Method and system for improved in-line management of an information technology network

A system and a method for leveraging human knowledge held by system administrators to support improved or optimal management of an information technology network. The present invention monitors and records the states and values key management indicators related to actions taken by a human system administrator in improving a perceived sub-optimal state of the information technology network. The present invention predicts the effect of command in situations later occurring, and optionally suggests actions to a system administrator. The method of the present invention optionally enables embodiments of the present invention to automatically select one or more preferred system commands and execute the selected command or commands.

FIELD OF INVENTION

The present invention relates to the application of information technology networks and systems in supporting an activity or a process. More particularly, the present invention relates to systems and techniques for improving system management responses to degradation or interruption of an activity, a process, an information technology network, or an information technology system.

BACKGROUND OF INVENTION

Information technology is applied in many sectors of the economy to improve management of processes having a plurality or multiplicity of measurable parameters. The prior art attempts to provide and implement information technology techniques that enable an information technology network to automatically and aggressively respond to indications of sub-optimal states of a target or monitored process. Some of these prior art techniques attempt to empower an automated management system to enable self-healing of the information technology network, whereby the network learns to alter the operation of the information technology network independently of interaction with a human manager. Certain prior art attempts provide a software program that independently learns to isolate causes of process, equipment, information technology network or system degradation, and generates and executes strategies to return improve the operating state of the target process, network or system. Prior art of this type requires a learning cycle and often fails to adapt at a sufficient speed when applied within in a heterogeneous and morphing environment, wherein the reaction of the targeted process to commands is less related to historical behavior. Furthermore, requiring a software program to predict all possible outcomes typically hobbles prior art automation management as applied to complex processes, as the universe of possible root causes and potentially appropriate responses may increase geometrically or exponentially in relation to the number of measurable or measured parameters associated with a monitored or target process. In addition, as the potential for serious loss caused by a damaging response by a prior art automated management system increases as the criticality of a process increases, the application of prior art self-healing techniques and other automated software driven management of processes, networks and systems are less likely to be applied where improvements in automated system management are most desired.

There is, therefore a long felt need for information technology management solutions that may conform to an existing hierarchy, scale to meet needs of various situations and organizational requirements, provide knowledge beyond status data and event descriptions, manage an information technology network in light of business priorities; and/or diagnose a state or trend of a process, network or system on a basis of information that includes data derived from human empirical review of observed and recent activity of, and date received by the information technology system.

OBJECTS OF THE INVENTION

It is an object of the present invention to provide guidance for use in improving the management of a process, an equipment, an information technology network, or an information technology system.

It is a further optional object of the present invention to provide a system that couples with or is comprised within an information technology network or system and that increases the effectiveness of support staff in responding to interrupted, degraded or sub-optimal network or system performance.

It is an object of certain preferred embodiments of the present invention to provide a method of determining the preferred actions for an information technology network or system manager to take in response to interrupted, degraded or sub-optimal performance of a process, an information technology network, or an information technology system.

It is a further object of certain preferred embodiments of the present invention to provide a method that extracts human knowledge about best or preferable practices in managing an information technology network or system by observing human interaction with the information technology system.

It is another optional object of certain preferred embodiments of the present invention to automate or semi automate responses to performance degradation, sub-optimal behavior, or interruption of an information technology network or system.

It is still another object of certain preferred embodiments of the present invention to provide a method to collect suggestions from human system administrators regarding information technology network or system behavior and management of information technology network or system behavior.

It is an additional object of certain preferred embodiments of the present invention to provide a system that forecasts information technology network or system behavior in response to network or system management actions.

Additional objects and advantages of the present invention will be set forth in the description that follows, and in part will be obvious from the description, or may be learned by practice of the present invention. The objects and advantages of the present invention may be realized and obtained by means of the instrumentalities and combinations particularly pointed out in the appended claims.

