Compound alarms

In accordance with the teachings of the present disclosure, a method of generating a computer alarm is disclosed. The method includes determining a new instance of a characteristic of an element of a computing network to be monitored, identifying a relationship of the element to other elements of the computing network, and automatically creating an alarm threshold for the new instance of the characteristic based upon the relationship of the element to the other elements of the computing network.

BACKGROUND

The present disclosure relates generally to information services infrastructure and network management, and more specifically, to automatically generating compound alarms for monitored elements of a computer system. Computer systems may include many elements communicatively coupled to one another via a network. Network and system administrators may manage network elements using various software tools, which may include a graphical user interface.

Application code runs on computer systems. One application may have code running on various elements of a computer system. The application itself may be managed by network or system administrators using various software tools which measure various monitored characteristics of the application itself, as well as the various elements of the computer system on which the application is running.

Traditional graphical user interfaces for software tools used by network and system administrators to monitor elements of a computer system may display data related to various monitored characteristics of the elements. The data related to the monitored characteristics may be displayed in the form of metrics, each of which may represent a measure of a particular monitored characteristic.

BRIEF SUMMARY

According to one aspect of the present disclosure, a method of generating an alarm is disclosed. The method includes determining a new instance of a characteristic of an element of a computing network to be monitored. The method further includes identifying a relationship of the element to other elements of the computing network. Additionally, the method includes automatically creating an alarm threshold for the new instance of the characteristic based upon the relationship of the element to the other elements of the computing network.

According to another aspect of the present disclosure, a computer-readable storage medium, comprising computer-executable instructions carried on the computer readable medium is disclosed. The instructions are readable by a processor and, when read and executed, are configured to cause the processor to determine a new instance of a characteristic of an element of a computing network to be monitored. The instructions are further configured to, when read and executed, cause the processor to identify a relationship of the element to other elements of the computing network. The instructions are also configured to, when read and executed, cause the processor to automatically create an alarm threshold for the new instance of the characteristic based upon the relationship of the element to the other elements of the computing network.

According to yet another aspect of the present disclosure, an apparatus for generating an alarm for a computer system is disclosed. The apparatus includes a processor and a memory communicatively coupled to the processor. The memory includes instructions configured to, when read and executed, cause the processor to determine a new instance of a characteristic of an element of a computing network to be monitored. The instructions are further configured to, when read and executed, cause the processor to identify a relationship of the element to other elements of the computing network. The instructions are also configured to, when read and executed, cause the processor to automatically create an alarm threshold for the new instance of the characteristic based upon the relationship of the element to the other elements of the computing network.

DETAILED DESCRIPTION

Any combination of one or more computer readable media may be utilized. The computer readable media may be a computer readable signal medium or a computer readable storage medium. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium would include the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an appropriate optical fiber with a repeater, a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.

In accordance with the teachings of the present disclosure, a system may be provided that is configured to monitor a network of computing elements and automatically create a compound alarm condition for one or more of the computing elements. In one embodiment, the compound alarm may be based upon a topology of the computing elements. In another embodiment, the compound alarm may be based upon relationships between the computing elements. Particular embodiments and their advantages are best understood by reference toFIGS. 1 through 4, wherein like numbers are used to indicate like and corresponding parts.

FIG. 1is a block diagram of an example system100, which may include a, for example, a plurality of elements115, a monitoring node130, and a network120. Each element115may include a physical or logical element communicatively coupled to monitoring node130via network120. For example, each element115may include a server (e.g., blade server or rack server), personal computer (e.g., desktop or laptop), tablet computer, mobile device (e.g., personal digital assistant (PDA) or smart phone), network storage device, printer, switch, router, data collection device, virtual machine, script, executable, firmware, library, shared library, function, module, software application, or any other suitable device or application. Although example system100is shown inFIG. 1as including a particular number of elements115, a system may include more than or fewer than the number of elements115illustrated. Similarly, although example system100is shown inFIG. 1as including elements115of particular types, a system may include elements115of types other than those shown inFIG. 1.

Network120may include a network and/or fabric configured to communicatively couple elements115, monitoring node130, and/or any element associated with system100. Network120may be implemented as, or may be a part of, a storage area network (SAN), personal area network (PAN), local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), a wireless local area network (WLAN), a virtual private network (VPN), an intranet, the Internet or any other appropriate architecture or system configured to facilitate the communication of signals, data and/or messages (generally referred to as data). Network120may transmit data using any storage and/or communication protocol, including without limitation, Fibre Channel, Frame Relay, Asynchronous Transfer Mode (ATM), Internet protocol (IP), other packet-based protocol, small computer system interface (SCSI), Internet SCSI (iSCSI), advanced technology attachment (ATA), serial ATA (SATA), advanced technology attachment packet interface (ATAPI), serial storage architecture (SSA), integrated drive electronics (IDE), and/or any combination thereof. Network120and its various components may be implemented using hardware, software, or any combination thereof.

