GB2362231A

GB2362231A - Providing context sensitive network information

Info

Publication number: GB2362231A
Application number: GB0011082A
Authority: GB
Inventors: Hamish D S Martin; Ronald Brown; Iain Hogg; Vanessa Serra
Original assignee: 3Com Corp
Current assignee: 3Com Corp
Priority date: 2000-05-08
Filing date: 2000-05-08
Publication date: 2001-11-14
Anticipated expiration: 2020-05-08
Also published as: GB0011082D0; GB2362231B

Abstract

A method for providing information relating to a network event consists of tracking network operations 101 to detect an event 102, logging the event with additional index information 104 and using the index information to retrieve information from a historical database 111. Preferably the network event is defined by rules and when detected displayed in a basic format. The additional index information may include an event type, a link identifier or a protocol used on the network. Once specific event information has been identified 107, the user using the index information 108, can select from a plurality of formats 109 how the data from the historical database is to be displayed 113. Preferably the method is enacted by a computer program on a computer readable medium or embodied in a carrier wave. A computer running the program and a computer network including a computer running the program are also claimed.

Description

2362231 STORAGE OF DATA P.ELATING TO EVENTS IN A NETWORK

BACKGROUND OF THE INVENTION

Field of the Invention

The present invention relates to storage of data relating to events in a network.

Description of the Related Art

Computer networks are managed by a network management system designed to aid a network manager in the running of the computer network. Typically, network management systems offer an 'event log' facility. An event log shows a display of recent 'events' that have been detected by the network management system. For the purposes of this discussion, an entry recorded in an event log shall be referred to as an event'. Typically these events n-dght document unusual conditions on the network, or unusual behaviour of individual devices on the network.

When the user of a network management system is viewing the event log, he may wish to get more information about the cause of the event and may wish to understand exactly why an event appeared in the log. We shall refer to the part of the system that displays additional information about an event as an 'event feedback mechanism'.

Standard techniques for implementing an event feedback mechanism include:

(a) displaying for each type of event that can be logged, a standard help screen or explanation. However, since the same explanation is displayed for every event of the same type, this does not provide much extra information to the user.

(b) storing when the event is logged, additional statistics about the event for use when the user requests event feedback. However, this requires the storage of a large amount of extra data for every event in the event log, and is limited in scope.

1 t We will describe a method of providing high-quality interactive event feedback without requiring large amounts of data to be stored along with every event in the event log.

SUMY OF THE INVENTION The present invention provides a method for providing information relating to a network event, comprising:

tracking network operation to detect a network event; logging said network event and index information relating to the network event, and subsequently using said index information to retrieve information from an historical database to provide further information relating to said network event.

The present invention also provides a computer program on a computer readable medium or embodied in a carrier wave for carrying out the method of the preceding paragraph.

The present invention also provides a computer program for use in a network management system on a computer readable medium or embodied in a carrier wave, said computer program comprising:

program step to track network operation to detect defined events at regular time intervals; program step to detect a network event; program step to what index information is required to be added to the log, depending upon the type of event detected.

program step to add detected event data and index information ftom preceding two steps to a log; program step to display a network event; when network manager requests further details about the relevant event, program step based on the type of event, to provide relevant format for display of further details about the relevant event, 2 1 program step to display-what type of format is required"; when network manager chooses the format about the relevant event; program step to utilise index information to retrieve relevant information from historical database; program step to operate on retrieved information in accordance with format chosen; program step to display additional information in the form of selected format, The present invention also provides a computer program for use in a network management systern, said computer program comprising:

a program step to track network operations to detect a network event; a program step to log said network event and index information relating to the network event; and a program step for subsequently using said index information to retrieve information from an historical database to provide further information relating to said network event.

The present invention also provides a computer comprising a central processing unit, a graphical user interface, and a selector to control the computer, a program store, said program store including a program, said computer program comprising:

a program step to track network operations to detect a network event.

a program step to log said network event and index information relating to the network event; and a program step for subsequently using said index information to retrieve information from an historical database to provide further information relating to said network event.

