Ca, Inc.

Hewlett-packard Company

Ixia

Hewlett-packard Development Company, L.P.

Keysight Technologies Singapore (sales) Pte. Ltd.

Ca Technologies, Inc.

Richard Bennett Whitner

Nimal K K Gamage

Thomas Guenter Bartz

Douglas P Drees

James Andrew Perkins

William G Golson

Ben Charles Nelson

Gautam Mehrotra

Charles J Gruber

Chia-Chu Dorland

Mark A Schilling

Kumar Shashank

Saurabh Grade

Provided is a process including: receiving, with one or more processors, an alarm of a monitoring application that is monitoring a distributed application; determining, with one or more processors, a type of the identified computational entity among a plurality of different types of computational entities, wherein at least some of the different types take longer to provision than other types among the plurality of different types; classifying, with one or more processors, the alarm based on the type of the identified computational entity that emitted the alarm or a metric or event upon which the alarm is based; and based on the classification of the alarm, adjusting, with one or more processors, a configuration of the monitoring application or a logical-architecture or network-architecture topology of the distributed application.

Managing alarms from distributed applications

In one embodiment, packet forwarding apparatus includes a data packet receiving interface, a data packet forwarding interface, and a configuration interface. The apparatus also includes circuitry that defines a plurality of data packet forwarding paths between the data packet receiving interface and the data packet forwarding interface. The circuitry defines at least one of the plurality of data packet forwarding paths in response to input received via the configuration interface, and the circuitry adaptively reconfigures at least one of the plurality of data packet forwarding paths i) in response to input received via the configuration interface, and ii) while data packets are being received by the packet forwarding apparatus.

Apparatus and methods for forwarding data packets captured from a network

Provided is a process including: receiving a given alarm from a given instance of a given service executing on a given computing device, wherein: the given service is one of a plurality of different services that form at least part of a given distributed application, and the distributed application is executing on a plurality of different computing devices including the given computing device; accessing contextual data, the contextual data including metrics or events received from other instances of the given service or other services of the given distributed application; determining an alarm score for the given alarm based on the contextual data, the alarm score being indicative of a marginal effect of the given alarm on performance of the given distributed application; and storing the alarm score in memory in association with the given alarm.

Programmatically classifying alarms from distributed applications

If an event management system or component within an event management system fails, events generated by systems and applications monitored by the event management system may not be processed or analyzed. As a result, the performance and health of the systems and applications may be unknown. To reduce the impact of a failure, an event management system can include at least two event managers: a primary event manager and one or more standby event managers. The standby event managers are configured to handle event processing tasks upon a failure of the primary event manager. To be prepared for a failure of the primary event manager, the standby event manager receives state data and copies of events. After determining that the primary event manager has failed, the standby event manager can begin processing events.

Fault tolerant event management system

A method includes receiving, for each of a plurality of entities in a network, device information associated with the entity, and network traffic information regarding data packets associated with the entity. The method also includes determining, using a processor, a priority score for each of the plurality of entities in the network based on the device information and the traffic information. The method additionally includes determining a polling frequency for each of the plurality of entities based on each priority score, wherein the polling frequency for a first entity having a first priority score is greater than the polling frequency for a second entity having a second priority score that is lower than the first priority score. The method further includes polling each of the plurality of entities at its polling frequency.

Key network entity detection

An alarm might not have information helpful to resolve the alarm to its contributing events. Thousands of events can occur in a system in a relatively short period of time, and any number of those events can contribute to various alarms. Tracing contributing events to an alarm can provide some helpful insight or at least efficiently provide a starting point for resolving or investigating an alarm. A system can determine, maintain, and persist associations at least among events, rule instances, and alarms to allow alarm-to-contributory event tracing.

Alarm to event tracing

A method includes polling a plurality of entities in a network for status information at a first polling frequency and receiving a fault indicator associated with an entity in the network. The method additionally includes mapping the fault indicator to a particular node in a network topology, the network topology comprising nodes corresponding to entities in the plurality of entities and edges describing relationships and dependencies between the plurality of entities, wherein the particular node corresponds to the associated entity for the fault indicator. The method further includes determining a set of related nodes based on connections to the particular node in the network topology, and polling corresponding entities for the set of related nodes for status information at a second polling frequency, the second polling frequency being greater than the first polling frequency.

Dynamic configuration of entity polling using network topology and entity status

A first event indication is received. In response to receiving the first event indication, it is determined that the first event indication has not been tagged. In response to determining that the first event indication has not been tagged, the first event indication is tagged as comprising an event chain. It is also determined that an event count associated with the event chain does not exceed a threshold. In response to determining that the event count does not exceed the threshold, the first event indication is processed.

Event chain detection

A method includes receiving historical monitoring data for components of a system, the historical monitoring data comprising a plurality of events, each triggered by an associated component, and a plurality of alarms, each triggered by detection of a particular type of condition in the components. The method also includes determining common event sequences in the plurality of events, each event sequence culminating in one of the plurality of alarms. The method further includes correlating the common event sequences into an event pattern. The method also includes receiving a plurality of real-time events triggered by the components. The method additionally includes detecting the event pattern in the plurality of real-time events to predict a potential future instance of the particular type of condition in the components of the system.

Preventing and servicing system errors with event pattern correlation

In one embodiment, data packets are captured from a network using a physical, network-connectable data capture probe. As the data packets are captured, the data packets are time-stamped with time-of-capture time-stamps. The time-stamped data packets are then stored; and in parallel, the time-stamped data packets are forwarded to at least one consumer in real-time.

Apparatus and methods for capturing data packets from a network

A system wherein work orders are used to accomplish polling of devices on a network. Work orders are created and passed to a scheduler which places the work order into one of a plurality of queues, based on the priority of the work order. As work orders are pulled from each of the queues, each work order is sent to a thread pool matching the priority, where the work order is executed. Within each work order is a run process that performs the actual polling of the node.

Method and apparatus for automated network polling

A task manager for operating and performing management tasks called for by a system administration manager. The task manager includes a command task manager for performing command tasks, a function task manager for performing function tasks, and a remote task execution manager for performing remote or distributed task. In addition, the task manager includes a single application program interface for interfacing the command task manager, function task manager, and remote task execution manager with the system administration manager. The task manager further performs error handling and automatic logging operations. The task manager uses a task registration manager which stores the individual task descriptions and makes them available to the task manager.

Growing community of inventors

Fort Collins, CO, United States of America

Richard Bennett Whitner