Monitoring node130may include a processor132, a memory134, and a monitoring module136. Processor132may be communicatively coupled to memory134and monitoring module136. Processor132may include any system, device, or apparatus operable to interpret and/or execute program instructions and/or process data, and may include without limitation a microprocessor, a microcontroller, a digital signal processor (DSP), an application specific integrated circuit (ASIC), or any other digital or analog circuitry configured to interpret and/or execute program instructions and/or process data.

Memory134may be configured in part or whole as application memory, system memory, or both. Memory134may include any system, device, or apparatus configured to hold and/or house one or more memory modules. Each memory module may include any system, device or apparatus configured to retain program instructions and/or data for a period of time (e.g., computer-readable storage media).

Monitoring module136may include computer-program instructions resident in memory134(or another computer-readable medium communicatively coupled to monitoring node130) and capable of being executed by processor132. Monitoring module136may be configured to monitor various characteristics of elements115. Such characteristics may include, but are not limited to, utilization, response time, performance, throughput, transaction count, and other characteristics related to usage and/or performance of elements115. Monitoring module136may be configured to collect data related to various metrics. Each metric may represent a measure of a particular monitored characteristic. Where a single characteristic is referenced, it may be understood that multiple characteristics may be monitored and/or utilized. Data related to a particular metric may include values representing a measure of the particular monitored characteristic. In some embodiments, the data collected by monitoring module136may be stored in memory134. In other embodiments, the data collected by monitoring module136may be stored in storage140.

Storage140may include a database, directory, or other data structure operable to store data. Further, storage140may include any instrumentality or aggregation of instrumentalities that may retain data and/or instructions for a period of time. Storage140may include random access memory (RAM), electrically erasable programmable read-only memory (EEPROM), a Personal Computer Memory Card International Association (PCMCIA) card, flash memory, solid state disks, hard disk drives, magnetic tape libraries, optical disk drives, magneto-optical disk drives, compact disk drives, compact disk arrays, disk array controllers, and/or any suitable selection or array of volatile or non-volatile memory operable to store data.

Monitoring node130may be implemented in any suitable portion of system100. Although monitoring node130is illustrated as a node separate from elements115, in various embodiments monitoring node130may be implemented in one of elements115. Furthermore, in various other embodiments, multiple instances of monitoring node130may be implemented in various ones of elements115.

Monitoring module136may be configured to actively and/or passively monitor elements115. For example, monitoring module136may actively monitor a particular element115by querying element115for specific information and/or measuring the time it takes element115to respond to queries. Monitoring module136may passively monitor a particular element115by, for example, accessing and analyzing an error log, or other performance related log maintained by an element115or another component of system100. Furthermore, monitoring module136may monitor elements115by sniffing or evaluating data as it is passed through an instance of monitoring module136.

In accordance with the teachings of the present disclosure, monitoring node130may be configured to analyze data collected by monitoring module136and trigger an alarm if data related to a monitored characteristic of one or more elements115or indicates a problem, issue, or condition. The thresholds for the characteristics may be defined by monitoring module136and may be applied based on the type of characteristic. Furthermore, the thresholds may be applied automatically to a newly detected element115or connection thereof. Thus, the thresholds may be applied automatically to a new source of a demand for a resource. The thresholds may include a default value to be applied automatically. For example, given a connection between element115Q and element115U, monitoring module136may be configured to set an alarm if the bandwidth utilization between elements115Q and115U reaches a threshold of 95%. In another example, given an available shared service operating on element115X, monitoring module136may be configured to set an alarm to any other element115connecting to element115X such that the alarm is triggered if a given one of such elements connecting to element115X utilizes greater than 25% of the available service.

An alarm may be implemented in any suitable manner. For example, an alarm may be implemented as a notation in a database, record or file; as an electronic communication to a user of system100or monitoring module136; as an electronic communication to another portion of system100for handling; or as a visual or audible indicator within a monitoring program. An alarm may be a compound alarm by, for example, inclusion of thresholds for multiple characteristics; thresholds for characteristics on multiple elements; or logical or predicate bases for characteristic thresholds.

