GB2355621A - Writing log and diagnostic data in a policy-based network management (PBNM) system - Google Patents

Abstract

A system for writing log and diagnostic data in a policy-based network management (PBNM) system. The logging system is a collection of individual log file generators 312, 322, 332 which reside in the various network resources and are configured to provide detailed, historical records of the operation of the PBNM system. A PBNM console 310 and a PBNM server 320 are provided to enable a network administrator to create and distribute policies across a network. The records generated by the logging system provide an archival record of the policies that are deployed within the network. This archival record can then be used by a network administrator to analyze and debug the PBNM system.

Description

2355621

WRITING LOG AND DIAGNOSTIC DATA TO ML-LTIPLE SIMULTANEOUS OUTPUT DESTINATIONS IN A POLICY-BASED NETWORK MANAGEMENT SYSTEM 5 FIELD OF THE INVENTION

The present invention relates generally to network systems and more particularly to a system and method for writing log and diagnostic data. BACKGROUND OF THE INVENTION

As computer networks have become more prevalent in corporate environments, network management software, which has the ability to solve a number of network problems automatically and remotely, has become crucial. One of the major goals of any efficient network administration setup is to accommodate the rapid pace in which networks are growing.

Network management software typically manages and automates administrative tasks across multiple machines in a network. Typical network management software allows administrators to run real-time diagnostics, provides real-time measurements, creates reports, logs events, filters events and generates alerts when performance criteria match predetermined conditions, installs applications and remotely configures multiple managed nodes.

The growth in network usage continues at a rapid pace. In addition to traditional uses such as e-mail and file sharing, networks are asked to handle audio and video traffic, especially those networks that are connected to the Internet. The number of users per network is also increasing. Thus, bandwidth and manageability of the network is straining current management techniques.

Quality of Service (QoS) is a term used to describe how well the 1 computing environment meets the needs of its users. Ne6w.orks traditionally provide best effort services. This suffices when the network traffic doesn't exceed network capacity, But no matter how well-provisioned the network, there is no way to assure that critical traffic will get through in a timely manner.

Technologies that are used to manage QoS for network traffic configure routers and switches to classify traffic and give it higher (or lower) priority relative to other traffic. Additionally, traffic shapers exist which are specifically designed to handle the task of classifying traffic so that other network elements can provide specialized handling.

The criteria used by network elements to classify traffic include: the type of application; and source/destination IP addresses. Also, a message can include a special bit(s) for identifying its relative importance. Finally, some network interface cards (NICs) have the capability to mark network packets, making possible to spread the overhead of managing network QoS.

The task of managing the network becomes complicated with the increase in overall network size and the varying number of elements (e.g., routers, switches, traffic shapers, NICs). A new paradigm that is being used in the industry is Policy-Based Network Management (PBNM). Using this paradigm, a network administrator can specify the desired QoS as a policy, for example.

A policy defines one or more rules that govern the use of or access to a network service. The rules comprise two distinct elements: (1) the action; and (2) the conditions. The action controls or configures a predetermined service (e. g., high priority class of service). The conditions define under what circumstances the service 2 is available for- bel ng controlled by the action (e.g., financal department at the end of each financial quarter). Policies are deployed to network resources (i.e., elements) which are then configured to enforce the action, based on the conditions.

There is a need in the field of network management to provide a view 5 into how these policies are performing.

SUMMARY OF THE INVENTION

The present invention provides a system and method for writing log and diagnostic data in a policy-based network management (PBNM) system. The logging system is a collection of individual log file generators which reside in the various network resources and are configured to provide detailed, historical records of the operation of the PBNM system. These records provide an archival record of the policies that were deployed within the network. This archival record can then be used by a network administrator to analyze and debug the PBNM system.

Log messages comprise at least four fields, the fields being a timestamp, a source field, a category field and a text field. In one preferred embodiment, the log messages which are generated on servers and agents can be saved in files local to the machine on which the processes are running. Each log generator, or logger, alternatively writes to one of a pair of log files so that the total disk space used by the log files does not grow without bounds. BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 shows a network, including multiple network nodes, on wWch the present invention is disposed.

3 FIG. 2 Skows a more detailed view of the network in FIG. 1, illustrating the heterogeneous nature of a policy-based network management (PBNM) system.

FIG. 3 shows an even more detailed view of the PBNM system to include a logging system and method for writing log and diagnostic data.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT

A novel system and method for writing log and diagnostic data in a policybased network management (PBNM) system is described in detail hereinafter. Although the illustrative embodiment is described in the context of a various commercial products, namely Hewlett Packard's PolicyXpert products, it is to be understood that their inclusion in the description of the illustrative embodiment is intended by way of example only and not limitation. It will be appreciated by those skilled in the art that as various other commercial and/or custom-developed products become available that provide the essential functionality required to implement the invention, that these alternative products may be employed to implement the invention in place of the commercial products described herein.

Briefly, the present logging system is a collection of individual log file generators which reside in the various network resources and are configured to provide detailed, historical records of the operation of the PBNM system. These records provide an archival record of the policies that were deployed within the network. This archival record can then be used by a network administrator to analyze and debug the PBNM system.

FIG. I is a block diagram of a network 1, which includes a plurality of computers, or network nodes, I 10- 114 in communication with one another via a 4 network 120.:in the illustrative embodiment, each of coliputers I 10- 114 runs a A distributed, client-server operating system that is capable of running on multiple hardware architectures and platforms, which can be either HP-UX or MS Windows NT. Network 100 includes one network node I 10 that operates as a managing console, executing managing console software 130. Nodes 111-114 are managed nodes.

Managing console software 130 is a proactive network system management software package that allows administrators to automatically deploy policies to every managed node 111-114. In the illustrative embodiment, managing console software is BP's OpenView PolicyXpert, which enables enterprise- wide administration of the operating system which is employed by the network 100, within a centralized, highly scaleable architecture capable of managing thousands of local and/or remote machines.

Managing console software 130 has the capability of deploying policies and which allow conditions to be specified, which, if matched, trigger a set of automated actions. Managing console software 130 allows administrators to write policies that can be deployed across multiple kinds of elements from multiple vendors. This feature facilitates a consistent configuration that delivers a desired Quality of Service (QoS) because the same policy is used to configure routers, switches, traffic shapers; and NICs.