The present invention also provides a computer network including a computer comprising a central processing unit, a graphical user interface, and a selector to control the computer, a program store, said program store including, a program, said computer program comprising:

Thus one aspect of the invention is that instead of storing large amounts of extra information in the event log to provide event feedback, a small amount of data is stored in the event.log which allows the network management system to reconstruct event feedback displays using historical data (which it is assumed is stored elsewhere in the system).

BRIEF DESCRIPTION OF TBE DRAWINGS

Figure I is a diagrammatic view of a computer network to which the invention may be applied, Figure 2 is a flow chart of an algorithm of a method according to the invention, and, Figure 3 shows a typical event log display.

DESCRIPTION OF A PREFERRED EMBODIMENT OF TBE INVENTION

The method may be applied to a network which comprises, for example, a computer network which includes computers 12B-E, hubs, 13A, 13B routers, switches 14, printers and other devices linked together by physical cable 16A-H or wireless links 16F and an RMON2 probe 26 the purpose of which will be described later- The network may be a local area network (LAN) or a wide area network (WAN) or other types and may operate in accordance with any desired protocol. The network will be managed by a network manager who will normally have a dedicated work station or computer I I which comprises, in addition to a graphical user interface 18, a central processing unit or signal processor 19, a selector which may be in the form of a mouse 22 and/or keyboard to operate the computer, and a program store 21 which may include a CD drive, a floppy disk drive or a zip drive. The method of the 4 invention may be controlled by a program provided to the network manager's computer by means, for example, of a CD, a floppy disk, or a zip disk loaded onto the network manager's computer or alternatively down loaded from the internet and a memory 17 for storing the data discovered by the system.

As explained above, in normal network management systems, events that have been detected by the network management system wiH be stored in the memory 17 and may be displayed for study by the network manager. These events document unusual conditions on the network or unusual behaviour of individual devices on the network.

For example, for each conversation between two devices which may both be on the network or only one which may be on the network, there will be stored the source address, the target address, the protocol used, the time of the start and end of the conversation, the baud rate, etc. This information is stored as previously mentioned in a separate database in the memory 17 or elsewhere.

In the management system, there is defined by relevant rules, (by the network manager or predefined),. events which need to be drawn to the network manager's attention.

Examples of events which are to be searched for and drawn to the network manager's attention might be any one or a combination of some or all of the following:

(a) Events related to the activity of a particular device.

(b) Events related to the activity of a particular network connection/link.

(c) Events related to the behaviour of one particular application/protocol. For example an event might be generated because a lot of HTTP (Hyper Text Transfer Protocol as defined in the IETF RFC2616 "Hyper Text Transfer Protocol") traffic was detected coming from a particular device on the network, in which case the event would be related to the HTTP protocol.

(d) Event related to a change in the behaviour of a particular device/group of devices/network connection. For example if the traffic generated by a particular device doubled between one hour and the next, and this caused an event to be 1 generated, then the event generated would fall into this category. In this case the event must have been detected by comparing the behaviour of the device/group/connection during an 'earlier' time period with the behaviour of the device/group/connection during a 'later' time period. The software in the network management system includes a rule or set of rules for each event and wfll only indicate an event if the relevant rule is met, eg a simple rule in the case of event (a) might be, "display an event if the traffic from a particular device increases fivefold in a successive hourly period".

It would be useful for the network manager to be able to ascertain further details of these events (a) - (d) and if such a provision were to be provided in a conventional network management system, then the additional information would have to be stored along with the network event itself This clearly requires a considerable amount of information to be stored and is inefficient since the network manager would not necessarily be interested in details of all types of network events.

In the present arrangement, as is common, the network management system stores historical data, for example, in a database in memory 17 or elsewhere, and has an event log facility.

In a typical arrangement, the graphical user interface 18 of the network manager's computer 11 may display each relevant event in the form of a line of information. In the present arrangement, in addition to the normal information stored in respect of a particular event, for a relevant type of event, there is also stored index information which enables the more detailed information to be retrieved from the historical database.