SUMMARY OF INVENTION

A method and system are provided for aiding the management of a process or an equipment by an information technology network or system. The process or equipment may be associated with the information technology network or system, or an equipment, process, network or system external to the information technology system. In a first preferred embodiment of the method of the present invention, key performance indicators are monitored, wherein an intervention request is generated when one or more key performance indicators enter into pre-specified ranges, states or values. A value, values, or range of values of one or more performance indicators (“KPI”) are identified and associated to define a key management indicator (“KMI”). A set of KMI's is stored within a first preferred embodiment, or First Network, for comparison with certain measurements or evaluations of the states or values of the KPI's. These certain measurements may include substantially current information concerning a process, an equipment, or an information technology network or system. One or more KMI may associated with a record of syslog data, commands, and performance data recorded within an incident record. When the plurality of KPI's includes at least one KPI that presents the states or values substantially similar to the pre-specified state, value, or ranges of values of a KPI associated with at least one KMI, the First Network responds by taking appropriate action, where the action is permitted by the First Network, and the action is the associated with the at least one KMI. The action may include issuing commands to one or more elements of the First Network, where a command may be a request for information. A human system administrator may then be alerted and provided with a record of the queries the network, analyzes the state of the network and the states and values of key management indicators, and information derived from or associated with one or more KMI's. The human system administrator, or sys admin, then issues commands to the information technology network with the intention to restore the process, equipment, or information technology network or system to a preferred state. Data describing or related to the intervention request, the states and values of one or more key management indicators and/or key performance indicators related to the intervention request and actions of the sys admin are recorded as an incident report and stored in an incident container. In certain alternate preferred embodiments of the present invention, the sys admin, or other human analyst or technician, may optionally (1) add data to the incident report and container, (2) tag data stored in the incident report and container, (3) annotate data stored in the incident report and container, and (4) exclude information from inclusion in the incident report and container. The information stored in the incident record and container may be selected by the sys admin for the purpose of creating a high level of relevancy of the data selected for storage, or allowed to be stored, in the incident container. The first preferred embodiment of the method of the present invention enables real-time, in-line capture of knowledge applied by a sys admin in responding to a sub-optimal state of an information technology network.

In certain alternate preferred embodiments of the method of the present invention, one or more alert values or state values of one or more KPI's or KMI's are established. An alert value may be a value at which a sys admin, or a computer system, should be or is alerted that the relevant KPI or KMI has met or exceeded a certain value. As described herein, it is an inventive aspect of certain alternate preferred embodiments of the method of the present invention that the present invention may automatically define, generate and/or apply KPI's and KMI's on the basis of the operational history of the present invention and actions taken by the sys admin in querying and managing the operation of an information technology network. In certain alternate preferred embodiments of the method of the present invention, one or more alert values or state values of one or more KPI's or KMI's are established automatically by an information technology management software program. An alert value may be a value at which a sys admin, or a computer system, should be, or is, alerted that the relevant KPI or KMI has met or exceeded a certain value.

It is understood that the terms “information technology system”, “information technology network”, and “IT network” are defined herein to include any configuration of two or more computational or electronics devices that are communicatively linked, two include configurations having two or more digital electronics devices that are communicatively linked with a each other and/or a monitor system. The term information technology system is comprised within the definitions of the terms “information technology network” and “IT network”.

A second preferred embodiment of the present invention, or Config TWO, comprises a context engine, a precast engine, an automation module, a key management indicator database, and an incident container. Config TWO generates predictions about network responses to possible commands. Config TWO may optionally be enabled to automatically select a preferred command or command sequence and execute the preferred command or command sequence.

BRIEF DESCRIPTION OF PREFERRED EMBODIMENTS

Referring now generally to the Figures and particularly toFIG. 1, a first information technology network2, or First Network2, includes a communications network4, and a variety of elements6, to include computational systems8, personal computers10, sensing devices12, wireless communications devices14, wireless communications transponders16, memory modules18, telephones20, electronic communications instruments22, electronic devices24, and an admin workstation26. The wireless communications transponders16are configured to provide unidirectional or bidirectional communications between the wireless communications devices14and the communications network2. The wireless communications devices14may be or comprise computational devices such as personal digital assistants, or telephony systems, such as cellular telephones. An admin workstation26, and the elements6, to include the computational systems8, the personal computers10, the sensing devices12, the wireless communications devices14, the wireless communications transponders16, the memory modules18, the telephones20, the electronic communications instruments22, and the electronic devices24either directly or via an intermediate electronic communications device28. The communications network4may be or comprise the Internet, an intranet, an extranet, a computer network, a telephony network, a wireless telephony network, and/or a wireless communications network.