FIG. 2 shows a more detailed view of the network in FIG. 1, illustrating the heterogeneous nature of a PBNM system. Managing server 110 is connected to managed node I 11 over the network 120, through a series of network elements 210, 220 and 230, In one preferred embodiment, item 210 is a traffic shaper while item 220 is a router. Item 230 is representative of local-area or wide- area network, such as an Intranet or Internet.

The PBNM system includes a console 250, a PBNM server 252, and in the illustrative embodiment, first and second PBNM proxies 260. The PBNM console 250 enables the administrator to define policies so that the PBNM server 252 can administer the policies, and agents to enforce the policies. A console user interface enables the network administrator to create, assign and deploy policies. The PBNM server 252 stores policies, distributes those policies via the PBNM proxies 260 to policy agents and maintains the results of the policy enforcement performed by each agent. The policy agent acts as a policy enforcement point (PEP) within the PBNM system. This agent runs either on the network resources themselves (e.g., shaper 210 or router 220), or in proxy to one or more of the resources. The PBNM server 252 distributes policies to each PEP using the Common Open Policy Service (COPS) protocol.

In one preferred embodiment, there are three types of policy agents: (1) an outsourcing PEP; (2) a configuration proxy; and (3) a configuration PEP. The outsourcing PEP executes on a network resource, such as router 220. It services all Resource reSerVation Protocol (RSVP) requests that are issued by applications needing a specified quality and/or quantity of bandwidth. Rather than servicing the reservation request based upon currently available resources, the outsourcing PEP interacts with the server 110, receiving the policy decision (i.e., granting or denying the request) from the policy server 110.

6 -Te configuration proxy combines deci-Von-making capabilities with enforcement. It translates policy information into configuration changes for the resources it proxies. The configuration changes are then sent to its managed resources using the specific protocol supported by the resource in question (e.g., telnet/CLI). The configuration proxy configures queuing, packet marking and traffic shaping in order to implement at least two types of policies--class of service and assured bandwidth.

The configuration PEP, like the outsourcing PEP, executes on a network resource, such as the managed node 111 or the router 220. Like the configuration proxy, the configuration PEP combines decision-making with enforcement, the difference being that the configuration PEP does it on-device.

FIG. 3 shows an even more detailed view of the PBNM system to include a logging system and method for writing log and diagnostic data. User interface area 301 comprises console 3 10. The network administrator, using console 3 10, creates, assigns and deploys policies via the COPS protocol. Console 3 10 comprises a log system, logger 312, which is configured to receive log and diagnostic messages. Each message is classified into a predetermined category. Appendix A lists a preferred embodiment list of message categories according to the present invention. The logger 312 will write each message to local log file 314, as well as to a predetermined output destination A.

A server area 302 may comprise a primary policy server 320 and a secondary policy server 330. The secondary policy server 330 provides intra-domain scalability; that is, the secondary server 330 facilitates the scaling of the PBNM system to larger network domains by assigned groups of agents to a secondary server. In one preferred embodiment, the primary server 320 controls an array of secondary servers, 7 each of the Zecondary servers then controlling a preAetermined number of agents distributed in the network.

The primary policy server 320 stores and distributes policies, with help from the PolicyXpert database 350. Logger 322 selectively writes each log message to local log file 328, to an SNMP host, as well as to the predetermined output destination A. A log collector 326 is employed to gather all log and destination messages for later collection to a log aggregator, for example.

An agent area 303 comprises a configuration agent 360 and an outsourcing PEP 370. The configuration agent 360 further comprises a logger 362 which writes messages to local log file 364.

As mentioned above, each logger (items, 312, 322, 332 and 362) selectively writes each log message to every output destination associated with the category of the message. For each destination, the user of the system can configure which category of message is sent. Further, the set of output destinations is determined at run time by the PolicyXpert which embeds the logger into each resource. In a preferred embodiment, the available destinations comprise: logfile, NT Event log and SNMP Management Station.

Appendix B shows a representative log report generated by the logging system.

Appendix C shows a representative code listing for implementing the present invention in the context of HP's PolicyXpert- 8 APPENDIX A MESSAGE CATErTC)RIES Message Type Description

Infonnational Notices of nonnal operation (e.g., agent or console connects or disconnects) Warning Operation continues, but some anomaly was noted (e.g., a policy deployed but may not handle all conditions specified) Serious An erTor was detected.

Critical Systems operation is jeopardized 9 APPENDIX A REPRESENTATIVE LOG REPOPT GENERATED BY THE PRESENT INVENTION Mon Jul 26 13:34:06 1999 new log file created Mon Jul 26 13:34:06 1999: Informational: Policy Deployment; bronco.cnd.hp.com, bronco: agent2 (RSVP) ""; Mon Jul 26 13:34:06 1999: Serious: Policy Deployment; bronco. cnd.hp.com, bronc o: agent2 (RSVP) Conflict; 10 Mon Jul 26 13:34:06 1999: Informational: Policy Deployment; bronco. cnd. hp. com, bronco: agent2 (RSVP) 111F; Mon Jul 26 13:34:06 1999: Informational: Operational Status; bronco: agent2, fizbin.acme.corn (RSVP) Available; Mon Jul 26 13:34:06 1999: Infon-national: Operational Status; fizbin.acme.com, firewall is (RSVP) Available; Mon Jul 26 13:34:29 1999: Informational: PEP Connected; IP address127.0.0. 1 Type = 32896; Id = bronco. end.hp. com; Mon Jul 26 13:35:59 1999: Informational: PEP Disconnected; IP address127. 0. 0. 1; Type = 32896; Id = bronco. cnd.hp. com; 20 APPENDIXB- C+ +CODE LISTING OF PRESENT NVENTION FOR WRITING LOGANDDIAGNOSTICDATA TOMULTIPLE SIMULTANEOUS OUTPUT DESTINATIONS INA POLICYBASED NETWORK MANAGEMENT SYSTEM 5 logWrite.h:

H Hewlett Packard Company Copyright 1999 $Source: D:Ihughlmhugh-view2/DE/PBNM/Server/PBMSrvce/logWrite.h $ $Revision: /main/Zen/2 $ H $Date: 1999/06/07 16:03 UTC $ H H logWrite.h: write log file entries #if!defined(LOGWRITE-H-fNCLUDED_) #define LOGWRITE_H_lNCLUDED_ #if -MSC-VER> 1000 #pragma once #endif /1 _MSC-VER > 1000 class logWrite public:

logWriteo; -logWriteo; H creationTime, diagLevel, diagLen, diagData int writeEntry(DWORD, WORD, WORD, BYTE private:

H Masks below are compared against value of diagLevel passed in via writeEntry interface. The mask is a word (1 6-bit value), the upper byte of which is the source of the diagnostic information (Server, SPS, Agent, Console), and the lower byte is the diagnostic level (critical, serious, warning, informational).

