Computer Associates Think, Inc.

Ca, Inc.

Concord Communications, Inc.

Lawrence A Stabile

Mark W Sylor

Bradley S Carey

Albert Briner

Thomas Allen LaRosa

David William Russo

Kevin M Jackson

Jeremiah David Small

Matthew Eric Baddeley

Will C Lauer

Jay B Wolf

George Iglesias

David L Shepard

Gordon Andrew Booman

Daniel R Seligman

Richard Wallace

Vincent H Fortin

Daniel L Seligman

A computer-implemented method for detecting alarm conditions, the method involving receiving at a first time a trigger notification describing a monitored occurrence on a network; setting a redundancy window to begin at the first time and to end at an expiration time; designating a first alarm condition to represent the trigger notification; receiving a second notification at a second time after the first time, the second notification describing the monitored occurrence; and determining whether a second alarm condition exists by testing whether the second time is within the redundancy window.

Network fault manager

The network fault manager described herein may include one or more processors configured to detect alarms. For example, the one or more processors may periodically sample rates at which similar events that relate to occurrences on a network arrive, compare the periodically sampled rates to a first threshold, and determine whether a preexisting alarm exists. In response to a number of the periodically sampled rates that exceeded the first threshold within a preceding time window exceeding a second threshold and the preexisting alarm not existing, the one or more processors may assert a first alarm. Otherwise, if the number of periodically sampled rates that exceeded the first threshold within the preceding time window exceeds the second threshold but the preexisting alarm does exist, the one or more processors may maintain the preexisting alarm for a predetermined time period.

The network fault manager described herein may generate an alarm data table having various columns and rows respectively corresponding to different alarm data fields and different alarms. The alarm data table may be associated with a primary key that includes a subset of the different data fields in the multiple columns to uniquely represent the different alarms in the multiple rows. In response to removing one or more of the different alarm data fields in the subset from the primary key, the primary key may non-uniquely represent the different alarms in a plurality of the multiple rows. Thus, the alarm data table may be collapsed to combine the different alarms non-uniquely represented in the plurality of the multiple rows into one combined row uniquely representing the different alarms, whereby the collapsed alarm data table may replace the plurality of the multiple rows with the combined row.

Network fault manager for maintaining alarm conditions

A method of monitoring an element in a computer network including monitoring a preselected variable relating to that element; defining a threshold for the monitored preselected variable; establishing a sliding window in time; repeatedly generating a time above threshold value, the time above threshold value being a measure of an amount of time during which the monitored variable exceeded the threshold during the sliding window of time; detecting when the time above threshold value exceeds a condition window value; and in response to detecting when the time above threshold value exceeds the condition window, generating an alarm.

System and method for displaying historical performance of an element on a network

A method of merging a list of newly found network elements and a list of previously known network elements includes arranging the newly found network elements in a hierarchical structure, and determining one or more device matches between each network device in the list of newly found network elements and one or more network devices in the list of previously known network elements. The method further includes, for each of the one or more device matches, determining one or more network element matches between the newly found network element and the corresponding previously stored network device. The method also includes updating the previously found network device corresponding to each of the one or more device matches with the corresponding newly found network device.

Discovering and merging network information

A method of processing data received at a local system in response to polling a remote device, wherein the local system includes a local clock, the method involving: sending a first poll to the remote device; receiving a response from the remote device to the first poll, the response to the first poll containing data and a time stamp indicating when the remote device responded to the first poll; for the data received in response to the first poll, computing a first time by using both a time that was derived from the local clock for a previous poll of the remote device and also the time stamp contained in the response to the first poll; comparing the computed first time to information that the local system stored in connection with the first poll, wherein the information that the local system stored in connection with the first poll was derived from the local clock; and determining how to process the data received in response to the first poll based on comparing the computed first time to the information that the local system stored in connection with the first poll.

Time skew correction in data time stamping

LiveException system

A method provides for merging lists of newly found and old network elements. The method comprises receiving the list of newly found elements and deriving a potential key value for a portion of the newly found elements from configuration data associated therewith and a key format. The method also updates one of the old elements with the configuration data of a newly found keyed element having the same key. The method compares attributes of newly found elements for components to attributes of old network elements for attribute matches and reports matches. The report lists matching old elements and newly found elements as unresolved if either one does not have a unique key.

Method and apparatus for detecting changes to network elements

A method for collecting and reporting monitored data for network traffic, which has been accumulated by a plurality of remote probes. The method includes making a series of polling requests for lists of monitoring data to each probe and receiving the requested lists. Each list has traffic count values that are identified by at least a sampling time, a source address, a destination address and a probe identifier. The method also includes calculating the traffic observed by each probe between successive sampling times and apportioning the calculated traffic data among a single set of consecutive temporal intervals and selecting best counts to avoid overcounting.

Growing community of inventors

Cochituate, MA, United States of America

Lawrence A Stabile