Dynamic modeling of complex networks and prediction of impacts of faults therein

• US 6,393,386 B1
• Filed: 03/26/1998
• Issued: 05/21/2002
• Est. Priority Date: 03/26/1998
• Status: Expired due to Fees

• Current Assignee: Visual Networks Operations, Inc. (Danaher Corporation)
• Original Assignee: Visual Networks Technologies, Inc. (Fortive Corp.)
• Inventors: Kostes, Robert, Zager, David
• Primary Examiner(s): Teska, Kevin J.
• Assistant Examiner(s): PHAN, THAI Q
• Application Number:
  US09/048,025
• Publication Number:
  US 20020022952A1
• Time in Patent Office: 1,517 Days
• Field of Search: 395/500.05, 395/500.34, 395/500.44, 709/224, 709/300, 709/223, 709/227, 709/228, 703/25, 703/27, 370/254, 713/201
• US Class Current: 703/25
• CPC Class Codes: G06F 11/008 Reliability or availability analysis
• CPC Class Codes: G06F 11/328 Computer systems status display G06F11/327 takes precedence
• CPC Class Codes: G06F 11/3447 Performance evaluation by modeling
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: H04L 41/0233 Object-oriented techniques, for representation of network management data, e.g. common object request broker architecture [CORBA]
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]

Abstract

A method and system are provided for use in administering a complex system, such as a distributed computing ensemble. A model of the system being administered is prepared, preferably during runtime of the invention, by a combination of autodiscovery processes and manual input of information as needed. The model represents not only the resources found in the administered system, but also the service-relationships among those resources. The system administrator also can define elements in the model corresponding to arbitrary groupings of already-existing parts of the model. Software agents, which can be reconfigured, started and terminated as desired during runtime, report changes in state of the managed resources to the model, which updates itself and explores portions of the model adjacent (in terms of the service relationships) to the affected resource(s). Clusters of neighboring state-changes that have a logical relation to each other are grouped together as an alarm, and are preferably represented in a graphical display. Any root-cause event of this type is marked as such, and any portions of the modeled system being (or logically likely to be) affected by the changes are also identified and displayed.

Claims

1. A modeling system for modeling an external system that has plural components at least some of which are providing services to others of the components, the modeling system comprising a software model of the external system, and a server for the model;

the model comprising software objects instantiated based on respective portions of the system, wherein each software object includes first information defining any services that a corresponding component of the system is providing or receiving, and second information identifying the software object(s) corresponding to the component(s) of the system to/from which that component is providing/receiving the services, and

wherein, responsive to occurrence of a predefined condition relating to either of a first and a second of the software objects one of which is providing at least one service to the other, the model server determines, based on the first and the second information, at least one path between the first and second objects along which that service can be provided.

2. A modeling system according to claim 1, wherein the model contains no information identifying such paths other than as a result of determination of such paths responsive to occurence(s) of such predefined condition.

3. A modeling system according to claim 1, wherein the predefined condition is occurrence of at least a degradation in performance of a component of the external system.

4. A modeling system according to claim 1, wherein at least one of the software objects is a group of others of the software objects.

5. A modeling system according to claim 4, wherein such group of software objects can be defined as a software object constituting part of the model, by a user of the modeling system.

6. A modeling system according to claim 5, further comprising displays of occurrences in the model are provided, and wherein the administrator can for each display, define a subset of such group of occurrences that are to be included in that display.

7. A modeling system according to claim 6, wherein at least some of the displays correspond to respective groups defined by the user.

8. A method of generating an interaction history of a portion of a system, by using a software model of the system that is a mathematical directed graph having nodes corresponding to respective components of the system and edges corresponding to services that are currently being provided by one component to another;

said method comprising the steps of;

the model receiving information relating to an event occurring in a given component of the portion of the system and generating an indicator of degraded state in a software object corresponding to that component; and

performing graph-traversal, said graph-traversal further comprising at least one of;

traversing the graph rootward, along at least one graph edge from that component in a first direction, from edge-head to edge-tail until edge of the graph is reached or until an object is reached for which a root-cause event has already been declared or until no further traversal in said first direction is possible, and

traversing the graph leafward, along at least one graph edge in a second direction, from edge-tail to edge-head until no further traversal in said first direction is possible or until the traversal reaches a node already traversed, and

said method being capable of both such rootward and such leafward traversal.

9. A method according to claim 8, wherein said receiving and generating step further comprises evaluating the received information and generating the indicator only responsive to a determination that the information meets a predetermined criterion.

10. A method according to claim 8, wherein the nodes of the graph are software objects.

11. A method according to claim 10, wherein the information received by the model is provided by execution of a program, and wherein the graph is one that has been generated by means of the program, and wherein the program performs the steps of:

identifying components of the system to be represented in the model and, for each component so identified, instantiating a respective software object that thus becomes a node of the graph;

once at least one software object representing one of the components has been instantiated, collecting information relating to the operation of such components as have thus far been identified and for which corresponding software objects have thus far been instantiated, and providing at least some of that information to the model; and

the program repeating said identifying and instantiating step asynchronously as needed to continue constructing and updating the model, while the program continues performing said collecting step.

12. A method according to claim 9, wherein said leafward-traversing step is performed only after said rootward traversing step is performed and has reached an object for which a root-cause event has already been declared, and in which said leafward-traversing step is then performed commencing not at the given component but at the object for which the root-cause event has been declared.

13. A method according to claim 12, further comprising the step of displaying a representation of each object for which an indicator of degraded state has been declared.

14. A method according to claim 13, wherein the indicator of degraded state for any object with respect to which the model has received information indicating occurrence of a root-cause event in the component corresponding to that object, is displayed with a special indication that a root-cause event has occurred at the corresponding component.

15. A method according to claim 14, further comprising the step of maintaining records that include the occurrence of the degraded state and other degraded states (if any) encountered in the traversal of the graph in said performing step.

16. A method according to claim 13, wherein the nodes of the graph are software objects, and wherein the model also includes nodes that are software objects that comprise groups of other nodes, and wherein, if the given node in which the degraded state has occurred is such a group, the record relating to the occurrence a given degraded state includes only those other degraded states (if any) which have occurred in nodes which are immediate neighbors in the graph of the given node.

17. A method of predicting an impact of an event that has occurred in a system, by using a software model of the system that is a mathematical directed graph having nodes corresponding to respective components of the system and directed edges corresponding to services that are currently being provided by one component to another, each edge having an edge-tail at a node corresponding to a component providing the service to which the edge corresponds, and the edge having an edge-head at the node corresponding to the component receiving that service;

said method comprising the steps of;

the model receiving information relating to an event occurring in a given component of the portion of the system and generating an indicator of degraded state in a software object corresponding to that component; and

performing leafward graph-traversal to identify a portion of the system that is currently receiving services from the given component, said graph-traversal comprising traversing the graph leafward, along at least one graph edge in a direction from edge-tail to edge-head until no further traversal in said direction is possible or until the traversal reaches a node already traversed; and

providing an indication of such portion of the system.