An alarm may be based upon any suitable threshold, binary determination, trend, or pattern in data related to a monitored characteristic. For example, an alarm may include thresholds that identify deviations from known safe usage trends and/or patterns. An alarm may be based upon underutilization or overutilization of a resource, node, element, or service of system100. Furthermore, an alarm may be based upon determined activity associated with malware or electronic intrusion.

In one embodiment, an alarm may be based upon multiple monitored characteristics. For example, a high transaction count for an element115processing network transactions may not violate a threshold and thus not trigger an alarm. However, the combination of a transaction count exceeding a threshold with a low response time below another threshold for the particular element115may trigger an alarm. In another embodiment, an alarm may be based upon a monitored characteristic from two or more elements115. For example, an alarm may be triggered when two peer nodes both exceed utilization rates of 90% for a threshold period of time, whereas a single such node exceeding the utilization rate would not trigger the alarm.

An alarm for one or more elements115may be automatically created based upon the relationship with other elements115. Such relationships may be expressed by, for example, the topology of network100with respect to elements115or by a connection between any given elements115. Furthermore, the automatically created alarm may be based upon monitored characteristics of element115.

FIG. 2is an example graph200of topologies of elements115for which an alarm may be automatically created, in accordance with the teachings of the present disclosure. Graph200illustrates various elements202,204,206,208,210,212,214,216,218,220,222,224, each of which may be implemented by any suitable one of elements115illustrated inFIG. 1. Although a particular number and arrangement of elements is illustrated inFIG. 2, any suitable number, combination, arrangement, or topology of elements may be used. Such topologies may be physical or virtual.

One or more elements in graph200may be arranged in a subnetwork226. For example, elements202,204,206,208,210,212,214,216, and218may be arranged in subnetwork226. One or more elements in graph200may be arranged in a subnetwork228. For example, elements220,222, and224may be arranged in subnetwork228.

The elements of subnetworks226,228may be arranged in any suitable manner. For example, subnetworks226,228may be implemented as a tree hierarchy, loop, ring, bus, star, point-to-point, mesh, or daisy-chain. In the example ofFIG. 2, subnetwork226may be implemented as a tree hierarchy, with element202as the root node of the hierarchy. Element202may have any suitable number and kind of children, such as elements204,206,208,210. Furthermore, elements204,206,208,210may have any suitable number and kind of children. For example, element204may have child elements212,214,216and element208may have element child218. In another example, element208may have child element218.

Furthermore, in the example ofFIG. 2, subnetwork228may be implemented as a tree hierarchy, with element220as the root node of the hierarchy. Element220may have any suitable number and kind of children, such as elements222and224.

Any suitable number and kind of topologies and relationships may exist between any given two elements in graph200. For example, the tree hierarchy of element202may include elements202,204,206,208,210,212,214,216,218. The tree hierarchy of element204in turn may include elements204,212,214. The tree hierarchy of element208may include elements208,218. The tree hierarchy of element220may include elements220,222,224.

In another example, element204may have peer elements such as elements206,208,210. These elements in turn may have each other and element204as peers, forming a peer group. Element212may have elements214and216, which in turn may have each other and element204as peers, forming a peer group. Element222may have element224as a peer, and vice-versa, forming a peer group.

In yet another example, various elements inFIG. 2may form electronic communication connections with each other. Such connections may include, for example, utilization by one element of a resource on another element. In another example, such connections may include data transfer from one element to another. In the example ofFIG. 2, connections may exist between elements212and222, spanning elements212,204,202,220,222and network120. Connections may exist between elements212and224, spanning elements212,204,202,220,224, and network120. Connections may exist between elements214and222, spanning elements214,204,202,220,222and network120. Furthermore, connections may exist between elements218and222, spanning elements218,208,202,220,222and network120.

Each of elements202,204,206,208,210,212,214,216,218,220,222,224may be associated with one or more monitored characteristics. The characteristics monitored for each of elements202,204,206,208,210,212,214,216,218,220,222,224may include the same or different characteristics. In one embodiment, all elements of a given topology or connection may share a common group of monitored characteristics. A given topology or connection may establish monitored characteristics by default according to, for example, settings for a topology or by the type of connection.

Monitoring module136may be configured to automatically create an alarm for one or more of the elements illustrated inFIG. 2based upon the relationship of a given element with other elements. In one embodiment, monitoring module136may be configured to automatically create an alarm for an element based upon a topology associated with the given element. In a further embodiment, other alarms may be automatically created or modified for other elements related to the given element within the topology. In another embodiment, monitoring module136may be configured to automatically create an alarm based upon a connection from a given element to another element. In a further embodiment, other alarms may be automatically created or modified for other elements that are associated with the connection or of the same topology of the given element.

