Method and apparatus for analyzing alarm conditions in a networked computing environment

• US 6,263,455 B1
• Filed: 11/05/1998
• Issued: 07/17/2001
• Est. Priority Date: 11/05/1998
• Status: Expired due to Term

• Current Assignee: AT&T Corporation (AT&T, Inc.)
• Original Assignee: AT&T Corporation (AT&T, Inc.)
• Inventors: Bannister, William J.
• Primary Examiner(s): Ray, Gopal C.
• Application Number:
  US09/186,468
• Time in Patent Office: 985 Days
• Field of Search: 714/25, 714/38, 714/47, 710/15, 379/1, 379/33, 370/241, 370/242
• US Class Current: 714/25
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions

Abstract

Alarm messages for a networked computing environment having multiple elements are analyzed. An alarm message from at least one element of the networked computing environment is received. The received alarm message parsed into a set of segments including a variable text segment. The variable text segment is categorized into a set of tokens. The alarm message is consolidated into an alarm table based on the set of tokens.

Claims

1. A method for analyzing alarm messages for a networked computing environment having a plurality of elements, comprising:

(a) receiving a plurality of alarm messages from at least one element of the networked computing environment;

(b) parsing each alarm message received in said step (a) into a plurality of segments including a variable text segment;

(c) categorizing the variable text segment parsed in said step (b) into a plurality of tokens; and

(d) consolidating each alarm message into an alarm table based on the plurality of tokens.

2. The method of claim 1, wherein:

the plurality of segments include a date segment having an alarm date, a time segment having an alarm time and an element segment having an element identifier; and

said consolidating step (d) includes consolidating the alarm message based on the alarm date, the alarm time and the element identifier.

3. The method of claim 1, wherein said consolidating step (d) includes:

(i) grouping the alarm message with an entry from the alarm table when the tokens of the alarm messages match the tokens of the entry within a minimum-match threshold.

4. The method of claim 1, wherein said consolidating step (d) includes:

(i) grouping the alarm message with an entry from the alarm table when the tokens of the alarm messages match the tokens of the entry within a minimum-match threshold; and

(ii) incrementing a per element event count associated with the entry when an alarm time associated with the alarm message is within a time threshold of an entry time associated with the entry.

5. The method of claim 1, wherein said consolidating step (d) includes:

(i) grouping the alarm message with an entry from the alarm table when the tokens of the alarm messages match the tokens of the entry within a minimum-match threshold; and

(ii) incrementing a source count associated with the entry when the alarm message and the entry are received from different elements of the plurality of elements.

6. The method of claim 1, wherein said consolidating step (d) includes:

(i) grouping the alarm message with an entry from the alarm table when the tokens of the alarm messages match the tokens of the entry within a minimum-match threshold; and

(ii) incrementing a message count associated with the entry.

7. The method of claim 1, wherein said categorizing step (c) includes:

(i) removing a container byte from the leading byte of each token.

8. The method of claim 1, wherein said categorizing step (c) includes:

(i) removing a container byte from the trailing byte of each token.

9. The method of claim 1, wherein said categorizing step (c) includes:

(i) categorizing each token having a type from the group of alphabetic, numeric, alphanumeric and other classes.

10. An article of manufacture, comprising:

a computer-readable medium having stored thereon an alarm table containing a plurality of entries and a plurality of instructions, the plurality of instructions, when executed by the processor, cause the processor to;

(a) receive a plurality of alarm messages from at least one element of the networked computing environment;

(b) parse each received alarm message into a plurality of segments including a variable text segment;

(c) categorize the parsed variable text segment parsed into a plurality of tokens; and

(d) consolidate each alarm message into an alarm table based on the plurality of tokens.

11. The article of manufacture of claim 10, wherein the plurality of segments include a date segment having an alarm date, a time segment having an alarm time and an element segment having an element identifier;

and

wherein the instructions, when executed by the processor, cause the processor to consolidate each alarm message based on the alarm date, the alarm time and the element identifier.

12. The article of manufacture of claim 10, wherein the instructions, when executed by the processor, cause the processor to consolidate each alarm message by:

(i) grouping the alarm message with an entry from the alarm table when the tokens of the alarm messages match the tokens of the entry within a minimum-match threshold.

13. The article of manufacture of claim 10, wherein the instructions, when executed by the processor, cause the processor to consolidate each alarm message by:

(i) grouping the alarm message with an entry from the alarm table when the tokens of the alarm messages match the tokens of the entry within a minimum-match threshold; and

(ii) incrementing a per entry event count associated with the entry when an alarm time associated with the alarm message is within a time threshold of an entry time associated with the entry.

14. The article of manufacture of claim 10, wherein the instructions, when executed by the processor, cause the processor to consolidate each alarm message by:

(i) grouping the alarm message with an entry from the alarm table when the tokens of the alarm messages match the tokens of the entry within a minimum-match threshold; and

(ii) incrementing a source count associated with the entry when the alarm message and the entry are received from different elements of the plurality of elements.

15. The article of manufacture of claim 10, wherein the instructions, when executed by the processor, cause the processor to consolidate each alarm message by:

(i) grouping the alarm message with an entry from the alarm table when the tokens of the alarm messages match the tokens of the entry within a minimum-match threshold; and

(ii) incrementing a message count associated with the entry.

16. The article of manufacture of claim 10, wherein the instructions, when executed by the processor, cause the processor to categorize each variable text segment by:

(i) removing a container byte from the leading byte of each token.

17. The article of manufacture of claim 10, wherein the instructions, when executed by the processor, cause the processor to categorize each variable text segment by:

(i) removing a container byte from the trailing byte of each token.

18. The article of manufacture of claim 10, wherein the instructions, when executed by the processor, cause the processor to categorize each variable text segment by:

(i) categorizing each token having a type from the group of alphabetic, numeric, alphanumeric and other classes.

19. An apparatus for analyzing a plurality of alarm messages for a plurality of elements within a networked computing environment, comprising:

a processor;

a computer-readable memory storing an alarm table containing a plurality of entries and a plurality of instructions, the plurality of instructions, when executed by the processor, cause the processor to;

(a) receive a plurality of alarm messages from at least one element of the networked computing environment collection point;

(b) parse each received alarm message into a plurality of segments including a variable text segment;

(c) categorize the parsed variable text segment parsed into a plurality of tokens; and

(d) consolidate each alarm message into an alarm table based on the plurality of tokens;

a port to be connected to the networked computing environment; and

a data bus connecting said processor, said computer-readable memory and said port.