same speed link connection, wherein the first event is an alarm indicating high transmission errors on one of the first port or the second port, wherein the second event is an absence of an alarm indicating high transmission errors on the other of the first port or the second port, and wherein the determined relationship is that the one of the first port and the second port having high transmission errors has a problem