Adaptive and generalized status monitor

• US 6,457,015 B1
• Filed: 05/07/1999
• Issued: 09/24/2002
• Est. Priority Date: 05/07/1999
• Status: Active Grant

• Current Assignee: NetApp, Inc.
• Original Assignee: Network Appliance Incorporated (NetApp, Inc.)
• Inventors: Eastham, Paul
• Primary Examiner(s): Breene, John
• Assistant Examiner(s): Ali, Mohammad
• Application Number:
  US09/307,089
• Time in Patent Office: 1,236 Days
• Field of Search: 706/46, 706/47, 706/14, 706/48, 706/12, 702/102, 702/185, 702/61, 702/84, 702/81, 702/181, 702/183, 702/186, 379/202, 714/25, 714/26, 709/224, 709/236, 709/204, 707/101-102, 345/501, 340/573, 705/8, 713/600, 382/209, 382/182, 700/17, 700/83, 700/29
• US Class Current: 1/1
• CPC Class Codes: G06F 11/2257 using expert systems
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3055 Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available error or fault processing without redundancy G06F11/0703; error detection or correction by redundancy in data representation G06F11/08; error detection or correction by redundancy in operation G06F11/14; error detection or correction by redundancy in hardware G06F11/16
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: Y10S 707/99932 Access augmentation or optimizing
• CPC Class Codes: Y10S 707/99943 Generating database or data structure, e.g. via user interface

Abstract

The invention provides a method and system for monitoring status in a relatively continuous, consistent, and intelligent manner. A status monitor receives monitoring data, adaptively and dynamically builds a database of known combinations of monitoring data, and adaptively and dynamically associates those known combinations with assessments of the monitored devices, systems, or networks. From an initial set of selected knowledge that is limited (even limited to no knowledge at all), the status monitor learns those anomalous conditions that require response and what responses are appropriate. The status monitor develops a database of information regarding distinguishable conditions, and measurements of the likely causes or effects of recognizable errors or faults. When an anomalous pattern is recognized, the status monitor, responsive to the anomalous pattern, diagnoses and corrects, or informs a human operator regarding, the monitored devices, systems, or network. The monitoring data includes a set of data streams each possibly having a different format, and each selectively interpreted so as to present information to the status monitor in a format usable by the status monitor. New data streams and formats can be dynamically added or altered. Appropriate responses can include informing human beings; taking remedial action for the monitored devices, systems, or networks; or altering or terminating the operation of the monitored devices, systems, or networks.

Claims

1. A method including steps for

receiving monitoring data, wherein said monitoring data is received from and pertains to operation or status of at least one of the following:

(i) a hardware element in a computer system or (ii) a software element in a computer system;

in response to said monitoring data, adaptively and dynamically building a database of known combinations of said monitoring data,

in response to said monitoring data, adaptively and dynamically building a database of associations between said known combinations and selected monitoring assessments; and

taking action in response to said selected monitoring assessments.

2. A method as in claim 1, wherein said database includes a non-null initial set of said known combinations.

3. A method as in claim 1, wherein said database includes a null initial set of said known combinations.

4. A method as in claim 1, wherein said database includes at least one said known combination associated with a non-fault monitoring assessment.

5. A method as in claim 1, wherein said monitoring data includes SNMP data or email text.

6. A method as in claim 1, wherein said selected monitoring assessments include at least one of

diagnostic information of a fault;

message information for presentation to an operator;

or

remedial action to be taken in response to said selected monitoring assessment.

7. A method as in claim 1, wherein said steps for receiving monitoring data include steps for receiving selected monitoring data having a new data format.

8. A method as in claim 1, wherein said computer system includes a file server.

9. Apparatus including

a plurality of monitoring data input ports, wherein each said monitoring data input port is (1) coupled to least one of the following:

(i) a hardware element in a computer system or (ii) a software element in a computer system, and (2) provides a sequence of monitoring data,

a plurality of comparison elements, each one coupled to an associated one of said input ports, and each providing a sequence of comparison values;

a database having a plurality of sets of comparison values, each said set of comparison values having a monitoring assessment associated therewith;

a vector comparator, coupled to said comparison values for said comparison elements, and coupled to said database, and providing a selected group of said plurality of sets in response thereto; and

a fault response element, coupled to at least one said monitoring assessment and providing a response thereto.

10. Apparatus as in claim 9, wherein at least one said sequence of monitoring data includes SNMP data or email text.

11. Apparatus as in claim 9, wherein said data input ports each include an element for recognizing monitoring data having a selected data format, whereby said apparatus can receive a new said data input port having a new said data format.

