JP2005520262A - Method and apparatus for generating a context description message - Google Patents

Abstract

A method for reporting a context of a warning condition that includes reporting a warning condition associated with the subject system object and analyzing one or more system objects associated with the warning condition to obtain context data Is disclosed. The method further includes generating a context message based on the context data and outputting the context message.

Description

Detailed Description of the Invention

This application is a continuation of U.S. Pat. No. 5,958,012, issued on Sep. 28, 1999, which is a continuation of U.S. Pat. No. 6,289,380, issued on Sep. 11, 2001. This is a continuation-in-part of US Application No. 09 / 949,101 filed on September 7, 2001, which is an application. This application claims priority from US Provisional Application No. 60 / 272,971, filed March 2,2001. This application incorporates the entirety of each related application by reference.
(Technical field)
The present application relates to the field of ongoing process monitoring and management. More specifically, this application relates to a system and method for generating warning and diagnostic messages that provide context descriptions.

(Background technology)
Systems that manage computers, or network systems, or other systems that incorporate computer technology generally monitor various system parameters to detect problems and alert people to problems. Various techniques can be used to monitor an ongoing process. Analyze monitored values in various ways, including comparison with thresholds, correlation of several values, and correlation of values over a period of time to find problems, unprecedented situations, or other events Can do.

  Some systems use various techniques to predict them before events occur. One such system is described in US Pat. No. 6,327,550 owned by the same applicant. Which is incorporated herein by reference in its entirety. In such systems, one response to detection or prediction is to make a human operator aware of the event. For example, these management systems can issue text message alerts and various such as Windows dialog boxes, monitoring consoles, event logs, e-mail messages, pager messages to indicate this text message to the operator. Technology can be used. Alerts can also be given as voice messages by loudspeakers, headsets, or telephones. An example of a system that provides an audio warning message is a co-filed and pending, owned by the same applicant, named “Method and Apparatus for Generating and Recognizing Audio as a User Interface Element in System and Network Management” In U.S. patent applications. Which is incorporated herein by reference in its entirety. A co-pending and pending US patent application owned by the same applicant and named “Method and Apparatus for Generating Context Description Messages” is also incorporated by reference in its entirety. A co-pending and pending US patent application owned by the applicant, entitled “Method and Apparatus for Filtering Messages Based on Context”, is also incorporated herein by reference in its entirety.

The generated alert notification can describe the detected or predicted alert condition in a broad representation or in detail. In a large management system with many managed components, the specific component included in the alert condition is usually identified by name. A typical warning notification is as follows, for example.
・ "Uschdb02 has excessive page swapping."
・ "Oracle 12's journaling drive is full."
・ "Coolant temperature of engine 3 is too high."
・ "Stock level of chocolate cookies is low"

  Some management systems can also access a wide range of information about managed components including hardware settings, software settings, performance and load, schedules, users, operational processes, and network connectivity. Such information is useful for detecting the cause of warning conditions and for identifying how to avoid or prevent future occurrences. Such information may further be useful for detecting which components are directly or indirectly affected by the problem. Such root cause analysis and effect analysis can be assisted by automated tools or simply left to human operators.

  In some management systems, a human operator who receives a warning notification about a detected or predicted problem can extract information about related objects through various types of user interfaces. However, as the managed system grows, the number of components also increases, making it increasingly difficult for human operators to remember the names of the various components or their functions in the system. Thus, the original alert notification will be of limited use, and the operator will begin by searching for the identified component through the graphical user interface, extracting relevant information from many sources, and You will have to analyze the meaning.

  In addition, alert notifications typically contain information primarily about alert conditions, and there is insufficient information about managed components, so users often have any support information that may be useful. You will search through several user interface layers to find. Such current procedures are inefficient and rely on excessively high levels of operator skill. Because such user interfaces for information extraction are based on visual representation, the requirement to retrieve additional information is an advantage of new delivery mechanisms such as pager and telephone call delivery. Will be greatly canceled. Information retrieval can be done on channels using keypad input or call recognition, but such information retrieval mechanisms are inconvenient when additional information is desired.