One aspect of this preferred embodiment of the invention is that the event log has the property that when an event is added to the log by the event generation system, that index information can be stored alongside the event to aid the event feedback mechanism.

6 When the event is stored in the event log, only the following additional index information is stored in the event log with the event:

An identifier defining the type of event which has been generated.

The time at which or the time period over which the event that caused the event to be generated occurred.

If event is of type (a) above, an identifier identifying the device.

If event is of type (b), an identifier identifying the network connection or link.

If event is of type (c), an identifier identifying the protocol.

If event is of type (d), the times of the 'earlier' and 'later' time periods.

Any additional information required to custornise the 'Event Explanation' (see later).

Storing as index information an identifier or a time does not require storage of a lot of data, therefore, the additional data stored with the event is quite small. Note that some events may relate to multiple protocols, time periods, or devices, in which case the index information for each protocol, time period or device is stored along with the event.

If the network manager selects a specific event and requests 'event feedback' from the network management application (ie he requires more information about an event), then one or more of the techniques in the following sections is used to provide the user with additional information about the event. The Mowing techniques are only possible because of the index information stored with the event.

Firstly, since an identifier is logged recording the type of each event, the network 0 management system can choose to offer to the user the most appropriate features from the following sections based upon the event type.

The network management system displays on the network manager's graphical user interface 18 a diagram or graph of data related to the event. Since, as was discussed earlier, the system keeps a record of historical data, data relating to the activity of devices and the connections at the time the event was created is available at the time 7 the user requests event feedback. When displaying the diagram or graph, the following techniques are used to provide the best possible display to the user:

Since the event log contains index information about the time at which the event occurred, the network management system uses this information to deteriniine from which time period the historical data is used.

If the event is of type (a) or (b), the display given to the user is restricted to or focussed on the device or connection for which the event was logged.

If the event is of type (c), then the display given to the user is restricted to or focussed on that particular protocol.

If the event is of type (d), then the user can choose to view data for the cearlier' or 'later' time periods for which the event was logged OR the display allows the user to compare activity from the 'earlier' period with the 'later' period.

Where multiple devices/connections/protocols are stored in the event log the user chooses either a simultaneous display for all devices/connections/protocols or the user chooses which device/connection/protocol to display data for.

Since the diagram/graph does not rely directly on data in the event log, the network management system could allow the user to interact with the diagram/graph and display further related diagrams/graphs.

As explained above, the system displays an explanation of why the event appeared in the log, based upon the type of event. Since index information about the time period of data involved in the event, the devices involved, etc, has been stored, the explanatory text can be custornised by inserting the addition information about devices, etc, into the text at appropriate points.

If the manager decides he is not interested in the event in the log, he might choose to reconfigure the network management application to prevent it from generating a similar event in future. Since the network management application knows the devices, protocols, etc, for which the event was logged it offers the following options:

If an event was generated in respect of a device X, the system offers the user the option not to generate events related to device X in the future.

If an event was generated in respect of a protocol X, the system offers the user the option not to generate events related to protocol X in the future.

I If appropriate information is available with the event, then similar options allow the user to modify the time of day, the network connection, etc, for which events are generated.

Two specific examples will now be set out- First example

The system is configured to include a rule "To monitor the HTTP activity of all devices, and to generate an event if a large (as defined in the rule) change in the activity of any of the devices is detected". The rule monitors all the HTTP network traffic going to and fi7om each of the devices on the network.

The system detects that the activity of a device X has increased by 1000%: between 4am and 5am on 20'h December 1999 the device activity was 100bytes/s of HTTP and between 5am and 6am on 2e December 1999 it was 1000bytes/s of HTTP. It logs an event with the following extra index information:

The type of event (deviceActivitylncreased) The device for which the change was detected. (X) The times during which comparisons were made: (4am-5am on 20ffi December 1999 vs. 5am-6am on 20 th December 1999).

The protocol that was being monitored (HTTP).

