Method and apparatus for monitoring a network environment

• US 6,327,677 B1
• Filed: 04/27/1998
• Issued: 12/04/2001
• Est. Priority Date: 04/27/1998
• Status: Expired due to Term

• Current Assignee: BMC Software Incorporated (KKR & Co., Inc.)
• Original Assignee: Proactive Networks Co.
• Inventors: Ketcham, Dan, Do, Minh Anh, Garg, Atul R.
• Primary Examiner(s): Sheikh, Ayaz
• Assistant Examiner(s): Jean, Frantz B.
• Application Number:
  US09/067,319
• Publication Number:
  US 20010052087A1
• Time in Patent Office: 1,317 Days
• Field of Search: 714/37, 714/48, 714/732, 709/224
• US Class Current: 714/37
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 43/103 with adaptive polling, i.e. dynamically adapting the polling rate
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04W 24/00 Supervisory, monitoring or testing arrangements
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic

Abstract

A system is provided that monitors a network environment. The system collects recent data associated with operation of the network environment. The network environment is analyzed by comparing the collected data with historical data associated with the operation of the network environment. The system determines whether a problem or a potential problem exists based on the analysis of the network environment. The historical data associated with the operation of the network environment is represented in multiple cognitive signatures. The system regularly updates the historical data to include the recently collected data. The data collected may include network performance data, network configuration data, traffic flow data, network utilization data, or network error information. The system generates an alarm if it determines that a problem exists. The generation of an alarm may include generating an electronic mail message or pager message and communicating the message to a network administrator. The generation of an alarm may also include activating an application on a device within the network environment. The monitoring system is able to monitor one or more network environments, as well as individual network devices and components or sub-systems within an individual network device.

Claims

1. A method comprising:

collecting recent data associated with operation of a network environment;

analyzing the network environment by comparing the collected recent data with dynamically configured cognitive signatures, the dynamically configured cognitive signatures being adjustable to account for selected network activity in order to represent normal operation modes of the network environment; and

determining whether a problem exists based on the analyzed network environment.

2. The method of claim 1, wherein the determining of whether a problem exists includes determining whether a potential problem exists based on the analyzed network environment.

3. The method of claim 1, wherein the dynamically configured cognitive signatures represent normal operation modes for temporal network activity of the network environment.

4. The method of claim 1, wherein the analyzing of the network environment includes determining a signature correlation factor associated with one of the dynamically configured cognitive signatures.

5. The method of claim 1, wherein the dynamically configured cognitive signatures include information related to a summary of previous performances of the network environment.

6. The method of claim 1, wherein the dynamically configured cognitive signatures include information related to performances of the network environment prior to the collection of the recent data associated with the operation of the network environment.

7. The method of claim 1, further comprising:

updating the dynamically configured cognitive signatures to include the collected recent data.

8. The method of claim 1, wherein the collected recent data includes network performance data.

9. The method of claim 1, wherein the collected recent data includes network configuration data.

10. The method of claim 1, wherein the collected recent data includes recent traffic flow through the network environment.

11. The method of claim 1, wherein the collected recent data includes recent utilization information of network resources operating within the network environment.

12. The method of claim 1, wherein the collected recent data includes network error information.

13. The method of claim 1, further comprising:

generating an alarm if a problem exists based on the analyzed network environment.

14. The method of claim 13, wherein the generating of the alarm includes generating an electronic mail message and sending the electronic mail message to a network administrator.

15. The method of claim 13, wherein the generating of the alarm includes generating a pager message and communicating the pager message to a pager.

16. The method of claim 13, wherein the generating of the alarm includes activating an application on a device within the network environment.

17. The method of claim 1, wherein the analyzing of the network environment includes correlating multiple related events into a single event.

18. A method comprising:

collecting recent data associated with operation of a network device;

analyzing the network device by comparing the collected recent data with dynamically configured cognitive signatures, the dynamically configured cognitive signatures being adjustable to account for selected network activity in order to represent normal operation modes of the network device; and

determining whether a problem exists based on the analyzed network device.

19. The method of claim 18, wherein the determining of whether a problem exists includes determining whether a potential problem exists based on the analyzed network device.