(Disclosure of the Invention)
The present disclosure provides a management system and method with improved alert message delivery. The present disclosure further provides a warning system and method capable of giving a warning notification state detected by the management system by a description of the context. According to one embodiment, a warning condition associated with the target system object is reported, one or more system objects associated with the warning condition are analyzed, context data is obtained, and the context data is stored in the context data. Disclosed is a method for reporting the context of a warning condition that includes generating a context message based thereon. The method further includes outputting a context message.

(Detailed explanation)
For a more complete understanding of the present method and system, reference is made to the following description, taken in conjunction with the accompanying drawings, wherein like reference numerals indicate like features, and in which:

  An exemplary IT organization is shown in FIG. 1A. The IT organization 150 includes local area networks 155, 160 and 165. The IT organization further includes various hardware and software components such as workstations, printers, scanners, routers, operating systems, applications, and application platforms. Each of the components of the IT organization can be monitored and managed according to the present disclosure.

  Various components of an exemplary management system 100 topology capable of managing an IT organization in accordance with the present disclosure are shown in FIG. 1B. Management system 100 includes at least one visualization workstation 105, object repository 110, one or more management applications 115, and one or more management agents 120 associated with each management application 115. including.

  Visualization workstation 105 provides users with access to various applications, including network management application 115. The workstation 105 interacts with the object repository 110 that stores and supplies notifications of requests, commands, and events. The workstation 105 requests information from the object repository 110 and sends commands to the object repository from which to obtain notification of events such as state changes or object additions. The object repository 110 receives from the management application 115 request information provided by a management agent 120 responsible for monitoring and managing a particular component or system in the IT organization.

  The management application 115 partially maintains the object repository 110 to keep track of the object under consideration. The object repository 110 may be a persistent storage that holds information about managed components or systems such as databases. In an alternative embodiment, the management application 115 and the object repository 110 are incorporated into a single unit that can maintain information about managed components in volatile memory and perform management application tasks. it can.

  As shown, one structural aspect of the system is that the visualization workstation 105 interacts primarily with the object repository 110 in normal operation. This reduces network traffic, improves the performance of graphical rendering at the workstation, and the visualization workstation 105 and multiple management applications 115, their subsystems, and the agents 120 residing in the IT organization. Reducing the need for interdependence between Of course, embodiments having other configurations for the components shown are contemplated, including standalone embodiments where the components include an integral workstation.

  In addition to processing requests, commands, and notifications, the object repository 110 can also process objects that describe the structure and operation of the management system 100. Such objects can describe the instantaneous state, load, and performance of components and / or systems. Such objects can be read using a manual process or an automatic discovery utility.

  Referring now to FIG. 2, the components that form one embodiment of a warning system according to the present disclosure are shown. Management application 115 includes an alert system 200 for detecting and reporting alert conditions related to managed components of IT organization 150. The alert system 200 includes an alert condition detection module 205 that supervises the status of system components with an analysis database 215 that contains system objects that define the topology of the system. Through analysis of system objects in database 215, warning condition detection module 205 can identify actual or possible warning conditions. When a warning condition is identified, module 205 generates a warning condition object and stores it in database 210. Alert notification module 220 periodically analyzes alert condition objects in database 210 and reports the associated alert conditions represented by the objects.

  The alert system 200 further includes an alert dialog manager 225 for generating a message that describes the context of the system object that is subject to the reported management system alert condition. In one embodiment, as shown in FIG. 2, a context description may be provided as a result of one or more dialog requests received by an alert dialog manager 225 from an operator. In an alternative embodiment, the alert notification module 220 and the alert dialog manager 225 can be integrated so that the context description is provided at the same time as the alert notification.

  The context description of the system object that is the subject of the warning condition includes the physical location of the associated system component, the logical relationship of the system object to other system objects, the operational status of the system object, the system It may include business processes associated with the object, engagement / business groups associated with the system object.

