Homogeneous monitoring of heterogeneous nodes

• US 7,316,016 B2
• Filed: 07/03/2002
• Issued: 01/01/2008
• Est. Priority Date: 07/03/2002
• Status: Active Grant

• Current Assignee: Tripwire Incorporated (Belden Inc.)
• Original Assignee: Tripwire Incorporated (Belden Inc.)
• Inventors: DiFalco, Robert A.
• Primary Examiner(s): An; Meng-Al T.
• Assistant Examiner(s): To; Jennifer N.
• Application Number:
  US10/188,430
• Publication Number:
  US 20040006614A1
• Time in Patent Office: 2,008 Days
• Field of Search: 709208-226, 709/232, 709/242, 713/310, 714/22, 714/30, 714/37, 714 43- 47, 718100-108, 370/254, 370/244, 706/45, 715/733
• US Class Current: 718/102
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]

Abstract

A distributed and scalable architecture is described to facilitate reactive detection of operational state changes in diverse, heterogeneous objects, logging of detected state-changes, and generating alerts in response to detected state-changes for the purpose of remediation. Such heterogeneous objects include but are not limited to stand-alone workstations, network appliances, files and directories, as well as embedded micro-systems such as digital assistants, cellular devices, and even remotely controlled peripherals such as environmental sensors, effectors and actuators. In one embodiment, user interaction with such diverse objects is facilitated through a homogeneous user-interface metaphor through which, the rules of interaction remain constant independent of the object being monitored.

Claims

1. A computerized method of monitoring a system or network comprising a plurality of heterogeneous nodes, the method comprising:

defining multiple rules, each of the rules identifying criteria for detecting when the plurality of heterogeneous nodes on the system or network deviate from an authoritative state;

defining multiple logical groupings of one or more heterogeneous nodes, the logical groupings determining where the rules are applied;

defining multiple monitoring tasks, each monitoring task comprising applying at least one of the rules to at least a subset of a logical grouping of heterogeneous nodes;

executing the multiple monitoring tasks; and

in response to detecting a heterogeneous node deviating from the authoritative state, applying a remediation response wherein the remediation response is capable of both updating the authoritative state of the heterogeneous node and restoring the authoritative state of the heterogeneous node;

wherein the one or more monitoring tasks are scheduled for opportunistic execution at a future date by an available one of the heterogeneous nodes.

2. The computerized method of claim 1, wherein the remediation response is an automatic remediation response.

3. The computerized method of claim 1, wherein the plurality of heterogeneous nodes comprise one of an active node-type or a passive node-type.

4. The computerized method of claim 3, wherein the one or more monitoring tasks are executed by an active node-type node.

5. The computerized method of claim 3, wherein the active node-types comprise at least one of a server, desktop computer, laptop computer, set-top box, PDA and a cell phone.

6. The computerized method of claim 3, wherein the passive node types comprise at least one of a router, a switch, a sensor, a file, a directory, and a network port.

7. An apparatus comprising:

at least one processor operatively coupled to a storage medium;

the storage medium having programming instructions stored therein, which, when executed, operate to;

define multiple rules, each of the rules identifying criteria for detecting when a heterogeneous node on a system or network comprising a plurality of heterogeneous nodes deviates from an authoritative state;

define multiple logical groupings of one or more heterogeneous nodes, the logical groupings determining where the rules are applied;

define multiple monitoring tasks, each monitoring task comprising applying at least one of the rules to at least a subset of a logical grouping of heterogeneous nodes;

execute the multiple monitoring tasks; and

in response to detection of the heterogeneous node deviating from the authoritative state, apply a remediation response wherein the remediation response is capable of both updating the authoritative state of the heterogeneous node and restoring the authoritative state of the heterogeneous node;

wherein the monitoring tasks are scheduled for opportunistic execution at a future date by an available one of the one or more nodes.

8. The apparatus of claim 7 wherein the remediation response is an automatic remediation response.

9. The apparatus of claim 7, wherein the plurality of nodes comprise one of an active node-type or a passive node-type.

10. The apparatus of claim 9, wherein the monitoring tasks are executed by an active node-type node.

11. The apparatus of claim 9, wherein the active node-types comprise at least one of a server, desktop computer, laptop computer, set-top box, PDA and a cell phone.

12. The apparatus of claim 9, wherein the passive node types comprise at least one of a router, a switch, a sensor, a file, a directory, and a network port.

13. A computerized method of monitoring a system or network comprising a plurality of heterogeneous nodes, the method comprising:

defining multiple rules, each of the rules identifying criteria for detecting when the plurality of heterogeneous nodes on the system or network deviate from an authoritative state;

defining multiple logical groupings of one or more heterogeneous nodes, the logical groupings determining where the rules are applied;

defining multiple monitoring tasks, each monitoring task comprising applying at least one of the rules to at least a subset of a logical grouping of heterogeneous nodes;

executing the multiple monitoring tasks; and

in response to detecting a heterogeneous node deviating from the authoritative state, applying a remediation response wherein the remediation response is capable of both updating the authoritative state of the heterogeneous node and restoring the authoritative state of the heterogeneous node;

wherein the one or more monitoring tasks are scheduled for execution by an identified one of the heterogeneous nodes.

14. An apparatus comprising:

at least one processor operatively coupled to a storage medium;

the storage medium having programming instructions stored therein, which, when executed, operate to;

define multiple rules, each of the rules identifying criteria for detecting when a heterogeneous node on a system or network comprising a plurality of heterogeneous nodes deviates from an authoritative state;

define multiple logical groupings of one or more heterogeneous nodes, the logical groupings determining where the rules are applied;

define multiple monitoring tasks, each monitoring task comprising applying at least one of the rules to at least a subset of a logical grouping of heterogeneous nodes;

execute the multiple monitoring tasks; and

in response to detection of the heterogeneous node deviating from the authoritative state, apply a remediation response wherein the remediation response is capable of both updating the authoritative state of the heterogeneous node and restoring the authoritative state of the heterogeneous node;

wherein the monitoring tasks are scheduled for execution by an identified one of the heterogeneous nodes.