System for uninterruptively displaying only relevant and non-redundant alert message of the highest severity for specific condition associated with group of computers being managed

• US 5,619,656 A
• Filed: 05/05/1994
• Issued: 04/08/1997
• Est. Priority Date: 05/05/1994
• Status: Expired due to Term

• Current Assignee: Nitrosecurity-Openservice Incorporated
• Original Assignee: Openservice, Inc. (McAfee, LLC)
• Inventors: Graf, Lars O.
• Primary Examiner(s): Lee, Thomas C.
• Assistant Examiner(s): Kim, Ki S.
• Application Number:
  US08/238,476
• Time in Patent Office: 1,069 Days
• Field of Search: 395/650, 395/575, 395/700, 395/200.11, 395/185.01, 395/185.1, 395/835, 395/839, 364/141, 364/144, 364/146, 364/152, 364/264.5, 364/284.3, 364/280, 364/286.3, 364/974.5
• US Class Current: 709/224
• CPC Class Codes: G06F 11/0715 in a system implementing multitasking multitasking per se G06F9/46
• CPC Class Codes: G06F 11/1438 Restarting or rejuvenating
• CPC Class Codes: G06F 11/327 Alarm or error message display
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: G06F 2201/81 Threshold

Abstract

The system and method of this invention automatically manages a group of computers by automatically gathering data, storing the data, analyzing the stored data to identify specified conditions, and initiating automated actions to respond to the detected conditions. The invention, hereafter "SYSTEMWatch AI-L", comprises a SYSTEMWatch AI-L client which turns a computer into a managed computer, a SYSTEMWatch AI-L console, which turns a computer into a monitoring computer, a SYSTEMWatch AI-L send facility, which allows a system administrator to send commands to various SYSTEMWatch AI-L clients through the SYSTEMWatch AI-L console, and a SYSTEMWatch AI-L report facility which allows a system administrator to query information collected and processed by the SYSTEMWatch AI-L clients and SYSTEMWatch AI-L consoles.

Claims

1. A method of automatically managing a group of at least one managed computer comprising the steps of:

gathering data;

analyzing the data to identify a specific computer condition;

constructing an alert message identifying said specific computer condition;

performing a set of validation tests on said alert message, said set of validating tests comprising;

querying for a duplicate alert message existing in a database in which previously posted alert messages are stored;

querying said database for an existing alert message associated a computer condition related to, and having a higher severity than, said specific computer condition prompting said alert message;

querying said database for an existing alert message associated with said specific computer condition which is being ignored; and

querying said database for a previously cleared alert message associated with said specific computer condition within a predetermined time period;

rejecting said alert message if an existing alert was found during any one test from said set of validation tests; and

displaying said alert message, when said alert message was not rejected during said validation tests, at the managed computer without inhibiting the managed computer from continuing its application processes;

whereby a user is only presented with relevant alerts and no network traffic is used to retransmit irrelevant or redundant alerts.

2. A method according to claim 1, further comprising a step of clearing other existing alert messages related to said alert message upon creation of said alert message whereby less severe alerts can be superseded by more severe alerts.

3. A method according to claim 1, wherein said identified computer condition is one from a set of conditions consisting of;

state of file system disk space;

state of file system inode usage;

state of process CPU usage;

state of process memory usage;

state of swap space usage;

state of daemon processes;

state of operating system;

state of hardware;

state of application;

state of networks;

state of other peripherals connected to said group of at least one managed computer.

4. A method according to claim 1, further comprising a step of initiating a predetermined action at said managed computer against said alert message, whereby once initiated, the action retrieves all argument necessary directly from said alert message and does not require the user to specify any additional arguments.

5. A method according to claim 1, further comprising a step of executing an action upon creation of said alert message whereby the problem can be fixed without human intervention.

6. A method according to claim 1, further comprising a step of clearing said alert message whereby less relevant alerts do not clutter up the alerts display screen.

7. A method according to claim 6, wherein said step of clearing said alert message is preformed automatically after a predetermined period of time whereby the need to manually clear alerts alleviated.

8. A method according to claim 1, further comprising a step of assigning said alert message with a priority indicating the severity of said computer condition whereby it is made easy to classify problems by severity.

9. A method according to claim 8, further comprising a step of changing said priority over time whereby an alert can be escalated in priority over time.

10. A method according to claim 9, further comprising a step of executing an action upon changing of said priority whereby different actions can be executed depending on escalation status of said alert message.

11. A method according to claim 1, further comprising a step of associating an owner with said alert message whereby it is possible to select only those alerts that require resolution by a specific user for viewing by the user.

12. A system of automatically managing a group of at least one managed computer comprising:

means for gathering data;

means for analyzing the data to identify a specific computer condition;

means for constructing an alert message identifying said specific computer condition;

means for performing a set of validation tests on said alert message, said set of validating tests comprising;

querying for a duplicate alert message existing in a database in which previously posted alert messages are stored;

querying said database for an existing alert message associated with a computer condition related to, and having a higher severity than, said specific computer condition prompting said alert message;

querying said database for an existing alert message associated with said specific computer condition which is being ignored; and

querying said database for a previously cleared alert message associated with said specific computer condition within a predetermined time period;

means for rejecting said alert message if an existing alert was found during any one of said validation tests; and

means for displaying said alert message, when said alert message was not rejected during said validation tests, at the managed computer without inhibiting the managed computer from continuing its application processes;

whereby a user is only presented with relevant alerts and no network traffic is used to retransmit irrelevant or redundant alerts.

13. A system according to claim 12, further comprising a step of clearing other existing alert messages related to said alert message upon creation of said alert message whereby less severe alerts can be superseded by more severe alerts.

14. A system according to claim 12, wherein said identified computer condition is one from a set of conditions consisting of;

state of file system disk space;

state of file system inode usage;

state of process CPU usage;

state of process memory usage;

state of swap space usage;

state of daemon processes;

state of operating system;

state of hardware;

state of application;

state of networks;

state of other peripherals connected to said group of at least one managed computer.

15. A system according to claim 12, further comprising a step of initiating a predetermined action at said managed computer against said alert message, whereby once initiated, the action retrieves all argument necessary directly from said alert message and does not require the user to specify any additional arguments.

16. A system according to claim 12, wherein the creation of said alert message causes an action to be executed whereby the problem can be fixed without human intervention.

17. A system according to claim 12, wherein said alert message is cleared whereby less relevant alerts do not clutter up the alerts display screen.

18. A system according to claim 17, wherein said alert message is cleared automatically after a predetermined period of time whereby the need to manually clear alerts alleviated.

19. A system according to claim 12, wherein said alert message has a priority indicating the severity of said computer condition whereby it is made easy to classify problems by severity.

20. A system according to claim 19, wherein said priority can change over time whereby an alert can be escalated in priority over time.

21. A system according to claim 20, wherein a change of said priority causes an action to be executed whereby different actions can be executed depending on escalation status of said alert message.

22. A system according to claim 12, wherein said alert message can be associated with an owner whereby it is possible to select only those alerts that require resolution by a specific user for viewing by the user.