  Referring now to FIG. 3, an exemplary flow diagram of a method for reporting a context associated with a warning condition according to one embodiment of the present disclosure is shown. At block 305, a warning condition is detected. The alert condition may be an alarm between an existing condition requesting operator attention, an existing condition that may request operator attention, or an expected / possible condition. Any technique known to those skilled in the art can be used to detect actual or possible warning conditions.

  At block 310, a warning condition notification is generated. The notification may be embodied as text, video, audio, or any other means of giving a warning. The alert condition notification may include identifying the alert condition and / or identifying the component of the system that is the subject of the alert. The warning condition notification is output to the operator at block 315.

  At block 320, it is determined whether a request has been received to provide a context description for the alert. If such a request is received, the system continues processing at block 325. In an alternative embodiment, the system can be configured to automatically provide a complete or partial description of the context of a warning condition without requiring a request from an operator. In yet another alternative embodiment, the system can be configured to automatically provide information for a specific context and provide information for another specific context upon operator request.

  In block 325, the relevant system object is analyzed to obtain context information. Which system objects will be analyzed depends in part on the context information required. For example, to provide the status of a component that is the subject of a warning condition, the system will only analyze system objects that represent the component of interest. On the other hand, if the context request is related to another component, such as a request that lists all of the components whose operation is dependent on the target component, Some or all system objects will be analyzed so that dependencies are sought.

  At block 330, a context message is generated that describes the warning condition and / or the context of the subject component. The context message is output at block 335.

  In the illustrated embodiment, blocks 320 through 335 can be executed one or more times, allowing the operator to connect the system to a dialog. As an example, the system may output a warning notification, such as “There is a very high risk of catastrophic deceleration at server uschdb02” at block 315.

  As in this example, the specific information can be replaced or paraphrased before the warning notification is output. Such word substitution, which can also be applied to messages that describe the context of warning conditions, may be made to make such messages more natural and easy for human operators to understand. In this example, the system uses quantitative terms with numbers such as “75% risk” and “severity 4” using numbers such as “very high risk” and “catastrophic slowdown”. Not replaced with a term.

(Context description of managed objects)
In order to identify the problem source, the user may request “Which system is it” for a more detailed context description of the managed component that is the subject of the alert notification. In block 335, the system
“Uschdb02 is a critical role NT server in Chicago's website server farm. It runs SQLServer. It has a replication server with automatic failover named uschdb02B, and this server Is operational and in normal status. "
Can respond.

Such a response is a meaningful representation for the user and displays the context of the managed component. The message elements include:
uschdb02: The warning dialog manager 225 identifies the managed component in the sentence and ensures that the character is self-explanatory without misunderstanding.
Mission Critical: The database 215 maintains data that describes the structure of the managed system, including importance attributes for all objects. Importance attributes can be defined at the category level or instance level and can be propagated like status. The importance attribute is described in more detail in the co-pending and co-filed US patent specification entitled “Method and Apparatus for Filtering Messages Based on Context” owned by the applicant. Yes.
NT server: identifies the class of components involved.
Chicago Website Server Farm: Identify the groupings to which the relevant components described in more detail below belong.
Run SQLServer: This phrase identifies the critical components in the managed component, in this example the software system that runs on this server. In some cases, the functionality of a component can be performed by a subcomponent or subsystem hosted by that component. Since components may host multiple subcomponents and / or subsystems, in one embodiment, subcomponents and / or subs with threshold importance attributes are used to avoid / reduce confusion. Only the system will be reported.

  The last part of the example response “This has a replica server with automatic failover named uschdb02B, this server is operational and in normal status.” Is of interest to the operator Give other information about the managed object that may be. In this example, the system has information about the replication and failover configuration installed for the object and describes that information along with a reasonable amount of descriptive information about the replication server. The alert dialog manager 225 also gives the name of the replica server and the current status.

(Identifies the topological location of managed objects)
To identify the source of the problem, the user may request “Where is the component located?” For a more detailed context description of the physical component that is the subject of the alert notification. At block 335, the system may respond “uschbd02 is in subnet xyz, segment 1234 of the headquarters building in Chicago”.

