Method and apparatus for automatic monitoring of simple network management protocol manageable devices

[0002] This application is related to the following U.S. Patent Applications:

[0003] U.S. application Ser. No. 09/098,030 entitled “Method and Apparatus for Graphical Display of Multiple Network Monitors over Multiple Intervals”, filed Jun. 15, 1998, pending;

[0004] U.S. application Ser. No. 09/098,016 entitled “Method and Apparatus for Sending Address in the Message for an E-Mail Notification Action to Facilitate Remote Management of Network Devices”, filed Jun. 15, 1998, pending;

[0005] U.S. application Ser. No. 09/098,031 entitled “Method and Apparatus for Verifying Network Devices using Simple Network Management Protocol”, filed Jun. 15, 1998, pending; and

[0006] U.S. application Ser. No. 09/098,026 entitled “Method and Apparatus for Discovering Network Devices using Internet Protocol and Producing a Corresponding Graphical Network Map”, filed Jun. 15, 1998, pending.

[0007] All of the above applications are assigned to the assignee of the present invention, and are hereby incorporated herein in their entirety by this reference thereto.

[0008] The present invention pertains in general to monitoring of computer networks, and more particularly, but not by way of limitation, to a method and apparatus for automatically monitoring devices which are connected to a communication network and are manageable using Simple Network Management Protocol.

[0009] Communication networks are changing the way people communicate, distribute, and share information. There are many different ways information can be accessed, shared, or communicated on a network. For example, networks are used to access software applications running on a file server, to send e-mail to someone in another country, and to access information on remote computer servers. Networks consist of many different devices connected together in some form to allow one device to benefit from another. These devices include, but are not limited to, switches, routers, repeaters, hubs, terminals, servers, queuing devices, and peripheral equipment such as printers, modems, and scanners. Communication networks allow the user to access remote programs and remote databases either of the same organization or from other enterprises or public sources. They also provide communication possibilities faster than other facilities. Because of these optimal information and communication possibilities, computer networks often increase the organizational learning rate, which many authors declare as a fundamental advantage in competition.

[0010] These benefits, however, do not come without their problems. Network systems can be very complex with complex problems which are difficult to identify and solve. To help identify network problems and solutions, network management tools have been developed to monitor networks and identify problems or potential problems associated with the networks.

[0011] A limitation of current network management tools is that they do not provide the user with meaningful or valuable monitoring of networks. Using current network management tools, a user manually configures specific attributes for monitoring each device interface within the communication network. Furthermore, the user is required to configure meaningful thresholds for each of the configured monitor attributes. Without substantial expertise and a great deal of time to configure the network management tools, the user is unlikely to select correct attributes and thresholds to provide meaningful data, and thus, the network management tools are unable to do anything more than indicate whether devices within the communication network are dead or alive. It is widely known that users believe that performing network management is too difficult and time consuming, and therefore, make no attempt at network monitoring.

[0012] It would be advantageous, therefore, to devise a method and apparatus for providing a user with automatic monitoring of devices residing within a communication network. It would further be advantageous if such a method and apparatus automatically selected the attributes, associated thresholds and formulas for monitoring each type of interface on each type of device residing within the communication network.

[0013] The present invention comprises a method and apparatus for automatically monitoring Simple Network Management Protocol (SNMP) manageable devices. A processor accesses a memory storage device to retrieve a device definition file and an interface definition file associated with each interface referenced in the device definition file. The processor creates a Device-Type-Specific Formula-Monitor Definitions (DTSFMD) data structure based on information contained within the device definition file and the interface definition files and stores the DTSFMD data structure in the storage device.

[0014] The processor accesses a communication network to retrieve information used to identify the types of devices and associated interfaces located within the communication network. Based on the retrieved information, the devices are identified as a router, a switch, a repeater or a device for which no monitoring is to occur. Based on the retrieved information and requirements established in the DTSFMD, the processor determines which interfaces are to be monitored and how they are to be monitored and automatically performs monitoring to generate data for graphical displays and the setting and clearing of alarms.

[0015] A more complete understanding of the present invention may be had by reference to the following Detailed Description and appended claims, when taken in conjunction with the accompanying Drawings wherein:

[0016] FIG. 1 is a functional block diagram of an apparatus for effectuating automatic monitoring of Simple Network Management Protocol manageable devices, and

[0017] FIGS. 2A-2D is a flow diagram of a method for effectuating automatic monitoring of Simple Network Management Protocol manageable devices consistent with the apparatus described in FIG. 1.

[0018] An example of the utilization of the present invention can be found in Compaq's Netelligent Management Software, the user guide of which (5th edition) (Attachment A) is incorporated herein by reference.

[0019] Referring now to FIG. 1, there is illustrated a functional block diagram of an apparatus for effectuating automatic monitoring of Simple Network Management Protocol manageable devices. A management console 100 comprising a processor 110, an output device 120 such as a video display or a printer, and input device 130 such as a keyboard or floppy disk drive, a storage device 140 such as Random Access Memory (RAM) or a disk drive, and a network interface 150 communicates with various network devices 160 and other devices 180 across a communication network 170.

