Abstract: A method and apparatus for determining causality mapping between causing events and detectable events among a plurality of nodes in a distributed system is disclosed. The method comprises the steps of automatically generating a causality mapping model of the dependences between causing events at the nodes of the distributed system and the detectable events in a subset of the nodes, the model suitable for representing the execution of at least one system operation. In one aspect the generation is perform by selecting nodes associated with each of the detectable events from the subset of the nodes and indicating the dependency between a causing event and at least one detectable event for each causing event at a node when the causing event node is a known distance from at least one node selected from the selected nodes.

Abstract: A method and apparatus are provided for multi-realm system modeling (MRSM) for dividing systems into components, defining realms containing objects representing system components, optionally defining relationships between the system components, defining associations between realms sufficient to unify objects in the realms when needed, and unifying objects in the realms based on the associations. The realms are defined in a way that enables unified processing for various applications of MRSM.

Abstract: A method and apparatus for discovering applications having components distributed over a plurality of nodes in a network is disclosed. The method comprises the steps of obtaining information associated with at least one application, said information providing first and second instructions, executing processing associated with the first instructions, determining a tentative identification of at least one application based on responses associated with the processing of the first instructions, executing processing associated with the second instructions based on each of the tentatively identified applications, and confirming an identification of at least one application based on responses associated with the processing of the second instructions. In one aspect of the invention, the method further comprises the step of storing the application identification and characteristics in a representation of the application.

Abstract: A method and apparatus for determining the number and location of monitoring entities in a distributed system is disclosed. The method comprising the steps of automatically generating a causality mapping model of the dependences between causing events at the nodes of the distributed system and the detectable events associated with a subset of the nodes, the model suitable for representing the execution of at least one system operation, reducing the number of detectable events in the model, wherein the reduced number of detectable events is suitable for substantially representing the execution of the at least one system operation; and placing at least one of the at least one monitoring entities at selected ones of the nodes associated with the detectable events in the reduced model. In another aspect, the processing described herein is in the form of a computer-readable medium suitable for providing instruction to a computer or processing system for executing the processing claimed.

Abstract: A method for providing an adaptive monitoring process for distributed system containing a plurality of detected events, each of which is associated with at least one causing event. The method comprises the steps of receiving an indication of an occurrence of at least one detected event, enabling the detection of at least one second detected event, the second detected events associated with the detected events are nominally disabled, initiating at least one process for generating at least one second causing event associated with each of the enabled second detected events and identifying selected ones of the at least one second causing events based on the occurrence of at least one corresponding one of the second detected events.

Abstract: A method and apparatus are provided for correlating events in a system. Problems and other events can, e.g., be detected in a system that generates symptoms or observable events. A computer-accessible codebook is provided that includes a mapping between each of a plurality of groups of possible symptoms and one of a plurality of likely exceptional events (e.g., problems) in the system. The system is monitored and one or more known symptoms generated by the system are detected. A mismatch measure is determined between each of the plurality of groups of possible symptoms in the mapping and the one or more known symptoms using a computer, while disregarding symptoms in the groups of possible symptoms not determined to be known. One or more of the plurality of likely problems is selected corresponding to one of the plurality of groups having the smallest mismatch measure.

Abstract: A method and apparatus are provided for correlating events in a system. Problems and other events can, e.g., be detected in a system that generates symptoms or observable events. A computer-accessible codebook is provided that includes a mapping between each of a plurality of groups of possible symptoms and one of a plurality of likely exceptional events (e.g., problems) in the system. The system is monitored and one or more known symptoms generated by the system are detected. A mismatch measure is determined between each of the plurality of groups of possible symptoms in the mapping and the one or more known symptoms using a computer, while disregarding symptoms in the groups of possible symptoms not determined to be known. One or more of the plurality of likely problems is selected corresponding to one of the plurality of groups having the smallest mismatch measure.

Abstract: A method for providing an adaptive monitoring process for distributed system containing a plurality of detected events, each of which is associated with at least one causing event. The method comprises the steps of receiving an indication of an occurrence of at least one detected event, enabling the detection of at least one second detected event, the second detected events associated with the detected events are nominally disabled, initiating at least one process for generating at least one second causing event associated with each of the enabled second detected events and identifying selected ones of the at least one second causing events based on the occurrence of at least one corresponding one of the second detected events.

Abstract: A method and apparatus are provided for correlating events in a system. Problems and other events can, e.g., be detected in a system that generates symptoms or observable events. A computer-accessible codebook is provided that includes a mapping between each of a plurality of groups of possible symptoms and one of a plurality of likely exceptional events (e.g., problems) in the system. The system is monitored and one or more known symptoms generated by the system are detected. A mismatch measure is determined between each of the plurality of groups of possible symptoms in the mapping and the one or more known symptoms using a computer, while disregarding symptoms in the groups of possible symptoms not determined to be known. One or more of the plurality of likely problems is selected corresponding to one of the plurality of groups having the smallest mismatch measure.

Abstract: A method and apparatus for determining causality mapping between causing events and detectable events among a plurality of nodes in a distributed system is disclosed. The method comprises the steps of automatically generating a causality mapping model of the dependences between causing events at the nodes of the distributed system and the detectable events in a subset of the nodes, the model suitable for representing the execution of at least one system operation. In one aspect the generation is perform by selecting nodes associated with each of the detectable events from the subset of the nodes and indicating the dependency between a causing event and at least one detectable event for each causing event at a node when the causing event node is a known distance from at least one node selected from the selected nodes.

Abstract: A method and apparatus for determining the number and location of monitoring entities in a distributed system is disclosed. The method comprising the steps of automatically generating a causality mapping model of the dependences between causing events at the nodes of the distributed system and the detectable events associated with a subset of the nodes, the model suitable for representing the execution of at least one system operation, reducing the number of detectable events in the model, wherein the reduced number of detectable events is suitable for substantially representing the execution of the at least one system operation; and placing at least one of the at least one monitoring entities at selected ones of the nodes associated with the detectable events in the reduced model. In another aspect, the processing described herein is in the form of a computer-readable medium suitable for providing instruction to a computer or processing system for executing the processing claimed.

Abstract: A method and apparatus for discovering applications having components distributed over a plurality of nodes in a network is disclosed. The method comprises the steps of obtaining information associated with at least one application, said information providing first and second instructions, executing processing associated with the first instructions, determining a tentative identification of at least one application based on responses associated with the processing of the first instructions, executing processing associated with the second instructions based on each of the tentatively identified applications, and confirming an identification of at least one application based on responses associated with the processing of the second instructions. In one aspect of the invention, the method further comprises the step of storing the application identification and characteristics in a representation of the application.

Abstract: A method and apparatus are provided for multi-realm system modeling (MRSM) for dividing systems into components, defining realms containing objects representing system components, optionally defining relationships between the system components, defining associations between realms sufficient to unify objects in the realms when needed, and unifying objects in the realms based on the associations. The realms are defined in a way that enables unified processing for various applications of MRSM.

Abstract: A method and apparatus are provided for correlating events in a system. Problems and other events can, e.g., be detected in a system that generates symptoms or observable events. A computer-accessible codebook is provided that includes a mapping between each of a plurality of groups of possible symptoms and one of a plurality of likely exceptional events (e.g., problems) in the system. The system is monitored and one or more known symptoms generated by the system are detected. A mismatch measure is determined between each of the plurality of groups of possible symptoms in the mapping and the one or more known symptoms using a computer, while disregarding symptoms in the groups of possible symptoms not determined to be known. One or more of the plurality of likely problems is selected corresponding to one of the plurality of groups having the smallest mismatch measure.