The admin workstation26receives information regarding the conditions and states elements6and the processes of the elements6and the communications network4by monitoring the First Network2and by receiving alert messages and status readings from the elements6. The monitoring by the admin workstation26and the transmission of messages and readings to the admin workstation26may be event driven, and/or be time scheduled. Requests by the admin workstation26for reports of status or condition of one or more elements6, or of the First Network2may trigger communications from one or more elements6, wherein the communications, scheduled or unscheduled, provide information describing one or more parameters, conditions, or states of one or more processes or elements6of the First Network2. The information provided to the admin workstation26may include the values of one or more key performance indicators29(“KPI”) (as perFIG. 2) of the First Network2and/or one or more elements6.

A system memory30of the admin workstation26contains an incident report container software program32, or incident container32. The incident container32stores and makes available an incident library33having a plurality of incident records34that contain information related to previous incidents of experienced by the First Network2, or that might be of interest to a sys admin tasked with supporting the operations of the First Network2.

Referring now generally to the Figures and particularly toFIG. 2,FIG. 2shows a hierarchy of software modules M2useful in managing the resources of the First Network2ofFIG. 1and supporting business systems performance.

Referring now generally to the Figures and particularly toFIG. 3, the incident record34contains information36previously captured and stored, wherein the information36relates to one or more historical incidents that occurred on the First Network2or other IT networks. A Key Management Indicator (“KMI”)38comprises a Boolean mathematical expression40, or incident signature40, that includes values of a plurality KPI's29related to the historical incident of the incident record34. Each KPI29is a numerical or logical value that describes the state of a specific KPI29. Each KMI38of each incident record34is formatted by placing each KPI29in a syntactical order, whereby each of the plurality KMI's38can be compared to determine to what degree of similarity each KMI38describes the states, conditions and parameters, as expressed by the plurality of KPI's29, as related to specific historical incidents. It is understood that various preferred embodiments of the method of the present invention may use suitable mathematical techniques known in the art to compare the degree of similarity or dissimilarity between the of values of the plurality of KPI's29as recorded separately in particular KMI's38. These alternate mathematical techniques for comparisons of KMI's38may include, in combination or in singularity, the application of Boolean logic expressions and Boolean operations, statistical analyses, logical value comparative techniques, and other suitable logical, mathematical and statistical methods known in the art.

In the preferred embodiment of the method of the present invention as practiced by means of the First Network2a plurality of KPI's29are defined as describing the state of specific parameters of elements6, the communications network4, and processes of the First Network2. For example the first KPI42is a Boolean value that indicates whether a computer system44, an element6of the First Network2, is operating above or below a given level of loading. A second KPI46is a Boolean value that indicates whether a memory module48of the computer system44is above or below a pre-specified level of free storage space. A third KPI49is a Boolean value that indicates whether the communications network4is transmitting more or less of a pre-specified volume of electronic message volume. By comparing the first KPI42, second KPI46, and third KPI48, and other predefined KPI's29that are ordered within each KMI38according to an identical syntax, Boolean logic techniques can determine the degree of similarity between any two KMI's38. It is understood that the certain preferred embodiments of the method of the present invention allow for the condition of “do not care”, wherein the degree of similarity between two KMI's38is not affected by a KPI29that is designated as being irrelevant, i.e., “do not care”, to a particular comparison or class of comparisons between or among the KMI's38. It is also understood that weighted averaging techniques may be applied within certain still alternate preferred embodiments of the method of the present invention, wherein the degree of similarity between two KMI's, as determined by mathematical, computational or logical operations, is affected by assigning greater or lesser significance to one or more KPI's29. For example, a match between the first KPI's42of two individual KMI's38may be less relevant to describing the similarity of the two individual KMI's38than a match between the third KPI's48of the compared KMI's38. For example, a weighted average technique might assign a fractional value significance to a match between the first KPI's29and a double value significance to a match between the third KPI's29of the compared KMI's38.

