Homogeneous monitoring of heterogeneous nodes

• US 20040006614A1
• Filed: 07/03/2002
• Published: 01/08/2004
• Est. Priority Date: 07/03/2002
• Status: Active Grant

• Current Assignee: Tripwire Incorporated (Belden Inc.)
• Original Assignee: ORIX Growth Capital, LLC (ORIX Corporation)
• Inventors: DiFalco, Robert A.
• Granted Patent: US 7,316,016 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]

Abstract

A distributed and scalable architecture is described to facilitate reactive detection of operational state changes in diverse, heterogeneous objects, logging of detected state-changes, and generating alerts in response to detected state-changes for the purpose of remediation. Such heterogeneous objects include but are not limited to stand-alone workstations, network appliances, files and directories, as well as embedded micro-systems such as digital assistants, cellular devices, and even remotely controlled peripherals such as environmental sensors, effectors and actuators. In one embodiment, user interaction with such diverse objects is facilitated through a homogeneous user-interface metaphor through which, the rules of interaction remain constant independent of the object being monitored.

Claims

1. A method comprising:

defining a first logical grouping of one or more heterogeneous nodes to be monitored, the one or more nodes corresponding to one or more node-types;

defining a second logical grouping of one or more rules to be asserted against at least a subset of the first logical grouping of nodes, each of said one or more rules identifying criteria for detecting an operational state change of one or more nodes;

generating one or more monitoring tasks, each of said monitoring tasks defining which ones of the second logical grouping of rules are to be asserted against which ones of the first logical grouping of nodes; and

executing the one or more monitoring tasks.

2. The method of claim 1, further comprising:

detecting one or more operational state changes to the one or more nodes; and

applying one or more responses to the one or more detected state changes.

3. The method of claim 2, wherein the one or more rules define at least a subset of the one or more responses.

4. The method of claim 3, wherein the one or more responses comprise at least one of an automatic remediation response, and an alert response.

5. The method of claim 4, wherein said remediation response includes a rollback operation to restore an operational state of a selected one of the one or more nodes to an earlier operational state.

6. The method of claim 1, wherein said one or more node-types comprise an active node-type and a passive node-type.

7. The method of claim 6, wherein the one or more monitoring tasks are executed by the active node-type.

8. The method of claim 6, wherein the active node-types comprise at least one of a server, desktop computer, laptop computer, set-top box, PDA and a cell phone.

9. The method of claim 6, wherein said one or more passive node types comprise at least one of a router, a switch, a sensor, a file, a directory, and a network port.

10. The method of claim 1, wherein the one or more monitoring tasks are scheduled for opportunistic execution at a future date by an available one of the one or more nodes.

11. The method of claim 1, wherein the one or more monitoring tasks are scheduled for execution by an identified one of said one or more nodes.

12. An apparatus comprising:

a storage medium having programming instructions stored therein, which when executed operate to

define a first logical grouping of one or more heterogeneous nodes to be monitored, the one or more nodes corresponding to one or more node-types,

define a second logical grouping of one or more rules to be asserted against at least a subset of the first logical grouping of nodes, each of said one or more rules identifying criteria for detecting an operational state change of one or more nodes,

generate one or more monitoring tasks, each of said monitoring tasks defining which ones of the second logical grouping of rules are to be asserted against which ones of the first logical grouping of nodes, and

perform the one or more monitoring tasks; and

at least one processor coupled with the storage medium to execute the programming instructions.

13. The apparatus of claim 12, wherein the instructions when executed further operate to:

detect one or more operational state changes to the one or more nodes; and

apply one or more responses to the one or more detected state changes.

14. The apparatus of claim 13, wherein the one or more rules define at least a subset of the one or more responses.

15. The apparatus of claim 14, wherein the one or more responses comprise at least one of an automatic remediation response, and an alert response.

16. The apparatus of claim 15, wherein said remediation response includes a rollback operation to restore an operational state of a selected one of the one or more nodes to an earlier operational state.

17. The apparatus of claim 12, wherein said one or more node-types comprise an active node-type and a passive node-type.

18. The apparatus of claim 17, wherein the active node-types comprise at least one of a server, desktop computer, laptop computer, set-top box, PDA and a cell phone.

19. The apparatus of claim 17, wherein said one or more passive node types comprise at least one of a router, a switch, a sensor, a file, a directory, and a network port.

20. The apparatus of claim 12, wherein the one or more monitoring tasks are scheduled for opportunistic execution at a future date by an available one of the one or more nodes.

21. The apparatus of claim 12, wherein the one or more monitoring tasks are scheduled for execution by an identified one of said one or more nodes.

22. An apparatus comprising:

means for defining a first logical grouping of one or more heterogeneous nodes to be monitored, the one or more nodes corresponding to one or more node-types;

means for defining a second logical grouping of one or more rules to be asserted against at least a subset of the first logical grouping of nodes, each of said one or more rules identifying criteria for detecting an operational state change of one or more nodes;

means for generating one or more monitoring tasks, each of said monitoring tasks defining which ones of the second logical grouping of rules are to be asserted against which ones of the first logical grouping of nodes; and

means for performing the one or more monitoring tasks.