Graphical interface system monitor providing error notification message with modifiable indication of severity

[0001] 1. Field of the Invention

[0002] The present invention relates generally to diagnostics in computer information systems. More specifically, the present invention relates to providing an interface to system monitors to facilitate creation and management of rule sets.

[0003] 2. Background of the Invention

[0004] Computer monitors use alarms to indicate problems or error conditions with a running computer application. These monitor systems are commonly used on high availability systems and Internet servers. Monitor systems typically use rule sets to determine what constitutes a problem for a particular computer application. These rule sets are typically entered manually by an administrator, and require the administrator to enter each rule to be used. These rules can include message text, alarm behavior, files to scan and other information that the system monitor uses to determine how to process a particular alarm.

[0005] Custom computer applications have different requirements for generating alarms in response to problems or error conditions encountered during the application's execution. Because such custom responses to errors or other problem conditions are not known to conventional system monitors, they must be manually entered into a rules file that a system monitor can access to determine how to handle particular messages. Such manual entry is inefficient and prone to error.

[0006] Moreover, these requirements can change as an application matures. Thus, modification and/or enhancements to the computer application may require modifications in the rule sets used by the system monitor. These modifications would also require manual entry using conventional systems.

[0007] The present invention addresses the foregoing problems in the art by providing an interface to a system monitor to facilitate creation and management of rule sets used by the system monitor. In one aspect, the present invention analyzes a custom computer application to be monitored and generates changes to the rule sets used by the monitor system. Furthermore, the present invention incorporates a decision support interface to customize the rules to be used by the monitor system.

[0008] In one embodiment, the present invention is a system for interfacing to a system monitor. The system includes a source file corresponding to a computer application to be monitored. An import module in the system extracts notification messages from the source file and stores the notification messages in a scan file. A manager module in the system displays each of the notification messages stored in the scan file. The system can also include an export module to store data in a table in a format acceptable to the system monitor.

[0009] In another embodiment, the present invention is a method for interfacing to a system monitor. The method includes one or more of the following steps. First there is a step of scanning a source file of a computer application to be monitored for one or more notification messages. The method continues with the step of extracting the notification message from the source code file. The method continues with the step of displaying the notification message in a graphical user interface. Next, the method continues with the step of displaying a modifiable severity in the graphical user interface corresponding to the notification message. Next the method continues with the step of displaying a modifiable location where the notification messages are stored when generated by the computer application. The method then continues with the step of generating an export file in a format compatible with a system monitor, the export file comprising the modifiable severity and the modified location as modified in the previous steps.

[0016] FIG. 1 is a schematic diagram of a system 100 for providing an interface to a system monitor according to a preferred embodiment of the present invention. System 100 includes a computer 102 on which a computer application 104 is executing. System 100 also includes a display 106 and storage disk 108. Disk drive 108 is shown for purposes this description as an internal disk drive. It would be apparent to those skilled in the art that disk drive 108 can be an external disk drive.

[0017] A system monitor 110 monitors application 104 by analyzing an error file 112 and a warning file 114. Preferably, system monitor 110 is an application running on computer 102. Error file 112 and warning file 114 store error and warning log messages respectively. The error and warning messages are messages that would be generated by computer application 104 if an error event or other predetermined condition were to occur.

[0018] The present invention can include a manager for managing rule sets used by system monitor 110 to process alarm conditions. In one embodiment of the present invention, the process proceeds in three stages. The first stage is an import stage, the second stage is a manager stage, and the third stage is an export stage.

[0019] In the import stage, as shown in FIGS. 1 and 4, an import module 120 scans a source code file having the source code of a computer application to be monitored. In the present case, import module 120 scans source code file 118, which contains the source code associated with computer application 104. Import module scans source code file 118 for specific computer code that generates notification messages to system monitor 110, for example, by storage in error file 112 or warning file 114. Preferably, the scan is performed by searching for text indicative of error messages, warning messages or any other messages that are used to provide notification of problems with the running computer application.

[0020] Notification messages include any message that can provide notification of a problem in a running application. Import module 120 can search for all such messages or some subset, not including all, of the notification messages. For purposes of clarity only, only error and warning messages are discussed in this description. For example, in one embodiment, import module 120 searches for text in quotations that begins with the text “ERROR:” or “WARNING:”.

