Apparatus and method for monitoring objects in a network and automatically validating events relating to the objects

• US 7,469,287 B1
• Filed: 11/17/2003
• Issued: 12/23/2008
• Est. Priority Date: 11/17/2003
• Status: Expired due to Fees

• Current Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Original Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Inventors: Bascle, Jeff P., Mahaffey, Paul D. Jr., Castillo, Luis A.
• Primary Examiner(s): Avellino; Joseph E
• Assistant Examiner(s): Keefer; Michael E
• Application Number:
  US10/715,233
• Time in Patent Office: 1,863 Days
• Field of Search: 714/49, 714/57, 709/224
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0663 Performing the actions predefined by failover planning, e.g. switching to standby network elements

Abstract

A method, apparatus, and program for monitoring an object of a system and validating the status of the object are provided. The invention can be implemented in numerous ways, including as a system (including a computer processing system), a method (including a computerized method), an apparatus, a computer readable medium, a computer program product, or a data structure tangibly fixed in a computer readable memory. Specifically, the invention provides methods and code devices for automated event processing to validate the status of an event of a monitored object in a network without manual operator intervention, including validation and remediation features based on event class.

Claims

1. A method of managing events in a network to reduce operator intervention when an event representative of a problem with an object in the network is detected, comprising:

receiving an event at reception engine representative of a problem with an object in the network;

reading the event details of the event to determine an event class for the event;

prior to dispatching the event by the reception engine, invoking one of a plurality automated triage processes based on the event class for the event, wherein each automated triage process is based on an event class and comprises a specific validation routine for determining valid and invalid events and a specific remediation routine for attempting to correct the problem without manual intervention, such that the same validation and remediation routines are called for every event within the same event class for consistent event processing;

said invoked automated triage process comprises;

(a) creating an event record to store results of the automated triage process;

(b) automatically invoking the specific validation routine for that event class which provides for detection and validation of the event and updates the event record with validation routine results;

(c) if the validation routine determines the event is invalid, dropping the event from the reception engine and ending the automated triage process;

otherwise, automatically invoking the specific remediation routine for that event class to attempt to correct the problem;

(d) re-invoking the validation routine for the event class which updates the event record with the validation routine results and, if the event is now invalid, dropping the event from the reception engine and ending the automated triage process;

(e) if the event is still valid, passing the event back to the reception engine along with at least two new environmental variables for the event comprising a validation code variable based on the validation routine results and a triage path variable comprising a path to the validation routine results of the automated triage for use in the event dispatch process; and

(f) ending the automated triage process.

2. The method of claim 1 wherein the validation routine tests the object and stores the validation result, updates a first environmental variable to designate a validation status, and updates a second environmental variable that contains a path to the validation result.

3. The method of claim 2 wherein step (b) further comprises invoking a default validation routine that stores a summary of the problem as a validation result and ends the automated triage process if no validation routine exists for the event class.

4. The method of claim 2, wherein the re-invoked validation routine re-tests the object and stores the validation result, and updates the first environmental variable to indicate the validation status.

5. The method of claim 2 wherein triage data comprises the first environmental variable indicating the validation status and the second environmental variable containing the path to the stored validation results.

6. The method of claim 5 wherein a network management program uses the triage data to create any required problem tickets or notifications for the event.

7. The method of claim 5 further comprising appending triage data to a problem ticket.

8. The method of claim 1 wherein the validation routine designates false positive events as invalid.

9. The method of claim 1 wherein the validation routine designates transient events as invalid.

10. The method of claim 1 wherein the validation routine designates predefined secondary events as invalid.

11. The method of claim 1 further comprising automatically dispatching a problem ticket at the end of the triage process only for valid events.

12. The method of claim 1 further comprising determining if the event is associated with an object in maintenance and, if in maintenance, ending the automated triage process.

13. The method of claim 1 wherein the validation routine designates as valid events those events that are not a transient system event, not a false positive event, or not a predefined secondary event.

14. The method of claim 1 wherein invoking the validation routine comprises dynamically loading a script dependent on the event class.

15. A system of managing events in a network to reduce operator intervention, when an event representative of a problem with an object in the network is received at a reception engine comprising:

a network communication channel;

at least one server having a reception engine connected to the network communication channel;

a notification means for forwarding an event of a monitored object to the reception engine;

an automated triage process for receiving an event at reception engine representative of a problem with an object in the network comprising;

reading the event details of the event to determine an event class for the event;

prior to dispatching the event by the reception engine, invoking one of a plurality automated triage processes based on the event class for the event, wherein each automated triage process is based on an event class and comprises a specific validation routine for determining valid and invalid events and a specific remediation routine for attempting to correct the problem without manual intervention, such that the same validation and remediation routines are called for every event within the same event class for consistent event processing;

said invoked automated triage process comprises;

(a) creating an event record to store results of the automated triage process;

(b) automatically invoking the specific validation routine for that event class which provides for detection and validation of the event and updates the event record with validation routine results;

(c) if the validation routine determines the event is invalid, dropping the event from the reception engine and ending the automated triage process;

otherwise, automatically invoking the specific remediation routine for that event class to attempt to correct the problem;

(d) re-invoking the validation routine for the event class which updates the event record with the validation routine results and, if the event is now invalid, dropping the event from the reception engine and ending the automated triage process;

(e) if the event is still valid, passing the event back to the reception engine along with at least two new environmental variables for the event comprising a validation code variable based on the validation routine results and a triage path variable comprising a path to the validation routine results of the automated triage for use in the event dispatch process; and

(f) ending the automated triage process.

16. A physical computer-readable storage medium for managing events in a network to reduce operator intervention when an event representative of a problem with an object in the network is received by a reception engine comprising computer-executable instructions embedded thereon for:

reading event details of an event received at a reception engine representative of a problem with an object in the network to determine an event class for the event;

prior to dispatching the event by the reception engine, invoking one of a plurality automated triage processes based on the event class for the event, wherein each automated triage process is based on an event class and comprises a specific validation routine for determining valid and invalid events and a specific remediation routine for attempting to correct the problem without manual intervention, such that the same validation and remediation routines are called for every event within the same event class for consistent event processing;

said invoked automated triage process comprises computer-executable instructions for;

(a) creating an event record to store results of the automated triage process;

(b) automatically invoking the specific validation routine for that event class which provides for detection and validation of the event and updates the event record with validation routine results;

(c) if the validation routine determines the event is invalid, dropping the event from the reception engine and ending the automated triage process;

otherwise, automatically invoking the specific remediation routine for that event class to attempt to correct the problem;

(d) re-invoking the validation routine for the event class which updates the event record with the validation routine results and, if the event is now invalid, dropping the event from the reception engine and ending the automated triage process;

(e) if the event is still valid, passing the event back to the reception engine along with at least two new environmental variables for the event comprising a validation code variable based on the validation routine results and a triage path variable comprising a path to the validation routine results of the automated triage for use in the event dispatch process; and

(f) ending the automated triage process.