Management event notification system using event notification messages written using a markup language

Abstract

An event notification system for a network including a managed device that includes one or more management agents that detect one or more management events of a plurality of possible management events. The managed device further includes event notification logic that generates an event notification message (ENM) which includes event related information. The ENM is written using a markup language, such as XML, to encode the event related information based on the management event. The ENM may include executable code written in a scripting language or the like, that when executed, causes at least one action to be performed. A management server is provided that includes an event processor that executes the code to perform the desired actions in response to the particular management event. The event related information may further include a URL to locate one or more information files in the network that provides further information about the management event. The event notification logic transmits the ENM to the management server using an HTTP post transaction to ensure delivery.

Claims

We claim:

1. A managed device for a network that performs event notification, comprising:

at least one management event detector that detects at least one management event of a plurality of possible management events;

event notification logic that generates an event notification message that includes event related information, the event notification logic transmitting the event notification message onto the network; and

the event notification message written using a markup language to encode the event related information based on the particular management event that was detected.

2. The managed device of claim 1, wherein the markup language comprises an extensible markup language.

3. The managed device of claim 1, further comprising:

the event notification message including executable code that when executed causes at least one action to be performed.

4. The managed device of claim 3, further comprising:

the executable code comprising an executable event action script written in a scripting language.

5. The managed device of claim 1, further comprising:

the event related information including a location pointer to locate further information on the network related to the particular management event that was detected.

6. The managed device of claim 5, wherein the location pointer comprises a universal resource locator to locate an information file in the network.

7. The managed device of claim 1, further comprising:

communication logic that operates according to Transmission Control Protocol/Internet Protocol (TCP/IP).

8. The managed device of claim 7, further comprising:

the event notification logic formulating the event notification message into an HyperText Transfer Protocol (HTTP) post transaction for transmitting on the network via the communication logic.

9. A managed device for a network that performs event notification, comprising:

at least one management event detector that detects at least one management event of a plurality of possible management events;

event notification logic that generates an event notification message that includes event related information, the event notification logic transmitting the event notification message onto the network; and

the event notification message including executable code that when executed instructs at least one action to be performed in response to the particular management event that was detected.

10. The managed device of claim 9, further comprising:

the event notification message written using a markup language to encode the event related information based on the particular management event that was detected.

11. The managed device of claim 9, further comprising:

the event notification message including a location pointer to locate further information on the network related to the particular management event that was detected.

12. The managed device of claim 11, wherein the location pointer comprises a universal resource locator to locate an information file in the network.

13. The managed device of claim 9, further comprising:

communication logic that operates according to Transmission Control Protocol/Internet Protocol (TCP/IP).

14. The managed device of claim 13, further comprising:

the event notification logic formulating the event notification message into an HyperText Transfer Protocol (HTTP) post transaction for transmitting on the network via the communication logic.

15. An event notification system, comprising:

a management server; and

a managed device that is communicatively coupled to the management server, the managed device comprising:

at least one management event detector that detects at least one management event of a plurality of possible management events;

event notification logic that generates an event notification message that includes event related information, the event notification logic transmitting the event notification message to the management server; and

the event notification message written using a markup language to encode the event related information based on the particular management event that was detected.

16. The event notification system of claim 15, wherein the markup language comprises an extensible markup language.

17. The event notification system of claim 15, further comprising:

the event notification message including executable code to perform at least one action.

18. The event notification system of claim 17, further comprising:

the management server including an event processor that receives and parses the event notification message and that executes the executable code to perform at least one action in response to the particular management event that was detected.

19. The event notification system of claim 15, wherein the event related information includes a universal resource locator to locate a file in the network that provides further information related to the particular management event that was detected.

20. The event notification system of claim 15, further comprising:

the management server including a web server that communicates on the network according to Transmission Control Protocol/Internet Protocol (TCP/IP); and

the managed device including communication logic that communicates with the web server of the management server according to TCP/IP.

21. The event notification system of claim 20, further comprising:

the event notification logic formulating the event notification message into an HyperText Transfer Protocol (HTTP) post transaction for transmitting to the management server.

Description

FIELD OF THE INVENTION

The present invention relates to system and network management, and more particularly, to an improved system for providing notification of management events.