[0021] The output of the import module 120's scan is a scan file 126. Scan file 126 includes each unique instance of an error warning message that is generated by the running application when there is a problem, or there is a condition that might result in a problem. Any duplicates of error or warning messages are not stored. Alternatively, duplicates of any error or warning messages are removed in a duplicate removal step performed by import module 120 after scan file 126 is initially created.

[0022] After scan file 126 is created and duplicates are removed, whether by a second pass or as part of the initial scanning, a manager module 122 presents the contents of scan file 126 in a graphical user interface (GUI) 116 so that they can be modified if desired. Preferably, the GUI 116 can be a web-enabled graphical user interface. Web-enabling GUI 116 provides for remote accessibility. Furthermore, it reduces the requirements of any client displaying the graphical user interface. That is, display 106 can be hosted on a lightweight client that is distinct from computer 102.

[0023] Manager module 122 reads scan file 126, which is generated by import module 120. Preferably, in a scrolling window in GUI 116, manager module 122 displays a scrolling window with each line of the scrolling window corresponding to a notification message stored in scan file 126. Preferably, each line of the scrolling window comprises three columns.

[0024] The first column includes message text. The message text is the exact representation of the message as it would appear if it were generated by computer application 104.

[0025] The second column includes information related to a priority or severity of an alarm that is generated if the message is detected by system monitor 110. For example, the priority or severity may be represented by a number between 0 and 99 inclusive. A value of 0 indicates that no action is taken when the error message is encountered. That is, it is an error condition that can be ignored.

[0026] Severity levels are used by the system monitor to determine how to process error messages. For example, the severity level can indicate who is to receive a report that the error message occurred, how that person is to receive the report of the error message, for example by pager or some other communication method and when the person is to receive the report of the error message, for example, immediately, or at some other time.

[0027] Any number range could be used within the scope and spirit of the present invention. Moreover, the severity level can be represented by text. One such textual representation includes severity levels of “LOW”, “MEDIUM” and “HIGH”.

[0028] When the notification messages are displayed in GUI 116, preferably they are assigned a default severity level. For example, where the severity levels are represented by a range of values from 0 to 99, the default severity level is preferably 50. The default level can be determined by the particular system monitor used.

[0029] The value of the severity is modifiable. The value can be modified by a user of the present invention by selecting the severity level corresponding to a particular notification message. Preferably, this selection of the severity level that is to be modified is made using a pointing device, such as a computer mouse 111.

[0030] The third column includes information related to a location to use for monitoring. The location is a data file that is used for logging errors, warnings or other notification messages that are generated by the computer application. System monitor 110 reads this information to determine what to monitor, that is where to find the notification messages output by the computer application. The location information is modifiable. That is, a user can select a location corresponding to a particular notification message and then modify that the value of the location.

[0031] FIG. 1 illustrates an exemplary notification message table 128 according to an embodiment of the present invention. In this example, the notification messages in table 128 can have assigned severity levels in the range from 0 to 99, with a default value of 50. Line 1 of table 128 represents an exemplary new error message for the next release of computer application 104. The new error message is assigned the default severity level of 50. Because it is a new error message, no location is identified. The location must be entered for monitoring.

[0032] Line 2 illustrates another exemplary entry in table 128. In line 2, the severity is modified from the default value 50 to the value 90. This indicates that an error message of this type is very severe, and must be handled accordingly. Consequently, this modification changes the emergency response behavior and diagnostics for the condition present when this error message is detected by system monitor 110.

[0033] Line 3 illustrates another exemplary table entry in table 128. In this case, assume that the location was originally c:\data\warning.log. As shown in FIG. 1, the location is modified to c:\app\warning.log to maintain consistency with the error message location as shown in line 2.

[0034] A user can make any desired changed as described above. When the user has completed the changes, the user submits the modifications for export. An export module 124 generates an export file 129 from the data comprising table 128. Export file 129 is created in a format that can be used by system monitor 110. Alternatively, export file 129 is created in an arbitrary format, and later converted into a format that can be used by system monitor 110.

