KR20030093227A - Method and apparatus for generating context-descriptive messages - Google Patents

Abstract

A method is disclosed for reporting a context of an alert condition, the method comprising reporting an alert condition associated with a target system object, and analyzing one or more system objects associated with the alert condition to obtain context data. The method further includes generating a context message based on the context data, and outputting the context message.

Description

METHOD AND APPARATUS FOR GENERATING CONTEXT-DESCRIPTIVE MESSAGES}

[Related Application]

This application is a part-continuation of US application Ser. No. 09 / 949,101, filed September 7, 2001, which is a continuing application of US Pat. No. 6,289,380, issued September 11, 2001, U. S. Patent No. 6,289, 380 is a continuing application of U.S. Patent No. 5,958,012, issued September 28,1999. This application claims US Provisional Application No. 60 / 272,971, filed March 2, 2001, as the basis of priority. This application contains the entire contents of each associated application by reference.

Systems running computer or network systems, or other systems in which computer technology is embedded, typically monitor various system variables for the purpose of detecting problems and alerting humans about them. Various techniques may be employed to monitor the ongoing process. To find problems, unprecedented situations and other events, the monitoring values can be analyzed in a variety of ways, including comparing with a threshold, correlating some values and correlating values over time.

Some systems use various techniques to predict events before they occur. One such system is described in shared US Pat. No. 6,327,550, which is incorporated herein by reference in its entirety. In such a system, the response to this discovery or prediction is to make the event noticeable to the human operator. For example, these operating systems can generate an alarm text message, and different techniques such as window dialog boxes, surveillance consoles, event logs, e-mail messages, and pager messages to present the text message to the operator. Can be adopted. The alarm can also be supplied in the form of an audio message via a speaker, headset or telephone. One example of a system that provides audio alert messages is "Method and Apparatus for Generating and Recognizing Speech as a User Interface Element in Systems and Network Management." "A shared U.S. utility model application, filed at the same time and pending application," the entirety of which is incorporated herein by reference. Also incorporated by reference in its entirety is the United States utility model application, entitled “Methods and Apparatus for Filtering Messages Based on Context,” which are simultaneously filed and pending together.

The generated alert notification may describe the detected or predicted alert condition in a broad sense or in detail. In large operating systems with many operating elements, the specific elements involved in the alarm condition are identified by name. For example, a typical alert notification may be in the form of:

-"uschbd02 has excessive page swaps."

-"Oracle 12 journaling drive is full."

-"Coolant temperature is too high for engine 3."

-"The list of chocolate cookies is low."

In addition, some operating systems have access to extensive information about operating elements, including hardware configuration, software configuration, performance and load, schedules, users, working processes, and network connectivity. This information can be useful for detecting the cause of an alarm condition and finding ways to reverse it or prevent future occurrences. This information can also be useful for detecting which components were directly or indirectly affected by the problem. This root cause analysis and impact analysis can be assisted by automated tools or simply left to the operator.

In some operating systems, an operator who has been alerted to a detected or predicted problem may retrieve information about associated objects through various types of user interface. However, as the operating system grows, the number of components also increases, making it increasingly difficult for an operator to remember the names of the various components of the system or their functions. Thus, the original alert notification can be limited in use, and the user can retrieve the identified components through a graphical user interface, taking the relevant information from many sources and analyzing the true meaning of this alert. You may have to start.

In addition, because alert notifications typically contain key information about the alarm condition and limited information about the operating components, users may often find information through the various layers of the user interface to find potentially useful support information. have. These current methods are not efficient and are overly dependent on the high level of user expertise. Since such user interfaces for information retrieval are based on visual representations, the requirement to fetch additional information usually vanishes from the benefits of new delivery mechanisms such as pagers and telephones that deliver information by voice. The retrieval of information can also be done with these channels, via keypad input or voice recognition, but when additional information is desired, this information retrieval mechanism can be inconvenient.