Referring now generally to the Figures, and particularly to the incident record34, or incident report34, ofFIG. 2, the incident report34comprises five incident aspect sections50, consisting of (1) the KMI38having the incident signature40, (2) an alarm record52, (3) a syslog list54, (4) a plurality of command citations56, and (5) performance data58. Each aspect section50may contain information related to a same historical incident of the First Network2. The information contained in each aspect section50may have been selected for entry into the incident report34by a sys admin and as according to the method of the present invention. It is understood that the term command is defined herein to include requests for information and other queries that may be addressed to or via the First Network2.

Referring now generally to the Figures and particularly toFIG. 4AandFIG. 4B,FIG. 4AandFIG. 4Bcomprise a process flow chart of a preferred embodiment of the method of the present invention that may be effected via the First Network2by means of an in-line management software program60, or in-line tool60. The in-line tool60may be stored in the system memory30of the admin workstation26, or the in-line tool60may distributively stored in whole or in portions within the First Network2, the memory modules18, the system memory30, and other suitable electronic elements6known in the art.

The process flow chart ofFIG. 4AandFIG. 4Bis driven and managed by the in-line tool60in coordination with the First Network2. In step A100values of KPI's29and alert messages are acquired or received by the admin workstation26via the communications4. In step A102the in-line tool60determines if any alert messages have been acquired or received via the First Network2. If an alert is not received, the in-line tool60moves on to step A104. If an alert message is received or acquired the in-line tool60proceeds beyond step A104, as described below, to execute an analysis of the states and condition of the First Network2in light of the incident library33and as described herein.

In step A104the in-line tool60compares the acquired KPI's29to values of a trigger signature62, whereby if the values of the acquired KPI's29present a commonality of a pre-specified degree with the values of the trigger signature62, the in-line toll60proceeds to create a current signature state64in step A.106. The current signature state64includes a current incident sate66(“CIS”), wherein the CIS66is formatted according to the syntax of the KMI38and contains some or all of current values of the KPI's29of the KMI38. It is understood that the CIS66may contain null values of one or more KPI's29and/or values of one or more KPI's29that are not the most recent available, as external conditions or other causes may limit or affect the capability of the in-line tool60to efficiently or timely acquire the most current value of all relevant KPI's29.

An alternate route to step A106exists from step A102, wherein the in-line tool60jumps from step A102to step A106on the occurrence of a positive finding by the in-line tool of an acquired or received alert.

In step A108the CIS66is compared to a first incident record68of the incident library33and a measure of the degree of similarity70of the CIS66and the first incident record68is computationally generated, optionally using Boolean logic methods, statistical techniques, and/or weighted averaging techniques. In step A110the measure of the degree of similarity70is compared against a similarity threshold value72. Where the measure of the degree of similarity70exceeds the similarity threshold value72, the first incident record70, or a pointer to or identifier of the first incident is stored in a match pool74in step A112. If the measure of the degree of similarity70does not exceed the similarity threshold value72, the in-line tool60proceeds on in step A114to determine if there is an additional incident record34that has not been compared to the CIS66. The loop from step A.106to step A.114is repeated until all of the incident records34of the incident library33have been compared with the CIS66, and the incident records34that exhibit a pre-specified of the degree of similarity as required by step A108are all stored, or pointers to or identifiers of the selected incident records34, in the match pool74. A current incident is detected and initiated when a single incident record34and the CIS66meets or exceeds the degree of similarity as tested for in step108.

Referring now generally to the Figures, and particularly toFIG. 3,FIG. 4AandFIG. 4B, when a current incident is detected, the in-line tool60proceeds in step A116a context analysis engine76of the in-line tool60accesses the incident records34stored in or indicated by the match pool74from the match pool74and/or the incident library33. As discussed above, each incident record34contains information included in the incident aspect sections50of (1) the KMI38having the incident signature40, (2) an alarm record52, (3) a syslog list54, (4) a plurality of command citations56, and (5) performance data58. Each aspect section50may contain information related to a same historical incident of the First Network2.

