Method and apparatus for identifying problems in computer networks

• US 7,600,160 B1
• Filed: 04/07/2006
• Issued: 10/06/2009
• Est. Priority Date: 03/28/2001
• Status: Expired due to Term

• Current Assignee: Optanix, Inc. (Axispoint Technology Solutions Group, Inc.)
• Original Assignee: ShoreGroup, Inc.
• Inventors: Fagan, Brant M., Lovy, David M., Bojanek, Robert J.
• Primary Examiner(s): Lohn; Joshua A
• Application Number:
  US11/399,965
• Time in Patent Office: 1,278 Days
• Field of Search: 714/4, 714/26, 714/43, 714/47, 714/57, 715/736
• US Class Current: 714/57
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route

Abstract

A network appliance for monitoring, diagnosing and documenting problems among a plurality of devices and processes (objects) coupled to a computer network utilizes periodic polling and collection of object-generated trap data to monitor the status of objects on the computer network. The status of a multitude of objects is maintained in memory utilizing virtual state machines which contain a small amount of persistent data but which are modeled after one of a plurality of finite state machines. The memory further maintains dependency data related to each object which identifies parent/child relationships with other objects at the same or different layers of the OSI network protocol model. A decision engine verifies through on-demand polling that a device is down. A root cause analysis module utilizes status and dependency data to locate the highest object in the parent/child relationship tree that is affected to determine the root cause of a problem. Once a problem has been verified, a “case” is opened and notification alerts may be sent out to one or more devices. A user interface allows all objects within the network to be displayed with their respective status and their respective parent/child dependency objects in various formats.

Claims

1. In a computer system having a processor, memory and a network interface, an apparatus for monitoring a plurality of device or process objects operatively coupled to the computer system over a computer network, the apparatus comprising;

(a) means for monitoring the status of the plurality of monitored objects over the computer network;

(b) means, coupled to the means for monitoring, for receiving data indicating that the status of one of the monitored object, and, if the data indicating that the status of a monitored object is not normal, for verifying that the status of a monitored object is not normal;

(b1) sending a verification query to said one monitored object, and

(b2) receiving a response to the verification query from said one monitored object confirming or denying abnormal status thereof; and

(c) a memory for storing data relating to the status of the monitored object wherein the memory stores a plurality of virtual state-machines relating to the monitored objects; and

(d) means, coupled to the memory, for presenting data relating to the monitored objects.

2. In an apparatus operatively coupled over a computer network to a plurality of device or process objects, a method comprising:

(a) monitoring the status of the plurality of monitored objects;

(b) receiving data indicating the status of a monitored object;

(c) storing data relating to the status of the monitored objects in memory;

(d) if the data indicating the status of a monitored object is not normal, verifying that the status of the monitored object is not normal by sending a verification request to the monitored object and requesting verification of abnormal status and receiving from the monitored object data confirming or denying abnormal status thereof; and

(e) presenting data relating to the monitored object.

3. The method of claim 2 further comprising:

(f) alerting a device external to the apparatus that the status of the monitored object has been verified as not normal.

4. The method of claim 3 wherein (f) comprises:

(f1) alerting an external device operatively coupled to the apparatus over a packet switched network that the status of the monitored object has been verified as not normal.

5. The method of claim 3 wherein (f) comprises:

(f1) alerting an external device operatively coupled to the apparatus over a circuit switched network that the status of the monitored object has been verified as not normal.

6. The method of claim 2 further comprising:

(f) providing a device external to the apparatus with access to the data relating to the status of the monitored objects in memory.

7. The method of claim 2 further comprising:

(f1) maintaining in memory a list of all monitored objects.

8. The method of claim 7 wherein selected of the plurality of monitored objects have parent/child dependency relations and wherein (f) further comprises:

(f2) maintaining in memory data identifying the parent/child dependency relations among a plurality of monitored objects.

9. The method of claim 8 wherein the data identifying the parent/child dependency relationship among a plurality of monitored objects is defined in memory with one or more Boolean expressions.

10. The method of claim 8 wherein (d) comprises:

(d1) identifying the highest parent object in the parent/child dependency relation that has a status other than normal.

11. A computer program product for use with an computer system operatively coupled over a computer network to a plurality of device or process objects, the computer program product comprising a computer useable medium having embodied therein program code comprising:

(a) program code for monitoring the status of the plurality of monitored objects;

(b) program code for receiving data indicating the status of a monitored object, and, if the data indicating that the status of a monitored object is not normal, for verifying that the status of a monitored object is not normal;

(b1) sending a verification query to said one monitored object, and

(b2) receiving a response to the verification query from said one monitored object confirming or denying abnormal status thereof; and

(c) program code for storing data relating to the status of the monitored objects in memory;

(d) program code for presenting data relating to the monitored object.