[Summary of invention]

The present disclosure provides an operating system and method for delivering enhanced alert messages. The present disclosure also provides an alert system and method that can provide a description of the context of alert notification conditions detected by an operating system. According to one embodiment, the method comprises reporting an alert condition associated with a target system object, analyzing one or more system objects associated with an alert condition for obtaining context data, and generating a context message based on the context data. A method for reporting the context of an alert condition is disclosed. The method further includes outputting a context message.

In general, the present application relates to the field of monitoring and operating ongoing processes. In particular, the present application relates to systems and methods for generating alert and diagnostic messages that provide contextual description.

For a more complete understanding of the present method and system, reference is made to the following description with reference to the accompanying drawings, in which like reference numerals refer to like features.

1A is a diagram of an exemplary enterprise system.

1B is a phase relationship diagram of an exemplary operating system that may be employed in accordance with the disclosed methodology.

2 is an exemplary component diagram for implementing one embodiment of an alert system methodology in accordance with the present disclosure.

3 is a flow diagram of one method for alerting a context associated with an alert condition in accordance with one embodiment of the present disclosure.

An exemplary IT enterprise is shown in FIG. 1A. IT enterprise 150 includes regional networks 155, 160, and 165. IT enterprise 150 includes various hardware and software components such as, for example, workstations, printers, scanners, routers, operating systems, applications, and application platforms. Each component of IT enterprise 150 may be monitored and operated in accordance with the present disclosure.

The topological relationship of the various components of an exemplary operating system 100 capable of operating an IT enterprise in accordance with the present specification is shown in FIG. 1B. Operating system 100 includes at least one visualization workstation 105, object storage 110, one or more operating applications 115, and one or more operating agents 120 associated with each operating application 115.

The visualization workstation 105 provides user access to various applications, including the network operating application 115. Workstation 105 interacts with object storage 110 to store and deliver requests, commands, and event notifications. Workstation 105 requests information from object storage 110, sends commands to object storage, and receives notification of an event, such as a change of situation or addition of an object, from object storage. The object storage 110 receives a request for information from an operational application 115, which is provided by an operational agent 120 that is responsible for monitoring and operating any component or system in an IT enterprise.

The operating application 115 maintains the object storage 110, in part to track changes in the object. Object storage 110 may be permanent storage that maintains information about operating components or systems, such as databases. In another embodiment, the operating application 115 and the object storage device 110 may be integrated into one unit that may maintain information about operating components and perform the task of the operating application.

As shown, one of the features of the architecture of the system is that in a standard operation the visualization workstation 105 interacts primarily with the object storage 110. This reduces network traffic, improves the performance of graphics processing at workstations, and provides visualization workstation 105 and a number of operational applications 115, their subsystems and agents (inside the IT enterprise). 120 reduces the need for interconnections. Of course, embodiments may be conceived in which the illustrated components are configured differently, including an integrated embodiment in which the components include one integrated workstation.

In addition to processing requests, commands, and notifications, object storage 110 also processes objects that describe the structure and operation of operating system 100. Such objects may describe the transient state, load, and performance of components and / or systems. These objects can be distributed using manual procedures or automated discovery utilities.

Referring now to FIG. 2, the components that form one embodiment of an alert system in accordance with the present disclosure are shown. The operational application 115 includes an alert system 200 for detecting and reporting alert conditions associated with the operating components of the IT enterprise 150. The alert system 200 includes an alert situation detection module 205 that monitors the state of system components by analyzing a database 215 containing system objects that define the topological relationships of the system. Through analysis of the system objects in the database 215, the alert condition detection module 205 may identify actual or potential alert conditions. Upon confirming the alert condition, module 205 generates an alert condition object and stores it in database 210. The alert notification module 220 periodically analyzes alert condition objects in the database 210 and reports the relevant alert conditions that these objects represent.

The alert system 200 includes an alert conversation manager 225 for generating a message describing the context of a system object that is the subject of the reported alert condition of the operating system. In one embodiment, the context description as shown in FIG. 2 may be provided as a result of one or more chat requests received from the operator by the alert chat manager 225. In another embodiment, alert notification module 220 and alert conversation manager 225 may be integrated, and a context description may be provided with alert notification.