20. The method of claim 18, wherein the dynamically configured cognitive signatures represent normal operation modes for temporal network activity of the network device.

21. The method of claim 18, wherein the analyzing of the network device includes determining a signature correlation factor associated with one of the dynamically configured cognitive signatures.

22. The method of claim 18, wherein the dynamically configured cognitive signatures include information related to performances of the network device performances prior to the collection of the recent data associated with the operation of the network device.

23. The method of claim 18, further comprising:

updating the dynamically configured cognitive signatures to include the collected recent data.

24. The method of claim 18, wherein the collected recent data includes recent utilization of the network device.

25. The method of claim 18, wherein the collected recent data includes the performance of a component within the network device.

26. The method of claim 18, wherein the collected recent data includes performance data of a sub-system within the network device.

27. The method of claim 18, further comprising:

generating an alarm if a problem exists based on the analyzed network device.

28. The method of claim 27, wherein the generating of the alarm includes generating an electronic mail message and sending the electronic mail message to a network administrator.

29. The method of claim 27, wherein the generating of the alarm includes generating a pager message and communicating the pager message to a pager.

30. The method of claim 27, wherein the generating of the alarm includes activating an application on the network device.

31. The method of claim 18, wherein the analyzing of the network device includes correlating multiple related events into a single event.

32. A network device comprising:

a data collection module to collect recent data associated with operation of a network environment;

a cognitive signature module coupled to the data collection module and to configure dynamically cognitive signatures associated with the network environment, the cognitive signatures being adjustable to account for selected network activity in order to represent normal operation modes of the network environment; and

an analysis module coupled to the data collection module and the cognitive signature module and to compare the data collected by the data collection module with the cognitive signatures associated with operation of the network environment; and

wherein the analysis module is to determine whether a problem exists based on the comparison of the data collected by the data collection module with the cognitive signatures.

33. The network device of claim 32, wherein the cognitive signature module is to associate temporally the cognitive signatures with the network environment.

34. The network device of claim 33, wherein the cognitive signature module is to update the cognitive signatures to include the data collected by the data collection module.

35. The network device of claim 32, wherein the cognitive signatures include information related to performances of the network environment prior to the collection of recent data associated with the operation of the network environment.

36. The network device of claim 32, further comprising:

an alarm generator to generate an alarm if the analysis module determines that a problem exists.

37. A network device comprising:

means for collecting recent data associated with operation of a network environment;

means for analyzing the network environment by comparing the data collected by the means for collecting recent data with dynamically configured cognitive signatures, the dynamically configured cognitive signatures being adjustable to account for selected network activity in order to represent normal operation modes of the network environment; and

means for determining whether a problem exists based on the analysis performed by the means for analyzing the network environment.

38. The network device of claim 37, further comprising:

means for temporally associating the dynamically configured cognitive signatures with the network environment.

39. The network device of claim 37, further comprising:

means for updating the dynamically configured cognitive signatures to include the data collected by the means for collecting recent data.

40. The network device of claim 37, wherein the dynamically configured cognitive signatures include information related to performances of the network environment prior to the collection of recent data associated with the operation of the network environment.

41. The network device of claim 37, further comprising:

means for generating an alarm if a problem exists.

42. A computer software product including a medium readable by a processor, the medium having stored thereon a sequence of instructions which, if executed by the processor, cause the processor to perform an operation comprising:

collecting recent data associated with operation of a network environment;

analyzing the network environment by comparing the collected recent data with dynamically configured cognitive signatures, the dynamically configured cognitive signatures being adjustable to account for selected network activity in order to represent normal operation modes of the network environment; and

determining whether a problem exists based on the analysis of the network environment.

43. The computer software product of claim 42, wherein the dynamically configured cognitive signatures are temporally associated with the network environment.

44. The computer software product of claim 42, wherein the dynamically configured cognitive signatures include information related to a summary of previous performances of the network environment.

45. The computer software product of claim 42, further including a sequence of instructions which, if executed by the processor, cause the processor to perform an operation comprising:

updating the dynamically configured cognitive signatures to include the recent data collected.

46. The computer software product of claim 42, further including a sequence of instructions which, if executed by the processor, cause the processor to perform an operation comprising:

generating an alarm if a problem exists.