Method and system for processing directives included in management events

• US 8,180,883 B1
• Filed: 08/02/2004
• Issued: 05/15/2012
• Est. Priority Date: 08/02/2004
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Clemm, Ludwig Alexander, Dini, Cosmin, Dini, Petre, Popescu, Manuela
• Primary Examiner(s): Lazaro, David
• Assistant Examiner(s): Ashraf, Waseem
• Application Number:
  US10/910,459
• Time in Patent Office: 2,843 Days
• Field of Search: 709/224, 709/223, 718/1, 718/100
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0609 based on severity or priority
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis

Abstract

A method and system for processing directives included in management events are disclosed. A method for handling management events includes detecting an event generated upon an occurrence relating to a device, such as a network device. The device related occurrence has a characteristic. A directive, appropriate to this characteristic, is included with the event format. The event is directed to a management entity, which interprets the directive and handles the event by processing it according to the directive. Such preprocessing directives included in the events allow recipients of the events to decide what to do with them, e.g., with the messages therein, and thus help prevent inadvertent loss of information conveyed in these events.

Claims

1. A system comprising:

a network managing device to receive one or more event messages from at least one network device, wherein each event message includes a directive having embedded instructions to indicate a type of processing to be performed on the event messages and to direct the network managing device to process the event messages with the type of processing indicated in the directive, wherein the directive and corresponding embedded instructions are defined by the at least one network device based on an importance level associated with each event message relative to other event messages capable of being received by the network managing device, and wherein, when at least one of the directives indicates the corresponding event message includes critical information regarding the operation of the network device, the directive and corresponding embedded instructions are configured to direct the network managing device to expedite handling of the at least one event message by sending one or more control messages that reroute traffic through a network away from the network device corresponding to the critical information in the event message and configured to store a full version of the at least one event message for a predetermined time.

2. The system as recited in claim 1, wherein the event message further comprises a System Log event message.

3. The system as recited in claim 1, wherein the at least one network managing device comprises:

a directive interpreter configured to read the directive and apply a policy for processing the corresponding event message, wherein the policy comprises an action corresponding to a characteristic of the event, and wherein the directive interpreter is configured to execute an automatic cancellation of processing relating to the event message; and

an application, wherein the directive interpreter is configured to direct the policy to the application, and wherein the application is configured to process the event message according to the policy.

4. The system as recited in claim 3, wherein the directive interpreter is configured to generate the policy, wherein the policy is based at least in part on business objectives of the at least one network management entity.

5. The system as recited in claim 1, wherein the event message further comprises a header field and a body portion.

6. The system as recited in claim 5, wherein the header field includes a plurality of subfields, wherein the plurality of subfields comprises:

one or more Boolean subfields, one or more string subfields, or combinations thereof.

7. The system as recited in claim 1, wherein the event message further comprises information relating to a classification of the event according to type, event criticality, direction of the event message to a specific network management entity, or combinations thereof, and wherein the event message is processed through an application of a policy to the event message according to the information.

10. The system as recited in claim 7, wherein the policy applied by the specific network management entity is configured to produce alarms related to event messages, store event messages to storage media, pass-through event messages to another network management entity, fast-track event messages, aggregate event message information, hold event messages in buffer for a predetermined time, abstract event message information, filter event message information, cancel event messages, or combinations thereof.

11. The system as recited in claim 5, wherein the directive is located in a tag of the body portion, and wherein the at least one network managing entity is further configured to parse the tag from the body portion of the event message.

12. The system as recited in claim 7, wherein the information relating to the classification is located in a header field of the event message.

13. The system as recited in claim 7, wherein the information relating to the classification is located in a body portion of the event message.

8. A system comprising:

a network device to generate an event message in response to an occurrence of an event relating to the network device, wherein the event message includes a directive having embedded instructions to explicitly indicate a type of processing to be performed on the event message and to direct a network managing device to process the event message with the type of processing indicated in the directive, wherein the network device is configured to define the directive and corresponding embedded instructions based on an importance level associated with the event message relative to other event messages capable of being received by the network managing device, and wherein, when at least one of the directives indicates the corresponding event message includes critical information regarding the operation of the network device, the directive and corresponding embedded instructions are configured to direct the network managing device to expedite handling of the event message, to reroute traffic through a network away from the network device corresponding to the critical information in the event message, and to store a full version of the event message for a predetermined time.