[0020] Various network devices 160 reside within the communication network 170 and are manageable using Simple Network Management Protocol (SNMP). SNMP is a communication network management protocol which is commonly known in the industry and is incorporated by reference to its fullest extent hereto. SNMP defines a set of variables that an entity in a communication network maintains and consists of three parts: a Structure of Management Information (SMI), Management Information Base (MIB) and the protocol itself The MIBs implemented by an SNMP agent 190 also include MIBII which is a particular instance of a MIB. Although various versions of SNMP may exist, the present invention is equally applicable to each version.

[0021] The network devices 160 include, but are not limited to, such devices as repeaters 160A, switch/bridges 160B, routers 160C and network servers 160D. Various other devices 180 may also reside within the communication network 170 which are manageable using SNMP but which are not necessarily “communication network” type devices. Examples of other devices 180 include, but are not limited to workstations and printers.

[0022] Within each SNMP manageable device, which includes network devices 160 and other devices 180, resides the SNMP agent 190. The SNMP agent 190 implements one or more MIB(s) including MIBII 200 which define the set of variables or databases needed to monitor and control components in the communication network 170 such as, but not limited to, the network devices 160 and other devices 1180. Using SNMP, the processor 110 located within the management console 100 accesses the SNMP agents 190 to retrieve information contained within the MIBs 200 and to effectuate automatic monitoring of the network devices 160 and other devices 180. The processor 110 stores the information within storage files 145 located within the storage device 140.

[0023] In the present invention, a user is provided with three persistence levels for monitoring of network devices 160 and other devices 180 (hereinafter referred to as device(s)) within the communication network 170. The three levels include aggressive, moderate and passive and are applicable to various attributes in the monitoring. Although the present invention is described as including three persistence levels, it is understood that the present invention may include any number of persistence levels.

[0024] A frequency of a monitor is the frequency at which the monitor performs monitoring. For example, if the monitor has a frequency of three hundred, the monitor performs monitoring calculations once every three hundred seconds. Given the three persistence levels, the present invention is capable of monitoring at three different frequencies. For example, the passive persistence level associated with the frequency attribute is set to once every ten minutes, the moderate persistence level is set to once every five minutes, and the aggressive level is set to once every two minutes. If the user initially sets the monitoring at the moderate persistence level but later decides that too many problems are going undetected, the user can instead select aggressive monitoring to “catch” more problems. Using the present invention, the user need not know the frequency of monitoring other than that selecting a more aggressive persistence level increases the degree of monitoring.

[0025] Alarm thresholds are values at which an alarm is set or cleared. In the present invention, there are three levels of alarms, a critical alarm, a major alarm, and a minor alarm with each level of alarm being associated with three persistence levels. Thus, there is a set value and a clear value for each level of alarm and also for each of the three persistence levels resulting in total of eighteen values. As an example, a monitor is defined to monitor utilization on an Ethernet link. Each time the monitor is sampled (according to the frequency dictated by the frequency associated with the selected persistence level) a value representing a percentage utilization of the link is obtained. If the utilization crosses above the threshold value for the major alarm associated with the selected persistence level, the major alarm is activated.

[0026] In the description of the alarm threshold described above, it is implied that if a sampled monitor exceeds or falls below a threshold value an alarm is set or cleared. In the preferred embodiment of the present invention, however, the poll interval attribute defines the number of consecutive occurrences for which the sampled monitor exceeds the threshold value before the alarm is set. Again, the present invention includes three poll interval persistence levels. For example, the passive, moderate and aggressive poll interval levels can be set to three consecutive occurrences, two consecutive occurrences and one occurrence respectively. Although in the preferred embodiment of the present invention an alarm is cleared on a single occupance of a sampled monitor falling below the alarm threshold, it is understood that clearing of an alarm can be effectuated in the same manner as the setting of alarms using a poll interval level.

[0027] All devices are categorized according to a “device type.” For each device type, a device definition file defines interface definition files to be used for the particular device type. An interface is defined as any grouping of network interfaces such as, but not limited to, a port, a group of ports such as a backplane tied across a number of ports, or a stack of communication devices.

[0028] Each interface definition file defines the following information: the kind of interface which is to be monitored for each type of device as defined in the ifType variable contained within MIBII 200, a network connectivity requirement, formulas used to monitor each interface, and the threshold values, such as, but not limited to set and clear values for critical major and minor alarms, associated with aggressive, moderate and passive monitoring for each formula. Each of the formulas is stored in a formula definition file and contains information about which MIB 200 objects need to be loaded and how they are combined to form the formulas. The network connectivity requirement defines whether the network connectivity threshold must be met for monitoring to occur. The network connectivity threshold defines the number of network connections existing on an interface. Network connectivity is a factor in monitoring the network in that if all interfaces were monitored, monitoring would be performed on interfaces having as little as one connection to the network 170. Such extensive monitoring would result in a degradation in the performance of the network 170.