//The bitmask is bitwise OR'd against the diagLevel value, and H if it is non-zero, the log entry is written to that fl destination WORD snmpmask; // bitmask for SNMP destination WORD filemask; H bitmask for log file char hostname; fl SNMP trap destination - DO WE WANT TO ALLOW MULTIPLE? char filename; // name of file for logging int filedes; file descriptor for log file itendif//!defined(LOGWRITE H FNCLUDED_) logWrite.cpp Hewlett Packard Company Copyright 1999 is SSource: D:/hugh/mhugh_view2/DEIPBNM/Server/PBMSrvce/logWrite.cpp $Revision: /main/Zen/ 10 $ Mate: 1999/06/18 22:56 UTC $ H logWrite.cpp: implementation to write log file entries H NOTE: this file is not thread safe! This code makes the assumption that there will only be one instance of logging for a policy server, and therefore does not keep separate file names, etc., nor does it H have critical section protection to prevent multiple threads from stomping over each other.

#include "stdafx.h" #include <winreg.h> #include <winsock2.h> #include "logWrite.h" #include "RegDefs.h" #include <fcntl.h> #include <sys/types.h> #include <sys/stat.h> Mriclude <io.h> #include <time.h> #include <stdio.h> #include "translate.h" #include "malloc.h" #include "OV/OVsnmpAsnl.h" #include "OV/OVsnmpApi.h" #include "OV/OVsnmpConf h" #include "OVutil.h" #include "OVmib.h" #include "acctdiag.h" // define names for use in accessing the registry - see RcgDefs.h for more H information and definition of REG-TOP-SOFTWARE #define REG KEY-LOGGING j(REG-TOP-SOFrWARE "Logging") #define REG PX - LOG - FILENAME -T(" filename") #define REG PX - LOG - SNMP-HOST _:F("SNMP-host") #define REG PX - LOG - FILEMASK -T("filemask") #define REG PX - LOG-SNMPMASK _T("snmpmask") #define REG-PX-LOG-FILESIZE -T("maxfilesize") #define LOG-MSG-BUF-SIZE 512 12 char diagLeveINames[] "Invalid", "Critical", "Serious", "Warning", "Informational" char originNameso "Invalid", "Server", "Secondary Server", "Agent", "Console" static FILE Iwfp; static char nodcname[ 128) 0 1; name of system running the code static int nodenameLen 0; H length of nodename static char oidString = 1.3.6.1.4.1.11.2.17.12"; H enterprise string for PX static OVsnmpSession session = NULL; H session for traps static unsigned long genOido (1, 3, 6, 1, 4, 1, 11, 2, 17, 12, 0, 0, 0, 0, 0 static unsigned int genOidLen 16; static int filesize = 0; H keep track of size of log file static int maxFileSize = 1048576; H I megabyte static char oldFileName = NULL; H storage for name to move file to when it H grows greater than maxFileSize H The following macros extract information from the DiagData passed into writeEntry #define extractIPaddr(diagData, inaddr) memcpy(&dataType, diagData, sizeof(WORD)); if (dataType DIAGDATA-IPADDRESSV4) length = sizeof(DIAG - IPADDRESSV4); memcpy(&addrv4, diagData, length); diagData += length; diagLen (unsigned short) length; inaddr.s-addr = htonl(addrv4.addr); #define extractClientType(diagData) memcpy(&dataType, diagData, sizeof(WORD)); if (dataType DIAGDATA-CLIENTTYPE) so length = sizeof(DIAG - CLIEN7rYPE); memcpy(&cType, diagData, length); diagData += length; diagLen (unsigned short) length; #deflne extractClientID(diagData) memcpy(&dataType, diagData, sizeof(WORD)); if (dataType DIAGDATA-CLIENTID) length = sizeof(DIAG - CLIENTID); memcpy(&cld, diagData, length); diagData. += length; 13 diagLen (unsigned short) lengbk) #define extractReason(diagData, ptrToStr) memcpy(&dataType, diagData, sizeof(WORD)); if (dataType DIAGDATA-REASONTYPE) length = sizeof(DIAG_REASONTYPE); memcpy(&reasonType, diagData, length); diagData += length; diagLen (unsigned short) length; ptrToStr (char)(diagData + reasonType. length); diagData += reasonType. length; Constructor logWrite::IogWriteo HKEY hkey; LONG size; DWORD maskval; DWORD typeval; LONG result; char buffer[LOG-MSG-BUF-SIZE]; //buffer for log file entry time t timer; char time str = NULL; char community = "public"; struct -stat buf, if there is a failure to get information or open the log file, is there a mechanism to tell the user? H initialize variables filemask = 0; snmpmask = 0; filedes = -1; hostname = (char) NULL; filename = (char) NULL; H read from registry bitmasks, IPaddress/hostname for SNMP traps, // and name of log file result = RegOpenKey(HKEY - LOCAL - MACHINE, REG_KEY-LOGGING, &hkey); if (result ERROR-SUCCESS) result = RegQueryValueEx(hkey, REG_PX-LOG-FILENAME, NULL, &typeval, NULL, (ULONG)&size); if (result ERROR-SUCCESS) filename = (char)malloc(size + 1), result = RegQuer-yValueEx(hkey, REG-PX-LOG-FILENAME, NULL, &typeval, (unsigned char)filename, (ULONG)&size); if (result ERROR - SUCCESS) filedes open(filename, _O WRONLY I _O_CREAT I _O_APPEND, 0755); if (filedes - 0) timer = time( &timer); time-str = ctime((long)&timer); 14 time - str[24) = ( -,r) NULL; result = sprintf(buffer, "%s log stat-ted\n", time_str); if (result > 0) write (filedes, buffer, result); H get the size of the file result = _stat(filename, &buf); filesize = buf.st - size; oldFileName = (char)malloc(strien(filename) + 4); sprintf(oldFileName, "%s.old", filename); result RegQueryValueEx(hkey, REG-PX-LOG-SNMP-HOST, NULL, &typeval, NULL, (ULONG)&size); if (result ERROR-SUCCESS) is hostname = (char)malloc(size + 1); result = RegQueryValueEx(hkey, REG-PX-LOG-SNMP-HOST, NULL, &typeval, (unsigned char)hostname, (ULONG)&size); if (result ERROR-SUCCESS) result RegQueryValueEx(hkey, REG-PX-LOG-SNMPMASK, NULL, &typeval, NULL, (ULONG)&size); if ((result - ERROR-SUCCESS) && (typeval REG-DWORD) && (size ≤ 4)) result RegQueryValueEx(hkey, REG-PX-LOG_SNMPMASK, NULL, &typeval, (BYTE)&maskval, (ULONG)&size); srimpmask = (WORD) maskval; result = RegQueryValueEx(hkey, REG-PX-LOG-FILEMASK, NULL, &typeval, NULL, (ULONG)&size); if ffiledes ≥ 0) && (result ERROR-SUCCESS) && (typeval REG-DWORD) && (size ≤ 4)) result = RegQueryValueEx(hkey, REG-PX-LOG-FILEMASK, NULL, &typeval, (BYTE)&maskval, (ULONG)&size); filemask = (WORD) maskval; result = RegQueryValueEx(hkey, REG-PX-LOG-FILESIZE, NULL, &typeval, NULL, (ULONG)&size); if ((filedes ≥ 0) && (result ERROR- SUCCESS) && (typeval REG-DWORD) && (size ≤ 4)) result = RegQueryValueEx(hkey, REG-PX-LOG-FILESIZE, NULL, &typeval, (BYTE)&maskval, (ULONG)&size); if (maskval > 0) maxFileSize = maskval; result = RegCloseKey(hkey); H initialize nodename (since it is a static variable and not a H member variable it could already have been initialized by /1 another instance if (nodenarneLen 0) result = gethostname(nodename, 128); if (result!= SOCKET - ERROR) nodenameLen = strlen(nodenarne); if there is a node name for sending traps to, initialize the H socket session, otherwise make So- trap mask is set to zero H (so we won't waste time setting up trap info) if ((hostname!= (char)NULL) && (session (NULL))) session = OVsnmpOpen(conununity, hostriame, 0 / retries SNMP-USE-DEFAULT-INTERVAL, SNMP-USE-DEFAULT-LOCAL-PORT, SNMP-USE-DEFAULT-REMOTE_PORT, / callback NULL, / callback - data NULL); fl should we do something if the session is not successfully opened? if (session NULL) snmpmask = 0; else session-session_flags OVSNMP_V2API OVSNMP-FREE-PDU; else snmpmask 0; Destructor logWrite::-IogWriteo H close log file if (filedes - 0) -closeffilecles); send SNMP trap that logging is ending H free memory taken by IPaddr/hostname and file name if (filename!= (char) NULL) free(filename); if (hostname!= (char) N-ULL) firee(hostrianne); if (session!= NULL) OVsnmpC]ose(session); method writeEntry int logWrite::writeEntry( DWORD creationTime, WORD diagLevel, WORD diagLen, BYTE diagData) char buffer[LOG - MSG-BUF-SIZE]; //buffer for log file entry int buf-count = 0; number of bytes in buffer int diagmask; // diagnostic value //int sourcemask; H source value int retval = TRUE; H return value char time-Str = NTJLL; time-str = ctimefflong)&creationTime); ti. me_str[24] = (char) NULL; // the following variables are for SNMP traps OVsnmpPdu request; // PDU for trap ObjectlD oidMem[MAX - SUBID-LEN]; unsigned int oidLen = MAX-SUBID-LEN; SNMPVal snmpval; struct SNMPVarBind varbind; IN - ADDR inaddr; DIAG IPADDRESSV4 addrv4; DIAG CLIENTTYPE cType; DIAG CLIENTID c1d; DIAG REASONTYPE reasonType; unsigned long length; char string; DWORD diagCode; struct - stat buf; time-t timer; buffer[O] = (char) NULL; is H compare diagLevel against bitmask for logfile H if result is non-zero, write to file if (diagLevel & filemask) H write entry to the log file // What is the appropriate way to localize strings on NT? H This will get ported to UNIX, so should be portable diagmask = diagLevel & OxOff, // strip off upper byte of word switch diagmask) case 1: diagmask = 1; break; case 2: diagmask = 2; break; case 4: diagmask = 3; 3 0 break; case 8: diagmask = 4; break; default: diagmask = 0; sourcernask = (diagLevel & OxOffOO) >> 8; fl switch ( sourcemask case 1: sourcemask = 1; H break; H case 2: sourcemask = 2; break; H case 4: sourcemask = 3; break; case 8: sourcemask = 4; 4 5 break; default: sourcemask = 0; H) buf count = sprintf(buffer, "%s %s time-str, diagLeveINames[diagmask]); so retval TranslateDiagnostics(diagLen, diagData,(char &(buffer[buf count])); if (retval TRUE) strcat(buffer, "\n"); retval = write(filedes, buffer, strlen(buffer)); if (rerval > 0) filesize += retval; if the file has grown larger than maxFileSize, H close it, move it to the name for the older H version, then open it again if (filesize ≥ maxFileSize) 17 retval stat(oldFileName, &bu; if (retval!= -1) unlink(oldFileName); close(filedes); filesize = 0; retval = rename(filename, oldFiIeName); filedes = _open(filename, _O-WRONLY I _O_CREAT I _O_APPEND, 0755); if (f iledes ≥ 0) timer = time( &timer); time-str = ctime((Iong)&timer); time str[24] = (char) NULL; retval = sprintf(buffer, "%s new log file created\n", time_str); if (Tetval > 0) retval = write (filedes, buffer, retval); if (retval > 0) filesize += retval; compare diagLevel against bitmask for SNMP traps if result is non-zero, send SNMP trap if (snmpmask & diagLevel) set up PDU which will contain trap information request = OVsnmpCreatePdu(V2TRAP_REQ_MSG); OVmib-read_objid(oidString, oidMem, &oidLen); // set enterprise oid request-enterprise = OVsnmpOidCopy( oidMem, oidLen need a copy request->enterprise - length = oidLen; request->agent-addr = htonl(SNMP - USE-DEFAULT-ADDRESS); request->time = SNMP-USE-DEFAULT-TIME; Tequest->generic_type = 17; length = sizeof(DWORD); memcpy(&diagCode, diagData, length); diagData += length; diagLen (unsigned short) length; switch (diagCode) case DIAGCODE SERVER STARTED:

