a2) United States Patent
`US 7,225,250 B1
`(10) Patent No.:
`Harrop
`(45) Date of Patent:
`May 29, 2007
`
`
`
`
`US007225250B1
`
`2003/0088663 Al*
`5/2003 Battat et al... 709/224
`OTHER PUBLICATIONS
`US. Appl. No, 09/345,634, filed Jun. 30, 1999, Tentij et al.
`(“. Age No. 09/469,026, filed Dec. 21, 1999, chk etal
`* cited by examiner
`Primary Examiner—David Wiley
`Assistant Examiner—David England
`(67)
`ABSTRACT
`Asystem and methodare disclosed which predict whether a
`performance problem within a network is likely to be
`encountered during future operation. Furthermore, a pre-
`ferred embodiment not only predicts the likelihood of a
`performance problem, but further determinesthe appropriate
`preventative measures to be taken in an attempt to prevent
`a predicted performance problem from occurring. In a
`preferred embodiment, a management system (MS)that
`oversees the operation of a network is implemented to
`predict likely performance problemswithin the network, and
`may determine appropriate preventative measures for pre-
`venting predicted performanceproblemswithin the network.
`Polling
`gateway(s) may be utilized to periodically
`poll the
`nettomouerin onder to retrieve sets information for
`
`
`
`54) METHOD AND SYSTEM FOR PREDICTIVE
`ENTERPRISE RESOURCE MANAGEMENT
`‘
`Inventor: Thomas C. Harrop, Folsom, CA (US)
`Assignee: Agilent Technologies, Inc., Santa Clara,
`Ga: (US)
`Subject to any disclaimer, the term ofthis
`patent is extended or adjusted under 35
`USCC.154(b) by 613 days.
`
`79)
`73)
`
`*)
`
`Notice:
`
`Appl. No.: 09/702,160
`
`Filed:
`
`Oct. 30, 2000
`
`21)
`
`22)
`
`51)
`
`Int. Cl.
`(2006.01)
`GO6F 13/173
`52) US. Che ec eeecteeeceeneseneesnees 709/224; 709/223
`58)
`Field of Classification Search........ 7109/222-224,
`709/226; 714/46-57, 4, 5,25, 26; 702/182,
`702/186, 188; 703/4, 13; 370/224,241
`See application file for complete search history.
`.
`References (lted
`
`(36)
`
`such resources, including but not limited to status of disk(s),
`U.S. PATENT DOCUMENTS
`database(s), memory, CPU(s), and operating system(s)
`,
`within the network. The gatheredstatus information is then
`6/1992 Simpkins et al.
`5,123,017 A *
`evaluated by the MSby, for example, correlating such status
`3/1997 Engel et al.
`5,615,323 A .
`
`9,819,028 A*10/1998 Manghirmalani etal. eeTIAIST information with knownperformancerules for the network
`Capone A : von nme ieee‘eereeerernes veslen
`to predict potential performance problems, and based on
`
`6.008 Af E600 Beacial st al. 7 _ V4
`such evaluation,
`the MS may predict whether a future
`
`scesscsssseenee 714/37
`6,327,677 B1* 12/2001 Garg et al.
`performance problem islikely to be encountered. Once a
`6,353,902 BI*
`3/2002 Kulatunge etal.
`14/70
`future performance problem has been predicted, the MSs
`6,415,189 BL*
`7/2002 Hajji oe.
`... 700/79
`determines an appropriate preventive action for preventing
`6,446,123 B1*
`9/2002 Ballantine etal.
`... 799/224
`‘the performance problem from occurring, and the MS may
`
`9/2002 Chin etal. ........
`... 345/810
`6,456,306 BI®
`initiate the appropriate preventive action before the occur-
`2/2004 Ding et al. esses 709/224
`6,691,067 BL*
`rence of the predicted performance problem in an attempt to
`6,738,811 BL*
`5/2004 Liang c.ceccssesseeeves 709/224
`prevent such performance problem. Most preferably, the
`... 370/224
`6,765,864 B1*
`7/2004 Natarajan etal. .
`network management system is implemented to “learn”
`
`5/2005 Sampath et al... 714/4
`6,892,317 B1*
`symptoms of performance problems overtime.
`2002/0038292 AlL*
`3/2002 Quelene oc 705/80
`2002/0133757 A1*
`9/2002 Bertram et al. v0... TIA/AT
`
`.........4.. 714/26
`
`
`
`45 Claims, 8 Drawing Sheets
`
`802
`
`POLL RESOURCES TO GATHER
`STATUS INFORMATION
`
`804 ~]
`
`
`
`
`806 ~|
`
`EVALUATE GATHERED STATUS
`INFORMATION (e.g., CORRELATE
`STATUS INFORMATION WITH KNOWN
`PERFORMANCE RULES)
`
`
`
`DETERMINE APPROPRIATE
`PREVENTATIVE ACTION
`810-7]
`a
`INITIATE. PREVENTATIVE ACTION
`812~|
`—UL
`Google Exhibit 1045
`Google Exhibit 1045
`Google v. Valtrus
`Google v. Valtrus
`
`PERFORMANCE
`
`PROBLEM LIKELY
`
`
`
`
`
`