9. A computer-readable memory device storing instructions configured to cause at least one device to perform operations comprising:

detecting an event message, received from a network device, includes a directive for handling an event, wherein the directive includes instructions to indicate a type of processing to be performed on the event message, and wherein the directive and corresponding instructions are defined by the network device based on an importance level associated with the event message relative to other event messages capable of being received by a network managing device; and

processing the event message according to the type of processing indicated in the directive, when the directive indicates the event message includes critical information regarding the operation of the network device, the directive and corresponding instructions are configured to direct the network managing device to expedite handling of the event message, to reroute traffic through a network away from the network device corresponding to the critical information in the event message, and to store a full version of the event message for a predetermined time.

14. The computer-readable memory device recited in claim 9, wherein the instructions are configured to cause the at least one device to perform operations further comprising:

selecting a policy appropriate to the event; and

processing the event by applying the policy to the event.

15. A method comprising:

generating, with a network device, an event message in response to an occurrence of an event relating to the network device, wherein the event message includes a directive having embedded instructions to indicate a type of processing to be performed on the event message and to direct a network managing device to process the event message according to the type of processing indicated in the directive, wherein the network device is configured to define the directive and corresponding embedded instructions based on an importance level associated with the event message relative to other event messages capable of being received by the network managing device; and

sending, with the network device, the event message to the network management device for processing according to the directive, and wherein, when the directive indicates the event message includes critical information regarding the operation of the network device, the directive and corresponding embedded instructions are configured to direct the network managing device to expedite handling of the event message, to reroute traffic through a network away from the network device corresponding to the critical information in the event message, and to store a full version of the event message for a predetermined time.

16. The method as recited in claim 15, wherein the directive further comprises information relating to a classification of the event according to event criticality, direction of the event message to a specific network management entity, or combinations thereof, and wherein the event message is configured to be processed through an application of a policy to the event message according to the directive information.

17. A method comprising:

receiving, with a network managing device, an event message from a network device, wherein the event message relates to an event that occurred on the network device and includes a directive for resolving the event, wherein the directive includes embedded instructions to indicate a type of processing to be performed on the event message, wherein the directive and corresponding embedded instructions are defined by the network device and based on an importance level associated with event message relative to other event messages capable of being received by the network managing device; and

processing, with the network managing device, the event message as directed by the directive and according to the type of processing indicated in the directive, wherein, when the directive indicates the event message includes critical information regarding the operation of the network device, the directive and corresponding embedded instructions are configured to direct the network managing device to expedite handling of the event message by sending one or more control messages that reroute traffic through a network away from the network device corresponding to the critical information in the event message and configured to store a full version of the event message for a predetermined time.

18. The method recited in claim 17, further comprising:

reading the directive;

applying a policy for processing the event message, wherein the policy comprises an action corresponding to a characteristic of the event; and

forwarding the event message, along with the policy, to an application, wherein the application is configured to process the event according to the policy.

19. A network managing device comprising:

means for receiving an event message from a network device, wherein the event message relates to an event that occurred on the network device and includes a directive for resolving the event, wherein the directive includes embedded instructions to explicitly indicate a type of processing to be performed on the event message, wherein the directive and corresponding embedded instructions are defined by the network device and based on an importance level associated with event message relative to other event messages capable of being received by the network managing device; and

means for processing the event message as directed by the directive and according to the type of processing indicated in the directive, wherein, when the directive indicates the event message includes critical information regarding the operation of the network device, the directive and corresponding embedded instructions are configured to direct the network managing device to expedite handling of the event message by sending one or more control messages that reroute traffic through a network away from the network device corresponding to the critical information in the event message and configured to store a full version of the event message for a predetermined time.

20. The network managing device recited in claim 19, further comprising:

means for applying a policy to the event; and

means for displaying the event message on a monitor device.

21. The network managing device recited in claim 20, further comprising:

means for generating the policy for the event; and

means for storing the policy.