// contents of trap: name of host running server H set up the Object ID for the trap itself genOid[10] = 30000000; genOidLen. = 11; request->notify_oid = OVsnmpOidCopy(genOid, genOidLen); H need a copy request->notify_oid - length = genOidLen; 5S H set up Object ID for variable in trap, in this case the node name genOid[l 1] = 1; // first value - name of system running PolicyXpert genOidLen = 12; snmpval.string = (uLchar) nodename; varbind = OVsnmpAddTypedVarBind( request, genOid, genOidLen, ASN_OCTET-STR, &snmpval, nodenameLen); break; case DIAGCODE-SERVER-SHUTDOWN:

18 H contents of trap: nameod host running server H set up Object ID for trap itself genOid[l 0] = 3000000 1; genOidLen = 11; need a copy request-notify-oid = OVsnmpOidCopy(genOid, genOidLen); H request-notify_oid_1ength = genOidLen; H set up Object ID for variable in trap, in this case the node name genOid[ 11] = 1; // first value - name of system running PolicyXpert genOidLen = 12; snmpval.string = (u_char) nodename; varbind = OVsnmpAddTypedVarBind( request, genOid, genOidLen, ASN_OCTET-STR, &snmpval, nodenameLen); break; is case DIAGCODE PEP-CONNECTED:

// contents of trap: IPaddress, clierittype, clientID H set up Object ID for the trap itself genOid[10] = 30000002; genOidLen = 11; request->notify_oid = OVsnmpOidCopy(genOid, genOidLen); H need a copy request->notify_oidJength = genOidLen; request->specific - type = 30000002; // set up Object ID for variable in trap, in this case IP address genOid[1 11 = 1; // first value - IP address of PEP genOidLen = 12; extractIPaddr(diagData, inaddr); snmpval.unsigned32 = (unsigned long) &inaddr; H value.string = (u_char) nodename; varbind = OVsnmpAddTypedVarBind( request, genOid, genOidLen, ASN-1PADDRESS, &snmpval, 4); H set up Object ID for variable in trap, in this case IP address gen0id[I 1) 2; H second value - client type 35 genOidLen 12; extractClientType(diagData); snmpval.integer = (long) &(cType.clientType); varbind = OVsnmpAddTypedVarBind( request, genOid, genOidLen, ASN-INTEGER, &snmpval, 1); // set up Object ID for variable in trap, in this case the node name genOid [I 1] 3; H third value - name of system on which PEP resides genOidLen 12; extractClientID(diagData); snmpval.string = (u_char) cId.id; length = strlen((const char)snmpval.string); varbind = OVsnmpAddTypedVarBind( request, genOid, genOidLen, ASN-OCTET-STF, &snmpval, length); break; case DIAGCODE - PEP-DISCONNECTED:

contents of trap: IPaddress, clierittype, clientID set up Object ID fthe trap itself genOid[10] = 30000003; genOidLen = 11; request->notify_oid = OVsnmpOidCopy(genOid, genOidLen); H need a copy request->notify_oid length = genOidLen; H set up Object ID for variable in trap, in this case IP address genOid[ 11] = 1; // first value - IP address of PEP genOidLen = 12; extractIPaddr(diagData, inaddr); snmpval.unsigned32 = (unsigned long) &inaddr; 19 varbind = OVsnmpAJJTypedVarBind( request, genOid, genOidLen, ASN-Ir-ADDRESS, &snmpval, 4); // set up Object ID for variable in trap, in this case IP address genOid[ 11] = 2; H second value - client type genOidLen = 12; extractClientType(diagData); snmpval.string = (unsigned char) &cType.clientType; length = strlen((const char)snmpval. string); varbind = OVsnmpAddTypedVarBind( request, genOid, genOidLen, ASN_INTEGF-R, &snmpval, 1); // set up Object ID for variable in trap, in this case the node name gen0id[l 1] 3; H third value - name of system on which PEP resides genOidLen 12; extractClientID(diagData); snmpval.string = (u_char) cld.id; length = strlen((const char)snmpval.st-ring)l- varbind = OVsnmpAddTypedVarBind( request, genOid, genOidLen, ASN_OCTET- STR, &snmpval, length); 2 0 break; case DIAGCODE - OPER-STATUS:

contents of trap: reason as a string set up Object ID for the trap itself genOid[ 10] = 30000004; genOidLen = 11; request->notify_oid = OVsnmpOidCopy(genOid, genOidLen); need a copy request->notify_oid - length = genOidLen; // set up Object ID for variable in trap, in this case a string genOid[I 1] = 1; // first value - reason code in a string genOidLen = 12; extractReason(diagData, string); snmpval.string = (unsigned char) string; varbind = OVsnmpAddTypedVarBind( request,genOid, genOidLen, ASN_OCTET-STR, &snmpval, reasonType-length); break; case DIAGCODE POL-DEPLOYMENT:

H contents of trap: reason as a string // set up Object ID for the trap itself genOid[10] = 30000005; genOidLen = 11; request->notify_oid = OVsnmpOidCopy(genOid, genOidLen); need a copy request->notify_oid - length = genOidLen; H set up Object ID for variable in trap, in this case a string genOid[1 1] = 1; // first value - reason string genOidLen = 12; extractReason(diagData, string); snmpval.str-ing = (unsigned char) string; varbind = OVsnmpAddTypedVarBind( request,genOid, genOidLen, ASN_OCTET-STR, &snmpval, reasonType.length); break; send the trap retval = OVsnmpSend(session, request); if (retval -1) OVsnmpFreePdu(request); // only need to free if OVsnmpSend failed retum(O); S notify.h H Hewlett Packard Company Copyright 1999 SWorkfile: $ fl $Revision: /main/Zen/2 $ // SModtime: S H H Description:

H Class definition of class CNotify- This class implements the H methods of IAcctNotify sink interface to receive H notifications from policy server. These functions then call // methods of IAcctSrv interface to retrieve acct/diag data.