A policy rules engine78, or policy engine78, is accessed by the context analysis engine76whereby the policy engine informs the context analysis engine76, or context engine76, of permissions and/or prohibitions that empower or limit actions and commands that the in-line tool60may automatically without permission from a sys admin. It is understood that the policy engine78may optionally further prohibit certain acts or commands even in the event that the sys admin communicates permission to the in-line tool60. It is further understood that in certain alternate preferred embodiments of the method of the present invention the context engine76may interpret a lack of a prohibition by the policy engine78of an act, or a lack of a prohibition by the policy engine78of an issuance or execution of a command, as permission to take the non-prohibited act, issue the non-prohibited command, or execute the non-prohibited command. It is further understood that in certain still alternate preferred embodiments of the method of the present invention the context engine76may interpret a lack of the policy engine78to issue permission to perform an act, or a lack of the policy engine78to issue a permission to issue or execute a command, as a prohibition against making the unauthorized act, or issuing the unauthorized command, or executing the unauthorized command.

The context engine76collates the syslog lists54and the command citations56of the incident records34for the steps following in the preferred embodiment of the method as described inFIG. 4AandFIG. 4B. In step A118a command analysis engine80determines the frequency of the occurrence of similar or identical commands in each of the incident records34delivered to the context engine76. As indicated in step A120, when the frequency of a particular command, or of a plurality of similar commands, as found within the command citations56delivered to the command analysis engine80, exceeds a pre-established threshold, the precise command or a generalized form of a group of similar commands is transferred into a command pool82in step A122. In step A124the commands from the command pool82are automatically executed by a command engine84, given that the execution of the command is permitted by the policy engine78. The command engine84may be directly informed of permissions and prohibitions of automatically exercising commands either by direct or indirect communication with the policy engine78, or by instructions sent from the context engine76as derived by the context engine76in interpreting the prohibitions and policies of the policy engine78.

In step A126any or some of the reported or detected results of the commands that were executed in step A124are recorded. In step A128a problem view software86contains the commands that were provided to the command analysis engine80, with indications of those commands that passed the threshold execution test of step A120, and with indications of the those commands that were executed in step A124, and the results of the executed commands as stored in step A126. The commands as stored in the problem view software86are thus tagged with (1) indications of similarity with other commands processed by the command engine84, (2) indication if the command was automatically executed by the in-line tool60in step A124, and (3) some or any reported or detected results of the execution of the command as per step A126.

Approximately simultaneously with the execution of steps A118through A128that deal with command analysis a series of steps A130through A136are processed by the in-line tool60. In step A130the syslog lists54, of the incident reports34and as delivered to the context engine76in step A116, are scanned and recorded. In step A132the syslog lists54are processed through an automated regular expression analyzer88. The output of the automated regular expression analyzer88is delivered to a log scanner90in step A132, wherein the log scanner90accesses a current log database92for comparison with the output of the regular expression analyzer88, whereby the information derived from the syslog lists54and delivered to the log scanner90is tagged where significant or substantive commonality is found between the output of step A132and the contents of the current log data base. In step A134a syslog engine92executes syslog information tagged in step A132where the tagged information is actionable, and the potential action is in accordance with the rules of the policy engine78. In step A136results detected in associated with execution of syslog information as per step A134are recorded. In step A138the tagged syslog information of step A132, the actions of step A134and the detected results of step A136are stored in the problem view software86.

In step A140some or all of the information delivered to the problem view software86is presented to the human sys admin via a display device94of the admin workstation26. The human sys admin is thereby with information by the in-line tool60that describes the actions of the in-line tool60and information stored in one or more incident reports34.

In step A142the in-line tool60creates a temporary incident record96and records information related steps A100through A140, and the interaction of the human sys admin with the First Network2. In step A144the sys admin selects information presented provided by the First Network2into a current incident report98. The sys admin may additionally annotate the current incident report with comments or other information in step A146.

