System for monitoring relevant events by comparing message relation key

• US 6,941,367 B2
• Filed: 05/10/2001
• Issued: 09/06/2005
• Est. Priority Date: 05/10/2001
• Status: Expired due to Term

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Recker, Martin, Vosseler, Frank
• Primary Examiner(s): Luu, Le Hien
• Application Number:
  US09/853,103
• Publication Number:
  US 20020169870A1
• Time in Patent Office: 1,580 Days
• Field of Search: 709/223, 709/224, 714/48, 714/47, 714/39, 719/318, 712/244, 707/201, 707/1, 711/147
• US Class Current: 709/224
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis

Abstract

The invention is directed to a method for monitoring objects within an information technological (IT) network having monitored nodes in which monitoring-relevant events occurs comprising: generating event-related messages comprising a message key and a message relation key; comparing the message relation key with the message key of another message; processing the other message depending on the result of the comparison. The invention is also directed to a corresponding system and computer program product.

Claims

1. A computer-implemented method for monitoring objects within an information technological (IT) network having monitored nodes in which monitoring-relevant events occur, comprising:

generating event-related messages comprising a message key and a message relation key, wherein each event-related message is generated in response to a single monitoring-relevant event occurring on a monitored node by a monitoring agent running on the monitored node;

comparing the message relation key with the message key of another message;

processing the other message depending on the result of the comparison.

2. The method of claim 1, wherein the message key has attributes which characterise certain characteristics of the related event which are relevant for monitoring purposes.

3. The method of claim 1, wherein the message relation key has attributes, at least one of the attributes being an attribute of the message key or comprising a wildcard.

4. The method of claim 1, wherein the step of comparing the message relation key and the other message key comprises checking whether the keys match with each other.

5. The method of claim 1, wherein the step of processing comprises discarding the other message if its message key is found to match with the message relation key.

6. The method of claim 1, further comprising:

a monitoring server which receives the messages and carries out the processing step.

7. The method of claim 1, wherein the message key and the message relation key are generated according to key patterns which can be defined on the basis of a set of pattern definition rules, and wherein both the message key pattern and the message relation key pattern are defined on the basis of the same set of pattern definition rules.

8. The method of claim 7, wherein the method is carried out by a computer program, and the message key pattern and the message relation key pattern can be defined by a user via a user interface at a common place of the computer program.

9. A system for monitoring objects within an information technological (IT) network having monitored nodes in which monitoring-relevant event occur and a message processor,

monitoring agents run on the monitored nodes and generate event-related messages in response to monitoring-relevant events occurring on the monitored nodes comprising a message key and a message relation key, each event-related message being generated in response to a single monitoring-relevant event;

and

wherein the message processor compares the message relation key with the message key of another message and processes the other message depending on the result of the comparison.

10. The system of claim 9, wherein the agents generate messages with message keys having attributes which characterise certain characteristics of the related event which are relevant for monitoring purposes.

11. The system of claim 9, wherein the agents generate messages with the message relation key having attributes, at least one of the attributes being an attribute of the message key or comprising a wildcard.

12. The system of claim 9, wherein the monitoring server compares the message relation key and the other message key by checking whether the keys match with each other.

13. The system of claim 9, further comprising:

a monitoring server which processes the other message by discarding it if it has found the other message'"'"'s message key to match with the message relation key.

14. The system of claim 9, wherein the agent generates the message key and the message relation key according to key patterns which are both defined on the basis of the same set of pattern definition rules.

15. The system of claim 14, wherein the system comprises a monitoring computer program baying a user interface, and the message key pattern and the message relation key pattern can be defined by a user via the user interface at a common place of the computer program.

16. A computer program product including program code for execution on a network having monitored nodes in which monitoring-relevant events occur, said program code comprising:

a monitoring agent portion for generating event-related messages comprising a message key and a message relation key, wherein each event-related message is generated in response to a single monitoring-relevant event occurring on a monitored node by the monitoring agent portion running on the monitored node; and

a monitoring server portion for comparing the message relation key with the message key of another message and processing the other message depending on the result of the comparison.

17. The computer program product of claim 16, wherein the message key has attributes which characterise certain characteristics of the related event which are relevant for monitoring purposes.

18. The computer program product of claim 16, wherein the message relation key has attributes, at least one of the attributes being an attribute of the message key or comprising a wildcard.

19. The computer program product of claim 16, wherein the step of comparing the message relation key and the other message key comprises checking whether the keys match with each other.

20. The computer program product of claim 16, wherein the step of processing comprises discarding the other message if its message key is found to match with the message relation key.

21. A computer program product including program code for execution on a network having monitored nodes in which monitoring-relevant events occur, said program code comprising:

an agent portion that runs on each monitored node and generates event-related messages comprising a message key and a message relation key, each event-related message being generated in response to a single monitoring-relevant event occurring on the monitored node; and

another portion that compares the generated message relation key with the message key of another message,

wherein the message key and the message relation key are generated according to key patterns which can be defined on the basis of a set of pattern definition rules.

22. The computer program product of claim 21, wherein the message key pattern and the message relation key pattern can be defined by a user via a user interface at a common place of the computer program.

23. The computer program product of claim 21, wherein both the message key pattern and the message relation key pattern are defined on the basis of the same set of pattern definition rules.