DESCRIPTION OF THE RELATED ART

In computer network environments, it is advantageous to manage the various software and hardware components coupled to the network from a central location or from a remote location. Such central or remote management of a network is commonly accomplished using industry standard protocols, such as the Simple Network Management Protocol (SNMP) or the Desktop Management Interface (DMI). Such traditional management systems utilize protocols that have been rigidly designed for delivering very specific management information. SNMP, for example, defines a protocol data unit known as a trap that is used to deliver event notification information. The format of the SNMP trap is narrowly defined. Additionally, SNMP delivers trap messages by use of User Datagram Protocol (UDP) which does not guarantee delivery of the message.

It is desired to provide a more flexible method of delivering notification and information of management events. It is also desired to ensure that an event notification gets delivered.

SUMMARY OF THE INVENTION

A managed device for a network that performs event notification according to the present invention includes at least one management event detector that detects at least one management event of a plurality of possible management events. The managed device further includes event notification logic that generates an event notification message (ENM) which includes event related information. In one embodiment, the ENM is written using a markup language to encode the event related information based on the particular management event that was detected. The event notification logic transmits the ENM onto the network to be received by a management device, such as a management server. The markup language may comprise the eXtended or extensible Markup Language (XML), which is a dialect of the Standardized General Markup Language (SGML). XML provides a meta language to define markup languages for specific applications. In this manner, a flexible and powerful method is provided to notify a management device and/or a system administrator of the management event.

For example, the ENM may include executable code that when executed causes at least one action to be performed. The executable code may be written in any manner, and may comprise an executable event action script written in a scripting language, such as JavaScript, Jscript, VBScript, Perl, etc. In one embodiment, the management server includes an event processor or processor logic that executes the code to perform the desired actions in response to the particular management event. In one embodiment, the ENM need not be written in a markup language but includes the executable code including instructions to execute one or more actions in response to the particular management event.

The event related information may further include a location pointer to locate further information on the network related to the particular management event that was detected. For example, the location pointer may comprises a universal resource locator (URL) or the like to locate an information file in the network. Preferably, the managed device includes communication logic that operates according to Transmission Control Protocol/Internet Protocol (TCP/IP). Also, the event notification logic formulates the ENM into an HyperText Transfer Protocol (HTTP) post transaction, that is transmitted on the network via the communication logic.

An event notification system according to the present invention includes a management server and a managed device that is communicatively coupled to the management server. The managed device includes the management event detector and the event notification logic that generates and transmits the ENM to the management server. The management server preferably includes an event processor that receives and parses the ENM. If the ENM includes executable code, the event processor executes the executable code to perform at least one action in response to the particular management event that was detected. The ENM may also include a URL or the like to locate a file in the network that provides further information related to the particular management event that was detected. The management server preferably includes a web server that communicates on the network according TCP/IP, and the managed device includes communication logic that communicates with the web server of the management server according to TCP/IP. The event notification logic formulates the ENM into an HTTP post transaction for transmitting the ENM to the management server.

It is appreciated that an event notification system according to the present invention provides an improved and enhanced ability to deliver event-related information of a managed device to a management server of a network. The use of a markup language, such as XML, for example, provides a flexible scheme for encoding management information in response to a management event. The content of the ENM is very flexible depending upon the particular management event that occurred. Executable code, for example, enables any one or more of a plurality of possible actions to be taken in response to the particular management event. A plurality of predefined code modules may be included on the managed device, each corresponding to one or more of the possible management events. A file locator enables the management server to locate more information related to the management event. Again, a plurality of predefined information files may be provided, each corresponding to one or more of the possible management events that may occur.

BRIEF DESCRIPTION OF THE DRAWINGS

A better understanding of the present invention can be obtained when the following detailed description of the preferred embodiment is considered in conjunction with the following drawings, in which:

FIG. 1 is a block diagram of a web-based management network;

FIG. 2 is a block diagram illustrating a network system including a managed device and management server that each perform event notification according to the present invention; and

FIG. 3 is a block diagram illustrating an exemplary event notification message formulated by the managed device for sending to the management server of FIG. 2.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

Referring now to FIG. 1, a block diagram of a web-based management network 100 is shown. A management system according to the present invention, such as the management network 100, enables management of both hardware and software components over a network using Internet technology. The management network 100 includes a management server 102, one or more managed elements 104, and a client system 106 that are coupled together using any one or more network architectures or technologies, such as Ethernet.RTM., ATM, Token Ring, etc. The management network 100 preferably supports the World Wide Web (WWW), which is an Internet technology that is layered on top of the basic Transmission Control Protocol/Internet Protocol (TCP/IP) services. The management network 100 may be any type of network or network topology such as a separate intranet, part of the Internet itself, an intranet with access via a gateway or firewall to the Internet, etc.