`

`
`
`
`
`U.S. Patent May 29, 2007.—-Sheet 1 of 8 US 7,225,250 B1
`
`MS
`
`100
`
`NETWORK
`ELEMENTS
`
`120
`
`
`
`Coeneeeeee ;
`FIG. 2
`
`Ma
`
`M6
`
`150
`
`
`
`
`
`ELEMENT MANAGEMENT LAYER (EML)
`NETWORK ELEMENTS (NEs)
`
`140
`-
`
`FIG. 3A
`
`
`
`
`
`OPERATIONS
`SYSTEMS
`FUNCTIONS
`
`
`
`USER
`INTERFACE
`
`
`FUNCTIONS
`
`
`
`
`NETWORK
`ELEMENT
`
`runctions_7(2° 120
`
`
`

`

`172
`
`174
`
`176
`
`LAYERS/|—SERVICE SERVICE
`
`
`ASPECTS|DELIVERY USAGE SERVICE ASSURANCE
`
`
`AUSINESS RAS QUALITY|PERFORMANCE
`
`ADMINISTRATION
`
`ALARM
`INSTALLATION
`PERFORMANCE
`SURVEILLANCE
`MONITORING
`LOCAIZATION
`USAGE
`PROVISIONING
`CONTAINMENT
`AND RECOVERY
`PERFORMANCE
`MANAGEMENT
`
`NETWORK|>atUS_ AND FAULT MANAGEMENT
`
`SECURITY
`CONTROL
`rONTRO
`CORRECTION
`
`ASSURANCE
`
`QUALITY
`ASSURANCE
`
`SERVICE
`
`EME
`
`TESTING
`
`PERFORMANCE
`
`ANALYSIS
`
`PIC. 3B
`
`DETECTION
`
`yuayed“SA
`
`
`LOOT‘67AVIA
`$JO7J90S
`
`Id0S7‘S77°LSA
`
`

`

`
`
`
`
`U.S. Patent May 29,2007.—-Sheet 3 of 8 US 7,225,250 B1
`
`BUSINESS
`
`220
`
`THIRD
`PARTY
`SYSTEMS
`
`2020
`9300
`
`RON
`
`255
`
`200
`a
`
`SERVICE
`,
`4
`i
`252C
`
`THIRD|230C Lill coe
`220~]
`Party
`
`
`SYSTEMS|235 [===
`
`NETWORK
`
`
`
`THIRD
`220~] party|2308
`SYSTEMS
`
`
`
`
`ELEMENT
`
`235
`
`THIRD|230A
`220~]|
`PARTY
`SYSTEMS
`
`NETWORK
`ELEMENT
`
`299
`
`910
`
`935
`
`000
`
`|_|
`
`FIG. 4
`
`relate 7
`
`NEs (CU)-dependent on layer |
`APP RULES
`!
`|
`Service Management Objects
`1
`Le eee ee ee ee ee a
`
`

`

`eoco------4
`| MODEL |
`2954 OBJECTS |
`! EDITOR |
`pot tots hahaha 7
`!
`MIB
`290
`
`APPLICATION
`
`204
`
`SERVICE
`BUILDER
`
`yuayed“S01
`
`
`LOOT‘67AVIA
`§JOpy90S
`
`Id0S7‘S77°LSA
`
`
` THIRD
`
`
`PARTY
`
`SYSTEMS
`
`
`
`
`MODEL OBJECTS
`
`INCLUDING SERVICE,
`NETWORK, AND
`
`ELEMENTS OBJECTS
`
`
`IN COMMON OBJECT
`CLASS. LIBRARY
`
`292
`
`
`—cnttwnSS
`
`(RULES ENGINE)
`eee eee ee ee
`
`
`SERVICE
`
`MANAGEMENT
` MANAGED
`
`OBJECTS
`NETWORK
`
`ELEMENTS
`
`
`
`— ee ia ee erm
`nel ee
`
`