[0029] Referring additionally now to FIGS. 2A-2D, there is illustrated a flow diagram of a method for effectuating automatic monitoring of Simple Network Management Protocol manageable devices consistent with the apparatus described in FIG. 1. To implement the present invention, a Device-Type-Specific Formula-Monitor Definitions (DTSFMD) data structure is created (step 300). The DTSFMD data structure is created by retrieving the device definition files (step 310), which determines references to the interfaces (step 320), and then retrieving the interface definition files (step 330) Retrieving the interface definition files determines ifTypes of interfaces to be monitored per device (step 340), determines each interface connectivity requirement (step 350), determines monitoring formulas required per interface (step 360) and also determines formula attributes, value threshold levels, and frequencies per formula per persistence level (step 370).

[0030] A determination is made as to whether a new device has been added to be monitored or the user has selected to reload the monitors (step 380). If, in step 380, a determination is made that a new device has been added to the network 170 or the user has selected to reload the monitors, any currently existing automatic monitors are terminated for that device (step 390) and a determination as to what kind of device each device is (step 400). For each device, a request is made for an ipForwarding MIB object 200 (step 410), a request is made for a dot 1 dBaseType MIB object 200 (step 420) and a request is made for a rptAddrTrackPackage MIB object 200 (step 430).

[0031] To determine what kind of device each device is, a determination is made as to whether the received ipForwarding MIB object 200 of the device is enabled (step 440), and if so, a device type parameter is set to indicate the device as a router (step 450) and an MIBII ifType object 200 is requested for each interface associated with the router (step 460).

[0032] If, in step 440, a determination is made that the ipForwarding MIB object 200 is not enabled, a determination is made as to whether the dot 1 dBaseType MIB object 200 of the device was retrieved successfully (step 470), and if so, the device type parameter is set to indicate the device as a switch (step 480) and an MIBII ifType object 200 is requested for each interface associated with the switch (step 490).

[0033] If, in step 470, a determination is made that the dot1 dBaseType MIB object 200 of the device was not retrieved successfully, a determination is made as to whether the rptrAddrTrackPackage MIB object 200 of the device was retrieved successfully (step 500), and if so, the device type parameter is set to indicate the device as a repeater (step 520).

[0034] If, in step 500, a determination is made that the rptrAddrTrackPackage MIB object 200 of the device was not retrieved successfully, the automatic monitoring process for that device is terminated (step 510) and the automatic monitoring process continues for the remaining devices at step 400.

[0035] If, in step 500, a determination is made that the device is a repeater and the device type parameter is set in step 520 to indicate the device as a repeater, a developer implementing the automatic monitoring defines a selected port grouping or backplane for the repeater (step 530) and the information identified in step 400 is merged with the DTSFMD data structure created in step 300 to create monitors for the selected port grouping/backplane (step 540).

[0036] If the device type parameter in step 490 is set to indicate the device as a switch, then following step 490, the dot1 dTpFdbPort table MIB object 200 is loaded (step 550) and the network connectivity for each interface associated with the device is determined (step 560). Monitors, for interfaces associated with the switch meeting the ifType and/or network connectivity requirements as specified in the DTSFMD data structure, are created (step 570).

[0037] If the device type parameter in step 450 is set to indicate the device as a router then following step 460 monitors, for interfaces associated with the router meeting the ifType requirements as specified in the DTSFMD data structure, are created (step 580).

[0038] Following steps 540, 570 and 580 or if it is determined in step 380 that a new device was not added and that the user has not selected a reloading of the monitors, the monitors are run (step 590) Each of the automatic monitors performs monitoring (step 600) and a determination is made as to whether there is currently an alarm set (step 605). If it is determined that an alarm is not currently set, a determination is made as to whether any threshold values were exceeded (step 610), and if so, associated alarms are set (step 620).

[0039] If, in step 605, it is determined that an alarm is currently set, a determination is made as to whether any previously exceeded threshold values are now within the threshold (step 630), and if so, associated alarms are cleared (step 640).

[0040] Following step 640, or if in step 630 it is determined that no previously exceeded threshold values are now within the threshold, or if in step 610 it is determined that no threshold values are exceeded, a determination is made as to whether a new device has been added to be monitored or the user has selected to reload the monitors. (step 650), and if so, the automatic monitor proceeds at step 400, otherwise, monitoring continues at step 600.

[0041] Although the preferred embodiment of the apparatus and method of the present invention has been illustrated in the accompanying Drawings and described in the foregoing Detailed Description, it is understood that the invention is not limited to the embodiment disclosed, but is capable of numerous rearrangements, modifications and substitutions without departing from the spirit of the invention as set forth and defined by the following claims.