International Business Machines Corporation

Micromuse Inc.

David R Franklin

Kristian Jon Stewart

John Michael Lake

John E Dinger

Matthew Edward Duggan

Christopher J Baggott

Andrew Jonathan Bennett

Stephen F Cook

Embodiments include methods of topology discovery in a virtual environment. Aspects include tracking change events, responsive to a change event, rediscovering dependencies between devices in the virtual environment and maintaining a dependency mapping between the devices. Aspects also include, responsive to a fault event, building a first topology model of the virtual environment and generating a first set of the devices which the first topology model is dependent on. Aspects also include, responsive to a resolution event, building a second topology model and generating a second set of the devices which the second topology model is dependent on. Aspects further include generating a fault device set by combining the first set and the second set, deleting any duplicate devices, and utilizing the generated fault device set to determine which of the devices are more likely to be associated with future fault events.

Topology discovery for fault finding in virtual computing environments

A network management system comprises a server connected to a plurality of probes, each probe connected to one or more managed devices. A method of operating the system comprises the steps of receiving fault events for the managed devices at the probes, detecting that the rate of received fault events has reached or is approaching an overload level for the server, identifying a managed device contributing to the reached or approached overload level, switching the probe for the identified managed device to a flood prevention mode, and operating the switched probe in the flood prevention mode thereby combining multiple fault events for the identified managed device into a single fault event for transmission to the server.

Network management system with a switchable flood revention mode pregarding fault events for a managed device

An apparatus for predicting a network event flood comprises an event rate detector for detecting rates of event emissions from one or more devices; an aggregator for producing an aggregate rate and an aggregate rate trend of the rates of event emissions from a plurality of the devices; a level generator for generating a plurality of levels comprising maximum acceptable event rate values of a plurality of the aggregate rate trends over plural time periods; a storage component for storing the plurality of levels; a comparator for comparing a current aggregate rate trend with at least a selected one of the levels; and a signaller for signalling a predicted event flood responsive to the comparator detecting that the current aggregate rate trend will exceed the at least a selected one of the levels at a first point in time.

Network event management

Processing network events generates multiple events from a single network device event. The system includes a network monitoring device for acquiring event data and a processing system for receiving an input event from a network monitoring device on a processing thread, wherein the processing system includes a communications thread generating component for generating multiple communications threads each for transmitting event data to a server database. The communication threads open connections to required server databases and these connections are maintained in an open state while the network monitoring device is running.

Processing network events

A method and system for fault management in virtual computing environments are provided. The system includes: a monitor of fault events from virtual machines and host devices in a virtual computing environment and a monitor of situation events in the virtual computing environment wherein the situation events refer to a virtual machine name and a host device name. A universal faults component determines if a fault event affects both virtual machines and host devices and a correlating component correlates fault events relating to virtual machines and host devices as relating to the same problem. Host machine fault events correlated to a problem are marked as a root event and virtual machine fault events correlated to a problem are marked as symptoms with a link to the root event.

Fault management in virtual computing environments

Described herein are methods and systems for preparing to efficiently distribute data to be extracted from a data store to clients and for distributing such prepared data to the clients. The methods and system have particular utility in the context of a network monitoring system which captures and stores network event data and makes the event data available to clients according to any desired view or summary. One method for preparing the data involves storing as primary requests one or more client requests for data to be extracted from the event database. Additional client requests for event are each compared to the stored primary requests to determine whether each additional request matches a stored primary request in accordance with a given criterion, such as a filter or summary formula. If the additional request matches a stored primary request, the additional client request is associated with the matching primary request. If the additional request does not match a stored primary request, the additional request is stored as a new primary request. As a result of this method, client requests which match one another can be processed at once and distributed to all clients registering the request.

Growing community of inventors

London, United Kingdom

David R Franklin