Method and apparatus for providing notification of network alarms using a plurality of distributed layers

• US 7,962,589 B1
• Filed: 11/07/2002
• Issued: 06/14/2011
• Est. Priority Date: 11/07/2002
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Kirti, Rituraj, Parello, John
• Primary Examiner(s): Bates; Kevin
• Assistant Examiner(s): Fritz; Bradford F
• Application Number:
  US10/291,118
• Time in Patent Office: 3,141 Days
• Field of Search: 709/224, 709/223
• US Class Current: 709/223
• CPC Class Codes: H04L 41/0233 Object-oriented techniques, for representation of network management data, e.g. common object request broker architecture [CORBA]
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence

Abstract

A method is disclosed for providing notification of network alarms using a plurality of distributed layers. A message is received that indicates an event occurred at a primary entity. The event is bound to a managed object, which represents the primary entity, to create a bound event. An overall condition is determined for the primary entity, based at least in part on the bound event, to create one or more condition notifications. The impact of a particular condition notification on one or more entities, which are related to the primary entity, is analyzed to create one or more impact notifications. One or more first alarms, which indicate the one or more related entities are impacted by a particular impact notification, are created. One or more second alarms are created based on the one or more first alarms.

Claims

1. A method of providing notification of network alarms using a plurality of distributed layers, the method comprising the computer-implemented steps of:

receiving a message that indicates an event occurred at a primary entity in a network;

in an event binding layer that is hosted in a first process, binding the event to a managed object of an inventory, wherein the managed object represents the primary entity, to create a bound event;

in a condition determination layer that is hosted in a second process different than the first process, determining a condition of the primary entity based on the bound event to create one or more condition notifications;

in an impact analysis layer that is hosted in a third process different than the first and second processes, analyzing the impact of a particular condition notification on one or more entities that are related to the primary entity to create one or more impact notifications;

wherein the one or more entities that are related to the primary entity include one or more child entities of the primary entity;

wherein each of the one or more impact notifications comprises information that notifies an event impact subscriber of an impact of the event on the related entities;

applying the one or more impact notifications to change state of one or more other managed objects in the inventory that represent the related entities;

in a notification layer that is hosted in a fourth process different than the first, second and third processes, creating one or more first alarms that indicate the one or more related entities are impacted by a particular impact notification; and

in a heuristics layer that is hosted in a fifth process different than the first second, third and fourth processes, receiving two or more first alarms created at the notification layer and creating, based on rules for determining that alarms resulting from events are related, one or more annotated alarms comprising an indication that at least one of the two or more first alarms is related to at least one other of the two or more first alarms;

wherein the method is implemented by one or more computing devices.

2. A method as recited in claim 1, the method further comprising creating a canonical version of the event from the message.

3. A method as recited in claim 1, wherein the step of binding further comprises the step of binding the event to the managed object based on a unique identifier of the managed object.

4. The method as recited in claim 1, wherein one or more finite state machines are associated with the primary entity, and wherein the step of determining the condition of the primary entity is based at least in part on the one or more finite state machines.

5. A method as recited in claim 1, wherein a particular entity of the one or more related entities is a child entity related to the primary entity, and wherein the step of analyzing the impact further comprises analyzing an impact of the particular condition notification on the child entity.

6. A method as recited in claim 1, wherein a particular entity of the one or more related entities is a dependent entity of the primary entity, and wherein the step of analyzing the impact further comprises analyzing an impact of the particular condition notification on the dependent entity.

7. A method as recited in claim 1, further comprising the step of determining an emitted state based at least in part on the condition of the one or more related entities.

8. A method as recited in claim 1, wherein a particular first alarm of the one or more first alarms is related to a previous first alarm, and wherein the step of creating the one or more first alarms further comprises creating an updated alarm based on the previous first alarm.

9. A method as recited in claim 1,

wherein the primary entity is a first router in a packet-switched network;

and

wherein the one or more entities include network links, other routers or switches that are related to the first router.

10. A method as recited in claim 3, wherein the step of binding further comprises the step of comparing received bindings with bindings that are associated with the managed object to determine the unique identifier of the managed object.