The managed elements 104 generally include computer systems with one or more corresponding network interface cards (NICs) or the like, such as desktops, portables, personal computer systems (PCs), servers, workstations, etc. as well as other networking devices, such as switches, routers, repeaters, hubs, etc. The managed elements 104 are generally divided into two different types, including web-enabled devices or Hyper-Media Managed Devices (HMMDs) 110 and legacy devices 112. The legacy devices 112 include those devices implemented with the Simple Network Management Protocol (SNMP), the Desktop Management Interface (DMI), or similar type management systems known to those skilled in the art.

The HMMDs 110 each include one or more management agents called Hyper-Media Managed Objects (HMMO) 111, described further below. In the preferred embodiment, the HMMDs 110 each convert management data into a form that may be browsed using Internet technology, which may incorporate TCP/IP, Universal Resource Locator (URL), HyperText Transfer Protocol (HTTP), HyperText Markup Language (HTML), JavaScript, etc. A managed element communication layer (MECL) 108 including one or more servers 109 is provided at the front end of the HMMOs 111 for providing security of and access to management data of the corresponding HMMD 110. The servers 109 preferably operate as HTTP servers, and a separate server 109 is loaded and operated within the MECL 108 for each installed HMMO 111.

The client system 106 supports TCP/IP and includes a web browser for accessing and displaying management information from the management server 102 or any of the HMMDs 110. Examples of web browsers include MicroSoft.RTM. Internet Explorer for Windows 95.RTM. or Windows NT.RTM. and Netscape Navigator.TM. for Windows 95.RTM., Windows NT.RTM. or HP/UX by Hewlett Packard. Other web browsers are contemplated as well. It is desired that the web browser support a scripting language, such as JavaScript, Jscript, VBScript, Perl, etc. Scripting language includes instructions interpreted by a browser to perform certain functions, such as how to display data. The client system 106 generally replaces the management console of an SNMP management system, providing access to either the HMMDs 110 or the management server 102.

The management server 102 preferably uses an appropriate operating system (OS) such as Windows NT.RTM. or the like. The management server 102 also executes or otherwise operates as a Hyper-Media Management Application (HMMA) that provides management services for all of the managed elements 104 including the HMMDs 110 and the legacy devices 112. The management server 102 may serve as the aggregation point for all management information of the management network 100 and provides a unified data model, in which data from the legacy devices 112 (SNMP, DMI, etc.) and data from the HMMDs 110 are consolidated into a common form. As such, the system and network management is unified and allows for easier integration and navigation between applications.

The management server 102 accesses management data from the HMMDs 110 and controls those devices using Internet technology. The HMMOs 111 may operate as self-describing web agents that use common web-enabling components to provide registration, discovery, security and HTTP communications. The HMMO web agents render information in HTML, or in scripting language, or a combination of both, for viewing by a browser on the client system 106. The information may also be sent directly to the management server 102. The management server 102 also converts data from the legacy devices 112 into a form that may be browsed. For example, the management server 102 includes an SNMP converter 122 that converts SNMP-based data from SNMP managed devices to HTML, and a DMI converter 124 that converts DMI-based data from DMI managed devices to HTML. The management data from the managed elements 104 is stored in a management database 128 maintained on the management server 102. The SNMP converter 122 and the DMI converter 124 are examples of management applications 126, which are plug-in modules used to perform the functions or otherwise expand the capabilities of the HMMA. In this manner, the management server 102 is adaptable and flexible depending upon specific embodiment needs. The management server 102 also generates a home page 130 accessible by any appropriate web browser, such as that executing on the client system 106 or on the management server 102 itself.