The context description of a system object under an alert condition includes the physical location of the associated system component, its logical relationship with other system objects, the operational state of this system object, the business process (s) associated with this system object, and Contains the interests / business groups associated with the system object.

Referring now to FIG. 3, an exemplary flow diagram of a methodology for reporting a context associated with an alert condition is shown in accordance with an embodiment of the present disclosure. At block 305, an alert condition is detected. This alert condition may be an existing condition that requires operator attention, an alarm regarding an existing condition, or a predicted / potential condition that may require operator attention. Any technique known to those skilled in the art in the detection of actual or potential alarm conditions may be used.

At block 310, an alert condition notification is generated. The notification may be implemented in the form of text, motion video, audio or other means capable of providing alerts. Alert condition notification includes the identification of an alert condition and / or a component of a system that is the subject of an alert. The alert condition notification is output to the operator at block 315.

At block 320, a determination is made whether a request has been received to provide a description of the context of this alert. If such a request has been received, the system continues the process at block 325. In other embodiments, the system may be configured to automatically provide a complete or partial description of the context of the alert condition without requiring a request from an operator. In yet another embodiment, the system is configured to provide certain context information automatically, and provide any other context information upon the operator's request.

At block 325, related system objects are analyzed to obtain context information. Which system objects are to be analyzed depends, in part, on the contextual information it seeks. For example, to provide the status of a component that is the subject of an alert condition, the system can only analyze system objects that represent the target component. On the other hand, context requests relating to other components, such as the need to list all components whose operation depends on the target component, can be analyzed to determine their dependencies on the target component.

At block 330, a context message is generated that describes the alert condition and / or the context of the target component. The context message is output at block 335.

In the illustrated embodiment, blocks 320-335 can be implemented more than once, allowing the operator to talk to the system. For example, the system may output an alert notification at block 315, such as " very likely to slow down processing speed on server uschdb02 ".

As in this example, certain information can be replaced or corrected before the alert notification is output. Substitution of these terms, which can also be applied to messages describing the context of an alert condition, can be performed to allow the operator to understand these messages more naturally and more easily. In this example, the system replaced a water meter such as "75% risk" and "problem level 4" with a non-water meter such as "very high risk" and "extreme degradation."

A description of the context of the operating object

To identify the source of the problem, the user may ask, "What system is it?" To get a more detailed contextual description of the operating component that is the subject of the alert notification. At block 335, the system may respond as follows:

"uschdb02 is a mission-critical NT server on the Chicago Web site server farm. It runs the SQL server. It is a copy server named uschdb02B that automatically switches over when it fails. server), this server is busy and in a good state. "

This response confirms the context of the operating component in a meaningful form to the user. The elements of the message include the following:

uschdb02: The alert dialog manager 225 identifies the components operating in this sentence, ensuring that this sentence is self-descriptive, ensuring that there is no misunderstanding.

Mission-critical: The database 215 maintains data describing the structure of the operating system, including the important properties for all objects. Critical properties can be defined at the class or instance level, and propagated as states. The critical properties are described in more detail in a shared and pending US patent application entitled “Methods and Devices for Filtering Messages Based on Context”.

NT Server: Check the class of the associated component.

Chicago Website Server Farm: Identify the groups to which associated components belong, which will be discussed in more detail below.

This runs SQL Server: This verse identifies the components that run, in this example, the critical components contained in the software system that runs on this server. In some examples, the functionality of a component may be performed by a sub-component or subsystem hosted by this component. Because a component can host multiple sub-components and / or subsystems, in one embodiment only sub-components and / or subsystems with critical important properties are confused. Can be reported to avoid / reduce it.

At the end of this example response, "it has a replication server named uschdb02B that automatically switches on failure, and this server is busy and healthy." It provides other information about the object being operated on. In this example, the system has information about the copy stored for the object and the switchover configuration upon failure, with a reasonable amount of descriptive information about this copy server. Alert conversation manager 225 may also provide the name and current status of this copy server.