11. The method as recited in claim 4, wherein a particular finite state machine of the one or more finite state machines comprises one or more states that represent observable criteria associated with the primary entity, and wherein the step of determining the condition of the primary entity is based at least in part on a current state of the particular finite state machine.

12. A method as recited in claim 4, wherein a particular finite state machine of the one or more finite state machines is associated with an observable indicator of the primary entity, and wherein the step of determining the condition of the primary entity is based at least in part on a current state of the particular finite state machine.

13. A method as recited in claim 9, wherein a particular entity of the one or more related network links, other routers or switches is a dependent entity of the router, and wherein the step of analyzing the impact further comprises analyzing an impact of the particular condition notification on the dependent entity.

14. A method as recited in claim 9, further comprising the step of determining an emitted state based at least in part on the condition of the one or more related network links, other routers or switches.

15. One or more non-transitory computer-readable media comprising one or more stored sequences of instructions which, when executed by one or more processors, cause the one or more processors to perform the steps of:

receiving a message that indicates an event occurred at a primary entity in a network;

in an event binding layer that is hosted in a first process, binding the event to a managed object of an inventory, wherein the managed object represents the primary entity, to create a bound event;

in a condition determination layer that is hosted in a second process different than the first process, determining a condition of the primary entity based on the bound event to create one or more condition notifications;

in an impact analysis layer that is hosted in a third process different than the first and second processes, analyzing the impact of a particular condition notification on one or more entities that are related to the primary entity to create one or more impact notifications;

wherein the one or more entities that are related to the primary entity include one or more child entities of the primary entity;

wherein each of the one or more impact notifications comprises information that notifies an event impact subscriber of an impact of the event on the related entities;

applying the one or more impact notifications to change state of one or more other managed objects in the inventory that represent the related entities;

in a notification layer that is hosted in a fourth process different than the first, second and third processes, creating one or more first alarms that indicate the one or more related entities are impacted by a particular impact notification; and

in a heuristics layer that is hosted in a fifth process different than the first second, third and fourth processes, receiving two or more first alarms created at the notification layer and creating, based on rules for determining that alarms resulting from events are related, one or more annotated alarms comprising an indication that at least one of the two or more first alarms is related to at least one other of the two or more first alarms.

16. One or more non-transitory computer-readable media as recited in claim 15, wherein the one or more stored sequences of instructions, when executed by the one or more processors, further cause the one or more processors to perform creating a canonical version of the event from the message.

17. One or more non-transitory computer-readable media as recited in claim 15, wherein the one or more stored sequences of instructions, when executed by the one or more processors, cause the one or more processors to perform binding the event to the managed object based on a unique identifier of the managed object.

18. One or more non-transitory computer-readable media as recited in claim 15, wherein one or more finite state machines are associated with the primary entity, and wherein the one or more stored sequences of instructions, when executed by the one or more processors, cause the one or more processors to perform determining the condition of the primary entity based at least in part on the one or more finite state machines.

19. One or more non-transitory computer-readable media as recited in claim 15, wherein a particular entity of the one or more related entities is a child entity related to the primary entity, and wherein the one or more stored sequences of instructions, when executed by the one or more processors, cause the one or more processors to perform analyzing the impact by analyzing an impact of the particular condition notification on the child entity.

20. One or more non-transitory computer-readable media as recited in claim 15, wherein a particular entity of the one or more related entities is a dependent entity of the primary entity, and wherein the one or more stored sequences of instructions, when executed by the one or more processors, cause the one or more processors to perform, analyzing the impact by analyzing an impact of the particular condition notification on the dependent entity.

21. One or more non-transitory computer-readable media as recited in claim 15, wherein the one or more stored sequences of instructions, when executed by the one or more processors, further cause the one or more processors to perform determining an emitted state based at least in part on the condition of the one or more related entities.

22. One or more non-transitory computer-readable media as recited in claim 15, wherein a particular first alarm of the one or more first alarms is related to a previous first alarm, and wherein the one or more stored sequences of instructions, when executed by the one or more processors, cause the one or more processors to perform creating the one or more first alarms by creating an updated alarm based on the previous first alarm.

23. One or more non-transitory computer-readable media as recited in claim 17, wherein the one or more stored sequences of instructions, when executed by the one or more processors, cause the one or more processors to perform binding the event to the managed object by comparing received bindings with bindings that are associated with the managed object to determine the unique identifier of the managed object.