The activity of device X between 4am and 5 am (I 00bytes/s) The activity of device X between 5am and 6am (1000bytes/s) Later, the network manager notes that the event has been generated and requests more O information from the system. The system offers a range of options depending on the type of the event (deviceActivityIncreased), as follows: "Events data display", Events explanation", or "Event generation feedback".

9 Event Data DisplU If the user selects Events Data Display, the user may further select one of the following:

Show FITTI activity of device X between 4am and 5am on 20th December 1999 (this will display all the HM network conversations between device X and other devices between 4am and 5am) Show FITTI activity of device X between 5am and 6am on 20 th December 1999 (this will display all the HTTP network conversations between device X and other devices between 5am and 6am). The user can compare this display and the previous display in order to see why the activity of device X changed.

Graph HTTP activity of device X on the 20'h December 1999. (this will display the FITTP activity of device X as a graph showing how the activity changed over the course of the 20'h December 1999) The data for these displays is retrieved from the historical database. The index information stored with the event is used to determine which data to use from the historical database eg it indexes the relevant dates, the protocol and the device. Event Explanation Selection of this option provides on the graphical user interface 18 an explanation of why this event was generated: 'The HTTP activity of device X increased by 1000%. Between 4am and 5am on 20th December 2000, the activity was 1 00bytes/s, but between 5 am and 6am, activity ro se to 1 000bytes/s' This is based on a textual template, which is filled in with the data stored: 'The <protocol> activity of device <device> increased by <percentage increase> %.

Between <first time interval>, the activity was <first activity>, but between <second time interval> activity rose to <second activity>'. The text in angle brackets <> is substituted with the information which was stored with the event as appropriate.

Each different type of event uses a different textual template.

Event Generation Feedback The user is offered two options:

Don't generate events for device X in future.

Don't monitor protocol HTTP in future.

If the user selects either of these options, then this will prevent future generation of such events. These two options are created based upon the information logged with the event.

Second example The system is configured to include a rule to monitor a physical connection between the US and the UK. 'US' and 'UK' are defined as two groups of devices, and this rule monitored traffic between the two groups of devices. The rule is defined "to generate an event if any single device uses more than 50% of the available capacity on the connection". 20 The system detects that between 3 prn and 4pm on 1 O'h December 1999, traffic sent by device Y (which is in the US) is using 75% of the capacity available on the connection between the US and the UK. It logs an event with the following extra information:

The type of event (deviceUsingf-EghCapacityOnConnection) The connection to which the event relates (US <-> UK) The device which was using high capacity. (Y) The time at which the traffic was detected (3 pm-4pm on I e December 1999).

The percentage of the connection capacity which was being used by device Y (75%).

1 Later, the user sees the event has been generated and requests more information from the system.

The system examines the type of the event (deviceUsingHighCapacityOnConnection), and based on this event type, offers a range of options as described below.

Event Data DisplU The user may select one of the following.

Show all activity on connection US <-> UK between 3 pm and 4pm on 10 th December 1999 (this will display all the network conversations between devices in the US and the UK between 3 pm and 4pm) Show the activity of device Y on the connection between 3 pm and 4pm on 1 O'h December 1999 (this will display all the network conversations between device Y and devices in the UK between 3pm and 4pm) Graph the activity of device Y on the connection for the 10 th December 1999 (this will display the traffic between device Y and devices in the UK showing how the activity changed over the course of the 1 Oth December 1999) The data for these displays is retrieved from the historical database. The index information stored with the event is used to determine which data to use from the historical database.

Event Explanation Selection of the option provides on the graphical user interface 18 an explanation of why this event was generated- 'Device Y was using 75% of the available capacity on the connection between the US and the UK between 3pm and 4pm on 1 & December 2000'.

12 This is based on a textual template, which is filled in with the data stored: 'Device <device> was using <capacity percentage> of the available capacity on the connection between <connection name> between <time interval>'. The text in angle brackets <> is substituted with the information which was stored with the event as appropriate.

Event Generation Feedback The user is offered two options:

Don't generate an event if device Y uses a larage amount of the connection capacity in future.