Identifies the topological location of the object being operated

To identify the source of the problem, the user may ask, "Where is the component located?" To obtain a more detailed context description of the physical component that is the subject of the alert notification. At block 335, the system may respond with "uschdb02 is in Chicago, headquarters building, subnet xyz, segment 1234".

The alert dialog manager 225 uses information about the position of the components in the database 215 to determine the topological hierarchy associated with the components and describes them based on the downward navigation from the root of the hierarchy to the components. Create In this example, the system may respond with "uschdb02 is in Chicago, HQ building, subnet xyz, segment 1234".

Traffic load technology

Another information that the operator wants to know in order to handle error conditions is a traffic load description. The operator may ask for "how busy the component is," and the system may respond, for example, "traffic load on uschbd02 is high but within normal operating range." This response indicates how self-descriptive the response can be to reduce the risk of misunderstanding of the pronoun's indication.

Dependency technology

In order to handle a given alert condition, the operator may wish to identify a dependency relationship between the component that is the subject of the alert condition and other components in the system. To facilitate providing this information, alert conversation manager 225 supports dependency queries such as "what or who is dependent on the component?".

In response to the request for information, alert conversation manager 225 may refer to database 215 at block 325 to analyze any dependency relationship associated with the target component. Information about the dependency relationship may be propagated upward through the containment hierarchy. The alert dialog module 225 may generate and output a response such as "All web servers in the Chicago web site server farm are dependent on uschbd02".

The dependency relationship may be defined exclusively by the user or the application, or may be inferred from the found relationship. The dependency relationship may be propagated to other components. For example, if an application depends on the database platform, the machine hosting the application also depends on that database platform.

In one embodiment, to make the context message more meaningful, alert conversation manager 225 may avoid long component lists within the initial message. Instead, at block 325, alert dialog module 225 may identify a unique group of components that may be used to create a more meaningful description. For example, a component may be identified as belonging to a predefined group with separate labels. If the database 215 predefines a dependency relationship as an indication for the group, the alert dialog module 225 can easily create this group level description. Otherwise, if the dependency relationship also points to a number of components, the alert dialog module 225 may inherently list all the groups whose components are elements and analyze the list based on conventional definitions. You can search for groups.

An example of a context message generated by this analysis is as follows.

1) The component list and group match perfectly: "All servers in the Chicago website…"

2) Some of the components in the list match the group perfectly: "All servers in the Chicago website and the Detroit Depot server…"

3) If a component in the list almost exactly matches the group definition: "All servers in the Chicago Web site except SNA Server…"

4) If an element in the list incompletely matches a group: "Most servers in the Chicago website…" or "Multiple servers in the Chicago website…"

In one embodiment, alert dialog module 225 compares the available group definitions and selects the one that best matches as a basis for the description. If no useful group matches the list, the system may list the systems individually if the list is short, or ignore them to clearly identify specific dependencies by using a syntax such as "some systems". To aid in the selection of appropriate groups as a basis for the description, the database 215 may include one or more indicators regarding the importance of different types of groups. For example, membership of a business process, such as Order Processing, is of more interest than the fact that the server is contained within a single network server, and thus may be identified as more useful as a descriptor. In addition, the alert dialog module 225 may support a request to clarify a list of dependencies such as "Chicago website server farm includes uschap01, uschap02, uschap03, uschap05, uschap11, uschap12".

In addition, the user can generate a query regarding the status of the entire group. In response to this query, the system may generate a response for the entire group instead of listing each of the objects in the group. The dialog below illustrates these group-based status requests.

"All web servers within the Chicago website server farm are dependent on uschbd02"

"What is their condition?"

