Predictive model-based measurement acquisition

Details Predictive model-based measurement acquisition Predictive model-based measurement acquisition

2002-03-29

2004-01-13

Najjar, Saleh (Department: 2157)

Electrical computers and digital processing systems: multicomput

Computer network managing

Computer network monitoring

Reexamination Certificate

active

06678730

ABSTRACT:

FIELD OF THE INVENTION
The present invention relates generally to the operations and management of networked systems. A particular version is related to acquiring measurements of computer and communications systems in distributed environments.
BACKGROUND
This invention relates to operations and management (OAM), such as considerations for security, performance, and availability. OAM accounts for 60% to 80% of the cost of owning network-connected information systems (according to leading analysts). These costs are expected to increase over the next several years due to the proliferation of networked applications and hand held devices, both of which make extensive use of services in distributed systems.
In an OAM system, the entities being controlled are called managed systems (also called agent systems). This control is typically exercised in part by software present on the managed systems. In addition, there are manager systems (also called managers) that are dedicated to OAM functions. Managers provide an environment for executing management applications (hereafter, applications) that provide functions such as detecting security intrusions, determining if managed systems are accessible, and responding to performance degradation.
A corner stone of OAM is measurement. Measurements include: (a) information on network activities that are suggestive of security intrusions; (b) the response times for “ping” messages sent to remote systems to determine if they are accessible; and (c) indicators of resource consumption that are used to diagnose quality of service problems. The term measurement acquisition protocol (MAP) is used to refer to a method of delivering measurements of managed systems to manager systems. A major concern with the proliferation of low-cost computing devices is developing scaleable MAPs. The present invention addresses this concern. It also addresses issues related to disconnected operations (which is increasingly common for low-powered devices) and synchronizing time stamps from multiple sources (which is problematic when systems have separate clocks, a situation that is common in practice).
A MAP allows one or more managers to access measurement variables collected on one or more managed systems. Examples of measurement variables are kernel CPU and user CPU as defined in the output of the UNIX™ vmstat command. The value of a measurement variable at a specific time is called a data item. Data items have a time stamp that identifies when they were obtained from the managed system.
Prior art for MAPs includes: polling, subscription, and trap-directed polling. In polling (e.g., SNMP-based measurement acquisition), the manager periodically requests data from the managed system. Thus, acquiring N data items requires 2N messages.
Subscription-based approaches can reduce the number of messages required for measurement acquisition. Here, the manager sends a subscription request to the managed system. This request specifies how often the managed system sends values of the measurement variable to the manager. Thus, acquiring N data items requires on the order of N messages. While this is a considerable reduction compared to polling, a large number of messages are still exchanged.
Still more efficiencies can be obtained by using trap-directed polling (e.g., Tannenbaum, 1996). As with the previous approach, a subscription is sent from manager to managed systems. However, the managed system does not send a data message unless the variable changes value. This works well for variables that are relatively static, such as configuration information. However, this is equivalent to the subscription approach if variables change values frequently. Unfortunately, the latter is the case for many performance and availability variables, such as TCP bytes sent in IP stacks and the length of the run queue in UNIX systems.
Several techniques can improve the scalability of existing MAPs. However, none of these techniques effectively circumvents the scalability deficiencies of existing MAPs. One approach is to batch requests for multiple measurement variable into a single message. Replies can be batched in a similar way. Doing this reduces the number of messages exchanged to approximately N/B, where N is the number of data items and B is the number of data items in a batch.
While batching has merits, it has significant limitations as well. First, its benefits are modest if only a few variables are needed at a high sampling rate; that is, B is small and N is large. Second, batching can be done only for variables that are obtained from the same managed system. Thus, if there are a large number of systems from which only a few variables are needed, the benefits of batching are limited.
A second way to improve scalability is to poll less frequently, which reduces N. However, a long polling interval means that errant situations may go undetected for an extended period of time. Thus, installations are faced with the unpleasant choice of carefully managing a few systems or poorly managing a large number of systems.
A third approach to improving scalability is to report information only when an exceptional situation arises (e.g., Maxion, 1990). This approach is widely in practice. However, it has significant limitations. First, by its nature, exception checking requires that the managed system inform the manager when difficulties arise. This can be problematic if the managed system is so impaired that it cannot forward a message to the manager. A further issue with exception checking is that some exceptional situations involve interactions between multiple managed systems. Detecting these situations requires forwarding data to a manager on a regular basis.
In addition to scalability, existing MAPs have other shortcomings as well. First, existing MAPs do not support disconnected operation in which the manager cannot communicate with the managed system. Disconnected operation is common in low-end devices that operate in stand-alone mode (e.g., to provide personal calendaring services or note pad capabilities) so as to reduce power consumption. Unfortunately, existing MAPs require that managers be connected (possibly indirectly) to the managed system in order to obtain measurement data for that system.
A second issue in existing MAPs is their lack of support for integrating data from multiple systems and for combining data with different time granularities. Such capabilities are important in problem determination and isolation (e.g., Berry and Hellerstein, 1996). Unfortunately, integration is often impaired in practice since adjusting measurement data to account for the diverse interval durations used in the measurement collection requires a model of the time serial behavior of measurement variables. Such considerations are beyond the scope of current MAPs.
In summary, MAPs are a core technology in OAM. Existing art for MAPs is deficient in several respects. Current approaches scale poorly. They do not address disconnected operation. And, they do not help with integrating measurement data from multiple managed systems.
Predictive models have been applied in some management contexts. A commonly used class of predictive models are time series models (e.g., Box and Jenkins, 1976). Time series models have been applied directly to management problems, such as in Hood and Ji, 1997. An example of a time series model is
x
(
t
)=
a*x
(
t−
1)+
b*x
(
t−
2),  Eq (1)
where x(t) is the value of the variable at time t, and a and b are constants that are estimated using standard techniques. For example, x(t) might be the average response time of transactions during time interval t. A more complex model might take into account other factors, such as the number of requests, denoted by y(t), and their service times, denoted by z(t):
x
(
t
)=
a′*x
(
t−
1)+
b′*x
(
t−
2)+
c*y
(
t
)+
d*z
(
t
).  Eq (2)
Even more sophisticated predictive models consider non-linear terms, such as powers of x, y, and z. As detailed in Box and Jenkins,

Affiliated with

Also associated with

Rating

Predictive model-based measurement acquisition does not yet have a rating. At this time, there are no reviews or comments for this patent.

If you have personal experience with Predictive model-based measurement acquisition, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Predictive model-based measurement acquisition will most certainly appreciate the feedback.

Rate now

Comments { 0 }

Profile ID: LFUS-PAI-O-3235059