Abstract: The present invention describes a method and apparatus for resolving anomalies within a network topology map that typically occur when a derived topology map fails, for a variety of reasons, to include devices resident on the network. The method of the present invention discovers missing devices by identifying a conflicting link within a received topology map, the conflicting link comprising a source and one or more conflicting destinations. The conflicting link is resolved through the use of one or more virtual devices within the topology map. The conflicting link is replaced with a link to a virtual device based upon the resolution of the conflicting link, thereby eliminating the anomaly in the topology map. The step of resolving the conflicting link may also comprise the steps of determining a number of conflicting destinations from the source of the conflicting link, resolving the source of the conflicting link, and resolving the conflicting destination.

Abstract: Described herein are methods and systems for preparing to efficiently distribute data to be extracted from a data store to clients and for distributing such prepared data to the clients. The methods and system have particular utility in the context of a network monitoring system which captures and stores network event data and makes the event data available to clients according to any desired view or summary. One method for preparing the data involves storing as primary requests one or more client requests for data to be extracted from the event database. Additional client requests for event are each compared to the stored primary requests to determine whether each additional request matches a stored primary request in accordance with a given criterion, such as a filter or summary formula. If the additional request matches a stored primary request, the additional client request is associated with the matching primary request.

Abstract: Methods and systems are described for reducing the number of false alarms in fault correlation software used to detect and diagnose faults in computer networks and similar systems. The fault correlation software includes rules that monitor a number of indicators that, if occurring together over a window of time, are known to cause or reflect the occurrence of a fault. The method involves monitoring the transition of these indicators from one state to another over the time window and determining the extent of the correlation of the transitions of the indicators. The determination that indicators monitored by a rule do not correlate closely in their transitions is used to reduce the likelihood of the rule finding correlation of the indicators as a whole. This in turn reduces the number of false alarms which the rule-based system might otherwise have transmitted.