System and method facilitating network diagnostics and self-healing

• US 7,313,613 B1
• Filed: 01/03/2002
• Issued: 12/25/2007
• Est. Priority Date: 01/03/2002
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Harding, Dennis H., McNelis, James J., Brooking, Arthur W., Zitek, William O.
• Primary Examiner(s): Jaroenchonwanit, Bunjob
• Assistant Examiner(s): TRUONG, LAN DAI T
• Application Number:
  US10/038,246
• Time in Patent Office: 2,182 Days
• Field of Search: 709/224, 709/220, 709/223
• US Class Current: 709/223
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A system and method facilitating network diagnostics and self-healing is provided. The invention includes a data stream monitor component adapted to selectively copy protocol specific subset(s) of raw network data and provide the subset(s) of data to a diagnostics engine. The invention further includes a diagnostic engine adapted to facilitate network diagnostics and/or self-healing.

The invention further provides for protocol state compressor(s) to analyze the protocol specific subset(s) of data to abstract and/or analyze relevant information about the specific protocol without having to strictly process the protocol or preserve protocol state variable(s) in order to analyze the state of the specific protocol. Based upon this analysis, the protocol state compressor(s) can generate event(s) for undesirable state(s) (e.g., error(s) and/or failure(s)) and/or congested state(s) for use by the event correlator/inference engine. Additionally, the protocol state compressor(s) can provide information to the event correlator/inference engine regarding the state of the specific protocol (e.g., success(es)).

Claims

1. A protocol diagnostic system, comprising:

a data stream monitor component that accesses raw network data and copies at least one protocol specific subset of the raw network data;

a diagnostics engine comprising at least one protocol state compressor that analyzes the at least one protocol specific subset of the raw network data, the protocol specific subset of raw network data being correlated with the protocol state compressor, the diagnostics engine determines condition of network connectivity, and the data stream monitor component utilizes at least one lexical rule set associated with the at least one protocol state compressor to determine subsets of the raw network data to copy, that at least one lexical rule set stores at least one of information regarding structure of subsets of the raw network data and protocol specific information, and

where the diagnostic engine, upon initialization, stores information associated with protocols to be monitored in that at least one lexical rule set, upon occurrence of a network connectivity problem, stores information associated with additional protocols, and upon correction of the network problem, deletes information associated with selected protocols from the at least one lexical rule set; and

an event correlator that receives results of analysis of the protocol state compressor, the event correlator correlates the results to detect a system problem.

2. The protocol diagnostic system of claim 1, the diagnostics engine further comprising at least one lexical rule set.

3. A method that facilitates network diagnostics, comprising:

accessing raw real-time network data and copying at least one subset of the raw real-time network data by a data stream monitor component;

selectively providing copied subset of the raw real-time network data to the protocol state compressors comprised in a diagnostics engine based at least in part upon lexical rule sets corresponding to the protocol state compressors, the lexical rule sets store at least one of information regarding structure of subsets of the raw real-time network data and protocol specific information;

storing and deleting information associated with protocols to be monitored in the lexical rules sets, where upon occurrence of a network connectivity problem, information associated with addition protocols is stored, and upon correction of the network problem, the information associated with the additional protocols is deleted from the lexical rule sets;

using the protocol state compressors to analyze the respective subset of the raw real-time network data;

diagnosing health status of a system based at least in part upon the analysis of the at least one of the protocol state compressors.

4. The method of claim 3, further comprising at least one of the following acts:

diagnosing a network connectivity problem based at least in part upon the analysis of at least one of the protocol state compressors; and

initiating corrective action associated with the network connectivity problem.

5. The method of claim 3, further comprising at least one of the following acts:

storing information associated with the health status of the system; and

providing information to a user regarding the health status of the system.

6. A computer network diagnostic system, comprising:

a data stream monitor or multiplex component that accesses real-time network data, selectively determines at least one subset of the real-time network data to multiplex based at least in part upon at least one lexical rule set;

the lexical rule sets store at least one of information regarding structure of subsets of the raw real-time network data and protocol specific information;

a data stream distribution engine that demultiplexes the multiplexed data based at least in part upon the at least one lexical rule set; and

a diagnostic engine having a plurality of protocol state compressors, the protocol state compressors being associated with the at least one lexical rule set, the protocol state compressors analyzing their respective subsets of demultiplexed data received from the data stream distribution engine, the diagnostic engine further including an event correlator or inference engine that receives results of the analysis of the plurality of protocol state compressors, the event correlator or inference engine correlates the results to detect a system problem; and

wherein the diagnostic engine, upon occurrence of a network connectivity problem, stores information associated with additional protocols, and upon correction of the network problem, selectively deleted information associated with the additional protocols from the at least one lexical rule set.

