Adaptive and generalized status monitor

• US 6,965,901 B2
• Filed: 09/05/2002
• Issued: 11/15/2005
• Est. Priority Date: 05/07/1999
• Status: Expired due to Fees

• Current Assignee: NetApp, Inc.
• Original Assignee: Network Appliance Incorporated (NetApp, Inc.)
• Inventors: Eastham, Paul
• Primary Examiner(s): Ali, Mohammad
• Application Number:
  US10/236,074
• Publication Number:
  US 20030046271A1
• Time in Patent Office: 1,167 Days
• Field of Search: 707100-1043, 707 1- 31, 709/224, 709/236, 709/204, 706/12, 706/48, 345/501
• US Class Current: 1/1
• CPC Class Codes: G06F 11/2257 using expert systems
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3055 Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available error or fault processing without redundancy G06F11/0703; error detection or correction by redundancy in data representation G06F11/08; error detection or correction by redundancy in operation G06F11/14; error detection or correction by redundancy in hardware G06F11/16
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: Y10S 707/99932 Access augmentation or optimizing
• CPC Class Codes: Y10S 707/99943 Generating database or data structure, e.g. via user interface

Abstract

The invention provides a method and system for monitoring status in a relatively continuous consistent and intelligent manner. A status monitor receives monitoring data, and adaptively and dynamically associates those known combinations with assessments of the monitored devices, systems, or networks. From an initial set of selected knowledge (or even no knowledge at all), the status monitor develops a database of information regarding anomalous conditions, and measurements of likely causes and faults and learns which of those anomalous conditions require response. Appropriate responses can include informing a system operator, taking remedial action, and altering or terminating the monitored device, systems or network.

Claims

1. A memory storing information including instructions, the instructions executable by a processor, the instructions including

receiving monitoring data, wherein said monitoring data is received from and pertains to at least one of the following:

(i) a file server;

or (ii) a software element in a computer system;

generating indicator bits, wherein each of said indicator bits is responsive to data in said monitoring data that falls outside a limit;

collecting said indicator bits in a bit vector comparator,

in response to said indicator bits, adaptively and dynamically building a database of known combinations of said monitoring data, wherein said database is coupled to a bit vector comparator;

in response to said monitoring data, adaptively and dynamically building a database of associations between said known combinations and selected monitoring assessments; and

taking action in response to said selected monitoring assessments.

2. A memory as in claim 1, wherein said database includes a non-null initial set of said known combinations.

3. A memory as in claim 1, wherein said database includes a null initial set of said known combinations.

4. A memory as in claim 1, wherein said database includes at least one said known combination associated with a non-fault monitoring assessment.

5. A memory as in claim 1, wherein said monitoring data includes SNMP data or email text.

6. A memory as in claim 1, wherein said selected monitoring assessments include at least one of

diagnostic information of a fault;

message information for presentation to an operator;

or

remedial action to be taken in response to said selected monitoring assessments.

7. A memory as in claim 1, wherein said instructions of receiving monitoring data include instructions of receiving selected monitoring data having a new data format.

8. An apparatus, including a processor, and a memory, said memory storing instructions of

receiving monitoring data, wherein said monitoring data is received from and pertains to at least one of the following:

(i) a file server;

or (ii) a software element in a computer system;

generating indicator bits, wherein each of said indicator bits is responsive to data in said monitoring data that falls outside a limit;

collecting said indicator bits in a bit vector comparator,

in response to said indicator bits, adaptively and dynamically building a database of known combinations of said monitoring data, wherein said database is coupled to a bit vector comparator;

in response to said monitoring data, adaptively and dynamically building a database of associations between said known combinations and selected monitoring assessments; and

taking action in response to said selected monitoring assessments.

9. An apparatus as in claim 8, wherein said database includes a non-null initial set of said known combinations.

10. An apparatus as in claim 8, wherein said database includes a null initial set of said known combinations.

11. An apparatus as in claim 8, wherein said database includes at least one said known combination associated with a non-fault monitoring assessment.

12. An apparatus as in claim 8, wherein said monitoring data includes SNMP data or email text.

13. An apparatus as in claim 8, wherein said selected monitoring assessments include at least one of

diagnostic information of a fault;

message information for presentation to an operator;

or

remedial action to be taken in response to said selected monitoring assessments.

14. An apparatus as in claim 8, wherein said steps of receiving monitoring data include steps of receiving selected monitoring data having a new data format.

15. A method including steps of:

receiving monitoring data, wherein said monitoring data is received from and pertains to at least one of the following;

(i) a file server;

or (ii) a software element in a computer system;

generating indicator bits, wherein each of said indicator bits is responsive to data in said monitoring data that falls outside a limit;

collecting said indicator bits in a bit vector comparator,

in response to said indicator bits, adaptively and dynamically building a database of known combinations of said monitoring data, wherein said database is coupled to a bit vector comparator;

in response to said monitoring data, adaptively and dynamically building a database of associations between said known combinations and selected monitoring assessments; and

taking action in response to said selected monitoring assessments.

16. A method as in claim 15, wherein said database includes a non-null initial set of said known combinations.

17. A method as in claim 15, wherein said database includes a null initial set of said known combinations.

18. A method as in claim 15, wherein said database includes at least one said known combination associated with a non-fault monitoring assessment.

19. A method as in claim 15, wherein said monitoring data includes SNMP data or email text.

20. A method as in claim 15, wherein said selected monitoring assessments include at least one of

diagnostic information of a fault;

message information for presentation to an operator;

or

remedial action to be taken in response to said selected monitoring assessments.

21. A method as in claim 15, wherein said instructions of receiving monitoring data include instructions of receiving selected monitoring data having a new data format.