`

`276
`
`276
`
`276
`
`276
`
`276
`
`276
`
`276
`
`276
`
`
`
`272
`
`27/3
`
`SNMP
`GATEWAY
`
`CMIP
`GATEWAY
`
`CUSTOM OSS
`FIG. 5B
`INTERFACE||
`I
`
`
`
`
`
`
`
`
`
`
`
`
`
`CUSTOM OSS
`INTERFACE
`
`INTELLIGENT
`GATEWAY
`
`PROTOCOL
`AGENTS
`
`SNMP
`GATEWAY
`
`CMIP
`GATEWAY
`
`INTELLIGENT
`GATEWAY
`
`PROTOCOL
`AGENTS
`
`CENTRALIZED
`MS
`
`I
`j
`
`230A
`
`yuayed*S'
`
`LOOT‘67AVIA
`$JO¢Joos
`
`Id0S7‘S77°LSA
`
`

`

`
`
`
`
`
`300
`
` Network
`
`
`
`
`Connection
`
`Subnet
`Connection
`
`Locoti
`ocation
`
`Subnetwork
`
`Termination
`Point
`
`Top
`
`310
`SML
`
`320
`NML
`
`yuayed“S01
`
`
`LOOT‘67AVIA
`§JO9Joa
`
`
`ooetoss| LCottection||Software||Subsystem]|Location||Contoct_|
`Equipment
`Cross
`Collection
`Software
`Subsystem
`Location
`Contact
`
`EquipmentR2|Region||Orgenizaton
`EquipmentR2
`Termination
`Region
`Organization
`
`330
`EML
`
`CircuitPack
`
`Id0S7‘S77°LSA
`
`

`

`
`
`
`
`U.S. Patent May 29, 2007.—-Sheet 7 of 8 US 7,225,250 B1
`
` 700
`
`
`7OBA~NETWORKSTATUS
`
`[_biskstarus_}~7088
`(OSCDRABASESTATUS]
`
`
`
`[wewoRYstatus}7989
`708¢|_trustatus_|
`
`
`
`
`[_o/sstatus 708
`
` MS
`
`706
`
`DATABASE
`
`°o
`
`°°
`
`
`o
`
`
`
`FIG.
`
`7
`
`802
`
`POLL RESOURCES TO GATHER
`STATUS.
`INFORMATION
`
`
`
`EVALUATE GATHERED STATUS
`
`806~.|INFORMATION (e.g., CORRELATE
`STATUS INFORMATION WITH KNOWN
`PERFORMANCE RULES)
`
` 804
` PERFORMANCE
`
`PROBLEM LIKELY
`?
`
`
`
`
`812
`
`
`810
`
`DETERMINE APPROPRIATE
`PREVENTATIVE ACTION
`
`INITIATE PREVENTATIVE ACTION
`
`FIG. 8
`
`

`

`U.S. Patent
`
`May29, 2007
`
`Sheet 8 of 8
`
`US 7,225,250 B1
`
`(String)
`(String)
`(Real)
`(Real)
`(Real)
`(Integer32
`(Integer32
`(Integer32
`Integer32)
`Integer32
`Integer32
`Integer32
`Integer32)
`
`)))
`
`)))
`
`Name:. Resource
`Type: Class
`Attribute(s): Type
`StartMon
`LastMon
`MinFaults
`IntFaults
`MojFoults
`
`FIG. 9
`
`Nome: ResourceMgr
`Class Resource
`
`Type: Managed Object Manager
`
`FIG. 10
`
`(String)
`(String)
`
`Name: SYSR
`Type: Resource
`Managed By: ResourceMgr
`Attribute(s): Type
`StartMon
`LostMon
`MinFaults
`IntFaults
`MojFoults
`Runqi
`Rungb
`Runqw
`Contxt
`MPin
`MPout
`MemRe
`Swapa
`CPU_Failure_Est
`Mem_Failure_Est
`Sys_Foilure_Est
`
`FIG.
`
`17
`
`
`
`
`Name: SYSD
`Type: Resource
`Manoged By: ResourceMar
`Attribute(s): Type
`StortMon
`LastMon
`MinFoults
`IntFoults
`MajFaults
`DiskW
`Disk_Foilure_Est
`
`Name: NETR
`Type: Resource
`Managed By: ResourceMgr
`Attribute(s): Type
`StortMon
`LastMon
`MinorFaults
`IntermediateFaults
`MajorFaults
`
`(((((
`
`