The management server 102 provides a management foundation, which includes discovery of manageable devices, performance of event management and determination of device status and device groups. The database 128 preferably includes events, discovered devices, device status, user preferences and user-specified data that is actively monitored. The management server 102 performs management services to discover managed elements 104 of the management network 100 and to track the device state of all of the managed elements 104. The management server 102 may discover devices on the network using IP pinging for IP devices, SAP broadcasts for Internetwork Packet Exchange (IPX) devices and is extendable to enable other discovery mechanisms. The management server 102 periodically collects and saves configuration information in the database 128 in a common form regardless of whether the information was originally web-based, SNMP or DMI. For example, the management server 102 stores events and traps, and enables configuration of filters that ultimately generate queries that are used to select records from the database 128. The management server 102 also enables access of the database 128. The database 128 is preferably based on SQL Server by Microsoft.RTM. and is accessed via Java.TM. DataBase Connectivity (JDBC) or Object DataBase Connectivity (ODBC). SQL views are created to abstract the database 128 for reporting purposes.

The management server 102 enables the user to select a managed element 104 and view detailed information about that device. The management server 102 also enables a user to create device groups for business process views by filtering for selected devices and for selected events of those devices. The management server 102 handles events, such as SNMP traps and HTTP alerts, logs the events and allows a user to set event filters.

As described previously, the client system 106 includes a web browser for accessing and displaying management information from the management server 102 and any of the HMMDs 110. For example, the client system 106 sends an HTTP request in URL format to an HMMD 110, which is received by the MECL 108 of that HMMD. The MECL 108 accesses an index page for the HMMD 110, or the request is transferred to one of the servers 109 for a corresponding one of the HMMOs 111. As further described below, each HMMO 111 formulates or renders a corresponding web page using HTML and/or scripting language, which is passed back to the client system 106 for rendering and display via the server 109 of the MECL 108. The client system 106 accesses the home page 130 or data from the database 128 in a similar manner using TCP/IP and another URL. The management server 102 also performs security functions as further described below.

It is noted that the legacy devices 112 are managed and controlled by the management server 102 as usual according to the particular protocol supported (SNMP, DMI), so that the client system 106 might not necessarily have direct access. Nonetheless, the client system 106 has access and control of the legacy devices 112 via the management server 102. In this manner, it is appreciated that the client system 106 may be located anywhere on the Internet to access and control all of the managed elements 104 of the management network 100.

One of the primary goals of the management network 100 is to ensure a continuous operation of the network with as little down time as possible by isolating and solving problems. The management server 102 provides the base for software modules to expose and present the solutions to problems that exist within the management network 100. The act of finding problems, reducing the complexity in analyzing or diagnosing problems, and helping to resolve problems is referred to as Action Oriented Management (AOM). AOM comprises several concepts, including discovering and defining a problem, determining the course of action(s) to take based on the problem, and providing the resolution to the problem, where the resolution may be performed either programmatically or by providing a list of steps for the user to follow.

There are many categories of actions that the management server 102 discovers. One action category is hardware fault detection, which is a category of actions identifying problems with hardware. Examples of hardware fault detection include failures or predictive failures on hard drives, processors, and memory. Most problem resolutions in the hardware fault detection category are simply identified steps that the user must follow to correct the problem. Tools in this category allow viewing of the problem. Another action is software configuration actions, which are actions that identify potential problems with software configurations. Software configuration actions use version control functionality along with the concept of a "software set". The user establishes a set of software that should be loaded on a server, and this category of actions identifies any deviations from that set, and differences between the set and the latest software. Problem resolution for software configuration allows distribution of software updates, along with retrieval of new software. Tools in this category include software distribution, Internet download, and report generation.

Another action category is thresholds, which are actions that track situations on the network identified by combinations of data. The user has to configure the situations. The threshold tools allow the user to monitor management data and be notified whenever certain conditions arise. Another action category is action advisories, which are actions that notify the user whenever an event is needed to be performed, such as service advisories generated by the manufacturer of the management server 102. Other advisory examples include backups, disk storage cleanup, etc. Tools for this category provide the details of the action advisory and may allow corrective action. Another action category is software updates, which are actions that notify the user whenever a new software update to software on their network becomes available on a corresponding web site. Tools for this category allow the new update to be fetched from servers setup on a user's network. Another action category is traps, which are actions that occur when an SNMP trap, an HTTP event, a DMI indication, or similar types of traps or events is received. The trap is turned into an action that is operated on just as any other action. The tools in this category allow the user to forward the trap to other management consoles, to page the user, provide correlation, etc.

