Method and system for network event impact analysis and correlation with network administrators, management policies and procedures

• US 6,694,362 B1
• Filed: 01/03/2000
• Issued: 02/17/2004
• Est. Priority Date: 01/03/2000
• Status: Expired due to Term

• Current Assignee: International Business Machines Corporation
• Original Assignee: Micromuse Incorporated (International Business Machines Corporation)
• Inventors: Perelman, Shoel, Tokarsky, Tim, Secor, Peter
• Primary Examiner(s): EL HADY, NABIL M
• Application Number:
  US09/476,846
• Time in Patent Office: 1,506 Days
• Field of Search: 709/223, 709/224, 709/201, 709/202, 705/8, 705/9, 705/28
• US Class Current: 709/223
• CPC Class Codes: G06Q 10/087 Inventory or stock management, e.g. order filling, procurement or balancing against orders
• CPC Class Codes: H04L 41/0636 based on a decision tree analysis
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]

Abstract

An impact analysis software system is described which resides on a computer connected to a network in an enterprise. The system analyzes the impact of network events on the network, and includes a number of modules, including a number of data source adapters for interfacing with external data sources to thereby allow access by the system to enterprise-related data in the external data sources. The system further includes an impact analysis data structure populated with data accessed from the external data sources and defining relationships between the enterprise-related data. One or more action tree data structures comprise a routine which, when executed, acts upon the relationships defined by the impact analysis data structure to handle events. A message processor reads the network events and select one of the action tree data structures to handle each read network event.

Claims

1. A software system residing on a computer connected to a network in an enterprise, the system being used in analyzing the impact of network events on the network, the system comprising:

a plurality of data source adapters for interfacing with external data sources to thereby allow access by the system to enterprise-related data in the external data sources;

an impact analysis data structure populated with data accessed from the external data sources and defining relationships between the enterprise-related data;

an action tree data structure comprising a routine which, when executed, acts upon the relationships defined by the impact analysis data structure to handle events; and

a message processor to read the network events and select one of the action tree data structures to handle each read network event.

2. The system of claim 1, wherein the impact analysis data structure comprises:

a plurality of organizational nodes each representative of an enterprise element and populated with data accessed by the system through the use of the data source adapters; and

one or more hierarchy structures of said organizational nodes, said hierarchy structures defining relationships of organizational nodes to one another by the data contained therein, said hierarchy structures representative of structures and business processes of the enterprise.

3. The system of claim 1, comprising an event handler to receive and queue data regarding network events from an event server.

4. The system of claim 1, wherein the external data sources store data using a plurality of different formats, and wherein the data source adapters comprise a data source adapter corresponding to each data source format.

5. The system of claim 4, comprising a selection routine for selecting one of the data source adapters corresponding to a given external data source.

6. The system of claim 4, wherein each data source adapter resides on a single computer with the corresponding external data source.

7. The system of claim 1, comprising a plurality of message processors utilized to read a plurality of events in parallel.

8. The system of claim 1, comprising a state database for storing a processing state during execution of an action tree data structure routine.

9. A method for analyzing the impact of network events on a network in an enterprise, the method comprising:

collecting and normalizing enterprise data from a plurality of individually managed data sources located throughout the network;

populating enterprise data objects representative of enterprise elements using the collected data;

generating hierarchies of related enterprise data objects representative of structures and business processes of the enterprise;

storing a plurality of action objects utilizing stored logic to act upon the relationships defined by the hierarchies to handle network event; and

processing received data regarding network events to select an action object to execute for each network event.

10. The method of claim 9, wherein the step of collecting and normalizing enterprise data is executed on each computer upon which an individually managed data source resides.

11. The method of claim 9, comprising queuing received network event data for processing.

12. The method of claim 11, wherein the step of processing network event data is executed multiple times in parallel.

13. A method for generating an impact analysis data structure for use in handling network events generated by a network in an enterprise, the method comprising:

storing a plurality of data source adapters each capable of collecting enterprise-related data from a data source having a particular format;

for each data source, using one of the data source adapters to collect enterprise-related data from the data source and storing the enterprise-related data in an enterprise data object; and

defining relationships between enterprise data objects of different data types representative of structure and business processes of the enterprise;

thereby generating an impact analysis data structure which defines relationships between enterprise-related data and which is used to determine how a network event impacts on the enterprise.

14. The method of claim 13, comprising a user selecting a first data source and automatically selecting a corresponding data source adapter to use in collecting enterprise-related data.

15. The method of claim 13, wherein the enterprise data objects comprise objects or different data types including an administrator data object, a workstation data object, and a business unit data object, and wherein the step of defining relationships comprising defining relationships between two or more enterprise data objects of different data types.

16. The method of claim 15, wherein the step of defining relationships comprises defining a relationship between an administrator data object and a workstation data object.

17. The method of claim 15, wherein the step of defining relationships comprises defining a relationship between a workstation data object and a business unit data object.

18. The method of claim 13, wherein the step of defining relationships comprises using the data source adapters to collect relationship data from the data sources.

19. A method for using an impact analysis data structure to handle network events generated in a network in an enterprise, the method comprising:

populating the impact analysis data structure with data accessed from a plurality of data sources throughout the network;

defining, by the impact analysis data structure, relationships between enterprise-related data objects including administrators, workstations, or business units;

selecting an action policy to implement for a given network event;

identifying a workstation affected by the given network event;

traversing the impact analysis data structure to determine the one or more administrators, and one or more business units affected by the network event; and

using the action policy to contact the one or more affected administrators.