Method and system for monitoring a computer system

• US 5,621,663 A
• Filed: 04/26/1995
• Issued: 04/15/1997
• Est. Priority Date: 06/20/1991
• Status: Expired due to Term

• Current Assignee: ICL Systems AB
• Original Assignee: ICL Systems AB
• Inventors: Skagerling, Lennart
• Primary Examiner(s): Cosimano, Edward R.
• Application Number:
  US08/428,472
• Time in Patent Office: 720 Days
• Field of Search: 364/550, 364/551.01, 395/180, 395/184.01, 395/575, 395/908, 395/916
• US Class Current: 702/186
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0748 in a remote unit communicating with a single-box computer node experiencing an error/fault remote testing G06F11/2294
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/0781 Error filtering or prioritizing based on a policy defined by the user or on a policy defined by a hardware/software module, e.g. according to a severity level
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: Y10S 706/916 Electronic or computer, internal or network, circuit

Abstract

A method and system for monitoring and changing the operation of a computer system which comprises a local area network or interconnected local area networks, each having a plurality of computers. The system further comprises at least one event report generator in each executable program (4) whose execution should be monitored: an event processing machine (15) for processing events which are reported by an event report generator depending on a flexible rule base (16) which is included in the event processing machine and associates a certain event with a predetermined action, for determining the action associated with the reported event: equipment (18) controlled by the event processing machine and adapted to perform an action determined by the event processing machine: and an interface (13) for transferring an event reported by an event report generator to an event processing machine, and for transmitting a message regarding an action associated with the event, from the event processing machine to a program which is executable in the computer system, for changing or starting thereof.

Claims

1. A system for monitoring and changing the operation of a computer system automatically, which computer system comprises at least one local area network including a plurality of computers and a server, wherein said monitoring and changing includes error processing, performance processing and utilisation processing, wherein a plurality of different programs are executable in the computer system and any particular computer can be executing a different program to one or more of the other computers at any particular point in time, and wherein the monitoring and changing system includes:

at least one event report generator in each said program of the plurality and whose execution is to be monitored, an event corresponding to the occurrence of a predetermined situation;

an event processing machine included in the server for processing events which are reported by the event report generators in the monitored programs during execution thereof in the computer system, depending on a respective rule base which is included in the event processing machine and associates certain events with predetermined actions, for determining the respective action associated with each reported event, all events occurring in the computer system computers being reportable to the event processing machine in the server;

equipment controlled by the event processing machine and adapted to perform actions determined by the event processing machine

and an interface for transferring information about events reported by the event report generators in the monitored programs to the event processing machine, and for transmitting messages, regarding the respective actions associated with the events and determined by the rule base, from the event processing machine, optionally via and for processing in a further event processing machine of the computer system, to at least one of the group consisting of the respective monitored program of the plurality whose event report generator had reported the associated event and a program of the plurality other than the respective monitored program, an action message to the respective monitored program serving to change the operation of the respective monitored program and correspondingly to change the operation of the computer system, and an action message to the other program serving to start it automatically and correspondingly to change the operation of the computer system.

2. A system as claimed in claim 1, wherein the equipment also comprises means for registration of reported events and means for forwarding reported events to an overriding part of the computer system.

3. A system as claimed in claim 1, wherein the event processing machine included in the server is adapted to change the internal state device and the rule base and the filter in response to reported events received by the event processing machine included in the server and in response to determined actions.

4. A system as claimed in claim 1, wherein the equipment controlled by said event processing machine also comprises means for forwarding a reported event to an overriding part of the computer system.

5. A system as claimed in claim 1, wherein the said event processing machine is adapted to change the rule base in response to reported events received by said event processing machine.

6. A system as claimed in claim 1, and including a filter directly connected to said interface and adapted to restrict the number of events reported which are forwarded to the event processing machine included in the server.

7. A system as claimed in claim 6, wherein the said event processing machine is adapted to change the filter in response to reported events received by said event processing machine.

8. A system as claimed in claim 1, wherein the event processing machine included in the server comprises an internal state device, and the rule base is adapted to associate a certain event with a predetermined action which depends on the instantaneous state of the internal state device.

9. A system as claimed in claim 8, wherein the said event processing machine is adapted to change the internal state device in response to reported events received by said event processing machine.

10. A method for monitoring and changing the operation of a computer system automatically, which computer system comprises at least one local area network including a plurality of computers and a server, wherein said monitoring and changing includes error processing, performance processing and utilisation processing, and wherein a plurality of different programs are executable in the computer system and any particular computer can be executing a different program to one or more of the other computers at any particular point in time, and including the steps:

incorporating at least one event report generator in each said program of the plurality and whose execution is to be monitored, an event corresponding to the occurrence of a predetermined situation;

operating the computer system by executing at least one said program whose execution is to be monitored in the computer system;

detecting reported events associated with the executed programs;

determining, in an event processing machine included in the server and depending on a rule base which associates certain events with predetermined actions, the respective action associated with each detected reported event, all events occurring in the computer system computers being reportable to the event processing machine in the server;

and performing each determined action at least in the form of transmitting a respective message to at least one of the group consisting of the respective monitored program of the plurality whose event report generator had reported the associated event and a program of the plurality other than the respective monitored program, a message transmitted to the respective monitored program serving to change the operation of the respective monitored program and correspondingly to change the operation of the computer system, and a message transmitted to the other program serving to start the other program automatically and correspondingly to change the operation of the computer system.

11. A method as claimed in claim 10, wherein the respective action is determined merely for some of the reported events which are identical, with the exception of the time of reporting.

12. A method as claimed in claim 10, wherein the actions which can be performed also comprise registration of a reported event to an overriding part of the computer system.

13. A method as claimed in claim 10, wherein the rule base is caused to change in response to reported events.

14. A method as claimed in claim 10, wherein the action associated with a certain event is also made dependent on parameters other than the event'"'"'s own parameters.

15. A method as claimed in claim 14, wherein said other parameters are caused to change in response to reported events.