H #if !defined(AFX-NOTIFY - H - 6BCCDA42-386A-I ID2-BA3C-OOAOC9220OC6rNCLUDED_) #define AFX-N0TIFY-H-6BCCDA42-386A-I I D2-BA3C-OOAOC9220OC6-TNCLLJDED- ffinclude "pbmsrvce.h" // IAcctNotify #include "acctdiag.h" H ACCT - RECORD - ACTIVE #include "logWrite.h" logWrite class #if MSC VER ≥ 1000 #pragma once #endif H _MSC-VER ≥ 1000 #define STRING-BUFFER-LENGTH 256 class CNotify: public IDispatchIrnpI<IAcctNotify, &IID_IAcctNotify, &LIBID-PBMSRVCELib>, public CComObjectRootEx<CCon-iMultiThreadModel> public:

CNotifyo; virtual -CNotifyo; 5S BEGTN-COM - MAP(CNotify) COM INTERFACE-ENTRY(IDispatch) COM-fNTERFACE-ENTRY(IAcetNotify) END-COM- MAPO STDMETH0D(OnAddNewRec)(/[in]/ DWORD recHandle, /[in]/ WORD pepType, /[in]/ WORD pepIdLen, /[in, size-is(pepIdLen)]/ BYTE pepId); 21 TDMETHOD(OnUpdateRec)(/[inj/ DWORD rtcndle, /[in]/ WORD pepType, /[in]/ WORD pepIdLen, /[in, size_is(pepIdLen)]/ BYTE pepid, /[in]/ WORD updateType, /[in]/ WORD noOfNewObjects, /[in]/ WORD objectlndex); STDMETHOD(OnC]oseRec)(/[in]/ DWORD recHandle, / [in]/ WORD pepType, /[in]/ WORD pepIdLen, /[in, size_is(pepIdLen)]/ BYTE pepid); STDMETHOD(OnNewDiagnostic)(/[in]/ DWORD recHandle); lAcctSrv m acctSr-v; is int Initialize(IAcctSrv acctSrv); private:

void Update(void); logWrite logit; #endif def ined(AFX-NOTIFY-H-6BCCDA42-3 86A- I I D2-BA3 C-OOAOC9220OC6- INCLUDEDJ notify.cpp Hewlett Packard Company Copyright 1999 SWorkfile: S $Revision: /main/Zen/4 S $Modtime:

Description:

This is the implementation file for class CNotify. This class implements the methods of IAcctNotify interface tn receive notifications from policy server. These f- cn call methods of IAcctSrv interface to re..ig data.

#include "stdafx.h" #include "pbmsrvce.h" //#include "AcctAgent.h" /Vinclude "AcctAgentDoc.h" #include "Notify.h" //#include "acctdiag.h" //#include "translate.h" //#include <stdio.h> //#include <ddebug.h> #ifdef DEBUG #undef THIS-FILE 22 Sfk6ic char THIS-FILE[]=-FILE-; "Liefine new DEBUG-NEW #endif Construction/Destruction Function Name: CNotify::CNotify H Parameters:

H Description:

is Constructor for CNotify H H Returns:

CNotify::CNotifyo //Function Name: CNotify::--CNotjfy H Parameters:

H B Description:

H Destructor for CNotify.

H H Returns:

CNotify::-CNotifyo I //Function Name: CNotify:: Initialize Parameters:

4S H acctSrv pointer to IAcctSrv interface H H Description:

// IAcctSrv interface pointer is needed by this class to call the H methods of IAcctSrv interface to read acct/diag data H // Returns:

H TRUE int CNotify:: Initial ize(lAcctSrv acctSrv) m - acctSrv = acctSrv; return TRUE; I H CNotifyAnitialize H Function Name: CNotify::Update H 23 /1116-rameters:

Description: This may prove to be a convenient spot to send recent] y-arri ved accounting or diagnostic messages to a list of logging destinations, checking category/severity combinations to determine if each destination is interested in this message.

H Returns: 10 void CNotify::Update(void) H CNotify::UpdateView //Function Name: CNotify::OnAddNewRec H // Parameters:

H recHandle record Handle of new record H pepType COPS client type H pepIdLen length of pepId // pepld pepId byte array H H Description: This method is called by policy server when a new acct record is added. More methods of lAcctSrv inter-face are called to read data 30 from the new acct record.

H Returns:

// S-OK STDMETHODIMP CNotify::OnAddNewRec(DWORD recHandle, WORD pepType, return S_OK; CNotify::OnAddNewRec H Function Name: CNotify::OnUpdateRec Parameters:

H recHandle record Handle of updated record H pepType COPS client type so pepIdLen length of pepId pepId pepld byte array H updateType indicates request/report/decis ion objs added noOfNewObjects number of new objects added objectIndex starting object index of new objects 55 H Description:

This method is called by policy server when an acct record is updated with new objects. More methods of lAcctSrv interface H are called to read new objects of the updated acct record.

B // Returns:

H S-OK 24 SDMETHODIMP CNotify::OnUpdateRec(DWORD rexHandle, WORD pepType, WORD pepIdLen, BYTE pepld, WORD updateType, WORD noOfNewObjects, WORD objectIndex) 5 return S_OK; // CNotj fy::OnUpdateRec Function Name: CNotify::OnC]oseRec H H Parameters:

recHandle record Handle of closed record pepType COPS client type pepIdLen length of pepld pepld pepId byte array Description:

This method is called by policy server when an acct record is H closed. More methods of IAcctSrv interface are called to get information about the closed acct record.