Monitoring module136may be configured to automatically create an alarm for an element at any suitable time. In one embodiment, monitoring module136may be configured to automatically create an alarm as an element is added to a topology. In another embodiment, monitoring module136may be configured to automatically create an alarm as an element establishes a connection to another element.

FIGS. 3A and 3Billustrate example operation of system100for automatically generating alarms for elements of graph200, in accordance with the teachings of the present disclosure. In the example ofFIGS. 3A and 3B, each element may be associated with a definition of one or more associated alarms. For example, element202may include alarms302. Although alarms such as alarms302are illustrated as resident within respective elements, such alarms may be stored in any suitable portion of system100. For example, all alarms may be stored with the associated probe such as monitoring module136.

Monitoring module136may determine that, for example, element216has been added to tree hierarchy226. Monitoring module136may determine the location of element216and its peers. Based on such a determination, monitoring module136may automatically generate one or more alarms for element216. The alarm may be based upon resources of system100for which element216has access. To determine what alarm or alarms are to be generated, monitoring module136may use any suitable mechanism.

In one embodiment, monitoring module136may access system settings326to determine how to define alarms for element216. System settings326may specify default thresholds for resources accessed or used by element216. For example, system settings326may specify that an instance of Alarm1is to be populated into the alarms of any newly created element such as element216, wherein Alarm1specifies that an alarm is to be triggered if processor utilization of element216exceeds ninety percent for longer than thirty minutes. This alarm may be added to alarms316. In another example, system settings126may specify that elements of a given type will be automatically created with a specified alarm. Thus, if element216is of a type X, then monitoring module136may automatically create Alarm7for element216. This alarm may be added to alarms316. Furthermore, system settings326may specify how or which other alarms may be replicated or reproduced to automatically create alarms for element216. System settings326may be specified by a user or administrator of system100. Furthermore, system settings326may be specified by another portion of system100. System settings326may be stored in, for example, a file, database, record, or other suitable structure.

In another embodiment, monitoring module136may determine alarms for element216based upon elements in the peer group of element216. Monitoring module136may traverse the hierarchy to determine the elements of the peer group. For example, monitoring module136may automatically create alarms for element216based upon existing alarms in elements212and214. These alarms may be added to alarms316. In a further embodiment, monitoring module136may determine all applicable alarms from elements212,214and automatically create equivalent alarms for element216. For example, monitoring module136may determine that Alarm2, Alarm3, Alarm4, and Alarm5are all alarms within the peer group of element216and automatically create new instances of these for element216. In another, further embodiment, monitoring module136may determine what alarms are common to elements in the peer group. For example, monitoring module136may determine that Alarm2and Alarm3are common to elements212,214and automatically create new instances of these for element216. These alarms may be added to alarms316.

In yet another embodiment, monitoring module136may determine alarms for element216based upon the hierarchy in which element216is present. For Monitoring module136may first traverse the hierarchy to determine the elements for which element216is a child. For example, monitoring module136may automatically create alarms for element216based upon alarms specified by element202as alarms for the entire tree hierarchy. Thus, monitoring module136may automatically create an instance of Alarm8for element216. This alarm may be added to alarms316. In another example, element216may inherit alarms from the element from which element216depends in the hierarchy. Thus, monitoring module136may automatically create an instance of Alarm6for element216, as element216is a child of element204. This alarm may be added to alarms316.

In various embodiments, any suitable number or kind of existing alarms may be updated or modified based upon the addition of an element. For example, the addition of element216may cause modifications to alarms in the peer group of element216or in parent or grandparent elements. In another example, the addition of element216may cause modifications to alarms in any other element accessing or sharing common resources with element216.

In the example ofFIG. 2, a set of alarms304associated with element204, the parent element of the newly added element216, may be updated based upon the addition of element216. Alarms304may specify Alarm9which includes monitoring network usage by child elements of element204such that, for example, network usage does not exceed a specified threshold. Alarm9may already include considerations of network usage by elements212,214. Upon the addition of element216, monitoring module136may automatically modify alarms304to add an additional condition that network usage by element216is not to exceed the specified threshold.

