Alarm server systems, apparatus, and processes

• US 6,256,670 B1
• Filed: 04/03/2000
• Issued: 07/03/2001
• Est. Priority Date: 02/27/1998
• Status: Expired due to Term

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: NetSolve, Inc. (Cisco Systems, Inc.)
• Inventors: Davies, Stephen W.
• Primary Examiner(s): Meky, Moustafa M.
• Application Number:
  US09/541,866
• Time in Patent Office: 456 Days
• Field of Search: 709/200, 709/201, 709/203, 709/217, 709/218, 709/219, 709/220, 709/221, 709/223, 709/224
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/0686 Additional information in the notification, e.g. enhancement of specific meta-data
• CPC Class Codes: H04L 43/0805 by checking availability
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route

Abstract

A system used to manage a network by monitoring at least one interface of the network comprises a poller, a server, and a database, all in communication with one another. The poller continuously checks the at least one interface of the network by continuously sending out a poller query message to at least one interface of the network. The poller suspects a first interface of at least one interface of failing when the poller does not receive a poller reply message in response to the query messages from the first interface within a first time period. The poller sends an alert signal to the server notifying the server that the first interface of the at least one interface may be failing when the poller suspects the first interface of the at least one interface is failing. After receiving the alert signal the server sends out at least one server query signal to the first interface, the server monitors the response to determine whether the first interface replies to at least one server query signal by sending at least one server replay message. The server evaluates at least one server replay message to determine whether the first interface is failing. The database contains information concerning at least one interface of the network. When the server determines the first interface is failing, the server pulls first information concerning the first interface and sends an alarm signal with the first information to client applications modules. A process to monitor at least one interface on a network comprises the following steps: (a) continuously sending Get Requests to at least one interface; (b) monitoring any first replies received from at least one interface to the Get Requests to determine whether a reply is received at a first time from each interface of at least one interface; (c) sending an alert message to a server, if a reply is not received from a first interface of at least one interface; (d) sending at least one server query to the first interface by the server; and (e) monitoring any second replies received from the first interface in response to at least one server query by the server to determine whether the first interface has failed.

Claims

1. A network monitoring system comprising:

a poller operable to exchange messages with a plurality of interfaces of a plurality of network devices, the poller operable to communicate a first get message to the plurality of interfaces, to receive a reply message from each of the plurality of interfaces, and to generate an interface alarm message when an interface does not communicate a reply message back within a first time period;

a database that includes information on the plurality of interfaces; and

a server operable to receive the interface alarm message, and to communicate a second get message to the interface to verify that the interface is not responding, the server operable to generate a failed interface message, query the database to retrieve information on the interface, and to communicate the failed interface message and information retrieved from the database to a client application if the interface does not communicate a reply message back within a second time period.

2. The network monitoring system of claim 1, wherein the server is operable to send a third get message to the interface if the interface does not communicate a reply message back to the poller within a second time period, the server operable to generate the failed interface message and to communicate the failed interface message and information retrieved from the database to the client application if the interface does not communicate a reply message back within a third time period.

3. The network monitoring system of claim 1, wherein the server is operable to log information in the database related to the interface failing to communicate the reply message back to the poller within the second time period if the interface does not communicate the reply message back to the poller within the second time period.

4. The network monitoring system of claim 1, wherein the client application includes a display server operable to receive the failed interface message and the information retrieved from the database, generate a client application interface in response, and to communicate the client application interface to a client for display.

5. The network monitoring system of claim 4, further comprising:

a plurality of clients operable to receive and display the client application interface.

6. The network monitoring system of claim 4, wherein the server and the client server are in a client/server relationship.

7. The network monitoring system of claim 1, wherein the client application includes a client application interface that includes active alarm information and historical information.

8. The network monitoring system of claim 7, wherein the historical information includes active alarm failure events and alarm clearing events.

9. The network monitoring system of claim 7, wherein the historical information includes network interface address information, physical location information, and contact information.

10. The network monitoring system of claim 7, wherein the active alarm information is presented in an hierarchical manner.

11. The network monitoring system of claim 10, wherein the hierarchy includes customer identification information, location information, network device information, and interface information.

12. The network monitoring system of claim 1, further comprising:

a second poller operable to exchange messages with a second plurality of interfaces of a plurality of network devices, the second poller operable to communicate a first get message to the second plurality of interfaces, to receive a reply message from each of the second plurality of interfaces, and to generate an interface alarm message when an interface does not communicate a reply message back within a designated time period.

13. The network monitoring system of claim 1, wherein the poller is operable to exchange messages with around 30,000 interfaces.

14. The network monitoring system of claim 1, wherein the poller is operable to exchange messages with at least 30,000 interfaces.

15. The network monitoring system of claim 1, further comprising:

a plurality of pollers each operable to exchange messages with a defined plurality of interfaces of a plurality of network devices, each poller operable to communicate a first get message to its defined plurality of interfaces, to receive a reply message from each of the defined plurality of interfaces, and to generate an interface alarm message when an interface does not communicate a reply message back within a designated time period.

16. The network monitoring system of claim 1, wherein the poller and the server are in a client/server relationship.

17. The network monitoring system of claim 1, wherein the messages exchanged between the network monitoring system and the plurality of interfaces use the Simple Network Management Protocol (SNMP).

18. The network monitoring system of claim 1, wherein the database includes a list of interfaces that identifies the plurality of interfaces.

19. The network monitoring system of claim 1, wherein the database is operable to store information related to failed interfaces.

20. The network monitoring system of claim 1, wherein more than one interface of the plurality of interfaces may be associated with one network device of the plurality of network devices.

21. The network monitoring system of claim 1, wherein the plurality of network devices may be part of one or more different networks.

