Topology based correlation of threshold crossing alarms

• US 8,423,827 B2
• Filed: 12/28/2009
• Issued: 04/16/2013
• Est. Priority Date: 12/28/2009
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Berriss, William P., Duggan, Matthew, Martin, Daniel, Pennell, David J. Sr.
• Primary Examiner(s): TRUONG, LOAN
• Application Number:
  US12/647,706
• Publication Number:
  US 20110161741A1
• Time in Patent Office: 1,205 Days
• Field of Search: 714/26, 714/25, 714/4.1, 714/40, 370/276, 370/229
• US Class Current: 714/26
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/16 Threshold monitoring

Abstract

Method, apparatus and computer program product for correlating performance events in a data processing system. A first event is received at one of a first device and a second device of the data processing system, and a second event is received at one of the first device and the second device. A type of a connection between the first device and the second device is identified to form an identified type of connection, and a relationship between the first event and the second event is determined based on the identified type of connection between the first device and the second device.

Claims

1. A method for correlating performance events in a data processing system, the method comprising:

receiving a first event at a first device of the data processing system;

receiving a second event at a second device of the data processing system, wherein the first event comprises a first alarm and the second event comprises a second alarm;

identifying a type of a connection between the first device and the second device to form an identified type of connection; and

determining a relationship between the first event and the second event based on the identified type of connection between the first device and the second device, wherein the identified type of the connection comprises a direct wire connection between a first port of the first device and a second port of the second device, wherein the first alarm indicates that egress utilization is high for packets transmitted on the first port, wherein the second alarm indicates that ingress utilization is high for packets received on the second port, and wherein the determined relationship comprises that the first and second alarms each indicate a high egress utilization on the first port.

6. The method of claim 1, wherein the first device comprises a first router and the second device comprises a second router.

7. A computer program product comprising a non-transitory computer recordable storage medium having computer usable program code stored thereon that is operable for correlating performance events when executed by a data processing system to perform the steps of claim 1.

2. A method for correlating performance events in a data processing system, the method comprising:

receiving a first event at a first device of the data processing system;

receiving a second event at a second device of the data processing system, wherein the first event comprises a first alarm and the second event comprises a second alarm;

identifying a type of a connection between the first device and the second device to form an identified type of connection; and

determining a relationship between the first event and the second event based on the identified type of connection between the first device and the second device, wherein the identified type of the connection comprises a direct same speed Ethernet link between a first port of the first device and a second port of the second device, wherein the first alarm indicates high collisions on the first port, wherein the second alarm indicates a high packet error on the second port, and wherein the determined relationship comprises a duplex mismatch between the first port and the second port.

8. A computer program product comprising a non-transitory computer recordable storage medium having computer usable program code stored thereon that is operable for correlating performance events when executed by a data processing system to perform the steps of claim 2.

3. A method for correlating performance events in a data processing system, the method comprising:

receiving a first event at a first device of the data processing system;

receiving a second event at a second device of the data processing system, wherein the first event comprises a first alarm and the second event comprises a second alarm;

identifying a type of a connection between the first device and the second device to form an identified type of connection; and

determining a relationship between the first event and the second event based on the identified type of connection between the first device and the second device, wherein the identified type of the connection comprises a direct same speed link connection, wherein the first alarm indicates that transmission errors are high, wherein the second alarm indicates that transmission errors are high, and wherein the determined relationship comprises that a wire connecting the first port and the second port has a problem.

9. A computer program product comprising a non-transitory computer recordable storage medium having computer usable program code stored thereon that is operable for correlating performance events when executed by a data processing system to perform the steps of claim 3.

4. A method for correlating performance events in a data processing system, the method comprising:

receiving a first event at a first device of the data processing system;

receiving a second event at a second device of the data processing system, wherein the first event comprises a first alarm and the second event comprises a second alarm;

identifying a type of a connection between the first device and the second device to form an identified type of connection; and

determining a relationship between the first event and the second event based on the identified type of connection between the first device and the second device, wherein the identified type of the connection comprises a direct same speed link connection, wherein the first alarm indicates a discard of packets from the second port of the second device, wherein the second alarm indicates congestion at a third port of the second device, and wherein the determined relationship comprises that the discard of packets is caused by the congestion at the third port.

10. A computer program product comprising a non-transitory computer recordable storage medium having computer usable program code stored thereon that is operable for correlating performance events when executed by a data processing system to perform the steps of claim 4.

5. A method for correlating performance events in a data processing system, the method comprising:

receiving a first event at a first device of the data processing system;

receiving a second event at a second device of the data processing system;

identifying a type of a connection between the first device and the second device to form an identified type of connection; and

determining a relationship between the first event and the second event based on the identified type of connection between the first device and the second device, wherein the identified type of the connection comprises a direct same speed link connection, wherein the first event is an alarm indicating high transmission errors on one of the first port or the second port, wherein the second event is an absence of an alarm indicating high transmission errors on the other of the first port or the second port, and wherein the determined relationship is that the one of the first port and the second port having high transmission errors has a problem.

11. A computer program product comprising a non-transitory computer recordable storage medium having computer usable program code stored thereon that is operable for correlating performance events when executed by a data processing system to perform the steps of claim 5.

12. An apparatus, comprising:

a memory storing instructions, and

at least one processing unit for executing the instructions for correlating performance events in a data processing system, the at least one processing unit executing the instructions to;

receive a first event at a first device of the data processing system;

receive a second event at a second device of the data processing system;

identify a type of a connection between the first device and the second device to form an identified type of connection; and

determine a relationship between the first event and the second event based on the identified type of connection between the first device and the second device, wherein the identified type of the connection comprises a direct same speed Ethernet link between a first port of the first device and a second port of the second device, wherein the first event comprises a first alarm indicating high collisions on the first port, wherein the second event comprises a second alarm indicating a high packet error on the second port, and wherein the determined relationship comprises a duplex mismatch between the first port and the second port.

13. An apparatus, comprising:

a memory storing instructions, and

at least one processing unit for executing the instructions for correlating performance events in a data processing system, the at least one processing unit executing the instructions to;

receive a first event at a first device of the data processing system;

receive a second event at a second device of the data processing system;

identify a type of a connection between the first device and the second device to form an identified type of connection; and

determine a relationship between the first event and the second event based on the identified type of connection between the first device and the second device, wherein the identified type of the connection comprises a direct same speed link connection, wherein the first event comprises a first alarm indicating that transmission errors are high, wherein the second event comprises a second alarm indicating that transmission errors are high, and wherein the determined relationship comprises that a wire connecting the first port and the second port has a problem.