Data processing: measuring – calibrating – or testing – Measurement system – Time duration or rate
Reexamination Certificate
2001-03-28
2003-12-02
Barlow, John (Department: 2863)
Data processing: measuring, calibrating, or testing
Measurement system
Time duration or rate
Reexamination Certificate
active
06658367
ABSTRACT:
TECHNICAL FIELD
The invention relates to a management device collecting data from remote devices over a network. More particularly, the present invention relates to improving the accuracy of analysis of data collected from the remote devices over the network.
DESCRIPTION OF THE RELATED ART
Network communications have become a fundamental part of today's computing. It is not uncommon to find two or more computer systems working together to resolve issues such as simulations, modeling, forecasting, etc. In fact, these efforts have been so successful, users have been inclined to design and implement larger and more powerful networks.
As the networks grow larger, increasingly complex, and interface with a variety of diverse networks, it is the task of a network manager (or administrator/user) to keep track of the devices on the networks, to monitor performances and load, to diagnose, and to correct problems with the network.
To assist a network manager, network management software (“NMS”) may be used in the management of a network. The conventional NMS may be typically executed on a management device or node of the network. From the management node, the conventional NMS may be configured to determine a network topology, detect malfunctioning remote network devices or communication links, monitor network traffic, etc.
As part of the monitoring duties, the network manager may configure the NMS to occasionally query or poll remote network devices for information. The information may include status data, port information, address, etc. The information required may be crucial for the network manager to assess the overall status of the network.
FIG. 7
illustrates a block diagram of a conventional management node or device
700
implementing a conventional data collection from a remote node. In particular, the management node
700
includes a NMS
710
and a network interface
720
. The NMS
710
may be configured to provide the functionality for a user, (e.g., a network manager), to manage a network
715
through the network interface
720
.
As part of the NMS
710
, the NMS
710
may include a data collector module
730
configured to retrieve user specified information at a scheduled time from remote devices
725
a . . .
725
n
at a scheduled time over the network
715
, a data collection event. The data collector module
730
may retrieve the selected information from at least one of the remote device
725
a . . .
725
n
and store the selected information in an associated output file in the management node
700
. The associated output file may be analyzed by additional network tools of the NMS
710
to assist in the assessment of the status and maintenance of the network
715
.
In the analysis of the associated output file, the results of the analysis may be skewed. Typically, network systems experience regular patterns of network traffic, (i.e., data/command packets traversing a network). A typical pattern may be a high volume of network traffic during the morning hours of a work week as a result of (e.g., users checking their electronic mail in the morning), followed by a steady volume of network traffic for the rest of the day. The network traffic volume may subsequently drop during the evening hours as users end their respective work days.
However, a workday-week network traffic pattern may be markedly different than a weekend network traffic pattern where network traffic pattern may comprise of occasional network administration traffic (e.g., back-up, maintenance commands, etc.) along with an occasional weekend user. The weekend network traffic pattern may also be markedly different from a workweek overnight traffic pattern which may consist entirely of network administration traffic and/or time-intensive computations.
For example, if the results of the analysis are to be used to determine a performance threshold for incoming data, the performance threshold computation may be skewed. In typical performance threshold computation, most conventional network management systems use all the relevant collected data value points to calculate a given performance threshold. As a result, the given performance threshold may not take into account the varying network traffic patterns that may occur during a week or a given time period of the network. Accordingly, a weekend data point, which may not be aberration when compared against comparable weekend data points, is an aberration when compared against the combined data points.
The aberration may generate an alarms (or alerts) to a network manager. Since the alerts may been unnecessary, the unnecessary alerts may present an erroneous picture of the state of a network. As a result, a network manager may unnecessarily adjust performance parameters of the network to accommodate the unnecessary alarms, which may lead to an inefficient allocation of network resources. Additionally, the generation of unnecessary alarms may lead a network manager to assume that all alarms from the NMS are trivial. Thus, the network manager may ignore meaningful alarms that arrive from the NMS.
One solution to the generation of unnecessary alarms is a proposal where a sliding window of time is utilized to create the appropriate thresholds. The technique is fully described by U.S. Pat. No. 6,182,022 to Mayle et al., the subject matter of which is herein incorporated by reference.
In the Mayle technique, only collected data value points over a sliding window of time are used by a statistical analyzer to calculate a baseline for a monitored performance parameter or attribute. The baseline represents a normal operating range for the monitored performance parameter during the sliding window of time. The baseline is subsequently utilized to generate a new performance threshold. However, although the sliding window of time may take into account the varying amount of network traffic over time, the technique does not distinguish differences between network traffic patterns, which may still lead to an inaccurate picture of a network.
SUMMARY OF INVENTION
In accordance with one aspect, the present invention pertains to a method for improving accuracy of performance thresholds. The method includes configuring a plurality of time intervals and determining a received time interval of the plurality of time intervals in response to an incoming data value. The method further includes computing a revised threshold for the received time interval in response to the incoming data value and comparing the revised threshold and the incoming data value.
One aspect of the present invention is a method for improving accuracy of performance thresholds that includes allocating a plurality of memory blocks where each memory block corresponds to a time interval of a plurality of time intervals. The method also includes determining a received memory block of the plurality of memory blocks in response to an incoming data value and calculating a revised threshold for each memory block. The method further includes updating a plurality of revised thresholds for comparison against subsequent incoming data values.
Another aspect of the present invention is a system for monitoring that includes at least one processor, a memory coupled to said at least one processor, and a time-bucketing data collection module stored on said memory and executed on said at least one processor. The time-bucketing data collection module is configured to determine a received time interval of a plurality of time intervals in response to an incoming data value, to compute a revised threshold for the received time interval in response to the incoming data value, and to compare the revised threshold and the incoming data value.
Another aspect of the present invention is a method that includes establishing a plurality of time intervals and receiving one or more data values, where each data value having an associated time. The method also includes associating each of the one or more data values with one of the plurality of time intervals based on the associated time of each of the one or more data values. The method furthe
Barlow John
Hewlett--Packard Development Company, L.P.
Lau Tung S
LandOfFree
System for time-bucketing of baselined data collector data does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with System for time-bucketing of baselined data collector data, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and System for time-bucketing of baselined data collector data will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3163999