`

`1
`METHOD AND SYSTEM FOR PREDICTIVE
`ENTERPRISE RESOURCE MANAGEMENT
`
`US 7,225,250 Bl
`
`RELATED APPLICATIONS
`
`
`
`This application relates in general to prediction of per-
`formance problems within a network and preventative main-
`tenance to avoid such predicted problems, and more spe-
`cifically to a system and method in which a network
`management system gathers information about a network,
`analyzes the information based onrule sets for the network
`to predict future performance problems, and intelligently
`determines appropriate actions to take in an attempt to
`prevent such performance problems from occurring.
`
`2
`mayallowforrelatively easy and inexpensive integration of
`disparate network elements and associated EMSs within a
`network. NetExpert™is an object-oriented network man-
`agement system that is comprised of a set of integrated
`software modules and graphicaluser interface (GUI) devel-
`opment tools that permit the creation and deployment of
`network management and operations support solutions.
`Each element type, device, device component, and even
`database may be managedasa separate “object.” NetExpert,
`like other NMSs/OSSs on the market today, may require
`customization for each managed object.
`Each element type and device, as well as other managed
`objects, requires a separate set of rules (knownasrulesets)
`to be tailored to the nature of the object. An object may
`comprise specific hardware and software, and also may
`
`includethe business practices of the company. Each ruleset
`provides the details for the management of the particular
`object to which the rules are directed. NetExpert’s Fourth
`Generation Language (4GL) editors permit this customiza-
`tion to be performed by subject matter experts (SMEs).
`SMEsusetheir knowledge to create simple rule sets, such as
`“"f-then” statements, to manage their Network Elements,
`EMSs, or NMSs,rather than requiring skilled programmers
`to integrate devices and other elements with additional
`computer software code such as C and/or C++.
`EMSs/NMSscan manage a wide range of communica-
`tions and computer devices,
`including switches, DCS,
`SONET ADM’s,routers, testing devices, video units, bank-
`The information-communication industry is an essential
`ing ATM machines, air traffic control systems, and other
`element of today’s society, which is relied upon heavily by
`computer elements such as databases and objects. OSSs
`most companies, businesses, agencies, educational institu-
`provide a broaderlayer of functionality to directly support
`tions, and other entities, as well as individuals. Asaresult,
`the daily operation of the network, such as order negotiation,
`information service providers such as telephone, cable, and
`order processing, line assignment, line testing and billing.
`wireless carriers, Internet Service Providers (ISPs) and util-
`EMSs/NMSs can be a componentof a larger OSS system.
`ity companiesall have the need to deploy effective systems
`For the sake of simplicity, but not limitation, the commu-
`suitable for servicing such a demand. The importance of
`nication switching network context will be used throughout
`such information service providers rapidly deploying new
`this application.
`systems and system elements and altering their existing
`for example, either
`Each device, such as a switch,
`management systems to accommodate evolving business
`responds to or has available certain information relating to
`and network requirements as needed has been recognized in
`its operation, such as performance, fault, configuration, and
`the prior art. For example,
`it has been recognized that
`inventory. For each device, the correlation of performance
`information service providers should have the ability to
`information with operational functions is typically provided
`integrate existing network equipment and systems with new
`within the EMS/NMS/OSS. For example, when an equip-
`elements and applications, customize existing systems and
`ment provider develops and markets a new switch, a skilled
`applications, and scale systems to accommodate growing
`programmertypically identifies and analyzes the perfor-
`networks and traffic volumes.
`mance information for that switch and then correlates that
`information with all of the functionalities that a customer
`Network management and operations have become cru-
`cial to the competitiveness of communication companies,
`may desire to use in connection with that switch. The
`utilities, banks and other companies operating Wide Area
`programmertypically then modifies the existing EMS/NMS/
`Networks (WANs) of computer devices and/or other net-
`OSS program code to manage that switch. Additionally, as
`work types and devices,
`including SONET, Wireline,
`disclosed in commonly assigned U.S. Pat. No. 6,047,279
`entitled “SYSTEM AND METHOD FOR AUTOMATIC
`Mobile, etcetera. For instance, many companies currently
`NETWORK MANAGEMENT SUPPORTUSING ARTIFI-
`use customized “legacy” network management systems
`(NMSs) and operations support systems (OSSs). However,
`CIAL INTELLIGENCE,”the disclosure of which is hereby
`such NMSs/OSSs are generally based on older technologies,
`incorporated by reference herein, an EMS/NMS/OSS may
`which poorly integrate disparate network elements and
`useartificial intelligence (e.g., expert systems and learning
`associated Element Management Systems (EMSs). Many
`techniques) to automatically identify and integrate new
`network elements.
`other companiesuse other types of EMSs, NMSs and OSSs
`that are not scalable, cannot be easily interfaced with dis-
`NetExpert™, OSI’s network management and operations
`parate network elements, and require costly programming
`support framework, currently uses a high-level computer
`while offering limited features and flexibility.
`language to permit non-programmers to write rule sets to
`Objective Systems Integrators, Inc. (“OST”) of Folsom,
`manage or route information within NetExpert, between
`Calif., the assignee of the present invention, currently pro-
`NetExpert systems, or between NetExpert and other pro-
`duces a Framework virtual system management (VSM)
`grams and functions, without the cost and complexity of
`which is both operationally and network-focused, and is
`other EMSs/NMSs/OSSs. For example, if a particular fault
`primarily used in the development of EMSs and NMSs sold
`message is generated by the switch, one customer may want
`under the trademark NetExpert™. In general, NetExpert™
`to page a particular technician, while a second customer may
`
`This application is related to co-pending application
`entitled “SYSTEM AND METHOD FOR A COMMON
`OBJECT CLASS LIBRARY,” assigned Ser. No. 09/469,
`026, filed Dec. 21, 1999; co-pending application entitled
`“FAULT MANAGEMENT SYSTEM AND METHOD,”
`assigned Ser. No. 09/345,634, filed Jun. 30, 1999; all of
`which are assigned to a commonassignee,the disclosures of
`which are hereby incorporated herein by reference.
`
`
`
`TECHNICAL FIELD
`
`BACKGROUND
`
`15
`
`20
`
`25
`
`35
`
`40
`
`45
`
`60
`
`65
`
`

