System for characterizing information from an information producer

• US 6,925,483 B1
• Filed: 12/12/2001
• Issued: 08/02/2005
• Est. Priority Date: 06/25/1998
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Niemi, Frederick Eldin
• Primary Examiner(s): Cuchlinski, Jr., William A.
• Assistant Examiner(s): Gerezgiher, Yemane M.
• Application Number:
  US10/021,364
• Time in Patent Office: 1,329 Days
• Field of Search: 709/201, 709/202, 709/203, 709/205, 709/223, 709/224, 709/206, 709/234
• US Class Current: 709/201
• CPC Class Codes: H04L 41/0604 using filtering, e.g. reduction of information by using priority, element types, position or time
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 41/0686 Additional information in the notification, e.g. enhancement of specific meta-data
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]

Abstract

A system enables a consumer to generate a filtering program based on criteria set forth by a system operator during run time. During system operation, the operator selects appropriate filtering criteria from a display screen associated with a respective consumer. Each consumer implements filtering criteria in a filtering program that is registered with a distributor. The filtering program may include simple true or false tests, or more complex tests. The distributor compiles each filtering program during registration and thereafter dynamically loads the compiled program before executing filtering queries.

Claims

1. A computer, the computer to aid in managing a computer network, comprising:

a distributor that receives a message from an entity that detects an anomaly on a network device;

a filtering device, for use by the distributor, tests a value of an argument contained in the message using a filtering expression that is created at run time; and

,

a transmitting device for transmitting the message if a result of the filtering expression is true.

2. The apparatus of claim 1 further comprising:

the distributor compiles each filtering device, and the filtering device is a filtering program, and the filtering program is programmed in a programming language that can be compiled.

3. The apparatus of claim 2 further comprising:

the distributor dynamically loads the compiled filtering program before executing the filtering expression in the filtering program.

4. The apparatus of claim 2 further comprising:

the filtering program includes a test implemented in a Boolean statement.

5. The apparatus as in claim 2 further comprising:

the filtering program includes a test implemented in a SQL statement.

6. The apparatus of claim 2 further comprising:

the filtering program includes a programming expression that performs queries on at least one individual message.

7. The apparatus of claim 2 further comprising:

the filtering program includes a programming expression that performs queries on a group of messages.

8. A computer, the computer to aid in managing a distributed computer network, comprising:

a distributor that receives a message from a network device, the message containing a value of an argument, the distributor testing the value of the argument in accordance with a filtering expression to distribute the message if a result of the filtering expression is true; and

a filtering device that creates the filtering expression at run time.

9. A computer, the computer connected in a distributed computer network, comprising:

a distributor for receiving at least one message that indicates an anomaly on a network device;

means for compiling a filtering program that is associated with the at least one message;

a filtering device for use by the distributor tests a value of an argument contained in the at least one message, using a filtering program that is created at run time; and

,

means for distributing the message if a result of the filtering program is true.

10. A computer, the computer connected into a computer network, comprising:

a distributor software application on said computer for receiving at least one message that indicates an anomaly on a network device;

a compiler to compile a filtering program that is associated with the at least one message;

a filtering device for use by the distributor to test a value of an argument contained in the message, wherein the filtering program is created at run time; and

a transmitting device to transmit the message if a result of the filtering program is true.

11. A method for operating a computer, comprising:

receiving a message into a distributor, the distributor receiving state messages from producers and transmitting the state messages to the appropriate network consumer, the message indicating an anomaly on a network device;

filtering the message by a filtering program that contains a filtering expression for testing a value of an argument contained in the message, and the filtering expression is created at run time; and

transmitting the message through a transmitting device if a result of the filtering expression is true.

12. A method for operating a computer, the computer connected into a computer network, comprising:

receiving a message into a distributor software application, said message indicating an anomaly on a network device;

filtering the message by a filtering program that contains a filtering expression for testing a value of an argument contained in the message, and the filtering expression is created at run time; and

,

transmitting the message through a transmitting device if a result of the filtering expression is true.

13. A node having a processor adapted to,

receive a message into a distributor software application, said message indicating an anomaly on a network device;

filter the message by a filtering program that contains a filtering expression for testing a value of an argument contained in the message, and the filtering expression is created at run time; and

,

transmit the message through a transmitting device if a result of the filtering expression is true.

14. A computer network, comprising:

two or more computers, at least one of the two or more computers connected into the network having,

a distributor that receives a message from an entity that detects an anomaly on a network device;

a filtering device, for use by the distributor, tests a value of an argument contained in the message using a filtering expression that is created at run time; and

,

a transmitting device for transmitting the message if a result of the filtering expression is true.

15. A computer-readable media, comprising:

instructions written on the computer readable media, the instructions for executing on a computer, the instructions to,

receive a message into a distributor software application, said message indicating an anomaly on a network device;

filter the message by a filtering program that contains a filtering expression for testing a value of an argument contained in the message, and the filtering expression is created at run time; and

,

transmit the message through a transmitting device if a result of the filtering expression is true.

16. A method for operating a computer, comprising:

receiving a message that an anomaly has been detected on a network device;

testing a value of an argument contained in the message using a filtering expression created at run time; and

transmitting the message in response to a specified result of the filtering expression.

17. A computer, comprising:

means for receiving a message that an anomaly has been detected on a network device;

means for testing a value of an argument contained in the message using a filtering expression created at run time; and

means for transmitting the message in response to a specified result of the filtering expression.

18. A computer readable media, comprising:

instructions for execution in a processor, the instructions to,

receive a message that an anomaly has been detected on a network device;

test a value of an argument contained in the message using a filtering expression created at run time; and

transmit the message in response to a specified result of the filtering expression.