  The alert dialog manager 225 uses information about the location of the component in the database 215 to generate a description based on navigation from the bottom of the hierarchy of the component so that a topology hierarchy for the component is determined. In this example, the system can respond: “uschbd02 is in Chicago HQ subnet xyz, segment 1234”.

(Description of traffic load)
Other information that the operator may want to know to deal with error conditions includes a description of the traffic load. The operator can request "How busy are the components?" And the system can respond, for example, "The traffic load on usdbdb02 is high but within normal operating range". Such a response shows how obvious the answer is and can reduce the risk of misunderstanding as compared to the use of pronouns.

(Description of dependency)
In order to address some warning conditions, the operator will want to identify dependencies between the component that is the subject of the warning condition and other components in the system. To help provide such information, alert dialog manager 225 supports dependency questions such as “who or what depends on the component?”.

  In response to the request for information, alert dialog manager 225 refers to database 215 at block 325 to analyze any dependencies associated with the component of interest. Information about dependencies can be propagated up through the hierarchy of containment relationships. The alert dialog module 225 may generate and output a response such as “All web servers in the Chicago website server farm depend on uschdb02”.

  Dependencies can be clearly defined by the user or application or inferred by discovered relationships. Dependencies can also be propagated to other components. For example, if an application depends on the database platform, the machine hosting the application also depends on the database platform.

  In one embodiment, to make the context message more meaningful, the alert dialog manager 225 can avoid a long list of components in the first message. Instead, at block 325, the alert dialog module 225 can identify a unique grouping of components and use it to generate a more meaningful description. For example, components can be identified as belonging to a predetermined grouping with a distinguishable display. If the database 215 already defines a dependency as pointing to a group, the warning dialog module 225 can easily generate such a group level description. Otherwise, and if the dependency indicates a large number of components, the warning dialog module 225 may analyze the list display by listing all groups of which the component is a member and based on common definitions. Thus, a unique grouping can be searched.

Examples of contextual messages resulting from such an analysis include:
1) If there is a perfect match between the list of components and the group: “All servers on the Chicago website ...”
2) If some components of the list form a perfect match with the group: “All servers on the Chicago website, and servers in the Detroit warehouse ...”
3) If the components in the list fit the group definition almost exactly: “All servers on the Chicago website except the SNA server ...”
4) If the components of the list form an incomplete match with the group: “Most servers on the Chicago website ...” or “Many servers on the Chicago website ...”
Is included.

  In one embodiment, the alert dialog module 225 compares the available group definitions and selects the one that best fits as the basis for the description. If any useful groupings do not fit the list, the system can list the systems individually if the list is short, or specify by using a phrase such as “Several Systems” It is possible not to specifically display the dependency of. To assist in selecting an appropriate grouping as a basis for the description, the database 215 can include one or more indicators about the importance of different types of groupings. For example, identifying membership in a business process such as order processing as more interesting than the fact that the server is contained in a single network segment, and thus more useful as a descriptor. Can do. In addition, the warning dialog module 225 may support explicit enumeration of dependencies such as “Chicago website server farm includes uscap01, uscap02, uscap03, uscap05, uscap11, and uscap12”. it can.

In addition, the user may issue a query about the status of the entire group. In response to such a query, the system can generate a response for the entire group instead of listing each of the objects in the group. The following dialog is a request for such a group-based status.
“The Chicago website server farm relies on uschdb02.”
"What status are they in?"
“The Chicago website server farm is in normal status.”

(Select relevant information)
Analysis for acquiring context information is not limited to objects in the database 215. In some embodiments, the alert dialog module 225 uses other information storage so that context information about managed objects is obtained. When a wealth of context information is acquired, it may be advantageous to show only a portion of the available information so that the understanding of large-scale situations is not compromised. Accordingly, the alert dialog module 225 can include control logic to determine what information to indicate. In one embodiment, the alert dialog module 225 ranks each piece of information based on a rating of the importance of each object and based on a predetermined rule regarding what kind of information is most interesting. These laws can depend on factors such as, for example, managed component or operator identifiers.