`

`US 7,225,250 Bl
`
`3
`only want to have an indicator light activated or a warning
`message generated. Generally,
`these rules are entered
`through an editor, such as NetExpert’s 4GL editor.
`In providing and operating a network, monitoring and
`control functionality is clearly important to support various
`management aspects of the network. In more recent times,
`not only does the networkitselffhave to be managed, but the
`services provided by the network also have to be managed.
`Generally, a network management system has to have inter-
`faces with the network it is managingso that it can monitor
`or test various aspects of the network, such as the current
`configuration and traffic conditions, and also determine
`whether the network is performing satisfactorily, i.e., meet-
`ing any performancecriteria applicable.
`Given the importance of network systems,it is crucial that
`information service providers maintain the operability,
`integrity, performance level, and overall “health” of the
`network. For example, a service level contract between a
`service provider and a customer often requires that
`the
`service provider provide a particular quality of service to the
`customer. The term network “performance” may be utilized
`herein for conciseness, which is intended to broadly encom-
`pass the network’s operability, integrity, and various other
`conditions of the network and/or its elements affecting the
`overall “health” of the network. As an example, a service
`provider mayutilize a computer network, such as Ethernet,
`Token Ring, fiber distributed data interface, virtual circuit
`switched network, e.g., frame relay (FR) or asynchronous
`transfer mode (ATM) network, which may each include one
`or more computer systems and/or other types of “network
`elements.” Additionally, one or more of such types of
`computer networks may be interlinked to form a larger
`overall network of elements. As the network is in use for a
`period oftime (e.g., days or even years), characteristics of
`the network typically change from time to time during such
`usage. For instance, as the network is in use over time,
`various system resources begin being consumed. Further-
`more, various peculiarities (e.g., faults) in the system may be
`detected. For example, a network management system
`(NMS) may detect that resources within the network are
`being consumed in an inappropriate manner. For instance,
`system resources such as the system’s CPU, memory, and
`hard drive, as examples, may be consumed (or utilized)
`beyondan acceptable usagelevel. Various other undesirable
`characteristics of a system may be detected upon their
`occurrence. For example, failure of all or a portion of a
`network or an elementof the network may be detected upon
`such failure.
`Generally, problems in computer networksofthe priorart
`are detected once they occur, and only then is an attempt
`made to correct or otherwise respond to such problems.
`NMSs of the prior art typically do not attempt to predict
`whether the network itself or some element of the network
`is likely to fail or whether performance of the network or
`some element thereofis likely to be hindered (e.g., slow to
`an undesirable performance level) while the network is in
`use. That is, prior art EMSs/NMSs/OSSs typically fail to
`recognize conditionsthat indicate that a failure or otherwise
`poor performance of the network or an element of the
`network is likely to occur in the near future. Furthermore,
`such EMSs/NMSs/OSSs not only fail to predict a likely
`failure or poor performance, but also fail to take responsive
`actions to prevent such a problem. While prior art EMSs/
`NMSs/OSSs may provide warnings of an inappropriate or
`dangerous condition in the network (e.g., fault messages),
`EMSs/NMSS/OSSs ofthe prior art fail to detect a cause of
`such a problem orpredict a solution to deter such a problem.
`
`
`
`20
`
`25
`
`30
`