The in-line tool60performs an advanced analysis of the syslog list54and the commands citations56of the selected KMI's of step A112in steps A148through A152. In step A148the in-line tool60compares the information recorded in the temporary incident record96, the current incident report98and/or the problem view software86with the selected KMI's38stored in the match pool74as per step A112. More particularly, in step148an advanced measure of the degree of similarity100and the information of the KMI's38stored in the match are compared optionally using Boolean logic methods, statistical techniques, and/or weighted averaging techniques. In step A148the advanced measure of the degree of similarity100is compared against a similarity threshold value102. In step A150some or all of each incident record34of the KMI's associated with the advanced measures of the degree of similarity100that exceeds the similarity threshold value102are stored in a performance match data pool104. In step152the performance data stored in the performance match data pool104is compared with performance data of the temporary incident record96, the current incident report98and/or the problem view software86. It is understood that the performance data of step152may be descriptive of the values of states of one or more KPI's29as maintained or varied over a period of time. As the comparisons of step A152may be computationally intensive, the in-line tool60is designed to perform the comparisons of step A152after the potentially less computationally intensive actions of steps A100through A150in order to support a timely and efficient provision of information to the sys admin. It is understood that various preferred embodiments of the method of the present invention may use suitable alternate mathematical techniques known in the art to compare the degree of similarity or dissimilarity between the of values of the plurality of KPI's29as recorded separately in particular KMI's38and the performance data of the temporary incident record96, the current incident report98and/or the problem view software86. These alternate mathematical techniques for comparisons of step A152may include, in combination or in singularity, the application of Boolean logic expressions and Boolean operations, statistical analyses, logical value comparative techniques, and other suitable logical, mathematical and statistical methods known in the art.

In step A154the results of step A152are communicated to the problem view software86and thereby made available to the sys admin via the admin workstation28. In step A156the incident is terminated, either by the sys admin or the in-line tool60. In step A158the sys admin edits the current incident report98by addition of data, removal of data, and/or annotation. A new incident record106formatted in accordance with the format of the incident record34is generated by the sys admin or automatically by the in-line tool60in step A160, whereby information acquired during or via steps A100through A158, and as selected by the sys admin, is recorded. In step A162the new incident record106is stored in the incident container32and made available to the in-line tool60for steps A108through A160.

Referring now generally to the Figures and particularly toFIG. 4A,FIG. 4BandFIG. 5,FIG. 5is a view of a video screen110of a display device94of the sys admin workstation26of the First Network2as presented executing the method of the present invention ofFIG. 3. The sys admin may select several types of information for recording in the new incident record106by indicating and selecting text112and images114as displayed on the video screen110. The sys admin may indicate the text112and images114for selection by using a keyboard116and mouse118of the sys admin workstation26. The information displayed on the video screen110may originate from several sources, to include the problem view software86, information stored in the sys admin workstation26, information received from the communications network4, and information entered into the workstation26by the sys admin.

Referring now generally to the Figures and particularly toFIG. 3andFIG. 6,FIG. 6is a process flow chart of the creation of the new incident record106of the in-line tool60ofFIG. 3. In step B100ofFIG. 5an incident is initiated as per step A106ofFIG. 3. In step B102the in-line tool60creates the temporary incident record96, and the new incident report106. In step B104information flows into the temporary incident record96from several sources, to include KPI data, information entered into the sys admin workstation26by the sys admin, and information sourced from the incident reports34of the incident library33. In step B106information selected from the temporary incident record96is selected by sys admin for storage into the new incident record106. In step B108the sys admin may provide additional information to the new incident record106via the sys admin workstation26or the communications network4. In step B110the in-line tool60determines if the current incident has ended. The current incident may be ended automatically by the in-line tool60when pre-established criteria are met, or by direction of the sys admin. If the current incident has not ended then the in-line tool proceeds to execute steps B104through B110. When the current incident has terminated, the in-line tool then enables the sys admin to edit the current incident record106in step B112. After the step B112the in-line tool60stores the current incident record106as an incident report34in the incident library33, as per step B114.

