Model-based system monitoring

• US 8,489,728 B2
• Filed: 04/15/2005
• Issued: 07/16/2013
• Est. Priority Date: 04/15/2005
• Status: Active Grant

• Current Assignee: ServiceNow Incorporated
• Original Assignee: Microsoft Corporation
• Inventors: Vinberg, Anders B., Lakshminarayanan, Anand, Sanghvi, Ashvinkumar J., Rajarajan, Vij, Voloshin, Vitaly, Tabbara, Bassam, Grealish, Kevin, Mensching, Rob, Outhred, Geoffrey, Hunt, Galen C., Hydrie, Aamer, Welland, Robert V.
• Primary Examiner(s): BEHARRY, NOEL R
• Application Number:
  US11/107,420
• Publication Number:
  US 20060235962A1
• Time in Patent Office: 3,014 Days
• Field of Search: 709/223, 709/224
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 69/40 for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06

Abstract

Model-based system monitoring includes accessing a model of a system that includes multiple components and executing a monitoring policy to monitor performance of the system. A notification of a problem is received from a first component. A determination is made regarding the cause of the problem. The determination is made, at least in part, based on the model of the system. At least one component associated with the cause of the problem is then identified.

Claims

1. A method comprising:

accessing a model of a system that includes a plurality of components, wherein the model of the system contains information defining a plurality of relationships between the plurality of components, wherein the plurality of relationships defined comprises;

containment relationships to identify a component of the plurality of components as being contained by another component of the plurality of components such that definitions of the component are incorporated into the another component enabling the another component to;

control a lifetime of the component being contained, control a visibility of the component being contained, and delegate a behavior of the component being contained;

hosting relationships to identify dependencies among the plurality of components such that a guest component is included in the model of the system via a hosting component; and

communication relationships to identify two or more components of the plurality of components configured to communicate with each other;

associating components from the plurality of components to one or more information pages, the one or more information pages comprising;

a monitoring page to describe monitoring a performance of an associated monitoring component and to identify an action to take when a rule is satisfied, actions to take include at least one of recording settings, recording events that occurred, or sounding an alarm;

executing a monitoring policy to monitor the performance of the system, the monitoring policy includes information regarding the components to be monitored;

receiving notification of a problem from the associated monitoring component;

determining a cause of the problem, the determination being made at least in part based on the model of the system; and

identifying at least one component associated with the cause of the problem.

2. A method as recited in claim 1, further comprising notifying an administrator of the at least one component associated with the cause of the problem.

3. A method as recited in claim 1, wherein the model of the system includes an associated page of data for each of the plurality of components, and wherein the associated page of data defines an operation of an associated component.

4. A method as recited in claim 1, wherein the model of the system includes a corresponding page of data for each of the plurality of components and the corresponding page of data defines a service level agreement for an associated component.

5. A method as recited in claim 1, further comprising suppressing problem-related notices generated by the first component if the first component is not associated with the cause of the problem.

6. A method as recited in claim 1, wherein determining a cause of the problem includes determining whether the first component experienced a problem while attempting to access another component.

7. A method as recited in claim 1, wherein determining a cause of the problem includes:

identifying a plurality of other components associated with the first component; and

determining whether any of the other components are not functioning properly.

8. A method as recited in claim 7, wherein identifying a plurality of other components associated with the first component includes identifying relationships associated with the first component based on information contained in the model of the system.

9. A method comprising:

accessing a model of a system that defines a plurality of components and defines relationships between those components, wherein the relationships defined between those components comprise;

containment relationships to identify a component as being contained by another component such that data and definitions of the contained component are incorporated into the another component enabling the another component to;

control a lifetime of the contained component, control a visibility of the contained component, and delegate a behavior of the contained component;

hosting relationships to identify dependencies among the plurality of components such that a guest component is included in the model of the system via a hosting component; and

communication relationships to identify two or more components of the plurality of components configured to communicate with each other;

receiving notification of a cumulative problem, wherein the notification of the cumulative problem indicates that each component is operating within acceptable operating parameters;

determining a cause of the cumulative problem and identifying at least one potential problem, the determination being made at least in part based on the model of the system and monitoring a performance of a group of components by performing an end-to-end analysis and the identification being made based on at least one potential point of failure or at least one area reducing the performance of the system;

identifying at least one component associated with the cause of the problem; and

suppressing notices generated by other components if the other components are not associated with the cause of the problem.

10. A method as recited in claim 9, wherein the model of the system includes an associated page of data for at least one of the plurality of components, and wherein the associated page of data defines a service level agreement associated with an associated component.

11. A method as recited in claim 9, wherein determining the cause of the cumulative problem includes:

identifying a plurality of other components associated with the at least one component; and

determining whether any of the other components are not functioning properly.

12. A method as recited in claim 11, wherein identifying the plurality of other components associated with the at least one component includes identifying the relationships associated with the at least one component based on information contained in the model of the system.

13. A method as recited in claim 9, further comprising notifying an administrator of the problem and the cause of the problem.

14. A method as recited in claim 9, further comprising executing a monitoring policy to identify potential problems associated with one or more of the plurality of components in the system.

15. One or more computer storage media having physical structure and having stored thereon a plurality of instructions that, when executed by one or more processors, causes the one or more processors to perform operations comprising:

accessing, via at least one of the one or more processors, a model of a system that includes a plurality of components, wherein the model of the system includes a plurality of pages of data for each of the plurality of components, wherein the plurality of pages of data comprises;

an installation page describing how to install an associated component onto another component and identifying a particular installation of a component to be completed before installing another component;

a constraints page describing constraints imposed on the associated component and constraints imposed on the system, and identifying default values for settings imposed on the system such that the default values fall within a range of values that satisfy the constraints;

a service level agreement page describing agreements between a purchaser of the model of the system and a seller of the model of the system regarding the associated component; and

a monitoring page describing information with rules related to monitoring the plurality of components;

monitoring the plurality of components that generates a notification of a problem according to the monitoring page;

identifying a response to the notification, the response based on the rules, which includes taking a corrective action, sending an email to an administrator, generating an alert, or paging an administrator;

receiving the notification of the problem from a first component;

the at least one of the one or more processors, responsive to the notification, determining a component of the plurality of components that is associated with the cause of the problem by using information in the model of the system to;

identify a subset of the plurality of components, the subset being components related to the first component;

identify at least one malfunctioning component of the subset of the plurality of components; and

provide the response regarding the at least one malfunctioning component.

16. One or more computer storage media as recited in claim 15, wherein the model of the system defines a hierarchical relationship among the plurality of components.

17. One or more computer storage media as recited in claim 15, wherein the plurality of other components associated with the first component are identified based on relationships associated with the first component defined in the model of the system.

18. One or more computer storage media as recited in claim 15, wherein the one or more processors further suppress error notices generated by the first component if the first component is not associated with the cause of the problem.