`35
`
`40
`
`45
`
`60
`
`65
`
`4
`Furthermore, before such an inappropriate or dangerous
`condition occurs within a network (or element thereof),
`EMSs/NMSS/OSSsof the prior art fail to predict, based on
`evaluation of the network (or element thereof), that such an
`inappropriate or dangerous condition 1s likely to occurin the
`future. Accordingly, prior art EMSs/NMSs/OSSs fail
`to
`predict or recognize potential problems within the network,
`and further fail to take preventative action in an attempt to
`prevent such a problem from occurring. That is, prior art
`EMSs/NMSS/OSSs fail
`to recognize potential problems
`within a network and take appropriate preventative action(s)
`in an attempt to avoid such problems.
`Typically, once a warning, such as a fault message, is
`provided in prior art systems, the performance of the net-
`work is already negatively affected. That is, in prior art
`EMSs/NMSS/OSSs, a fault message is typically provided
`only after a problem has occurred. Generally, in prior art
`networks, once a problem, such asa failure or other type of
`inappropriate condition is detected in the network, reliance
`is placed on an engineer ortechnician to inspect and service
`the network. Such a technician can perform somelimited
`analysis of the network in an attempt to detect the source of
`the problem, but the technician will not necessarily find the
`source of a problem. In fact, when the technician actually
`services the network, conditions in the network may have
`changed such that
`the technician fails to detect
`that a
`problem even exists within the network. Accordingly, dif-
`ficulty exists in prior art networks in determining whether
`the network (or some element thereof) is likely to fail during
`future use of the network and to prevent such a failure.
`Therefore, prior art EMSs/NMSs/OSSs exist which can
`monitor a network to know when the network (or some
`element thereof) fails, but such EMSs/Ss/OSSs fail to pro-
`vide a prediction of when the network (or some element
`thereof)
`is about
`to fail because,
`for example, certain
`resources being utilized at an inappropriate rate or some
`other factors being detected which are indicative of a prob-
`lem existing.
`Prior art networks may include one or more “intelligent
`agents” that monitor a specific network element to predict
`failures within the specific network element and may pos-
`sibly trigger some type of manualintervention in an attempt
`to prevent such a failure of the specific network element.
`However, networksof the prior art have generally not been
`implemented to monitor the system which manages the
`network elements (i.e., the EMS/NMS/OSS)to predict per-
`formance problems within the network. Generally, such
`intelligent agents that have been implementedin the priorart
`to monitor a specific network elementare “passive.” Thatis,
`while such agents may detect failures for a specific network
`element, they typically rely on some type of manualinter-
`vention to resolve a detected failure.
`Additionally, such intelligent agents provide very limited,
`focused monitoring, in that they are typically implemented
`to monitor only a specific network element. Thus, overall
`problemsof a network may not be detected or prevented by
`such intelligent agents. That is, network problems of an
`entire network, which may or may not involve a specific
`network element being monitored by an intelligent agent,
`are generally not predicted or prevented by such intelligent
`agents. Furthermore, such intelligent agents that monitor a
`specific network element may have a skewed view of
`whether a problem exists. For instance, an intelligent agent
`may determine that a condition exists that is very critical to
`the performanceof its specific network element, but such a
`condition may havelittle or no effect on the overall perfor-
`manceof other network elements or the network as a whole.
`
`