12. The computer program product of claim 11 further comprising:

(f) program code for alerting a device external to the apparatus that the status of the monitored object has been verified as not normal.

13. The computer program product of claim 12 wherein (f) comprises:

(f1) program code for alerting an external device operatively coupled to the apparatus over a packet switched network that the status of the monitored object has been verified as not normal.

14. The computer program product of claim 12 wherein (f) comprises:

(f1) program code for alerting an external device operatively coupled to the apparatus over a circuit switched network that the status of the monitored object has been verified as not normal.

15. The computer program product of claim 11 further comprising:

(f) program code for providing a device external to the apparatus with access to the data relating to the status of the monitored objects in memory.

16. The computer program product of claim 11 further comprising:

(f1) program code for maintaining in memory a list of all monitored objects.

17. The computer program product of claim 16 wherein selected of the plurality of monitored objects have parent/child dependency relations and wherein (f) further comprises:

(f2) program code for maintaining in memory data identifying the parent/child dependency relations among a plurality of monitored objects.

18. The computer program product of claim 17 wherein the data identifying the parent/child dependency relationship among a plurality of monitored objects defines one or more Boolean relationships.

19. The computer program product of claim 17 wherein (d) comprises:

(d1) program code for identifying if any monitored object in the parent/child dependency relation has a status other than normal; and

(d2) program code for determining that the status of a monitored object is normal if the status of all parent monitored objects in a parent/child dependency chain is other than normal.

20. A computer program product for use with a computer system operatively coupled over a computer network to a plurality of device or process objects, some of the plurality of objects existing over the computer network at different layers of an Open Systems Interconnection (OSI) network protocol model, the computer program product comprising a computer useable medium having embodied therein program code comprising:

(a) poller program code for sending queries to the plurality of monitored objects and for receiving responses therefrom;

(b) trap receiver program code for receiving traps generated by the monitored objects;

(c) decision engine program code, responsive to decision requests from any of the trap receiver program code and poller program code, for sending a verification query to one of the plurality of monitored objects identified in the decision request and for a receiving response to the verification query confirming or denying abnormal status thereof;

(d) program code for storing in memory data relating to status of the monitored object; and

(e) program code for presenting a visual representation of a requested monitored object, a current state of the requested monitored object, and any dependency relationship of the requested monitored object to other of the monitored objects existing in the computer network at a same layer and at a different layer of the OSI network protocol model.

21. The computer program product of claim 20 wherein (e) further comprises:

(e1) program code for representing the dependency relationship of the requested monitored object to others of the monitored objects in the computer network with a Boolean expression.

22. In a computer system operatively coupled over a computer network to a plurality of device or process objects, a method comprising:

(a) sending queries to the plurality of monitored objects and receiving responses therefrom;

(b) receiving traps generated by the monitored objects;

(c) in response to a received decision request, sending a verification query to one of the plurality of monitored objects identified in the decision request and receiving response to the verification query confirming or denying abnormal status thereof;

(d) storing in memory data relating to status of the monitored object; and

(e) presenting a visual representation of a requested monitored object, a current state of the requested monitored object, and any dependency relationship of the requested monitored object to other of the monitored objects existing in the computer network at a same layer and at a different layer of an Open Systems Interconnect (OSI) network protocol model.

23. The method of claim 22 wherein (e) further comprises:

(e1) representing the dependency relationship of the requested monitored object to others of the monitored objects in the computer network with a logical expression.

24. A computer program product for use with a computer system operatively coupled over a computer network to a plurality of device or process objects, some of the plurality of objects existing over the computer network at different layers of an Open Systems Interconnect (OSI) network protocol model, the computer program product comprising a computer useable medium having embodied therein program code comprising:

(a) program code for monitoring the status of the plurality of monitored objects over the computer network;

(b) program code, coupled to the program code for monitoring, for receiving data indicating that the status of a monitored object, and, if the data indicating that the status of the monitored object is not normal, for sending a verification request to the monitored object requesting verification of abnormal status and for receiving from the monitored object data confirming or denying abnormal status thereof;

(c) program code for storing in memory data relating to the status of the monitored object; and

(d) program code for presenting a visual representation of the monitored object, and a current state of a plurality of parameters associated with the status of the monitored object, the current state of the plurality of parameters represented as a visual icon.

25. The computer program product of claim 24 wherein (d) further comprises:

(d1) program code for presenting a visual representation of any child monitored object which depends directly from the requested monitored object and a current state of any said child monitored object.