12. Apparatus as in claim 9, wherein said database includes a non-null initial set of said comparison values.

13. Apparatus as in claim 9, wherein said database includes a null initial set of said comparison values.

14. Apparatus as in claim 9, wherein said database includes at least one said known set of comparison values associated with a non-fault monitoring assessment.

15. Apparatus as in claim 9, wherein said selected monitoring assessments include at least one of

diagnostic information of a fault;

message information for presentation to an operator;

or

remedial action to be taken in response to said selected monitoring assessment.

16. An apparatus as in claim 9, wherein said computer system includes a file server.

17. A memory storing information, including instructions, the instructions executable by a processor, said instructions including

receiving monitoring data, wherein said monitoring data is received from and pertains to at least one of the following:

(i) a file server;

or (ii) a software element in a computer system;

adaptively and dynamically building a database of known combinations of said monitoring data, wherein said database is coupled to a bit vector comparator;

in response to said monitoring data, adaptively and dynamically building a database of associations between said known combinations and selected monitoring assessments; and

taking action in response to said selected monitoring assessments.

18. A memory as in claim 17, wherein said database includes a non-null initial set of said known combinations.

19. A memory as in claim 17, wherein said database includes a null initial set of known combinations.

20. A memory as in claim 17, wherein said database includes at least one said known combination associated with a non-fault monitoring assessment.

21. A memory as in claim 17, wherein said monitoring database includes SNMP data or email text.

22. A memory as in claim 17, wherein said selected monitoring assessments includes at least one of the following:

(a) diagnostic information of a fault;

(b) message information for presentation to an operator;

or (c) remedial action to be taken in response to said selected monitoring assessments.

23. A memory as in claim 17, wherein said steps of receiving monitoring data include steps for receiving selected monitoring data having a new data format.

24. A method including steps of

receiving monitoring data, wherein said monitoring data is received from and pertains to at least one of the following:

(i) a file server;

or (ii) a software element in a computer system;

generating an indicator bit, wherein said indicator bit is responsive to said monitoring data that falls outside a limit;

collecting said indicator bits in a bit vector comparator,

in response to said indicator bits, adaptively and dynamically building a database of known combinations of said monitoring data, wherein said database is coupled to a bit vector comparator;

in response to said monitoring data, adaptively and dynamically building a database of associations between said known combinations and selected monitoring assessments; and

taking action in response to said selected monitoring assessments.

25. A method as in claim 24, wherein said database includes a non-null initial set of said known combinations.

26. A method as in claim 24, wherein said database includes a null initial set of said known combinations.

27. A method as in claim 24, wherein said database includes at least one said known combination associated with a non-fault monitoring assessment.

28. A method as in claim 24, wherein said monitoring data includes SNMP data or email text.

29. A method as in claim 24 wherein said selected monitoring assessments include at least one of

diagnostic information of a fault;

message information for presentation to an operator;

or

remedial action to be taken in response to said selected monitoring assessments.

30. A method as in claim 24, wherein said steps of receiving monitoring data include steps of receiving selected monitoring data having a new data format.

31. Apparatus including

a plurality of monitoring data input ports, wherein each said monitoring data input port is (1) coupled to least one of the following:

(i) a file server;

or (ii) a software element in a computer system, and (2) provides a sequence of monitoring data,

a plurality of comparison elements, each one coupled to an associated one of said input ports, and each providing an indicator bit, wherein said indicator bit indicates whether said sequence of monitoring data is within a stated range;

a plurality of indicator bit vectors, wherein said each indicator bit vector collects said indicator bits generated from said sequence of monitoring data;

a bit vector comparator coupled to said comparison element wherein said bit vector comparator includes a database having a plurality of sets of comparison values, each said set of comparison values having a monitoring assessment associated therewith; and

a fault response element, coupled to at least one said monitoring assessment and providing a response thereto.

32. An apparatus as in claim 31, wherein said sequence of monitoring data includes SNMP data or email text.

33. An apparatus as in claim 31, wherein said data input ports each include an element for recognizing monitoring data having a selected data format, whereby said apparatus can receive a new said data input port having a new said data format.

34. An apparatus as in claim 31, wherein said database includes a non-null initial set of comparison values.

35. An apparatus as in claim 31, wherein said database includes a null initial set of comparison values.

36. An apparatus as in claim 31, wherein said database includes at least one said known set of comparison values associated with a non-fault monitoring assessment.

37. An apparatus as in claim 31, wherein said selected monitoring assessments includes at least one of

diagnostic information of a fault;

message information for presentation to an operator;

or

remedial action to be taken in response to said selected monitoring assessment.