System and method for correlating and diagnosing system component performance data

• US 7,237,023 B2
• Filed: 04/02/2002
• Issued: 06/26/2007
• Est. Priority Date: 03/30/2001
• Status: Expired due to Fees

• Current Assignee: Clouding Corporation (Marathon Patent Group, Inc.)
• Original Assignee: Tonic Software, Inc. (Gen Digital Inc.)
• Inventors: Menard, Cody, Murthy, Raghavendra K.
• Primary Examiner(s): Coulter; Kenneth R.
• Application Number:
  US10/063,232
• Publication Number:
  US 20020184065A1
• Time in Patent Office: 1,911 Days
• Field of Search: 709/223, 709/224, 709/203, 714/47
• US Class Current: 709/224
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: H04L 41/0233 Object-oriented techniques, for representation of network management data, e.g. common object request broker architecture [CORBA]
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls

Abstract

The system and method for correlating, predicting and diagnosing system component performance data includes capturing knowledge about system behavior, deploying the captured knowledge as baseline system behavior files, evaluating system performance data against the baseline system behavior files, performing predictive and diagnostic analysis when received system performance data exceeds thresholds in the baseline system behavior files, and notifying a user when an analysis result is generated. The method of capturing knowledge about system behavior includes defining problems to be solved, creating datasets that correspond to defined problems, constructing problem scenarios, associating data patterns modules with the problem scenarios, and generating XML definition files that characterize system behavior in terms of the scenarios, modules, and datasets. The system has the capability to activate corrective scripts in the target system and to reconfigure the target system.

Claims

1. A method for correlating and diagnosing system performance data, comprising:

capturing knowledge about system behavior;

deploying the captured knowledge as baseline system behavior files;

evaluating monitored system performance datapoints against the baseline system behavior files to determine whether a change in state has occurred;

identifying, in response to a change in state determination, datasets containing one or more datapoints causing the change in state;

performing real-time prediction and diagnostic analysis on the datasets that have changed states;

notifying a user of a prediction and diagnostic analysis result;

wherein the deploying step further comprises;

loading XML definition files that characterize system behavior in terms of the scenarios, modules and datasets;

receiving system domain, component and datapoint information;

creating relationships between components; and

evaluating and creating domain and component instances in each domain to form instances of datasets.

2. The method of claim 1, wherein the capturing step comprises:

defining problems to be solved;

creating datasets that correspond to the defined problems;

constructing problem scenarios;

associating data patterns with the problem scenario ases; and

generating XML definition files that characterize system behavior in terms of the scenarios modules and datasets.

3. The method of claim 1, wherein the deploying step further comprises characterizing the captured system behavior knowledge as XML files.

4. The method of claim 1, wherein the evaluating step comprises:

receiving system performance datapoints from data collectors;

comparing the datapoints against a threshold value to determine a state of the datapoints;

analyzing the received performance daaapurnb when a slate changes or exceeds a threshold;

correlating the datapoints that exceeded the threshold values with stored datasets in the baseline system behavior flies to identify related datasets; and

sending the correlated datasets to a reasoning system for prediction and diagnostic analysis.

5. The method of claim 1, wherein the pefforming step comprises:

receiving correlated datasets by a reasoning system;

performing prediction and diagnosis analysis by the reasoning system to determine it the received datasets match problem patterns in a knowledge base; and

generaing an analysis result based on analysis of the recieved datasets and problem patterns.

6. Thc method of claim 5, wherein the generating step provides an analysis result chat identifies a problem and a probable cause of the problem.

7. The method of claim 5, wherein the generating step provides an analysis result that predicts an incipient system component failure.

8. The method of claim 5, wherein the generating step provides a best estimate of a problem and probable cause of the problem.

9. A computer-readable medium containing instruction for controlling a computer system to carry out the steps of claim 1.

10. A computer system for correlating and diagnosing system performance data, comprising:

an extension environment comprising means for capturing knowledge about system behavior;

a system manager comprisng;

means for deploying the captured knowledge as baseline system behavior files;

means for evaluating monitored system performance datapoints against the baseline system behavior files to determine whether a change in state has occurred

means, responsive to a change in state determination, for identifying datasets comprising one or more datapoints causing the change in state;

a reasoning system comprising;

means fur performing real-time prediction and diagnostic analysis on the datasets;

means for notifying a user of a prediction and diagnostic analysis result;

means for parsing XML files into a tree representation;

means for traversing the tree representation and taking actions on specific tree elements;

means for creating and updating domain, component, datapoint

relationship, and dataset objects specified by a given tree elements;

means for instantiating derived objects by proeesing newly created components to determine if new relationships need to be created;

means for instantiating datasets by processing newly created relationships and components to determine if new datasets need to be instantiated; and

wherein the means for deploying comprises loading XML definition files that characterize system behavior in terms of scenarios, modules and dataset;

receiving system domain, component and datapoint information;

creating relationships between components; and

evaluating and creating domain and component instances in each domain to form instances of datasets.