Only generate an event if some device uses more than 75% of the connection capacity in future.

If the user selects either of these options, then this will prevent filture generation of such events. These two options are created based upon the information logged with the event.

The operation of the network management system in respect of this event log procedure will be controlled by means of a computer program. As is well known the network manager will normally have installed on his workstation a program that enables him to understand the technical operation of the network. The network manager's computer, using relevant software, is fed data from one or more devices such as the RMON or RMON2 (Remote Monitoring Specification) probe 26 which collects data about the activity of devices on the network. The preferred method of the invention is carried out under the control of the network manager's workstation or computer and in particular by means of a program controlling the process of that computer or elsewhere in the system. The program for controlling the operation of the invention may be provided on a computer readable medium, such as a CD, or a floppy disk or a zip drive disk, carrying the program or its equivalent, or may be provided on a computer or computer memory carrying the website of, for example, the supplier of the network products. The program may be downloaded from which ever appropriate source and used to control the processor to carry out the steps of the invention as described. The program may carry out the steps shown in the flow chart set out in Figure 2.

Initially the criteria (rules) for events to be recorded are defined either by the network manager or pre supplied in the software (step 100).

Thus the program may include the following steps:

program step 101, track network operation to detect defined events at regular time intervals; program step 102, network event detected.

program step 1037, based on the type of event, decide what index information is required to be added to the log; program step 104, add new event data from program step 102, and index information from step 10-31, to log; program step 105, display network event.

network manager requests further details about the relevant event at 106; program step 107, retrieve event and index information which was added to the log at program step 104; program step 108, based on the type of event, decide which formats are appropriate for display of further details about the relevant event; program step 109, to display, "what type of format is required?"; network manager chooses the format for further details about the relevant event at 110; program step 111, utilise index information retrieved in program step 108 to retrieve relevant information from historical database; program step 112, operate on retrieved information in accordance with format chosen; program step 113), display additional information in the form of selected format.

Figure 13, shows a typical events log display.

The invention is not restricted to the details of the foregoing example.

14 CLAMS 1. In or for a network management system, a method for providing information relating to a network event, comprising:

2. A method as claimed in claim 1 including an initial step of defining the rules defining a network event.

3. A method as claimed in claim 1 or 2 in which when said network event is detected, displaying an event in a basic format.

4. A method as claimed in claim 1,2 or 3 in which after the information has been retrieved from said historical database, further information relatine, to the event is displayed in a selected more detailed format.

5. A method as claimed in claim 4 in which a plurality of more detailed formats may be provided, and including a step to select between said plurality of more detailed formats.

6. A method as claimed in claim 1 substantially as hereinbefore described.

7. A computer program on a computer readable medium or embodied in a carrier wave for carrying out the method of claim 1.

8. A computer program for use in a network management system on a computer readable medium or embodied in a carrier wave, said computer program comprising.

CY 1 program step to track network operation to detect defined events at regular time intervals; program step to detect a network event; program step to what index information is required to be added to the log.

depending upon the type of event detected; program step to add detected event data and index information from preceding two steps to a log; program step to display a network eventl when network manager requests further details about the relevant event; program step based on the type of event, to provide relevant format for display of further details about the relevant event; program step to display "what type of format is required', when network manager chooses the format about the relevant event; program step to utilise index information to retrieve relevant information from historical database.

program step to operate on retrieved information in accordance with format chosen; program step to display additional information in the form of selected format.

9. A computer program for use in a network management system, said computer program comprising:

10. A computer program as claimed in claim 9 substantially as hereinbefore described.

16 1 11. A computer comprising a central processing unit, a graphical user interface, and a selector to control the computer, a program store, saidprogram store including a program, said computer program comprising:

12. A computer network including a computer comprising a central processing unit, a graphical user interface, and a selector to control the computer, a program store, said program store including a program, said computer program comprising:

a program step to track network operations to detect a network event; a program step to log said network event and index information relating to the network event; and a program step for subsequently using said index information to retrieve information from an historical database to provide further information relating to said network event. 20 17