Dynamic incident tracking and investigation in service monitors

• US 20050262237A1
• Filed: 10/08/2004
• Published: 11/24/2005
• Est. Priority Date: 04/19/2004
• Status: Abandoned Application

• Current Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Original Assignee: Netqos Incorporated (Broadcom, Inc.)
• Inventors: Spofford, Jason Joseph, Haley, Benjamin Paschal, Fulton, Cathy Anne
• Application Number:
  US10/962,331
• Publication Number:
  US 20050262237A1
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/065 related to network devices
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/0882 Utilisation of link capacity
• CPC Class Codes: H04L 43/16 Threshold monitoring

Abstract

A method for a service monitor of a computing environment includes monitoring application network transactions and behaviors for the computing environment, the computing environment including client subnets accessing servers, the monitoring independent of client site monitors; decomposing the monitored transactions and behaviors into network, server and application quality components; using the components to identify services, servers and client subnets as associated with a quality issue; and implementing an active investigation on the services, servers and client subnets to gather statistical data to assist root cause analysis independent of a network monitoring interruption; The quality issue might be a performance issue, such as excessive response times, excessive loss rates, or small transfer rates. The quality issue might be an availability issue, such as an unreachable network node or a missing web page. The service monitor includes an event detection module configured to decompose the monitored transactions and behaviors into network, server and application quality components and to use the components to identify services, servers and client subnets as being associated with a quality issue. The monitor also includes active investigation modules networked to gather statistical data according to criteria to assist root cause analysis without monitoring interruption.

Claims

1. A method for server-side monitoring of a computing environment, the method comprising:

monitoring application network transactions and behaviors for the computing environment, the computing environment including one or more client subnets accessing one or more servers, the monitoring capable of being independent of client site monitors;

decomposing the monitored transactions and behaviors into at least network, server and application quality components where a quality component may be based on performance or availability;

using the decomposed quality components to identify one or more of the services, servers and client subnets as being associated with a quality issue; and

implementing an active investigation on the one or more services, servers and client subnets, the active investigation including gathering statistical data to assist root cause analysis independent of a network monitoring interruption.

2. The method of claim 1 wherein the decomposing is based on response size.

3. The method of claim 1 further comprising:

analyzing the decomposed components to identify anomalies, reduce alarms, perform an active investigation, and further isolate an identified problem.

4. The method of claim 1 wherein if the element with an identified problem is a server, the statistical data includes server statistics and if the element with an identified problem is a client subnet, the statistical data includes network statistics.

5. The method of claim 1 wherein the active investigation enables retrieval of specific information to isolate one or more quality issues.

6. The method of claim 1 wherein the server-side monitoring of the computer environment is independent of whether the active investigation retrieves statistics.

7. The method of claim 6 wherein the active investigation can retrieve none, some, or all statistical data to assist identifying a root cause of a quality issue.

8. The method of claim 1 wherein the active investigation includes one or more of a continuous mode and a snapshot mode.

9. The method of claim 8 wherein the snapshot mode is operational only when triggered by an event, the snapshot mode providing a snapshot of performance around a predetermined period of time.

10. The method of claim 9 wherein the snapshot is about five to 15 minutes from the beginning of an event, the snapshot independent of context or historical information.

11. The method of claim 8 wherein the continuous mode polls a source of information continuously to provide a performance history.

12. The method of claim 8 wherein the continuous mode stores and reports performance and availability data in a database wherein the event detection data concerning anomalies in the computer environment are stored.

13. The method of claim 8 wherein the continuous mode stores and reports performance data in a dedicated database for active investigations.

14. (canceled)

15. (canceled)

16. (canceled)

17. (canceled)

18. (canceled)

19. (canceled)

20-60. -60. (canceled)

61. A method of collecting data processing system status information, comprising:

monitoring network communications with the data processing system to observe at least one transaction associated with the data processing system;

analyzing the at least one transaction to determine if the at least one transaction complies with a quality standard;

generating a trigger based on the analysis of the at least one transaction; and

collecting system status information responsive to the generation of the trigger.

62. The method of claim 61, wherein collecting system status information comprises collecting system status information so that collection of the system status information automatically time correlates the collected system status information with the trigger.

63. The method of claim 61, further comprising:

monitoring a plurality of network communications; and

identifying respective ones of the plurality of network communications so as to establish network communications associated with the at least one transaction.

64. The method of claim 61, wherein generating a trigger based on the analysis of the at least one transaction comprises:

correlating a plurality of events associated with at least one transaction to provide related events;

comparing a value associated with the related events with a threshold value; and

generating a trigger responsive to the value associated with the related events meeting the threshold value.

65. The method of claim 64, further comprising:

weighting the related events to provide weighted correlated events;

wherein comparing a value associated with the related events with a threshold value comprises comparing a value of weighted correlated events with the threshold value; and

wherein generating a trigger responsive to the a value associated with the related events meeting the threshold value comprises generating a trigger responsive to the value of the weighted correlated events meeting the threshold value.

68. The method of claim 61, wherein the quality standard comprises a quality associated with results of a function associated with the at least one transaction.

66. (canceled)

67. (canceled)

69. (canceled)

70. (canceled)

71. (canceled)

72. A method of collecting data processing system status information, comprising:

generating a trigger based on a measure of quality of content of transactions associated with the data processing system; and

collecting system status information responsive to generation of the trigger so that collection of the system status information automatically time correlates the collected system status information with the trigger.

73. (canceled)

74. (canceled)

75. (canceled)

76. (canceled)

77. (canceled)