[0035] There are a variety of system monitors that can be used as system monitor 110. Some system monitors use text descriptions to represent severity levels. Other system monitors use numbers to represent severity levels. A configurable mapping mechanism translates the representation of the severity level into a format acceptable for the particular system monitor being used.

[0036] For example, if severity levels are described numerically in table 128, but represented textually in the system monitor being used, a mapping table is created to translate the numerical representation of table 128 to the textual representation compatible with the system monitor. An exemplary table 200 for translating severity levels from a numerical representation to a textual representation is illustrated in FIG. 2. In the example shown in FIG. 2, notification messages assigned a severity level of 0 to 33 in table 128 are translated to a severity level of LOW for the system monitor that used textual severity levels. Notification messages assigned a severity level of 34 to 66 in table 128 are translated to a severity level of MEDIUM for the system monitor that used textual severity levels. Notification messages assigned a severity level of 0 to 33 in table 128 are translated to a severity level of HIGH for the system monitor that used textual severity levels.

[0037] FIG. 3 illustrates an exemplary translation mapping table 300 for severity levels that are described textually in table 128, but represented numerically in the system monitor being used. In the example shown in FIG. 3, notification messages assigned a severity level of LOW in table 128 are translated to a severity level of 15 for the system monitor that uses numerical severity levels. Notification messages assigned a severity level of MEDIUM in table 128 are translated to a severity level of 50 for the system monitor that used textual severity levels. Notification messages assigned a severity level of HIGH in table 128 are translated to a severity level of 84 for the system monitor that used textual severity levels.

[0038] FIG. 4 is a flowchart of an import method 400 for performing the import stage according to a preferred embodiment of the present invention. The method illustrated in FIG. 4 can be performed, for example, by import module 120. Import method 400 includes the step of scanning a source file for notification messages in step 402. The source file corresponds to the computer application to be monitored. Import method 400 continues in step 404 with the step of extracting notification messages from the source file. Import method 400 stores the notification messages in a scan file in step 406. In step 408, import method 400 removes any duplicate notification messages from the scan file.

[0039] FIG. 5 is a flowchart of a manager method 500 for performing the manager stage according to a preferred embodiment of the present invention. The method illustrated in FIG. 5 can be performed, for example, by manager module 122. Import method 500 includes the step of reading the scan file in step 502. In step 504, manager method 500 continues with the step of creating a table using each notification message stored in the scan file. Preferably, the table includes three columns, a notification message column, a severity level column and a location column. Preferably, values in the severity level and location columns are modifiable. These columns are described above with reference to FIG. 1. Manager method 500 continues in step 506 with the step of displaying each line of from the scan file in a scrolling window in a GUI. In step 508, manager method 500 continues with the step of accepting changes to the values stored in the table. In step 510, manager method 500 continues with the step of submitting the table for export.

[0040] FIG. 6 is a flowchart of an import method 600 for performing the import stage according to a preferred embodiment of the present invention. The method illustrated in FIG. 6 can be performed, for example, by export module 124. Import method 600 includes the step of translating the submitted table into a format that is acceptable to the system monitor that is used to monitor the computer application in step 602. Translation can include the steps of mapping the severity level from a numerical representation to a textual representation and vice versa. Export method 600 continues in step 604 with the step of creating an export file that comprises data from the table in a format that is acceptable to the system monitor.

[0041] The foregoing disclosure of the preferred embodiments of the present invention has been presented for purposes of illustration and description. It is not intended to be exhaustive or to limit the invention to the precise forms disclosed. Many variations and modifications of the embodiments described herein will be apparent to one of ordinary skill in the art in light of the above disclosure. The scope of the invention is to be defined only by the claims appended hereto, and by their equivalents.

[0042] Further, in describing representative embodiments of the present invention, the specification may have presented the method and/or process of the present invention as a particular sequence of steps. However, to the extent that the method or process does not rely on the particular order of steps set forth herein, the method or process should not be limited to the particular sequence of steps described. As one of ordinary skill in the art would appreciate, other sequences of steps may be possible. Therefore, the particular order of the steps set forth in the specification should not be construed as limitations on the claims. In addition, the claims directed to the method and/or process of the present invention should not be limited to the performance of their steps in the order written, and one skilled in the art can readily appreciate that the sequences may be varied and still remain within the spirit and scope of the present invention.