Rule-based network management approaches

• US 7,668,953 B1
• Filed: 11/13/2003
• Issued: 02/23/2010
• Est. Priority Date: 11/13/2003
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Thirukazhukundram, Suresh, Sinclair, Keith, Pithawala, Burjiz
• Primary Examiner(s): STRANGE, AARON N
• Application Number:
  US10/714,158
• Time in Patent Office: 2,294 Days
• Field of Search: 709/224
• US Class Current: 709/224
• CPC Class Codes: H04L 41/064 involving time analysis
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence

Abstract

A method is disclosed for detecting symptoms in a network infrastructure, combining one or more symptoms into a problem, then optionally applying detailed diagnosis to the network elements experiencing the problems, ultimately providing detailed problem determination.

Claims

1. A method for defining a Rule-Based Markup Language (“

RBML”

) to describe a set of rules for managing a first network among a plurality of networks, the method comprising the computer-implemented steps of;

creating one or more RBML documents for storing the set of rules, wherein the one or more RBML documents include one or more tags defining one or more rule elements, and wherein;

a RBML document storing a symptom-event rule from the set of rules includes;

an event tag identifying a particular event occurring on the network; and

a symptom tag identifying a symptom as a generalized abstraction of the particular event; and

a RBML document storing a problem-diagnosis rule from the set of rules includes;

a problem-definition tag describing a problem; and

a correlation tag identifying a correlation between one or more symptoms, wherein the one or more symptoms are defined in one or more symptom tags that include one or more pre-defined indicators associated with the one or more symptoms; and

wherein each of the RBML documents comprises a profile block, event block, summary block, corrective action block, and match block, wherein the profile block identifies network profile elements to which a rule applies, wherein an event block defines which events published by a target device may constitute a recognized symptom, wherein the summary block comprises metadata defining what services or systems are entitled to use or execute a rule;

wherein the corrective action block defines one or more actions that can and should be taken to correct a problem that has been determined to exist;

wherein the match block comprises one or more match statements that may be applied to raw data to either parse or make a determination about the data;

generating, from information stored in one or more tags of the one or more RBML documents, one or more sequences of instructions, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of;

collecting and storing symptom-related data about one or more symptoms, wherein collecting and storing the symptom-related data includes monitoring the network for one or more network events identified in the symptom-event rule; and

detecting a problem within the network, wherein detecting the problem includes applying the problem-diagnosis rule to the symptom-related data;

receiving a request from a user to employ a particular rule in managing a second network, separate from the first network; and

distributing to a device on the second network the one or more RBML documents storing the particular rule.

2. A method as recited in claim 1, wherein the step of detecting a problem within the network further comprises the steps of:

comparing the symptom-related data to the one or more pre-defined indicators associated with the one or more symptoms to determine whether a particular symptom exists in the symptom-related data;

repeating the step of comparing the symptom-related data for all symptoms identified in the correlation tag of the RBML document storing the problem-diagnosis rule; and

only if all symptoms identified in the correlation tag exist, determining that the problem identified in the problem-definition tag is detected.

3. A method as recited in claim 1, wherein the RBML document storing the symptom-event rule further includes:

a profile tag identifying a particular network device; and

a command tag identifying a data-collection command, wherein the data-collection command, when executed on the particular network device, returns symptom-related data associated with the particular network device.

4. A method as recited in claim 1, wherein:

the step of creating one or more RBML documents further includes creating a RBML document for storing a problem-correction rule defining one or more corrective actions capable of correcting the problem within the network; and

the step of generating instructions includes generating one or more sequences of instructions, which instructions, when executed by the one or more processors, cause the one or more processors to carry out the step of recommending to a user the one or more corrective actions defined in the RBML document storing the problem-correction rule.

5. A computer-readable storage medium carrying one or more sequences of instructions for defining a Rule-Based Markup Language (“

RBML”

) to describe a set of rules for managing a first network among a plurality of networks, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of;

creating one or more RBML documents for storing the set of rules, wherein the one or more RBML documents include one or more tags defining one or more rule elements, and wherein;

a RBML document storing a symptom-event rule from the set of rules includes;

an event tag identifying a particular event occurring on the network; and

a symptom tag identifying a symptom as a generalized abstraction of the particular event; and

a RBML document storing a problem-diagnosis rule from the set of rules includes;

a problem-definition tag describing a problem; and

a correlation tag identifying a correlation between one or more symptoms, wherein the one or more symptoms are defined in one or more symptom tags that include one or more pre-defined indicators associated with the one or more symptoms; and

wherein each of the RBML documents comprises a profile block, event block, summary block, corrective action block, and match block, wherein the profile block identifies network profile elements to which a rule applies, wherein an event block defines which events published by a target device may constitute a recognized symptom, wherein the summary block comprises metadata defining what services or systems are entitled to use or execute a rule;

wherein the corrective action block defines one or more actions that can and should be taken to correct a problem that has been determined to exist;

wherein the match block comprises one or more match statements that may be applied to raw data to either parse or make a determination about the data;

generating, from information stored in one or more tags of the one or more RBML documents, one or more sequences of instructions, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of;

collecting and storing symptom-related data about one or more symptoms, wherein collecting and storing the symptom-related data includes monitoring the network for one or more network events identified in the symptom-event rule; and

detecting a problem within the network, wherein detecting the problem includes applying the problem-diagnosis rule to the symptom-related data;

receiving a request from a user to employ a particular rule in managing a second network, separate from the first network; and

distributing to a device on the second network the one or more RBML documents storing the particular rule.

6. A computer-readable storage medium as recited in claim 5, wherein the instructions for detecting a problem within the network further comprise instructions for carrying out the steps of:

comparing the symptom-related data to the one or more pre-defined indicators associated with the one or more symptoms to determine whether a particular symptom exists in the symptom-related data;

repeating the step of comparing the symptom-related data for all symptoms identified in the correlation tag of the RBML document storing the problem-diagnosis rule; and

only if all symptoms identified in the correlation tag exist, determining that the problem identified in the problem-definition tag is detected.

7. A computer-readable storage medium as recited in claim 5, wherein the RBML document storing the symptom-event rule further includes:

a profile tag identifying a particular network device; and

a command tag identifying a data-collection command, wherein the data-collection command, when executed on the particular network device, returns symptom-related data associated with the particular network device.

8. A computer-readable storage medium as recited in claim 5, wherein:

the instructions for creating one or more RBML documents further comprise instructions for carrying out the step of creating a RBML document for storing a problem-correction rule defining one or more corrective actions capable of correcting the problem within the network; and

the instructions for generating one or more sequences of instructions, by using information stored in one or more tags of one or more RBML documents, further comprise instructions for carrying out the step of recommending to a user the one or more corrective actions defined in the RBML document storing the problem-correction rule.