Referring now generally to the Figures and particularly toFIG. 7,FIG. 7is a schematic diagram of a second preferred embodiment of the present invention, or Config TWO120. Config TWO120includes the communications network4, and a variety of elements6, to include computational systems8, personal computers10, sensing devices12, wireless communications devices14, wireless communications transponders16, memory modules18, telephones20, electronic communications instruments22, and electronic devices24. The communications network4may be or comprise the Internet, an intranet, an extranet, a computer network, a telephony network, a wireless telephony network, and/or a wireless communications network. The plurality of sensing devices12are configured within a manufacturing operation and provide the admin workstation26with information about the status of equipment, processes and environment of the manufacturing operation.

The admin workstation26receives information regarding the conditions and states elements6and the processes of the elements6and the communications network4by monitoring the communications network4and by receiving alert messages and status readings from the elements6. The monitoring by the admin workstation26and the transmission of messages and readings to the admin workstation26may be event driven, and/or be time scheduled. Requests by the admin workstation26for reports of status or condition of one or more elements6, or of the communications network5may trigger communications from one or more elements6, wherein the communications, scheduled or unscheduled, provide information describing one or more parameters, conditions, or states of one or more processes or elements6of the manufacturing operation. The information provided to the admin workstation26may include the values of one or more key performance indicators29(“KPI”) (as perFIG. 2) of the Config TWO120and/or one or more elements6.

The system memory30of the admin workstation26contains the incident container32. The incident container32stores and makes available the incident library33having a plurality of incident records34that contain information related to previous incidents of experienced by the Config TWO120, or that might be of interest to a sys admin tasked with supporting the operations of the manufacturing operation.

Referring now generally to the Figures and particularly toFIG. 4A,FIG. 4B,FIG. 7andFIG. 8,FIG. 8is a process flow chart of the operation of Config TWO120ofFIG. 7. It is understood that Config TWO120integrates the process steps ofFIG. 4AandFIG. 4Bwith the steps of the process flow chart ofFIG. 8.FIG. 8illustrates steps taken by the in-line tool60in providing data to the context engine76from (1) the incident library33and (2) information from a policy database122in order to determine what actions may be automatically taken by the in-line tool60. The policy rules engine76may be comprised within the policy database122. A precast module124informs an automation engine126of commands that are to be executed, as well as providing information to the incident library33concerning the current incident. The automation engine126executes command as directed by the precast module124. The incident library33stores the new incident report34in a KMI library128for later access by the context engine76.

The pre-cast module124includes set of algorithms that analyze key performance indicators to provide context and actions. The output of the pre-cast module124comprises a set of execution instructions that interact with hardware, software or the end-user to correct a problem of the First Network2or obtain additional Key Performance Indicators. A first set of instructions is a prediction of automated actions to correct an identified problem, and commands that interact with the hardware and software infrastructure of the First Network2. A second set of instructions is a prediction of the types of information to be collected of an environment base on historical interaction between the sys admin and the First Network2during troubleshooting. This environment base on historical interaction may include records of interrogation of hardware and software for additional diagnostic information by the sys admin and/or the in-line tool.

A consolidation engine130includes a series of software information handlers or programs that normalize information from disparate systems into an XML format that can be easily imported into the system. A correlation engine132comprises a software program that ties together KPI information delivered by the consolidation engine130with an infrastructure inventory of the First Network2. The infrastructure inventory can be or include a base model or list of equipment identifications (e.g., specific workstation identifiers), Internet Protocol addresses, time parameters, and other suitable aspects, features or characteristics of a communications network known in the art.

Referring now generally to the Figures and particularly toFIG. 9,FIG. 9is a schematic diagram of a decision tree134useful in relating the current incident state66ofFIG. 5to the library33of incident records34ofFIG. 5. The decision tree134includes a plurality of decision nodes135and may be used by certain alternate preferred embodiments of the present invention to select incident records34that are correlated to a greater or lesser degree with the information contained in the CIS66. As represented inFIG. 9, a particular set of KPI's of an instant CIS136is formatted in Cells138ordered in a syntax from Cell1to Cell107. The decision tree134is implemented to select incident records34that present similar or equal values of individual selected Cells138. For example, a decision node N11compares the instant CIS136for matching with the plurality of the incident records34of the library33, wherein the determination of a match of an individual incident record34with the instant CIS136is based upon the existence of a value of “C” in the Cell2of the CIS136and in the Cell2each of the incident records34. Following the hierarchy of the decision tree134a decision node N21compares a value of the Cell102of the instant CIS136with the library of incident records33to identify a subset of the records34that each have a matching value of “C” in the Cell102. It is understood that the hierarchy of decision nodes may present an order in which values of individual Cells138of the instant CIS136and each, or subset of, the incident records34of the incident library33or compared to determine matches with the instant CIS136and each incident record34.