In general, management is often classified by what is being managed: Hardware, Operating System, Software, etc. The following Table 1 illustrates the layers and the management data that is typical of that layer. It is noted that Table 1 is by no means exhaustive and simply provides typical management data for the corresponding layer.

                  TABLE 1
    ______________________________________
    Management Layers and Corresponding Typical Management Data
    Managed Layer Examples of managed data at each layer
    ______________________________________
    Applications (highest layer)
                  Transactions per second
    (Vertical, specialized
                  Application specific data, such as status of
    applications) batch processing activities
    Databases, web servers,
                  Table space used
    So-called "Horizontal"
                  Number of locks set
    applications  Resources used - percent of system work
                  areas, etc.
    Operating System
                  Number of processes
                  Interrupts per second being serviced
                  Per cent of CPU time spent in user state
                  Names of processes
    Hardware (lowest layer)
                  Configuration: serial number of disk drive,
                  bytes of RAM installed, etc.
                  Operational: number of bytes sent by
                  Ethernet controller, number of packet
                  collisions on Ethernet, temperature of CPU
                  cabinet, etc.
    ______________________________________

    ______________________________________
    <!DOCTYPE DOCUMENT [
    <!ELEMENT DOCUMENT (EVENT)+>
    <!ELEMENT EVENT (DEVICEID, IPADDRESS, EVENTSEV,
    EVENTTIME, EVENTCODE, DEVICENAME, DESCRIPTION?,
    TRANSACTION.sub.-- NO, EVENTACTIONSCRIPT?,
    EVENTURL?)>
    <!ELEMENT DEVICEID (#PCDATA)>
    <!ELEMENT IPADDRESS (#PCDATA)>
    <!ELEMENT EVENTSEV (#PCDATA)>
    <!ELEMENT EVENTTIME (#PCDATA)>
    <!ELEMENT EVENTCODE (#PCDATA)>
    <!ELEMENT DEVICENAME (#PCDATA)>
    <!ELEMENT DESCRIPTION (#PCDATA)>
    <!ELEMENT TRANSACTION.sub.-- NO (#PCDATA)>
    <!ELEMENT EVENTACTIONSCRIPT (#PCDATA)>
    <!ELEMENT EVENTURL (#PCDATA)>
    ]>
    ______________________________________

    ______________________________________
    POST POST /EventListener HTTP/1.0<cr><ln> Start of
    HTTP POST transaction
    Host: ManagementServer.domain.com
    (the management server 220, for example)
    Accept-Language: en<cr><ln>
    Accept-Charset: iso-8859-1, *, utf-8<cr><ln>
    Content-Type: x-event/XML <cr><ln>
    Content-length: nnn<cr><ln>
    <cr><ln>
    <?XML version = "1.0"?>   First line of the XML document
    <DOCUMENT>
    <EVENT  (the ENM document)
    <DEVICEID>UUID</DEVICEID>
    <IPADDRESS>255.255.255.255</IPADDRESS>
    <EVENTSEV>CRITICAL</EVENTSEV>
    <EVENTTIME>Tue, 21 Jan 1998 08:21:32 GMT</EVENTTIME>
    <EVENTCODE>234</EVENTCODE>
    <DEVICENAME>BIGSERVER</DEVICENAME>
    <DESCRIPTION>Processor thermal event</DESCRIPTION>
    <TRANSACTION_NO>11111 </TRANSACTION.sub.-- NO>
    <EVENTACTIONSCRIPT></EVENTACTIONSCRIPT>
    <EVENTURL></EVENTURL>
    </EVENT>
    </DOCUMENT>
    ______________________________________

    __________________________________________________________________________
    <SCRIPT LANGUAGE="JavaScript">
    >!-
    // Send an alphnumeric page
    // This code assumes that this script is executing in an environment in
    which
    // the event XML object has been parsed and the constituent tagged fields
    can be
    // accessed
    var eventdoc = new object(xml);
    // gain access to fields this function call creates a new object that can
    be
    used to access the parsed
    // contents of the fields of this ENM
    var msg = "At time" + eventdoc.EVENTTIME
    msg = msg + "server LONGHOUSE is shutting down due to a processor thermal
    event";
    // send the page
    SendAlphaPage(msg);
    //-->
    </SCRIPT>
    __________________________________________________________________________