Returns:

H S-OK STDMETHODIMP CNotify::OnCloseRec(DWORD recHandle, WORD pepType, return S_OK; 3 5 H CNotify::OnCloseRec H Function Name: CNotify::OnNewDiagnostic H // Parameters:

H recHandle record Handle of new diag record H Description:

H This method is called by policy server when a new diag record is I/ added. GetDiagnostic method of IAcctSrv interface is called to get complete diagnostic data for the record handle given.

so Returns:

H S-OK STDMETHODIMP CNotify::OnNewDiagnostic(DWORD recHandle) 5 WORD diagLevel; BYTE diagData; DWORD creationTime; HRESULT hr, 6 0 int result; Get Diagnostics record hr = m-acctSrv->GetDiagnostic(recHandle, &creationTime, &diagLevel, &diagLen, &diagData); if (SUCCEEDED(hr)) result = logit.writeEntry( creationTime, diagLevel, diagLen, diagData); CoTaskMemFree(diagData); Need to have a logWrite interface to allow logging a failure here return S OK; CNotify::OnNewDiagnostic pbmdiag.h INTEL CORPORATION PROPRIETARY INFORMATION This software is supplied under the terms of a license agreement or 2S nondisclosure agreement with Intel Corporation and may not be copied or disclosed except in accordance with the terms of that agreement.

Copyright (c) 1998 Intel Corporation. All Rights Reserved.

SWorkfile: pbmdiag.h S $Revision: /main/Zen Intel/Zen/l S H SModtime: Oct 12 1998 18:08:42 S H // Description:

H This file declares the functions used by Policy server to add H diagnostic messages to PBM logging.

H #ifndef PBMDIAG H #define -PBMDIAG-H #include "acctdiag.h" #include "AcctServer.h" // Add a diagnostic message AddDiagnosticMessage(IAcctData acctData, WORD diagLevel, DWORD diagCode, DWORD addrv4, DWORD subnetv4, so DWORD clientType, BYTE clientld, WORD clientIdLen, const char reason); void IogOpStat-us(IAcctData aectData, CString dbName, DWORD status); void logDeployStatus(lAcctData acctData, CString dbname, DWORD status); void logDeployMessage(IAcctData acctData, CString dbname, char deploy); #endif //-PBMDIAG-H- pbmdiag.cpp 26 INTEL CORPORATION PROPRIETARY INFORMATION H This software is supplied under the terms of a license agreement or H nondisclosure agreement with Intel Corporation and may not be copied or disclosed except in accordance with the terms of that agreement.

Copyright (c) 1998 Intel Corporation. All Rights Reserved.

H $Workfile: pbmdiag.cpp $ $Revision: /main/Zen Intel/Zen/3 S SModtime: Oct 12 1998 18:12:00 $ H // Description:

H This file declares the functions used by Policy server to add H diagnostic messages to PBM logging.

#include "stdafk.h" #include "pbmdiag.h" #include "AttribVals.h" #include "PTData.h" #include <stdio.h> #include <ddebug.h> fl Function Name: AddDiagnosticMessage fl H Parameters:

H acctData IAcctData interface pointer H diagLevel diagnostic level // diagCode diagnostic code H addrv4 IP v4 address; 0 means don't add H subnetv4 IP v4 subnet mask; 0 means don't add /I clientType PEP type WORD; 0 means don't add /I clientld Client Id string; NULL means don't add H clientIdLen Length of Client Id string H fl Description:

// Helper function to build and add a diagnostic message. Currently H supports only a few data items needed. In future, more items need H to be added as they become necessary.

H H Returns: H TRUE if successful, FALSE otherwise.

