Method and apparatus for providing notification of network alarms using a plurality of distributed layers

• US 8,732,259 B2
• Filed: 05/02/2011
• Issued: 05/20/2014
• Est. Priority Date: 11/07/2002
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Parello, John, Kirti, Rituraj
• Primary Examiner(s): MACILWINEN, JOHN MOORE JAIN
• Application Number:
  US13/098,660
• Publication Number:
  US 20110208826A1
• Time in Patent Office: 1,114 Days
• Field of Search: 709/207, 709/223
• US Class Current: 709/207
• CPC Class Codes: H04L 41/0233 Object-oriented techniques, for representation of network management data, e.g. common object request broker architecture [CORBA]
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence

Abstract

A method is disclosed for providing notification of network alarms using a plurality of distributed layers. A message is received that indicates an event occurred at a primary entity. The event is bound to a managed object, which represents the primary entity, to create a bound event. An overall condition is determined for the primary entity, based at least in part on the bound event, to create one or more condition notifications. The impact of a particular condition notification on one or more entities, which are related to the primary entity, is analyzed to create one or more impact notifications. One or more first alarms, which indicate the one or more related entities are impacted by a particular impact notification, are created. One or more second alarms are created based on the one or more first alarms.

Claims

1. A method comprising:

one or more computing devices receiving a message that indicates a first event occurred at a primary entity in a network;

the one or more computing devices determining that one or more entities related to the primary entity are impacted by the first event;

in a notification layer that is hosted in a first process, the one or more computing devices automatically creating and publishing one or more first alarms that indicate the one or more entities are impacted by the first event and one or more second alarms that indicate one or more other entities are impacted by a second event that subsequently occurred at the primary entity;

in a heuristics layer that is hosted in a second process different than the first process and that is subscribed to the notification layer, the one or more computing devices receiving, from the notification layer, the one or more first alarms and the one or more second alarms that were created at the notification layer, and automatically creating, based on stored rules for determining that alarms resulting from events are related, one or more annotated alarms comprising a relationship between the one or more first alarms and the one or more second alarms; and

publishing, by the heuristics layer, the one or more annotated alarms in addition to the one or more first alarms and the one or more second alarms that were previously published.

2. A method as recited in claim 1, wherein a particular first alarm of the one or more first alarms is related to a previous first alarm, and further comprising creating an updated alarm based on the previous first alarm.

3. A method as recited in claim 1, wherein a particular entity of the one or more related entities comprise a dependent entity related to the primary entity;

further comprising determining that the one or more entities are impacted by the first event by analyzing an impact that a change in a condition of the primary entity has on the dependent entity.

4. A method as recited in claim 1,

wherein the primary entity is a first router in a packet-switched network;

wherein the one or more related entities include network links, other routers or switches that are related to the first router.

5. A method as recited in claim 1, further comprising:

in an event binding layer that is hosted in a third process different than the first process and the second process, binding the first event to a managed object of an inventory, wherein the managed object represents the primary entity, to create a bound event;

in a condition determination layer that is hosted in a fourth process different than the first process, the second process, and the third process, determining a condition of the primary entity based on the bound event to create one or more condition notifications;

in an impact analysis layer that is hosted in a fifth process different than the first process, the second process, the third process, and the fourth process, analyzing the impact of a particular condition notification on the one or more entities that are related to the primary entity to create one or more impact notifications.

6. A method as recited in claim 5, wherein each of the one or more impact notifications comprises information that notifies an event impact subscriber of an impact of the first event on the one or more entities;

further comprising applying the one or more impact notifications to change state of one or more other managed objects in the inventory that represent the one or more entities.

7. A method as recited in claim 1, further comprising determining a condition of the primary entity based at least in part on a current state of one or more finite state machines, wherein the one or more finite state machines comprise one or more states that represent observable criteria associated with the primary entity.

8. One or more non-transitory computer-readable media comprising one or more stored sequences of instructions which when executed by one or more processors, cause the one or more processors to perform:

receiving a message that indicates a first event occurred at a primary entity in a network;

determining that one or more entities related to the primary entity are impacted by the first event;

in a notification layer that is hosted in a first process, automatically creating and publishing one or more first alarms that indicate the one or more entities are impacted by the first event and one or more second alarms that indicate one or more other entities are impacted by a second event that subsequently occurred at the primary entity;

in a heuristics layer that is hosted in a second process different than the first process and that is subscribed to the notification layer, receiving, from the notification layer, the one or more first alarms and the one or more second alarms that were created at the notification layer and automatically creating, based on stored rules for determining that alarms resulting from events are related, one or more annotated alarms comprising a relationship between the one or more first alarms and the one or more second alarms; and

publishing, by the heuristics layer, the one or more annotated alarms in addition to the one or more first alarms and the one or more second alarms that were previously published.

9. The computer-readable media as recited in claim 8, wherein a particular first alarm of the one or more first alarms is related to a previous first alarm, and wherein the one or more stored sequences of instructions that, when executed by the one or more processors, cause the one or more processors to perform creating the one or more first alarms include instructions that cause the one or more processors to perform creating an updated alarm based on the previous first alarm.