    __________________________________________________________________________
    POST POST /EventListener Start of HTTP POST transaction
    Host: ManagementServer.domain.com
    Accept-Language: en<cr><in>
    Accept-Charset: iso-8859-1, *, utf-8<cr><ln>
    Content-Type: x-event/XML<cr><in>
    Content-length: nnn<cr><in>
    <cr><in>
    <?XML version  = "1.0"?> First line of the XML document
    <DOCUMENT>
    <EVENT
    <DEVICEID>UUID</DEVICEID>
    <IPADDRESS>255.255.255.255</IPADDRESS>
    <EVENTSEV>CRITICAL</EVENTSEV>
    <EVENTTIME>Tue, 21 Jan 1998 08:21:32 GMT</EVENTTIME>
    <EVENTCODE>234</EVENTCODE>
    <DEVICENAME>LONGHOUSE</DEVICENAME>
    <DESCRIPTION>Processor thermal event</DESCRIPTION>
    <TRANSACTION.sub.-- NO>22222</TRANSACTION.sub.-- NO>
    <EVENTACTIONSCRIPT>
    <SCRIPT LANGUAGE = "JavaScript">
    <!-
    // Send an alphnumeric page
    // This code assumes that this script is executing in an environment in
    which
    // the event XML object has been parsed and the constituent tagged fields
    can be
    // accessed
    var eventdoc = new object(xml); // gain access to fields
    var msg = "At time" + eventdoc.EVENTTIME
    msg = msg + "server LONGHOUSE is shutting down due to a processor thermal
    event";
    // send the page
    SendAlphaPage(msg);
    //->
    </SCRIPT>
    </EVENTACTIONSCRIPT>
    <EVENTURL></EVENTURL>
    </EVENT>
    </DOCUMENT>
    __________________________________________________________________________

    __________________________________________________________________________
    POST POST /EventListener Start of HTTP POST transaction
    Host: ManagementServer.domain.com
    Accept-Language: en<cr><in>
    Accept-Charset: iso-8859-1, *, utf-8<cr><ln>
    Content-Type: x-event/XML<cr><in>
    Content-length: nnn<cr><in>
    <cr><in>
    <?XML version =  "1.0"?> First line of the XML document
    <DOCUMENT>
    <EVENT
    <DEVICEID>UUID</DEVICEID>
    <IPADDRESS>255.255.255.255</IPADDRESS>
    <EVENTSEV>CRITICAL</EVENTSEV>
    <EVENTTIME>Tue, 21 Jan 1998 08:21:32 GMT</EVENTTIME>
    <EVENTCODE>234</EVENTCODE>
    <DEVICENAME>ACCTSERVER</DEVICENAME>
    <DESCRIPTION>System degraded</DESCRIPTION>
    <TRANSACTION.sub.-- NO>33333</TRANSACTION.sub.-- NO>
    <EVENTURL>acctserver.acme.com/disksubsys:2301 </EVENTURL>
    </EVENT>
    </DOCUMENT>
    __________________________________________________________________________

• Inventors
  Hemphill, John M.; Stupek, Jr., Richard Allen; Rozzi, James A.; Fairchild, Steven E.;
• Assignee
  Compaq Computer Corporation (Houston, TX)
• Published
  Dec-26-2000
• Current US Classes:
  709/217
  709/219
  709/223
  709/224
  709/230
  712/214
  712/216
  712/28
  715/501.1
  715/503
  715/513
  718/100
• Application #
  096064
• International Classes
  G06F 015/173; G06F 015/16
• Field of Search
  709/202 709/217 709/219 709/223 709/224 709/230 709/200 709/100 707/501 707/503 706/50 705/1 712/28 712/214 712/216
• Examiner
  Maung; Zarni
• Agent
  Akin, Gump, Strauss, Hauer & Feld, LLP
• US Patent References:
  4975829
  5430845
  5475836
  5522042
  5559958
  5561769
  5572195
  5581478
  5608907
  5708845
  5862325
  5870549
  5884312
  5960176
  5983190
  6049805