"Chicago Web site server farm is in a healthy state"

Selection of related information

The analysis for obtaining the context information 325 is not limited to objects in the database 215. In some embodiments, alert dialog module 225 may use another information store to obtain contextual information about the object being operated on. Once sufficient contextual information is obtained, it may be advantageous to present only a portion of the available information so as not to compromise the understanding of large-scale situations. Thus, alert dialog module 225 may include control logic to determine what portion of information is to be provided. In one embodiment, alert dialog module 225 ranks each piece of information based on a priority ranking of each object, as well as predefined rules about what type of information is most interested. Such rules may depend on factors such as operating component or operator identifiers, for example.

For example, when operating a networked computer system, it may be more interested in which business process it is, rather than which network subnet it is part of. The alert dialog module 225 can create descriptive elements and then rank them by relevance, including only the most important ones.

Impact analysis

In certain embodiments, object store 110 stores data describing relationships between components that operate, including, for example, inclusion relationships that indicate which components are included in other various types of dependency relationships. . Thus, the system can perform an impact analysis, which can be used to generate a message about all components affected by a diagnostic or predicted alarm condition.

In one embodiment, the most important effect or problem may be reported to the operator. The operational application 115 employs logic to identify the impact analysis chain and can generate alert notifications based on the most important objects affected. The importance property propagates along containment and dependency relationships, so it tends to be the top object in the containment hierarchy.

Language translation

Within a multinational system, operators may find that they use a variety of national languages. Thus, in one embodiment, the alert notification system includes a translation function.

Language translations may include: (1) a message is generated in several languages, one of several languages is selected as output for an operator, or (2) a message is generated in a suitable suitable language, or another output is output to an operator. This can be done in at least two ways, including being translated in real time.

Since complex systems can generate a wide variety of messages-messages composed by intelligent subsystems in the form of complete syntax with context-dependent elements-it is not practical to handle translation of messages by simply manually translating the messages in advance. You may not. In addition, it can be impractical to force all messages to be generated in English because individual subsystems can be written in different countries and can be executed in different countries. Thus, according to one embodiment, the alert subsystem of the operating application 115 may generate a message in a predetermined language based on each subsystem, and the message may be translated by industry standard translation software.

This application is related to US Pat. Nos. 5,598,012, 6,289,380, 6,327,550, and co-pending US Application Ser. Nos. 09 / 558,897, 09 / 559,237, which are hereby incorporated by reference in their entirety. do.

Accordingly, the drawings and techniques herein are provided to facilitate understanding of the system and should not be construed as limiting the scope thereof. It should be understood that various changes, substitutions and alterations can be made without departing from the spirit and scope of the present system.

Claims (10)

In the method of reporting the context of an alert condition, Reporting an alert condition associated with the target system object; Analyzing one or more system objects associated with the alert condition to obtain context data; Generating a context message based on the context data; And Outputting the context message Context reporting method comprising a. 2. The method of claim 1 further comprising receiving a request to report the context of the alert condition. The method of claim 1 wherein the analyzing comprises determining a characteristic of the target system object. The method of claim 1, wherein the analyzing comprises determining a physical location of a component represented by the target system object. The method of claim 1, wherein the analyzing comprises determining a logical relationship between a component represented by the target system object and at least one other component. 2. The method of claim 1 wherein the analyzing comprises determining a traffic load associated with the target system object. The method of claim 1, wherein the analyzing comprises identifying one or more system objects, wherein each identified system object represents a context that represents a component that is dependent on the component represented by the target system object. Way. The method of claim 1 wherein the generating step includes replacing quantifiable context data with a qualitative identifier. In a system for reporting the context of an alert condition, Means for reporting an alert condition associated with the target system object; Means for analyzing one or more system objects associated with the alert condition to obtain context data; Means for generating a context message based on the context data; And Means for outputting the context message Context reporting system comprising a. A computer readable storage medium encoded with process instructions for reporting a context of an alert condition, the computer readable storage medium comprising: Computer readable instructions for reporting an alert condition associated with the target system object; Computer readable instructions for analyzing one or more system objects associated with the alert condition to obtain context data; Computer readable instructions for generating a context message based on the context data; And Computer readable instructions for outputting the context message Computer-readable storage medium comprising a.