10. The computer-readable media as recited in claim 8, wherein a particular entity of the one or more related entities comprise a dependent entity related to the primary entity, and wherein the one or more stored sequences of instructions that, when executed by the one or more processors, cause the one or more processors to perform determining that the one or more entities are impacted by the first event include instructions that cause the one or more processors to perform analyzing an impact that a change in a condition of the primary entity has on the dependent entity.

11. The computer-readable media as recited in claim 8,

wherein the primary entity is a first router in a packet-switched network;

wherein the one or more related entities include network links, other routers or switches that are related to the first router.

12. The computer-readable media as recited in claim 8, wherein the one or more stored sequences of instructions that, when executed by the one or more processors, cause the one or more processors to perform determining that the one or more entities are impacted by the first event include instructions that cause the one or more processors to perform:

in an event binding layer that is hosted in a third process different than the first process and the second process, binding the first event to a managed object of an inventory, wherein the managed object represents the primary entity, to create a bound event;

in a condition determination layer that is hosted in a fourth process different than the first process, the second process, and the third process, determining a condition of the primary entity based on the bound event to create one or more condition notifications;

in an impact analysis layer that is hosted in a fifth process different than the first process, the second process, the third process, and the fourth process, analyzing the impact of a particular condition notification on the one or more entities that are related to the primary entity to create one or more impact notifications.

13. The computer-readable media as recited in claim 12, wherein each of the one or more impact notifications comprises information that notifies an event impact subscriber of an impact of the first event on the one or more entities, wherein the one or more stored sequences of instructions, when executed by the one or more processors, further cause the one or more processors to perform applying the one or more impact notifications to change state of one or more other managed objects in the inventory that represent the one or more entities.

14. The computer-readable media as recited in claim 8, wherein the one or more stored sequences of instructions, when executed by the one or more processors, further cause the one or more processors to perform determining a condition of the primary entity based at least in part on a current state of one or more finite state machines, wherein the one or more finite state machines comprise one or more states that represent observable criteria associated with the primary entity.

15. An apparatus comprising:

one or more computing devices configured to receive a message that indicates a first event occurred at a primary entity in a network; and

determine that one or more entities related to the primary entity are impacted by the first event;

the one or more computing devices configured with a notification layer hosted in a first process and a heuristics layer hosted in a second process different than the first process, wherein the heuristics layer is subscribed to the notification layer;

the notification layer configured to automatically create and publish one or more first alarms that indicate the one or more entities are impacted by the first event and one or more second alarms that indicate one or more other entities are impacted by a second event that subsequently occurred at the primary entity;

the heuristics layer configured to receive, from the notification layer, the one or more first alarms and the one or more second alarms that were created at the notification layer and automatically create, based on stored rules for determining that alarms resulting from events are related, one or more annotated alarms comprising a relationship between the one or more first alarms and the one or more second alarms; and

the heuristics layer configured to publish the one or more annotated alarms in addition to the one or more first alarms and the one or more second alarms that were previously published.

16. An apparatus as recited in claim 15, wherein a particular first alarm of the one or more first alarms is related to a previous first alarm, and wherein the notification layer is configured to create the one or more first alarms at least in part by creating an updated alarm based on the previous first alarm.

17. An apparatus as recited in claim 15, wherein a particular entity of the one or more related entities comprise a dependent entity related to the primary entity, and wherein the one or more computing devices are configured to determine that the one or more entities are impacted by the first event at least in part by analyzing an impact that a change in a condition of the primary entity has on the dependent entity.

18. An apparatus as recited in claim 15,

wherein the primary entity is a first router in a packet-switched network;

wherein the one or more related entities include network links, other routers or switches that are related to the first router.

19. An apparatus as recited in claim 15, wherein the one or more computing devices comprise an event binding layer hosted in a third process different than the first process and the second process, a condition determination layer hosted in a fourth process different than the first process, the second process, and the third process, and an impact analysis layer hosted in a fifth process different than the first process, the second process, the third process, and the fourth process;

wherein the event binding layer, the condition determination layer, and the impact analysis layer are collectively configured determine that the one or more entities are impacted by the first event;

the event binding layer configured to bind the first event to a managed object of an inventory, wherein the managed object represents the primary entity, to create a bound event;

the condition determination layer configured to determine a condition of the primary entity based on the bound event to create one or more condition notifications;

the impact analysis layer configured to analyze the impact of a particular condition notification on the one or more entities that are related to the primary entity to create one or more impact notifications.

20. An apparatus as recited in claim 19, wherein each of the one or more impact notifications comprises information that notifies an event impact subscriber of an impact of the first event on the one or more entities, the one or more computing devices further configured to apply the one or more impact notifications to change state of one or more other managed objects in the inventory that represent the one or more entities.

21. An apparatus as recited in claim 15, the one or more computing devices configured to determine a condition of the primary entity based at least in part on a current state of one or more finite state machines, wherein the one or more finite state machines comprise one or more states that represent observable criteria associated with the primary entity.