11. The system of claim 10, wherein the capturing means comprises:

problems to be solved;

datasets that correspond to the defined problems;

problem scenarios;

data pattern modules with the problem scenarios; and

XML definition files that characterize system behavior in terms of the scenarios, modules and datasets.

12. The system of claim 10, wherein the means for deploying further comprises XML files that characterize the captured system behavior knowledge.

13. The system of claim 12, wherein the system behavior knowledge is stored in a repository, encapsulated in XML tiles and built into the engine and module.

14. The system of claim 10, wherein the means for deploying further comprises XML definition files that characterize system composition and behavior in terms of:

the scenarios, modules and datasets;

domain information;

datapoints and components; and

relationships between components.

15. The system of claim 10, wherein the means for evaluating comprises:

system performance data from data collectors;

domain, components, datapoint and relationship instances from received data;

relationships based on pre-defined templates based on component instances;

datasets based on a relationships and component instances;

evaluated performance data to determine if a threshold value is exceeded;

identified dataset containing datapoints that exceed a threshold value; and

a reasoning system for receiving the identified datasets.

16. The system of claim 10, wherein the means for performing real-time prediction and diagnostic analysis comprises:

a reasoning system for receiving identified datasets;

a prediction engine and a diagnostic engine in the reasoning system for determining if the received dataset matches a problem pattern in a knowledge base; and

an analysis result from the prediction engine and diagnostic engine.

17. The system of claim 16, wherein the analysis result identifies a problem, a probable cause of the problem, and suggested solution.

18. The system of claim 16, wherein the analysis result predicts an incipient system component failure.

19. The system of claim 16, wherein the analysis result is a best estimate of a problem and a probable cause of the problem.

20. A method for correlating and diagnosing system performance data, comprising:

capturing knowledge about system behavior;

deploying the capture knowledge as baseline system behavior flies;

evaluating monitored system performance datapoints against the baseline system behavior files to identify datasets that have changed states;

performing real-time prediction and diagnostic analysis on the datasets that have changed states;

notifying a user of a prediction and diagnostic analysis result;

parsing XML files into a tree representation;

traversing the tree representation and taking actions on specific tree elements;

creating and updating domain, component, datapoint, relationship, and dataset objects specified by a given tree element;

instantiating derived objects by processing newly created components to determine if new relationships need to be created;

instantiating datasets by processing newly created relationships and components to determine if new datasets need to be instantiated; and

wherein the deploying step further comprises loading XML definition files that characterize system behavior in terms of scenarios, modules and datasets;

receiving system domain, component and datapoint information;

creating relationships between components; and

evaluating and creating domain and component instances in each domain to form instances of datasets.

21. The method of claim 20, wherein the capturing step comprises:

defining problems to be solved;

creating datasets that correspond to the defined problems;

constructing problem scenarios;

associating data patterns with the problem scenario cases; and

generating XML definition files that characterize system behavior in terms of the scenarios modules and datasets.

22. The method of claim 20, wherein the deploying step further comprises characterizing the captured system behavior knowledge as XML flies.

23. The method of claim 20, wherein the evaluating step comprises:

receiving system performance datapoints from data collectors;

comparing the datapoints against a threshold value to determine a state of the datapoints;

analyzing the received performance datapoints when a state changes or exceeds a threshold;

correlating the datapoints that exceeded the threshold values with stored datasets in the baseline system behavior files to identify related datasets; and

sending the correlated datasets to a reasoning system for prediction and diagnostic analysis.

24. The method of claim 20, wherein the performing step comprises:

receiving correlated datasets by a reasoning system;

performing prediction and diagnosis analysis by the reasoning system to

determine if the received datasets match problem patterns in a knowledge base; and

generating an analysis result based on analysis of the received datasets and problem patterns.

25. The method of claim 24, wherein the generating step provides an analysis result that identifies a problem and a probable cause of the problem.