7. The protocol diagnostic system of claim 6, the event correlator/inference engine diagnoses a potential source of the system problem.

8. The protocol diagnostic system of claim 6, the diagnostics engine further comprising the at least one lexical rule set.

9. The protocol diagnostic system of claim 7, the event correlator/inference engine initiates corrective action related to the system problem.

10. The protocol diagnostic system of claim 7, the event correlator/inference engine utilizing at least one of a neural network and an expert system to facilitate diagnosis of the potential source of the system problem.

11. A method that facilitates network diagnostic, comprising:

accessing at least one lexical rule set coinciding with a protocol to be monitored and copying raw data frames coinciding with the at one least lexical rule set by a data stream monitor component;

wherein the lexical rule set stores at least one of information regarding structure of data frames and protocol specific information

multiplexing the copied raw data frames by the data stream monitor component;

demultiplexing the copied raw data frames based at least in part upon the at least one lexical rule set by a data stream distribution engine;

providing the copied raw data frames to a protocol state compressor comprised in a diagnostic engine;

using the protocol state compressor to analyze corresponding copied raw data frames utilizing at least in part the corresponding lexical rule set; and

storing and deleting information associated with protocols to be monitored in the at least one lexical rule set, where upon occurrence of the network connectivity problem, information associated with addition protocols is stored, and upon correction of the network problem, the information associate with addition protocols is deleted from the at least one lexical rule set;

receiving correlating information at an event correlator from the protocol compressor to facilitate diagnosis of health status of a system.

12. The method of claim 11, further comprising at least one of the following acts:

determining whether an additional protocol to be monitored has been added; and

adding a protocol state compressor and corresponding lexical rule set associated with the additional protocol.

13. The method of claim 11, further comprising at least one of the following acts:

initiating corrective action based at least in part upon the correlated information; and

providing information to a user regarding the health status of network connectivity.

14. The method of claim 11, further comprising at least one of the following acts:

storing historical information regarding the health status of network connectivity;

determining potential sources of a problem associated with network connectivity;

accessing historical information regarding the health status of network connectivity;

calculating a probability of utility of one or more corrective actions based at least in part upon the potential sources of the problem and accessed historical information; and

,

consecutively initiating one or more corrective actions based at least in part upon the probability of utility.

15. A diagnostic engine for a server of a computer system, comprising:

a plain language notification data information store storing plain language notification information associated with a plurality of potential server problem;

a data stream monitor component that accesses raw network data and copies at least one protocol specific subset of the raw network data;

a protocol specific event information data store storing information associated with a server health status;

a diagnostic engine comprising at least one protocol state compressor that analyzes the at least one protocol specific subset of the raw network data, the protocol specific subset of raw network data being correlated with the protocol state compressor, the diagnostics engine determines condition of network connectivity and the data stream monitor component utilizes at least one lexical rule set that stores information regarding structure of the at least one protocol specific subset of the raw network data and protocol specific information, where upon occurrence of a network connectivity problem, information associated with additional protocols is stored, and upon correction of the network problem, information associated with the additional protocols is deleted from the at least one lexical rule set; and

a self healing component that analyzes information stored in the protocol specific event information to determine at least one of appropriate corrective action and appropriate plain language notification, the plain language notification based at least in part upon information stored in the plain language notification data store.

16. A computer storage readable medium having computer usable components for protocol diagnostics engine, comprising:

a data stream monitor or multiplex component that access real-time network data, selectively determines at least one subset of the real-time network data to multiplex based at least in part upon the at least in part upon the at least one lexical rule set;

the lexical rule sets store at least one of information regarding structure of subsets of the raw real-time network data and protocol specific information;

a data stream distribution engine that demultiplexes the multiplexed data based at least in part upon the at least one lexical rule set; and

a diagnostics engine having at least one protocol state compressor, the protocol state compressor being associated with at least one lexical rule set, the protocol state compressor analyzing respective subsets of demultiplexed data received from the data stream distribution engine, where the diagnostic engine, upon initialization, stores information associated with protocols to be monitored in the at least one lexical rule set, the diagnostic engine, upon occurrence of a network connectivity problem, stores information associated with additional protocols, and upon correction of the network problem, deletes information associated with selected protocols from the at least one lexical rule set; and

An event correlator inference engine that receives results of the analysis of the protocol state compressor, the event correlator or inference engine correlates the results to detect a system problem.