`

`US 7,225,250 Bl
`
`5
`The intelligent agent is typically unable to determine the
`effect a condition detected within its associated network
`element may or may not have on other elements or the
`network as a whole. On the other hand, an intelligent agent
`may determine that a condition exists for its monitored
`network elementthat is not very critical for the performance
`of such network element, but the condition may greatly
`impact the performance of other network elements and/or
`the network as a whole. Again,
`the intelligent agent is
`typically unable to determinetheeffect a condition detected
`for its associated network element may or maynot have on
`other elements or the network as a whole.
`
`SUMMARY OF THE INVENTION
`
`
`
`Thepresent invention is directed to a method and system
`hat address the problemsof preventative maintenance asso-
`ciated with dissimilar events that are likely to result in a
`performanceproblem (e.g., a failure) of a computer network.
`Thepresent invention is directed to a system and method
`which predict whether a performance problem within a
`network is likely to be encountered during future operation.
`Furthermore, a preferred embodiment not only predicts the
`likelihood of a performance problem, but further determines
`he appropriate preventative measures to be taken in an
`attempt to prevent a predicted performance problem from
`occurring. In a preferred embodiment, a network manage-
`ment system that oversees the operation of a network is
`implemented to predict likely performance problems within
`he network, and may determine appropriate preventative
`measures for preventing predicted performance problems
`within the network.
`
`More specifically, a preferred embodiment provides a
`system and method for managing a network, which gathers
`status
`information about
`the network resources. For
`example, a most preferred embodiment utilizes a polling
`gateway to periodically poll the network resources in order
`to retrieve status information for such resources. Most
`
`preferably, a plurality of polling gateways may bedistrib-
`uted throughout the network, and various types of polling
`gateways may be implemented having responsibility of
`polling particular types of network elements. Status infor-
`mation may be retrieved for various network resources,
`including but not limited to status of disk(s), database(s),
`memory, CPU(s), and operating system(s) within the net-
`work. A most preferred embodiment then evaluates the
`gathered status information. For example, a network man-
`agement system mayreceivethe gathered status information
`rom the polling gateway and operates to correlate the
`gathered status information with known performancerules
`for the network to predict potential performance problems.
`Mostpreferably, a centralized network management system
`receives the status information gathered by the various
`distributed polling gateways and correlates such gathered
`status information to evaluate the overall performanceof the
`network. For instance, the gathered status information may
`be evaluated in view of known performance rules for the
`network to determine whether conditions exist that are
`indicative of (e.g., “forecast” or likely to lead to) future
`performance problems. Accordingly, based on such evalua-
`ion, the network management system of a most preferred
`embodiment may then predict whether a future performance
`problem is likely to be encountered within the network.
`In a most preferred embodiment, once a future perfor-
`mance problem has been predicted, the network manage-
`ment system determines an appropriate preventiveaction for
`preventing the performance problem from occurring. There-
`
`
`
`15
`
`20
`
`25
`
`40
`
`45
`
`60
`
`65
`
`6
`after, the network management system of a most preferred
`embodiment
`initiates the appropriate preventive action
`before the occurrence ofthe predicted performance problem
`in an attempt to prevent such performance problem. For
`example, the network management system may send com-
`mands to one or more network elements (e.g., via the
`distributed gateways) in an attempt to prevent a predicted
`performance problem. As another example,
`the network
`management system may open a problem ticket and/or
`request service of particular network elements in an attempt
`to prevent and/or timely respond to predicted performance
`problems.
`the network management system is
`Most preferably,
`implementedto “learn” over time. For example, the network
`management system of a most preferred embodiment is
`implemented to learn the status conditionsthat are indicative
`of future performance problems. For instance, upon a per-
`formance problem occurring, the network managementsys-
`tem may evaluate the conditions leading up to such a
`problem in order to enable the system to recognize those
`conditions as being indicative of a potential problem in the
`future. As a further example,
`the network management
`system of a most preferred embodiment is implemented to
`learn the appropriate preventive action to initiate in response
`to a particular performance problem being predicted. For
`instance, neural networking techniques now knownorlater-
`developed for “learning” patterns that indicate a potential
`problem and/or responsive actions for preventing such a
`potential problem may be utilized within the network man-
`agement system. Thus, the network management system
`may improveits ability to predict performance problems and
`determine preventive actions for preventing such perfor-
`mance problems over time. Therefore, as the network man-
`agement system becomes more familiar with the perfor-
`manceofthe network, the network management system may
`more effectively predict performance problems and prevent
`such performance problems from occurring within the net-
`work.
`While this invention relates to any network management
`system, a preferred embodiment will be described in refer-
`ence to OSI’s NetExpert™ system in order to provide a
`concrete example of a network management system appli-
`cation. Thus, it should be understoodthat the present inven-
`tion is not intended to be limited only to OSI’s NetExpert™
`system provided herein, but rather the NetExpert™system
`is intended solely as an example that renders the disclosure
`enabling for many other types of network management
`systems. Thus, for example, it will be recognized that the
`present invention is intended to encompass any type of
`managementsystem,particularly a centralized management
`system having distributed gateways for polling network
`elements and providing status information to the centralized
`management system for monitoring/evaluating the perfor-
`mance of the network.
`It should be appreciated that a technical advantage of one
`aspect of the present invention is that it providesa pro-active
`approach to detecting (or predicting) potential
`system
`resource problemsand resolving(or preventing) such poten-
`tial problems before they occur. By ensuringthat the system
`is maintained properly, service level assurances are created
`which greatly enhancethe reliability of the overall system.
`The foregoing has outlined rather broadly the features and
`technical advantages of the present invention in order that
`the detailed description of the inventionthat follows may be
`better understood. Additional features and advantages ofthe
`invention will be described hereinafter which form the
`subject of the claims of the invention. It should be appre-
`
`