BOOL AddDiagnosticMessage(lAcctData acctData, WORD diagLevel, so DWORD diagCode, DWORD addr-v4, DWORD subnetv4, DWORD clientType, BYTE clientId, WORD clientIdLen, const char reason) PSTRACE(PS_INFO, "PS:AddDiagnosticMessage\n"); BYTE buffer = NULL; if acctData) PSTRACE(PS_ERR, "PS: acctData interface pointer is NULL\n"); return FALSE; 27 // allocate for diag code buffer = (BYTE) calloc(l, sizeof(DWOPD)); if (buffer NULL) 5 PSTRACE(PS_EP,R, "PS:Memory alloc for diag object buffer failed\n"); return FALSE; put diag code and increment length memcpy(buffer, &diagCode, sizeof(DWORD)); len = sizeof(DWORD); // check for data items if(addrv4) DIAG IPADDRESSV4 addr; addr.type = DIAGDATA IPADDRESSV4; addr.length = sizeof(DWORD); addr.addr = addrv4; buffer = (BYTE) realloc(buffer, len + sizeof(DIAG_IPADDRESSV4)); if (buffer NULL) PSTRACE(PS_EPR, "PS:ReAlloc for diag object buffer failed\n"); return FALSE; memcpy(buffer + len, &addr, sizeof(DIAG_IPADDPESSV4)); len = len + sizeof(DIAG_IPADDRESSV4); if (subnetv4) DIAG SUBNETV4 subnet; subnet-type = DIAGDATA - SUBNETMASKV4; subnet.length = sizeof(DWORD); subnet.mask = subnetv4; buffer = (BYTE) realloc(buffer, len + sizeof(DIAG_SUBNETV4)); if (buffer NULL) PSTRACE(PS_ER-R, "PS:ReAlloc for diag object buffer failed\n"); return FALSE; memcpy(buffer + len, &subnet, sizeof(DIAG_SUBNETV4)); len = len + sizeof(DIAG_SUBNETV4); if (clientType) DIAG - CLIENTTYPE cType; cType.type = DIAGDATA - CLIENTTYPE; cType.length = sizeof(DWORD); cType.clientType = clientType; buffer = (BYTE) realloc(buffer, len + sizeof(DlAG_CLIENT'FYPE)); if (buffer NULL) PSTRACE(PS_ERR, "PS:ReA]Ioc for diag object buffer failed\n"); return FALSE; 28 memcpy(buffer + len, &cType, sizeof(DIAG - CLIENTTYPE)); len = len + sizeof(DIAG_CLIENTTYPE); if (clientId) DIAG CLIENTID c1d; cid.type = DIAGDATA - CLIENTID; c1d.length = MAX-CLIENT-ID_LEN; memset(cid.id,'O', MAX - CLIENT - ID_LEN); memepy(cId.id, clientld, clientIdLen); buffer = (BYTE) realloc(buffer, len + sizeof(DIAG-CLIENTID)); if (buffer NULL) PSTRACE(PS_ERR, "PS:ReAlloc for diag object buffer failed\n"); return FALSE; memepy(buffer + len, &cId, sizeof(DIAG - CLIENTID)); len = lcn + sizeof(DIAG_CLIENTID); 2 5 if(Teason) DIAG-REASONTYPE cStr; H Pad string length to 4 bytes H (add I null terminator + up to 3 pad) then truncate int reason - len = (strlen(reason) + 4) & -00); cStr.type = DIAGDATA-RFASONTYPE; cStr.length = reason-len; buffer = (BYTE) realloc(buffer, len + sizeof(DIAG_REASONTYPE) + reason- len); if (buffer NULL) PSTRACE(PS_ERR, "PS:ReAlloc for diag object buffer failed\n"); return FALSE; memcpy(buffer + len, &cStr, sizeof(DIAG-REASONTYPE)); memepy(buffer + len + sizeof(DIAG - REASONTYPE), reason, reason-len); len = len + sizeof(DIAG-REASONTYPE) + reason-len; H Now add it to accounting HRESULT hr = acctData->AddDiagnostics( 0, 0, NULL, diagLevel, len, buffer); if (FAILED(hr)) PSTRACE(PS_ERR, "PS:AddDiagnostic Failed; Returned Ox%x\n", hr); free(buffer); return FALSE; free(buffer); return TRUE; H AddDiagnosticMessage H Extract the Nth component of a namespace name fl For example, getNScomponent("ConfigDB,134217728,agent,intf', 2, ret) appends " 134217728" to ret 29 Vod getNScomponent(CString dbName, int comp, C56ring &ret) if (Comp - 0) return; int start = 0; int end = dbName.Find(POL_NS_NAMESEPAR-ATOR, start) - 1; comp-1 while ((end - 0) && (comp > 0)) start end + 2; end dbName.Find(POL_NS-NAMESEPARATOR, start) 1; comp--; is if (end> 0) ret += dbName.Mid(start, end-start+ 1); else f ret += dbName.Mid(start); Interpret the ConfigDB namespace name on which a status change has occurred For example, for "ConfigDB, I 34217728,acme agent, 15.2.112.240" fill the H passed in char array with "acme agent, 15.2-112.240 (Priority)" void NS2desc(CString dbName, CString &msg) CString resource; getNScomponent(dbName, 3, msg); Msg += getNScomponent(dbName, 4, msg); getNScomponent(dbName, 2, resource); // Decimal string versions of the POLC_ constants defined in StdDefs.h if (resource "65536") msg += (RSVP)"; else if (resource " 131072") rnsg += (DiffServ)"; else if (resource "65536000") rnsg += (MCAP)"; else if (resource "218693632") rnsg += (Athens)"; else if (resource "2155872256") rnsg += (PolProp)"; else if (resource " 134217728") rnsg += (Priority)"; else rnsg += C + resource + "Y'; logOpStatus sends a message to log destinations when a ConfigDB operational status changes void logOpStatus(IAcctData acctData, CString dbNarne, DWORD status) CString rnsg; NS2desc(dbName, msg); switch (status) I case OPERATION STATUS UNAVAILABLE:

rnsg += '. Unavailable"; break; 14 case OPERATION STATUS AVAILABLE:

msg += " Available'.

break; default:

CString num; num.Format(" %d", status); msg += num; break; AddDiagnosticMessage(acctData, DIAG-LEVEL-INFO, DIAGCODE-OPER-STATUS, 0, 0, 0, 0, 0, (LPCTSTR)msg); Send a message to log destinations when a ConfigDB deployment status changes void logDeployStatus(lAcctData acctData, CString dbName, DWORD status) CString msg; NS2desc(dbName, msg); switch (status) case DEPLOY - STATUS-UNMANAGED:

msg += " Unmanaged"; break; case DEPLOY - STATUS-UNKNOWN:

msg += " Unknown"; break; case DEPLOY - STATUS-GOOD:

msg += " Good"; break; case DEPLOY - STATUS-WARNING:

msg += " Warning"; level = DIAG-LEVEL-WARNING; break; case DEPLOY STATUS-ERROR:

msg += 1. Error"; level = DIAG-LEVEL-SERIOUS; break; case DEPLOY STATUS CONFLICT:

msg += " Conffict"; level = DIAG-LEVEL-SEIUOUS; break; default:

CString num; num.Format(" %d", status); msg += num; break; AddDiagnosticMessage(acctData, level, DIAGCODE-POL-DEPLOYMENT, 0, 0, 0, 0, 0, (LPCTSTR)msg); 31 H Send a message to log destinations when ConfigDB deployment message changes void logDeployMessage(IAcctData acctData, CString dbName, char deploy) CString rnsg; CStTing depmsg = deploy; NS2desc(dbName, msg); msg += " V"' + depmsg + 'T"'; AddDiagnosticMessage(acctData, DIAG-LEVEL_INFO, DIAG CODE-POL-DEP LOYM ENT, 0, 0, 0, 0, 0, (LPCTSTR)msg); 32

Claims (2)

1. What is claimed is:

   I An apparatus for writing log data in a policy-based network management (PBNND system 100, the logger comprising: a PBNM console 3 10 that enables a network administrator to create, assign and deploy policies; a PBNM server 320, connected to the PBNM console, that stores the policies created by the administrator and that distributes the policies to at least one agent 360; and a logger 322, disposed within the PBNM server, the logger configured to receive log messages and selectively write the log messages to multiple output destinations 340.
2. 2. An apparatus for writing log data in a PBNM substantially as hereinbefore described wfth reference to and as shown in the accompanying drawings.

   33