22. The network monitoring system of claim 1, wherein the interface alarm message identifies the interface that did not respond.

23. The network monitoring system of claim 1, wherein the poller is operable to communicate a first get message to the plurality of interfaces within a minute.

24. The network monitoring system of claim 1, wherein the poller is operable to communicate a first get message to the plurality of interfaces within ninety seconds.

25. The network monitoring system of claim 24, wherein the poller is send get messages to around 30,000 interfaces.

26. The network monitoring system of claim 1, wherein the poller is operable to communicate a first get message to the plurality of interfaces within a programmable period of time.

27. The network monitoring system of claim 1, wherein the number of pollers used in the network monitoring system is scalable.

28. The network monitoring system of claim 1, wherein the poller is operable to communicate a first get message to the plurality of interfaces at defined and successive intervals.

29. The network monitoring system of claim 1, wherein the database includes multiple tables.

30. The network monitoring system of claim 1, wherein the messages are exchanged using sockets.

31. The network monitoring system of claim 1, wherein the poller is operable to communicate the first get message to the plurality of interfaces in parallel.

32. The network monitoring system of claim 1, wherein the first time period and the second time period are the same.

33. A network monitoring system comprising:

a poller operable to exchange messages with a plurality of interfaces of a plurality of network devices, the poller operable to communicate a get message to the plurality of interfaces over a defined period of time and on successive occasions, to receive a reply message from each of the plurality of interfaces in response to each get message within a given period of time, and to generate an interface alarm message when an interface does not communicate a reply message back in response to the get message within the given period of time on a threshold number of occasions;

a database that includes information on the plurality of interfaces; and

a server operable to receive the interface alarm message generated by the poller, and to communicate a get message to the interface on successive occasions to verify that the interface is not responding, the server operable to generate a failed interface message, query the database to retrieve information on the interface, and to communicate the failed interface message and information retrieved from the database to a client application if the interface does not communicate a reply message back in response to the get message communicated by the server within a desired period of time on a predetermined number of occasions.

34. The network monitoring system of claim 33, wherein the threshold number of occasions is two consecutive occasions.

35. The network monitoring system of claim 33, wherein the threshold number of occasions is three consecutive occasions.

36. The network monitoring system of claim 33, wherein the threshold number of occasions is defined as seventy percent of the time.

37. The network monitoring system of claim 33, wherein the predetermined number of occasions is defined as seventy percent of the time.

38. The network monitoring system of claim 33, wherein the predetermined number of occasions is defined as sixty percent of the time.

39. The network monitoring system of claim 33, wherein the predetermined number of occasions is six or fewer occasions in ten attempts.

40. The network monitoring system of claim 33, wherein the server is operable to communicate a message to the poller indicating that an interface is not responding if the interface does not communicate a reply message back in response to the get message communicated by the server within a desired period of time for a predetermined number of occasions.

41. The network monitoring system of claim 33, wherein the server is operable to communicate a message to the database indicating that an interface is not responding if the interface does not communicate a reply message back in response to the get message communicated by the server within a desired period of time for a predetermined number of occasions.

42. The network monitoring system of claim 33, wherein the server is operable to monitor a failed interface by periodically sending a get message to the interface and checking for a reply message.

43. The network monitoring system of claim 42, wherein the server is operable to generate a clear message once a failed interface begins to respond.

44. A method for monitoring network interfaces comprising:

communicating a first get message to a plurality of network interfaces;

determining whether a reply message was received from each of the plurality of network interfaces within a first time period;

generating an interface alarm message when an interface does not communicate a reply message back within the first time period;

receiving the interface alarm message and, in response, communicating a second get message to the interface;

determining whether a reply message was received in response to the second get message within a second time period;

generating a failed interface message, querying a database to retrieve information on the interface, and communicating the failed interface message and information retrieved from the database to a client application when the interface does not communicate a reply message back within the second time period.

45. The method of claim 44, further comprising:

storing information in the database related to the failed interface.

46. The method of claim 44, further comprising:

receiving the failed interface message and the information retrieved from the database and generating a client application interface.

47. The method of claim 46, wherein the client application interface includes active alarm information and historical information.

48. The method of claim 47, wherein the historical information includes active alarm failure events and alarm clearing events.

49. The method of claim 47, wherein the historical information includes network interface address information, physical location information, and contact information.

50. The method of claim 47, wherein the active alarm information is presented in an hierarchical manner.

51. The method of claim 50, wherein the hierarchy includes customer identification information, location information, network device information, and interface information.

52. A method for monitoring network interfaces comprising:

communicating a get message to a plurality of network interfaces on successive occasions;

determining whether a reply message was received from each of the plurality of network interfaces within a given period of time;

generating an interface alarm message when an interface does not communicate a reply message back within the given period of time on a threshold number of occasions;

receiving the interface alarm message and, in response, communicating a get message to the interface on successive occasions;

determining whether a reply message was received from the interface within a desired period of time;

generating a failed interface message and querying a database to retrieve information on the interface, and communicating the failed interface message and information retrieved from the database to a client application when the interface does not communicate a reply message back within the desired period of time on a predetermined number of occasions.

53. The method of claim 52, wherein the threshold number of occasions is two consecutive occasions.

54. The method of claim 52, wherein the threshold number of occasions is three consecutive occasions.

55. The method of claim 52, wherein the threshold number of occasions is defined as seventy percent of the time.

56. The method of claim 52, wherein the predetermined number of occasions is defined as seventy percent of the time.

57. The method of claim 52, wherein the predetermined number of occasions is defined as sixty percent of the time.

58. The method of claim 52, wherein the predetermined number of occasions is six or fewer occasions in ten attempts.