LiveException system

• US 7,490,145 B2
• Filed: 06/21/2001
• Issued: 02/10/2009
• Est. Priority Date: 06/21/2000
• Status: Active Grant

• Current Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Original Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Inventors: Iglesias, George, Lauer, Will C., Stabile, Lawrence A., Sylor, Mark W., Wolf, Jay B.
• Primary Examiner(s): Vaughn, Jr.; William C
• Assistant Examiner(s): Shingles; Kristie D
• Application Number:
  US09/886,611
• Publication Number:
  US 20020049838A1
• Time in Patent Office: 2,791 Days
• Field of Search: 709/224, 709/223, 714/812, 714/712, 713/200, 715/733
• US Class Current: 709/224
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/0829 Packet loss
• CPC Class Codes: H04L 43/0852 Delays
• CPC Class Codes: H04L 43/087 Jitter
• CPC Class Codes: H04L 43/0882 Utilisation of link capacity
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 43/16 Threshold monitoring

Abstract

A method of monitoring an element in a computer network including monitoring a preselected variable relating to that element; defining a threshold for the monitored preselected variable; establishing a sliding window in time; repeatedly generating a time above threshold value, the time above threshold value being a measure of an amount of time during which the monitored variable exceeded the threshold during the sliding window of time; detecting when the time above threshold value exceeds a condition window value; and in response to detecting when the time above threshold value exceeds the condition window, generating an alarm.

Claims

1. A computer-implemented method of monitoring an element in a computer network, said method comprising:

monitoring a preselected variable relating to said element;

defining a threshold for the monitored preselected variable, wherein defining the threshold for the monitored preselected variable comprises;

defining a first set of threshold eras such that the threshold eras of the first set of threshold eras are periodic at an era frequency and have a common era length;

defining a plurality of metric threshold periods that occur within each threshold era of the first set of threshold eras such that the metric threshold periods do not overlap each other and occur within the threshold eras of the first set of threshold eras at predetermined times within the threshold eras, the plurality of metric threshold periods including a first metric threshold period and a second metric threshold period;

computing an average value for the preselected variable within the first metric threshold period based on values obtained for the preselected variable within the first metric threshold period during previous threshold eras in the first set of threshold eras;

computing an average value for the preselected variable within the second metric threshold period based on values obtained for the preselected variable within the second metric threshold period during previous threshold eras in the first set of threshold eras;

determining a first threshold based on the average value for the preselected variable within the first metric threshold period; and

determining a second threshold based on the average value for the preselected variable for the second metric threshold period;

establishing a sliding window in time that is shorter than the common era length;

determining if the preselected variable is currently breaching the threshold during a threshold era included in the first set of threshold eras, wherein determining if the preselected variable is currently breaching the threshold during a threshold era included in the first set of threshold eras comprises;

determining if the preselected variable is breaching the first threshold during a first metric threshold period of the current era included in the first set of threshold eras; and

determining if the preselected variable is breaching the second threshold during a second metric threshold period of the current threshold era included in the first set of threshold eras;

repeatedly generating a time above threshold value, said time above threshold value being a measure of an amount of time during which the preselected variable exceeded the threshold during the sliding window of time;

detecting when the time above threshold value exceeds a predefined condition window value; and

in response to detecting when the time above threshold value exceeds said condition window value, generating an alarm.

2. The method of claim 1 further comprising after generating an alarm, maintaining the alarm at least as long as the time above threshold value exceeds a clear window value.

3. The method of claim 2 wherein said clear window value is equal to said condition window value.

4. The method of claim 3 further comprising:

monitoring a plurality of variables relating to said element, said preselected variable being one of said plurality of variables; and

for each of the plurality of monitored variables, defining a corresponding threshold for that other variable, wherein the time above threshold value is a measure of an amount of time during which any one or more of the monitored variables exceeded its corresponding threshold during the corresponding sliding window of time.

5. The method of claim 1 wherein determining the first threshold comprises:

defining an excursion amount; and

setting the first threshold equal to a sum of the average value for the preselected variable within the first metric threshold period plus the excursion amount.