Additionally or alternatively, and as is well known in the art, the decision tree134typically may be represented using a plurality of decision nodes135, each decision node135incorporating a test criterion, and the decision tree134being organized into a plurality of paths or branches140. The branches140may be are selectively traversed for the instant CIS136based upon the application of the attributes, e.g., KPI's, of the instant CIS136to the test criteria defined within the decision tree134. In the decision tree134, the decision nodes135may represent the termination points of paths140through the decision tree134. A decision node135may be associated by the in-line tool160with identifiers (e.g., pointers or record ID's) of the incident records34that best meet the test criteria for a particular instant CIS136. It is then with these incident records34that nearest-neighbor matching is performed to attempt to predict an outcome of, or suggest appropriate responses to, the CIS136based upon the outcomes and histories of the incident records34of the subset the incident records34of the incident library33identified by the decision tree134.

Consistent with certain alternate preferred embodiments of the present invention, each decision node135within a decision tree path140may be associated with a particular search criterion, e.g., a structured query language or other form of database query that will retrieve the case identifiers that satisfy each test and answer combination. Thus, at each decision node135, a set of case identifiers that meet the test criterion for that node are dynamically generated. Then, using set intersection, the cases that meet all of the criteria in a path may be dynamically selected.

As an added benefit, in some embodiments, dynamically generating a subset permits a only a portion of a path in a decision tree to be used, e.g., until a candidate case set is small enough to perform efficient nearest-neighbor matching. A result set of matching cases may be dynamically “pared down” from the entire search space at each decision node135in a path140, until a moderate number of cases remain in the result set, whereby an effectively variable-length decision tree paths are defined. As an additional benefit, in many instances, the decision tree need134not be modified each time a new case is added to the incident library33. Such an advantage can be realized based upon the fact that generalizations often do not need to be completely in synchronization with the most current data in a case library33to be useful.

In certain still alternate preferred embodiments of the method of the present invention the incident records33selected by means of the decision tree134and for consideration by the in-line tool160in determining the recommended actions are communicated to the sys admin, and/or provided to the automation engine for automatic execution. As one optional feature of certain yet alternate embodiments of the method of the present invention, the set of incident records33selected by the decision tree134as matching the instant CIS136may be selected on variable degrees of matching. For example, a high degree of matching may require that only those incident records34that match values of each and every Cell138of the instant CIS136compared in execution of the decision tree134are selected for processing by the in-line tool160. Alternatively, the degree of matching may be set that those incident records that match values of only 75% of the Cells138of the instant CIS136compared in execution of the decision tree134are selected for processing by the in-line tool160. The degree of matching may be optionally be set by the sys admin or by a directive of the policy engine, or by the organization of the decision tree134itself. As one example of varying the degree of matching required to select an incident record34for examination by the in-line tool160, consider that if a match is found between the values of the instant CIS136and an incident record34of a particular and pre-identified Cell138, then the degree of matching required may be raised or lowered, in recognition of the degree of significance of the match of the value of the particular and pre-identified Cell138.

Many features have been listed with particular configurations, options, and embodiments. Any one or more of the features described may be added to or combined with any of the other embodiments or other standard devices to create alternate combinations and embodiments. The features of one of the functions may also be used with other functions. For example, a scaled measurement could be converted to a nominal value such as a wire gauge.

Although the examples given include many specificities, they are intended as illustrative of only one possible embodiment of the invention. Other embodiments and modifications will, no doubt, occur to those skilled in the art. Thus, the examples given should only be interpreted as illustrations of some of the preferred embodiments of the invention, and the full scope of the invention should be determined by the appended claims and their legal equivalents.