  For example, when managing certain types of networked computer systems, knowing what business processes this system is not part of which network subnet It will be more interesting. The alert dialog module 225 can generate descriptive elements and then rank them by relevance so that only the most important ones are included.

(Effect analysis)
In some embodiments, the object repository 110 stores data describing relationships in managed components, including, for example, containment relationships that indicate which components are contained in different and various types of dependencies. Store. Thus, the system can perform an effects analysis that can be used to generate messages for all components that are affected by the diagnosed or anticipated warning condition.

  In one embodiment, the most significant impact or problem is reported to the operator. The management application 115 can generate alert notifications based on the most important objects affected using logic to identify the effect analysis chain. Since importance attributes are propagated along containment and dependency relationships, this can be the highest object in the containment hierarchy.

(Language translation)
In a multinational system, operators are allowed to speak different native languages. Thus, in one embodiment, the alert notification system includes translation capabilities.
Language translation is performed in at least two ways: (1) a message is generated in several languages, one of the several languages is selected for output to the operator, or (2) a message Are generated in several suitable languages and translated in real time to another language for output to the operator.

  Complex systems can generate a wide range of messages, i.e. messages composed of intelligent subsystems in the form of complete sentences with context-dependent elements, so simply translate the messages artificially in advance Thus, dealing with the translation of the message may not be practical. In addition, it may not be practical to force all messages to be generated in English, as individual subsystems may be written in different countries and operate in different countries. Thus, in one embodiment, the alert subsystem of management application 115 generates messages in a predetermined language based on each subsystem, and the messages will be translated by industry-standard translation software.

  This application further includes U.S. Patent Nos. 5,958,012, and 6,327,550, and pending U.S. Patent Application Serial Nos. 09 / 558,897 and 09 / 559,237. All of which are incorporated herein by reference in their entirety.

  Accordingly, it is to be understood that the drawings and descriptions in the present disclosure are preferred to assist in understanding the system and should not be construed as limiting the scope thereof. It should be understood that various changes, substitutions, and modifications can be made without departing from the spirit and scope of the system.

1 illustrates an example organizational system. 1 is an exemplary management system topology that can be used in accordance with the disclosed methods. FIG. 4 shows a block diagram of exemplary components for implementing an embodiment of a method of a warning system according to the present disclosure. FIG. 6 is an exemplary flow diagram of one method for reporting a context associated with a warning condition according to an embodiment of the present disclosure.

Claims (10)

A method for reporting the context of a warning condition,
Report warning conditions associated with the system object in question,
Analyzing one or more system objects associated with the warning condition to obtain context data;
Generating a context message based on the context data;
Outputting the context message;
A method that consists of things.   The method of claim 1, further comprising receiving a request for reporting a context of the warning condition.   The method of claim 1, wherein the analyzing comprises determining attributes of the target system object.   The method of claim 1, wherein the analyzing includes determining a physical location of a component represented by the target system object.   The method of claim 1, wherein the analyzing comprises determining a logical relationship between a component represented by the target system object and at least one other component.   The method of claim 1, wherein the analyzing comprises determining a traffic load associated with the subject system object.   2. The analyzing includes identifying one or more system objects, wherein each identified system object represents a component that depends on a component represented by the subject system object. The method described in 1.   The method of claim 1, wherein the generating comprises replacing context data that can be quantified with a qualitative identifier. A system for reporting the context of warning conditions,
Means for reporting a warning condition associated with the system object of interest;
Means for analyzing one or more system objects associated with the warning condition to obtain context data;
Means for generating a context message based on the context data;
Means for outputting the context message;
A system comprising: A computer readable storage medium encoded with processing instructions for reporting the context of a warning condition,
Computer readable instructions for reporting warning conditions associated with the subject system object;
Computer readable instructions for analyzing one or more system objects associated with the warning condition to obtain context data;
Computer readable instructions for generating a context message based on the context data;
Computer readable instructions for outputting the context message;
A computer-readable storage medium comprising:

Images