6. The method of claim 1 wherein the common era length is less than or equal to a day.

7. The method of claim 1 wherein defining a threshold for the monitored preselected variable further comprises:

defining a second set of threshold eras such that the threshold eras of the second set of threshold eras are periodic at the era frequency and have the common era length, but are offset in time from threshold eras of the first set of threshold eras such that the eras of the first set of threshold eras and the eras of the second set of threshold eras do not overlap;

defining a plurality of metric threshold periods that occur within each threshold era of the second set of threshold eras such that the metric threshold periods do not overlap each other and occur within the threshold eras of the second set of threshold eras at predetermined times within the threshold eras, the plurality of metric threshold periods that occur within each threshold era of the second set of threshold eras including a third metric threshold period and a fourth metric threshold period;

computing an average value for the preselected variable within the third metric threshold period based on values obtained for the preselected variable within the third metric threshold period during previous threshold eras in the second set of threshold eras;

computing an average value for the preselected variable within the fourth metric threshold period based on values obtained for the preselected variable within the fourth metric threshold period during previous threshold eras in the second set of threshold eras;

determining a third threshold based on the average value for the preselected variable within the third metric threshold period; and

determining a fourth threshold based on the average value for the preselected variable for the fourth metric threshold period.

8. The method of claim 7 wherein the common era length is a day and the era frequency is once per week such that the first set of threshold eras includes days that fall on a first day of the week, and the second set of threshold eras includes days that fall on a second day of the week.

9. The method of claim 5 wherein the step of defining an excursion amount comprises:

computing a standard deviation for the preselected variable based on values obtained for the preselected variable; and

setting the excursion amount equal to K times the computed standard deviation, wherein K is a positive number.

10. The method of claim 8 wherein computing an average value for the preselected variable within the first metric threshold period based on values obtained for that preselected variable within the first metric threshold period during previous threshold eras in the first set of threshold eras comprises computing an average value for values of the preselected variable corresponding to the same hour period of the same day of the week for a predetermined number of previous weeks.

11. The method of claim 1 wherein the measure of the amount of time during which the monitored variable exceeded the threshold during the sliding window in time includes an aggregation of two or more noncontiguous time intervals during which the preselected variable exceeded the threshold during the sliding window in time.

12. The method of claim 1 wherein the measure of the amount of time during which the monitored variable exceeded the threshold during the sliding window in time includes time during which the preselected variable exceeded the threshold in two or more metric threshold periods.

13. A non-volatile electronic storage medium that electronically stores a computer program configured to cause a computer system to perform the functions of:

monitoring a preselected variable relating to said element;

defining a threshold for the monitored preselected variable, wherein defining the threshold for the monitored preselected variable comprises;

defining a first set of threshold eras such that the threshold eras of the first set of threshold eras are periodic at an era frequency and have a common era length;

defining a plurality of metric threshold periods that occur within each threshold era of the first set of threshold eras such that the metric threshold periods do not overlap each other and occur within the threshold eras of the first set of threshold eras at predetermined times within the threshold eras, the plurality of metric threshold periods including a first metric threshold period and a second metric threshold period;

computing an average value for the preselected variable within the first metric threshold period based on values obtained for the preselected variable within the first metric threshold period during previous threshold eras in the first set of threshold eras;

computing an average value for the preselected variable within the second metric threshold period based on values obtained for the preselected variable within the second metric threshold period during previous threshold eras in the first set of threshold eras;

determining a first threshold based on the average value for the preselected variable within the first metric threshold period; and

determining a second threshold based on the average value for the preselected variable for the second metric threshold period;

establishing a sliding window in time that is shorter than the common era length;

determining if the preselected variable is currently breaching the threshold during a threshold era included in the first set of threshold eras, wherein determining if the preselected variable is currently breaching the threshold during a threshold era included in the first set of threshold eras comprises;

determining if the preselected variable is breaching the first threshold during a first metric threshold period of the current era included in the first set of threshold eras; and

determining if the preselected variable is breaching the second threshold during a second metric threshold period of the current threshold era included in the first set of threshold eras;

repeatedly generating a time above threshold value, said time above threshold value being a measure of an amount of time during which the preselected variable exceeded the threshold during the sliding window of time;

detecting when the time above threshold value exceeds a predefined condition window value; and

in response to detecting when the time above threshold value exceeds said condition window value, generating an alarm.