System and method for baseline threshold monitoring

• US 7,672,814 B1
• Filed: 06/13/2005
• Issued: 03/02/2010
• Est. Priority Date: 03/03/2004
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Tsarfati, Tom, Raanan, Gili
• Primary Examiner(s): Wachsman; Hal D
• Assistant Examiner(s): Suarez; Felix E
• Application Number:
  US11/152,821
• Time in Patent Office: 1,723 Days
• Field of Search: 702/71, 702/183, 702/185, 702/186, 702/188, 702/193, 702/198, 702/182, 702/189, 702/194, 370/252, 370/352, 703/2, 709/224
• US Class Current: 702/193
• CPC Class Codes: H04L 41/5058 Service discovery by the service manager
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/18 Protocol analysers

Abstract

The present invention provides a system for identifying exceptional behavior of a hardware or software component. According to one embodiment, the system comprises an operational metric calculator that is operative to sample a first behavior of an operational metric and a second behavior of the operational metric. The operational metric may be any metric that quantifies the operation of a hardware or software component, as well as combinations thereof. A baseline threshold calculator is operative to calculate a baseline threshold on the basis of the first sampled behavior of the operational metric. The baseline threshold is applied by a baseline threshold analyzer to the second operational metric to generate an alarm when the second sampled behavior of the operational metric deviates from the baseline threshold.

Claims

1. A system for identifying exceptional behavior of a hardware or software component, the system comprising:

an operational metric calculator operative to sample a first behavior of an operational metric and a second behavior of the operational metric, wherein the operational metric quantifies a behavior of a component;

wherein the sampling of the first behavior of the operational metric occurs during a time period within the time window;

a baseline threshold calculator operative to calculate a baseline threshold, based on the sampling for the time window, wherein the baseline threshold calculator smoothes the baseline threshold to remove noise and temporary peaks in the operational metric data, for the operational metric on the basis of the first sampled behavior of the operational metric; and

a baseline threshold analyzer operative to apply the baseline threshold for the operational metric to the second sampled behavior of the operational metric and generate an alarm when the second sampled behavior of the operational metric deviates from the baseline threshold.

2. The system of claim 1, wherein the baseline threshold calculator is further operative to generate a plurality of baseline thresholds for the operative metric in response to a plurality of samplings of the first behavior of the operative metric, wherein each baseline threshold of the plurality is associated with a different time window.

3. The system of claim 1, wherein a operational metric calculator samples behaviors of a plurality of operational metrics for a component in the system.

4. The system of claim 3, wherein the operational metric calculator samples behaviors of at least two of the operational metrics of the plurality at different granularities.

5. The system of claim 1, wherein the operational metric calculator samples behaviors of an operational metric for at least two different components.

6. The system of claim 1 wherein the sampling of the first behavior of the operational metric occurs during a time window, and is repeated for successive time periods such that first sampled behavior of the operational metric changes over time.

7. The system of claim 6 wherein the sampling of the first behavior of the operational metric occurs during a time period within the time window, and the sampling is extrapolated over the time window.

8. The system of claim 1 wherein the baseline threshold calculator tunes the sample of the first behavior of the operational metric to smooth the sample.

9. The system of claim 1 wherein the smoothing means are selected from the group consisting of moving average smoothing, exponential moving average smoothing, Holt-Winters exponential smoothing, Binomial smoothing, and Savitzky-Golay smoothing.

10. A computer executed method in which a computer system accesses instructions from a storage medium, for identifying exceptional behavior of a hardware or software component, the computer executes the instructions to perform operations for the method comprising:

sampling a first behavior of an operational metric of a hardware or software component, wherein the operational metric quantifies a behavior of a component;

wherein the sampling of the first behavior of the operational metric occurs during a time period within the time window;

calculating a baseline threshold, based on the sampling for the time window, wherein the baseline threshold calculator smoothes the baseline threshold to remove noise and temporary peaks in the operational metric data, for the operational metric on the basis of the first sampled behavior of the operational metric;

sampling a second behavior of the operational metric of the hardware or software component;

applying the baseline threshold of the operational metric to the second sampled behavior of the operational metric; and

generating an alarm when the second sampled behavior of the operational metric deviates from the baseline threshold.

11. The method of claim 10, wherein the baseline threshold calculator further generates a plurality of baseline thresholds for the operative metric in response to a plurality of samplings of the first behavior of the operative metric, wherein each baseline threshold of the plurality is associated with a different time window.

12. The method of claim 10, wherein a operational metric calculator samples behaviors of a plurality of operational metrics for a component in the system.

13. The method of claim 12, wherein the operational metric calculator samples behaviors of at least two of the operational metrics of the plurality at different granularities.

14. The method of claim 10, wherein the operational metric calculator samples behaviors of an operational metric for at least two different components.

15. The method of claim 10 wherein the sampling of the first behavior of the operational metric occurs during a time window, and is repeated for successive time periods such that first sampled behavior of the operational metric changes over time.

16. The method of claim 10 wherein the smoothing means are selected from the group consisting of moving average smoothing, exponential moving average smoothing, Holt-Winters exponential smoothing, Binomial smoothing, and Savitzky-Golay smoothing.