26. The method of claim 24, wherein the generating step provides an analysis result that predicts an incipient system component failure.

27. The method of claim 24, wherein the generating step provides a best estimate of a problem and probable cause of the problem.

28. A computer-readable medium containing instruction for controlling a computer system to carry out the method of claim 20.

29. A computer readable storage medium containing a data structure for storing objects for correlating and diagnosing system component performance data, comprising:

domain objects that identify distinct areas of a system environment, wherein the domain objects are defined by DomainDefXML definition structures that include a type, category, and attributes of component and datapoint objects;

component objects that identify parts of the domains of the system environment, wherein the component objects are defined by ComponentDefXML definition structures that include a type and attributes of datapoint objects;

datapoint objects that identify monitored characteristics of system components, wherein the datapoint objects are defined by DataPointDefXML definition structures that contain a name and attribute;

relationship templates for connecting two or more components related to one another, wherein the relationship templates are defined by RelationTemp definition structures that include identification of related components;

scenario objects that identify possible causes for the problem, wherein the scenario objects are defined by the Scenario definition structures that include the problem description, probable cause and suggested solutions; and

module objects that encapsulate stored knowledge.

30. The data structure of claim 29, wherein a system manager instantiates the objects in a repository from XML files.

31. The data structure of claim 29, wherein:

domain objects comprise one or more component objects;

component objects comprise one or more datapoint objects; and

dataset objects comprise one or more component objects and one or more datapoint objects.

32. The data structure of claim 29, wherein dataset objects contains datapoints belonging to one or more component objects.

33. The data structure of claim 29, wherein the relationship templates specify a rule to create relationships between components, the relationship template including the following attributes:

Type for identifying method of creation;

OwnerDomainType for identifying owner domain type;

OwnerCompType for identifying owner component type;

MemberDomainType for identifying member domain type;

MemberCompType for identifying member component type;

OwnerComp for identifying owner component instance;

MemberComp for identifying member component instance;

OwnerDomainInst for identifying owner domain instance;

MemberDomainInst for identifying member domain instance; and

flags to specify that owner and member should be pert of same domain, same component and same host.

34. The data structure of claim 29, further comprising an engine template for associating analysis with a dataset, the engine including one or more modules that address a specific dataset.

35. A computer readable storage medium containing a data structure for storing objects for correlating and diagnosing system component performance data, comprising:

domain objects that identify distinct areas of a system environment, the domain objects defined by DomainDefXML definition structures that include a type, category, and attributes of component and datapoint objects;

component objects that identify parts of the domains of the system environment, the component objects defined by ComponentDefXML definition structures that include a type and attributes of datapoint objects;

datapoint objects that identify monitored characteristics of system components, the datapoint objects defined by DataPointDefXML definition structures that contain a name and attributes;

dataset objects that comprise logical collections of datapoint objects, the dataset objects defined by DataSetDefXML definition structures that include attributes of components objects and datapoint objects;

relationship templates for connecting two or more components related to one another, the relationship templates defined by RelationTemp definition structures that include identification of related components;

scenario objects that identify possible causes for the problem, the scenario objects defined by the Scenario definition structures that include the problem description, probable cause and suggested solutions;

module objects that encapsulate stored knowledge; and

wherein the DatasetDef objects comprise a DataSetDef name; and

a list of DsComponentDef objects wherein each object includes a pointer to the component definition used in the dataset; and

subset of DsDataPointDef objects included in the component definitions needed in the dataset;

a liot of child DoComponentDof objects related to this component;

a parent DsComponentDef object; and

wherein the DsDataPointDef objects include a pointer to a DataPointDef object used in the dataset;

a trigger flag for specifying whether this datapoint triggers analysis;

a trigger threshold at which point analysis is triggered;

an analyze flag for specifying whether this datapoint participates in analysis; and

a label to uniquely identify the datapoint.

36. The data structure of claim 35, wherein the trigger threshold is selected from the group consisting of good, fair, warning and critical.

37. The data structure of claim 35, wherein the DsComponentDef object further includes a constraint selected from the group consisting of possible candidates for this component based on its host, the domain instance, and the component instance.

38. The data structure of claim 35, wherein a system manager instantiates the objects in a repository from XML files.

39. The data structure of claim 35, wherein:

domain objects comprise one or more component objects;

component objects comprise one or more datapoint objects; and

dataset objects comprise one or more component objects and one or more datapoint objects.

40. The data structure of claim 35, wherein dataset objects contains datapoints belonging to one or more component objects.