Monitoring architecture

• US 5,729,472 A
• Filed: 05/17/1996
• Issued: 03/17/1998
• Est. Priority Date: 05/17/1996
• Status: Expired due to Term

• Current Assignee: Trend Micro Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Seiffert, Roland, Wong, Stan
• Primary Examiner(s): Trammell, James P.
• Assistant Examiner(s): ASSOUAD, PATRICK J
• Application Number:
  US08/650,903
• Time in Patent Office: 669 Days
• Field of Search: 364/550, 364/551.01, 395/200.11, 395/182.02, 395/183.01, 370/229, 370/235
• US Class Current: 702/188
• CPC Class Codes: G06F 11/0757 by exceeding a time limit, i.e. time-out, e.g. watchdogs
• CPC Class Codes: G06F 11/2257 using expert systems
• CPC Class Codes: G06F 11/2294 by remote test
• CPC Class Codes: G06F 11/34 Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks

Abstract

A method and apparatus of monitoring a computer system having two or more managed systems, by utilizing an optimized distributed policies or rules evaluation knowledge-base. The computer systems includes a subsystem designated as the central point of control and one or more subsystems designated as managed systems. Each of the subsystems include a monitoring agent that is fully-automated and optimized to improve performance of the computer system. A monitoring agent includes watchdog agents, rule evaluator modules and action modules for monitoring various characteristics of the computer system. The monitoring agents are optimized by evaluating policies or rules locally when possible and globally when required.

Claims

1. A method of monitoring a computer system having a plurality of subsystems, in which one of the subsystems is defined as a central subsystem and another one of the subsystems is defined as a managed subsystem, said method comprising the steps of defining a set of watchdog checks for monitoring said subsystems;

defining one or more watchdog rules for evaluating at least one of said watchdog checks, each rule being based on a predetermined algorithm; and

optimizing the processing of said watchdog rules based on the subsystems monitored by said watchdog checks which are evaluated by each of said watchdog rules.

2. A method of monitoring a computer system as defined by claim 1, wherein said step of defining a set of watchdog checks comprises the steps of defining, for each of said watchdog checks, the subsystem to monitor, and at least one of a filter value, check scheduling information, a command to execute, and whether to store values returned by said watchdog checks.

3. A method of monitoring a computer system as defined by claim 1, wherein said step of defining one or more watchdog rules comprises the steps of defining, for each of said watchdog rules, a set of conditions and one or more of said watchdog checks to evaluate against said set of conditions;

and defining a first action to be carried out if said set of conditions is satisfied and a second action to be carried out if said set of conditions is not satisfied.

4. A method of monitoring a computer system as defined by claim 1, further comprising the step of identifying the subsystem each of said watchdog checks is defined to monitor and producing corresponding check identification information;

and transferring each of said watchdog checks to the subsystem identified, based on said check identification information.

5. A method of monitoring a computer system as defined by claim 4, wherein said optimizing step comprises the steps of qualifying each of said watchdog rules as a global rule or local rule, based on said check identification information;

wherein a global rule is constituted by a watchdog rule that evaluates watchdog checks monitoring more than one subsystem, and a local rule is constituted by a watchdog rule that evaluates watchdog checks monitoring the same subsystem.

6. A method of monitoring a computer system as defined by claim 5, wherein said optimizing step further comprises the steps of qualifying each watchdog check as a global check or local check, wherein a global check is constituted by a watchdog check that is evaluated by a global watchdog rule, and a local check is constituted by a watchdog check that is evaluated by a local watchdog rule;

said method further comprising the step of transferring a message to each of said subsystems indicating whether a watchdog check is qualified as a global check or local check.

7. A method of monitoring a computer system as defined by claim 6, further comprising the step of transferring all watchdog rules which are qualified as a global rule to a global rule evaluator;

and transferring all watchdog rules which are qualified as a local rule to a local rule evaluator, wherein said global rule evaluator is located at one of said subsystems, and said local rule evaluator is located at the subsystem being monitored by the watchdog checks upon which the watchdog rule is based.

8. A method of monitoring a computer system as defined by claim 5, wherein said global rule evaluator is located at the central subsystem.

9. A method of monitoring a computer system as defined by claim 6, further comprising the steps of executing each of said watchdog checks at the subsystem each watchdog check is defined to monitor, and generating a check value for each of said watchdog checks, said check value being representative of the status of the subsystem being monitored by said watchdog check;

and storing selected ones of said check values.

10. A method of monitoring a computer system as defined by claim 9, further comprising the steps of transferring each of said check values qualified as a local check to said local rule evaluator and transferring each of said check values qualified as a global check to said global rule evaluator and local rule evaluator;

executing each of said watchdog rules based on at least one of said check values; and

each of said watchdog rules initiating a predetermined action based on the evaluation of said at least one check value.

11. An apparatus for monitoring a computer system having a central subsystem and at least first and second remote subsystems, said apparatus comprising:

an interface unit for defining a plurality of watchdog checks to monitor one of said subsystems, and for defining a set of watchdog rules for evaluating a set of conditions against one or more of said plurality of watchdog rules; and

an infobase agent, coupled to said interface unit, for receiving and processing said plurality of watchdog checks and said set of watchdog rules, said infobase agent being operative to transfer each of the plurality of watchdog checks to the subsystem the watchdog check is defined to monitor, and to distribute each of said watchdog rules to one of said subsystems, based on the location of the watchdog checks which are evaluated by the watchdog rule.

12. An apparatus for monitoring a computer system as defined by claim 11, wherein each of said subsystems includes a monitoring agent comprising:

one or more watchdog agents, each operative to execute one or more of said watchdog checks and to produce a corresponding check value;

a local rule evaluator operative to execute one or more of said watchdog rules in response to one or more of said check values and to produce a corresponding result; and

an action agent operative to carry out predetermined routines in response to said result, said monitoring agent being coupled to said infobase agent, and said apparatus further comprising a global rule evaluator located at one of said subsystems.

13. An apparatus for monitoring a computer system as defined by claim 12, wherein said infobase agent comprising means for qualifying each of said watchdog rules as a global rule or local rule, wherein a global rule is constituted by a watchdog rule that evaluates watchdog checks monitoring more than one subsystem, and a local rule is constituted by a watchdog rule that evaluates watchdog checks monitoring only one of the central subsystem, the first remote subsystem, and the second remote subsystem.

14. An apparatus for monitoring a computer system as defined by claim 13, wherein said infobase agent further comprising means for transferring each of the watchdog rules qualified as a global rule to the global rule evaluator, and for transferring each of the watchdog rules qualified as a local rule to the local rule evaluator of the subsystem the watchdog rule is defined to monitor.

15. An apparatus for monitoring a computer system as defined by claim 14, wherein said local rule evaluators at each of said remote subsystems comprise means for transferring check values generated by watchdog checks which are utilized by a global rule to said global rule evaluator for execution of the watchdog rules which are qualified as a global rule.

16. An apparatus for monitoring a computer system as defined by claim 11, further comprising a data repository, coupled to said infobase unit, for storing information concerning said computer system and said watchdog checks and rules.

17. An apparatus for monitoring a computer system as defined by claim 16, wherein said interface unit, infobase agent, and data repository are located as said central subsystem.