METHOD AND APPARATUS FOR MONITORING A NETWORK ENVIRONMENT

• US 20010052087A1
• Filed: 04/27/1998
• Published: 12/13/2001
• Est. Priority Date: 04/27/1998
• Status: Active Grant

• Current Assignee: BMC Software Incorporated (KKR & Co., Inc.)
• Original Assignee: Proactive Networks Co.
• Inventors: GARG, ATUL R., DO, MINH ANH, KETCHAM, DAN
• Granted Patent: US 6,327,677 B1
• Time in Patent Office: Days
• US Class Current: 714/37
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 43/103 with adaptive polling, i.e. dynamically adapting the polling rate
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04W 24/00 Supervisory, monitoring or testing arrangements
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic

Abstract

A system is provided that monitors a network environment. The system collects recent data associated with operation of the network environment. The network environment is analyzed by comparing the collected data with historical data associated with the operation of the network environment. The system determines whether a problem or a potential problem exists based on the analysis of the network environment. The historical data associated with the operation of the network environment is represented in multiple cognitive signatures. The system regularly updates the historical data to include the recently collected data. The data collected may include network performance data, network configuration data, traffic flow data, network utilization data, or network error information. If the system generates an alarm if it determines that a problem exists. The generation of an alarm may include generating an electronic mail message or pager message and communicating the message to a network administrator. The generation of an alarm may also include activating an application on a device within the network environment. The monitoring system is able to monitor one or more network environments, as well as individual network devices and components or sub-systems within an individual network device.

Claims

1. A method of monitoring a network environment, the method comprising the steps of:

a. collecting recent data associated with operation of the network environment;

b. analyzing the network environment by comparing the data collected in step (a) with historical data associated with the operation of the network environment; and

c. determining whether a problem exists based on the analysis performed in step (b).

2. The method of

claim 1

wherein the step of determining whether a problem exists includes determining whether a potential problem exists based on the analysis performed in step (b).

3. The method of

claim 1

wherein the historical data is represented in a plurality of cognitive signatures.

4. The method of

claim 3

wherein the step of analyzing the network environment includes determining a signature correlation factor associated with a cognitive signature.

5. The method of

claim 1

wherein the historical data represents a summary of previous network performance.

6. The method of

claim 1

wherein the historical data represents network performance prior to the collection of recent data associated with the operation of the network.

7. The method of

claim 1

further including the step of updating the historical data to include the data collected in step (a).

8. The method of

claim 1

wherein the data collected in step (a) includes network performance data.

9. The method of

claim 1

wherein the data collected in step (a) includes network configuration data.

10. The method of

claim 1

wherein the data collected in step (a) includes recent traffic flow through the network.

11. The method of

claim 1

wherein the data collected in step (a) includes recent utilization of network resources.

12. The method of

claim 1

wherein the data collected in step (a) includes network error information.

13. The method of

claim 1

further including the step of generating an alarm if step (c) determines that a problem exists.

14. The method of

claim 13

wherein the step of generating an alarm includes generating an electronic mail message and sending the electronic mail message to a network administrator.

15. The method of

claim 13

wherein the step of generating an alarm includes generating a pager message and communicating the pager message to a network administrator'"'"'s pager.

16. The method of

claim 13

wherein the step of generating an alarm includes activating an application on a device within the network environment.

17. The method of

claim 1

wherein the step of analyzing the network environment includes correlating multiple related events into a single event.

18. A method of monitoring a network device, the method comprising the steps of:

a. collecting recent data associated with operation of the network device;

b. analyzing the network device by comparing the data collected in step (a) with historical data associated with the operation of the network device; and

c. determining whether a problem exists based on the analysis performed in step (b).

19. The method of

claim 18

wherein the step of determining whether a problem exists includes determining whether a potential problem exists based on the analysis performed in step (b).

20. The method of

claim 18

wherein the historical data is represented in a plurality of cognitive signatures.

21. The method of

claim 20

wherein the step of analyzing the network device includes determining a signature correlation factor associated with a cognitive signature.

22. The method of

claim 18

wherein the historical data represents network device performance prior to the collection of recent data associated with the operation of the network.

23. The method of

claim 18

further including the step of updating the historical data to include the data collected in step (a).

24. The method of

claim 18

wherein the data collected in step (a) includes recent utilization of the network device.

25. The method of

claim 18

wherein the data collected in step (a) includes the performance of a component within the network device.

26. The method of

claim 18

wherein the data collected in step (a) includes the performance of a sub-system within the network device.

27. The method of

claim 18

further including the step of generating an alarm if step (c) determines that a problem exists.

28. The method of

claim 27

wherein the step of generating an alarm includes generating an electronic mail message and sending the electronic mail message to a network administrator.

29. The method of

claim 27

wherein the step of generating an alarm includes generating a pager message and communicating the pager message to a network administrator'"'"'s pager.

30. The method of

claim 27

wherein the step of generating an alarm includes activating an application on the network device.

31. The method of

claim 18

wherein the step of analyzing the network device includes correlating multiple related events into a single event.

32. A network monitor comprising:

a data collection module configured to collect recent data associated with operation of a network environment; and

an analysis module coupled to the data collection module, wherein the analysis module is configured to compare the data collected by the data collection module with historical data associated with the operation of the network environment; and

wherein the analysis module is configured to determine whether a problem exists based on the comparison of the data collected by the data collection module with the historical data.

33. The network monitor of

claim 32

further including a cognitive signature module, wherein the cognitive signature module maintains the historical data in a plurality of cognitive signatures.

34. The network monitor of

claim 33

wherein the cognitive signature module updates the historical data to include the data collected by the data collection module.

35. The network monitor of

claim 32

wherein the historical data represents network performance prior to the collection of recent data associated with the operation of the network.

36. The network monitor of

claim 32

further including an alarm generator, wherein the alarm generator is configured to generate an alarm if the analysis module determines that a problem exists.

37. A network monitor comprising:

means for collecting recent data associated with operation of a network environment;

means for analyzing the network environment by comparing the data collected by the means for collecting recent data with historical data associated with the operation of the network environment; and

means for determining whether a problem exists based on the analysis performed by the means for analyzing the network environment.

38. The network monitor of

claim 37

further including means for maintaining the historical data in a plurality of cognitive signatures.

39. The network monitor of

claim 37

further including means for updating the historical data to include the data collected by the means for collecting recent data.

40. The network monitor of

claim 37

wherein the historical data represents network performance prior to the collection of recent data associated with the operation of the network.

41. The network monitor of

claim 37

further including means for generating an alarm if a problem exists.

42. A computer software product including a medium readable by a processor, the medium having stored thereon a sequence of instructions which, when executed by the processor, cause the processor to:

collect recent data associated with operation of a network environment;

analyze the network environment by comparing the recent data collected with historical data associated with the operation of the network environment; and

determine whether a problem exists based on the analysis of the network environment.

43. The computer software product of

claim 42

wherein the historical data is represented in a plurality of cognitive signatures.

44. The computer software product of

claim 42

wherein the historical data represents a summary of previous network performance.

45. The computer software product of

claim 42

further including a sequence of instructions which, when executed by the processor, cause the processor to update the historical data to include the recent data collected.

46. The computer software product of

claim 42

further including a sequence of instructions which, when executed by the processor, cause the processor to generate an alarm if a problem exists.