`

`US 7,225,250 Bl
`
`7
`ciated by those skilled in the art that the conception and
`specific embodimentdisclosed may bereadily utilized as a
`basis for modifying or designing other structures for carry-
`ing out the same purposesof the present invention. It should
`also be realized by those skilled in the art that such equiva-
`ent constructions do not depart from the spirit and scope of
`he invention as set forth in the appended claims. The novel
`eatures which are believed to be characteristic of the
`invention, both as to its organization and method of opera-
`ion, together with further objects and advantages will be
`better understood from the following description when con-
`sidered in connection with the accompanyingfigures. It is to
`be expressly understood, however, that each of the figures is
`provided for the purposeofillustration and description only
`and is not intendedas a definition of the limits of the present
`invention.
`
`
`
`BRIEF DESCRIPTION OF THE DRAWING
`
`For a more complete understanding of the present inven-
`tion, reference is now madeto the following descriptions
`taken in conjunction with the accompanying drawing, in
`which:
`FIG. 1 is a functional depiction of the conceptual Tele-
`communication Management Network (TMN)relationship
`between Management System (MS) and the managed net-
`work;
`FIG. 2 shows a logical functional diagram of a MS
`consistent with the TMN standard;
`FIG. 3A is a TMN standard abstraction of four layers for
`managing a network through an MS;
`FIG. 3B showsa table, which includes the management
`layers of FIG. 3A and associated functional groups of
`service delivery, service usage, and service assurance;
`FIG. 4 depicts one embodiment of an MS for managing
`and providing network services;
`FIG. 5A shows one embodiment of a management pro-
`cessor for implementing a MS;
`FIG. 5B shows an embodiment of a management proces-
`sor implemented with a plurality of distributed gateways for
`monitoring-network elements;
`FIG. 6 illustrates one embodiment of a class tree for
`Object Classes (OCs) within the element, network, and
`service layers;
`FIG. 7 shows an exemplary implementationofa preferred
`embodimentof the present invention;
`FIG. 8 shows an exemplary flow diagram illustrating the
`operational flow of a most preferred embodiment;
`FIG. 9 shows a table, which includes the MSclass of a
`preferred embodiment;
`FIG. 10 shows a table, which includes the MS Managed
`Object Manager of a preferred embodiment;
`FIG. 11 shows a table, which includes an exemplary
`managed object named SYSR;
`FIG. 12 shows a table, which includes another exemplary
`managed object named SYSD; and
`FIG. 13 shows a table, which includes still another
`exemplary managed object named NETR.
`
`DETAILED DESCRIPTION
`
`A system and method for predicting poor performance
`(e.g., slowed performance or failure)