Monitoring module136may determine that, for example, element212has formed a connection to another element, such as element222. The connection may include a use of a resource of the other element. For example, a virtual machine running on or through element212may access a datastore of element222. Monitoring module136may traverse the connection to determine related portions of system100, such as elements204,202, network120, elements220,222. The alarms of each such element may be modified as necessary. Furthermore, monitoring module136may determine whether any other elements are accessing the shared resource. In response, monitoring module136may add conditions associated with element212's usage to existing alarms of related elements. Once monitoring module136has determined the destination identity, monitoring module136may determine the resource capacity. In one embodiment, monitoring module136may determine whether any other alarms exist with respect to the resource. For example, monitoring module136may determine that element214also access element222, or at least has an alarm related to usage of element222and its datastore. Alarms314may include Alarm10with a threshold of fifty-percent usage of element222. Given the determined capacity of element222and/or the determined existing alarm, monitoring module136may automatically create Alarm11for use by element212in its alarms312.

FIG. 4is a flowchart of an example method400for automatically creating alarms, in accordance with the teachings of the present disclosure. AlthoughFIG. 4discloses a particular number of steps to be taken with respect to example method400, method400may be executed with more or fewer steps than those depicted inFIG. 4. In addition, althoughFIG. 4discloses a certain order of steps to be taken with respect to method400, the steps of these methods may be completed in any suitable order. Method400may be implemented using the system ofFIGS. 1-3or any other suitable mechanism. In certain embodiments, method400may be implemented partially or fully in software embodied in computer-readable storage media.

Program instructions may be used to cause a general-purpose or special-purpose processing system that is programmed with the instructions to perform the operations described below. The operations may be performed by specific hardware components that contain hardwired logic for performing the operations, or by any combination of programmed computer components and custom hardware components. Method400may be provided as a computer program product that may include one or more machine readable media having stored thereon instructions that may be used to program a processing system or other electronic device to perform the methods.

In some embodiments, method400may begin at405. At405, the monitoring module of a monitoring node (such as shown inFIG. 1) may determine whether a new element has been introduced into a system, or whether a new connection of resource usage has been made between elements. As discussed above with respect toFIG. 1, each element may include a server (e.g., blade server or rack server), personal computer (e.g., desktop or laptop), tablet computer, mobile device (e.g., personal digital assistant (PDA) or smart phone), network storage device, printer, switch, router, data collection device, virtual machine, script, executable, firmware, library, shared library, function, module, software application, or any other suitable device or application. The particular characteristics of each element that may be monitored may, for example, be determined and set by system preferences. The monitoring module may be configured to actively and/or passively monitor various characteristics of each element and collect data related to various metrics, each of which may represent a measure of a particular monitored characteristic. In some embodiments, the monitoring module may be configured to collect data related to the monitored characteristics of each element at particular time intervals and the data collected by the monitoring module may be stored in the memory of the monitoring node.

If a new element or connection has been determined, method400may proceed to410. If a new element or connection has not been determined, method400may proceed to455.

At410, the monitoring node may determine what resource are used by the new element or involved in the new connection. The resources may dictate what kinds of thresholds and alarms may be used to monitor the usage of such resources. At415, default alarms based upon the resources may be automatically generated. The default alarms may include default threshold values. Furthermore, such defaults may be based on the type of element. The default alarms may be specified according to system preferences.

At420, peers to a newly added element may be determined by the monitoring node. The peers may include other elements with one or more parent or grandparent nodes in common with the newly added element. At425, new instances of alarms present in the peer elements may be created for the newly added element. The alarms may be added based upon, for example, presence of the alarm in each or any element in the peer group.

At430, the hierarchy of elements associated with the newly added element may be determined by the monitoring node. The hierarchy may include parent nodes of the newly added element. At435, new instances of alarms from parent nodes may be automatically created for the newly added element. For example, the newly added element may inherit alarms from its parent node. In another example, the newly added element may inherit alarms from the root node of its hierarchy.

At440, the monitoring node may determine what other elements of the system are using the resources used by the newly added element, or are also using the resources associated with the newly formed connection. At445, new instances of alarms from such other elements may be automatically created for the newly added element or for the element establishing the connection. At450, the alarms of other elements associated with the newly formed connection or added element may be modified or adjusted by the monitoring node. Such alarms may take into account the demands of the new connection or element.

At455, the monitoring node may monitor usage of shared resources in the system. Such monitoring may be active or passive. At460, the monitoring node may determine whether or not any defined alarms have been triggered by, for example, resource usage exceeding a threshold amount. If no alarms have been triggered, method400may proceed to405. If an alarm has been triggered, method400may proceed to465. At465, the monitoring node may provide a suitable indication that the identified alarm has been triggered. Such an indication may be provided, for example, in software, audibly, or through another electronic communication. Method400may terminate or may repeat by proceeding to405.