24. One or more non-transitory computer-readable media as recited in claim 18, wherein a particular finite state machine of the one or more finite state machines comprises one or more states that represent observable criteria associated with the primary entity, and wherein the one or more stored sequences of instructions, when executed by the one or more processors, cause the one or more processors to perform determining the condition of the primary entity based at least in part on a current state of the particular finite state machine.

25. One or more non-transitory computer-readable media as recited in claim 18, wherein a particular finite state machine of the one or more finite state machines is associated with an observable indicator of the primary entity, and wherein the one or more stored sequences of instructions, when executed by the one or more processors, cause the one or more processors to perform determining the condition of the primary entity based at least in part on a current state of the particular finite state machine.

26. An apparatus for providing notification of network alarms using a plurality of distributed layers, comprising:

one or more computing devices configured with a transport layer, an event binding layer, a condition determination layer, an impact analysis layer, a notification layer, and a heuristics layer;

the transport layer configured to receive a message that indicates an event occurred at a primary entity in a network;

the event binding layer, hosted in a first process, configured to bind the event to a managed object of an inventory, wherein the managed object represents the primary entity, to create a bound event;

the condition determination layer, hosted in a second process different than the first process, configured to determine a condition of the primary entity based on the bound event to create one or more condition notifications;

the impact analysis layer, hosted in a third process different than the first and second processes, configured to analyze the impact of a particular condition notification on one or more entities that are related to the primary entity to create one or more impact notifications;

wherein the one or more entities that are related to the primary entity include one or more child entities of the primary entity;

wherein each of the one or more impact notifications comprises information that notifies an event impact subscriber of an impact of the event on the related entities;

the one or more computing devices configured to apply the one or more impact notifications to change state of one or more other managed objects in the inventory that represent the related entities;

the notification layer, hosted in a fourth process different than the first, second and third processes, configured to create one or more first alarms that indicate the one or more related entities are impacted by a particular impact notification; and

the heuristics layer, hosted in a fifth process different than the first second, third and fourth processes, configured to receive two or more first alarms created at the notification layer and create one or more annotated alarms comprising an indication that at least one of the two or more first alarms is related to at least one other of the two or more first alarms.

27. An apparatus as recited in claim 26, wherein the one or more computing devices are further configured with an event normalization layer to create a canonical version of the event from the message.

28. An apparatus as recited in claim 26, wherein the event binding layer is configured to bind the event to the managed object based on a unique identifier of the managed object.

29. An apparatus as recited in claim 26, wherein one or more finite state machines are associated with the primary entity, and wherein the condition determination layer is configured to determine the condition of the primary entity based at least in part on the one or more finite state machines.

30. An apparatus as recited in claim 26, wherein a particular entity of the one or more related entities is a child entity related to the primary entity, and wherein the impact analysis layer is further configured to analyze an impact of the particular condition notification on the child entity.

31. An apparatus as recited in claim 26, wherein a particular entity of the one or more related entities is a dependent entity of the primary entity, and wherein the impact analysis layer is further configured to analyze an impact of the particular condition notification on the dependent entity.

32. An apparatus as recited in claim 26, the one or more computing devices further configured to determine an emitted state based at least in part on the condition of the one or more related entities.

33. An apparatus as recited in claim 26, wherein a particular first alarm of the one or more first alarms is related to a previous first alarm, and wherein the notification layer is configured to create the one or more first alarms further by creating an updated alarm based on the previous first alarm.

34. An apparatus as recited in claim 28, wherein the event binding layer is configured to compare received bindings with bindings that are associated with the managed object to determine the unique identifier of the managed object.

35. An apparatus as recited in claim 29, wherein a particular finite state machine of the one or more finite state machines comprises one or more states that represent observable criteria associated with the primary entity, and wherein the condition determination layer is configured to determine the condition of the primary entity based at least in part on a current state of the particular finite state machine.

36. An apparatus as recited in claim 29, wherein a particular finite state machine of the one or more finite state machines is associated with an observable indicator of the primary entity, and wherein the condition determination layer is configured to determine the condition of the primary entity is based at least in part on a current state of the particular finite state machine.