Abstract: Embodiments disclosed herein can significantly optimize a root cause analysis and substantially reduce the overall time needed to isolate the root cause or causes of service degradation in an IT environment. By building on the ability of an abnormality detection algorithm to correlate an alarm with one or more events, embodiments disclosed herein can apply data correlation to data points collected within a specified time window by data metrics involved in the generation of the alarm and the event(s). The level of correlation between the primary metric and the probable cause metrics may be adjusted using the ratio between theoretical data points and actual points. The final Root Cause Analysis score may be modified depending upon the adjusted correlation value and presented for user review through a user interface.

Abstract: An improved performance management technique allows automatic determination dynamic thresholds of a metric based on a baseline of the matching pattern. A pattern matching process is conducted against a set of baseline patterns to find the matching pattern. If a matching pattern is found, the baseline of the matching pattern is used as the dynamic threshold. A series of sanity checks are performed to reduce any false alarms. If the metric does not follow any pattern, a composite of baselines is selected as the dynamic threshold.

Abstract: An improved performance management technique allows automatic determination dynamic thresholds of a metric based on a baseline of the matching pattern. A pattern matching process is conducted against a set of baseline patterns to find the matching pattern. If a matching pattern is found, the baseline of the matching pattern is used as the dynamic threshold. A series of sanity checks are performed to reduce any false alarms. If the metric does not follow any pattern, a composite of baselines is selected as the dynamic threshold.

Abstract: A baseline technique allows reducing the number of threshold violation predictions that need to be generated in a performance monitoring system. One or more baselines may be calculated based on long-term trends in a monitored metric. If the metric is within the baseline, then predictions regarding short-term trends in the metric may be omitted. If the metric is outside the baseline, then short-term trends may be analyzed to predict possible threshold violations.

Abstract: A network management system in which an administrator may specify attributes of interest, and the specified attributes are monitored. Graphs/reports corresponding to the specified reports may be generated in a single place (e.g., on a web page) such that the data points for the various attributes may be correlated easily. The specified attributes may contain attributes which are dynamically created (e.g., counters measuring various aspects related to instances of objects). The network management system provides the ability to discover such attributes using a suitable interface, and selection of such attributes as well.

Abstract: To facilitate gathering of information required for root cause analysis associated with the abnormal behavior of an attribute (“problem attribute”), a user can specify causation attributes associated with the problem attribute. When the abnormal behavior is detected for the problem attribute, the causation attributes are automatically polled and stored in a database. The user can later examine the values of the causation attributes to determine if there is a causal relationship to the abnormal behavior of the problem attribute.

Abstract: A monitoring system provided according to an aspect of the present invention enables a user to specify multiple resource elements as a resource pool, and view various aggregate information (e.g., sum, average) for attributes of interest for all the resource elements together. Such a feature is particularly useful in distributed environments where multiple independent resource elements need to be viewed as a single resource pool. The user is provided the flexibility to select the specific resource elements to be included in the resource pool.

Abstract: Embodiments disclosed herein can significantly optimize a root cause analysis and substantially reduce the overall time needed to isolate the root cause or causes of service degradation in an IT environment. By building on the ability of an abnormality detection algorithm to correlate an alarm with one or more events, embodiments disclosed herein can apply data correlation to data points collected within a specified time window by data metrics involved in the generation of the alarm and the event(s). The level of correlation between the primary metric and the probable cause metrics may be adjusted using the ratio between theoretical data points and actual points. The final Root Cause Analysis score may be modified depending upon the adjusted correlation value and presented for user review through a user interface.

Abstract: A monitoring system provided according to an aspect of the present invention enables a user to specify one or more resource elements as a group, and compute an Abnormality Index that represents the deviation from a baseline operation of these selected resource elements. In an embodiment, the Abnormality Index is computed as a single number. The user may include any desired attributes of each resource element to be considered in determining deviations. The Abnormality Index represents the number of deviations, the seriousness of deviation (e.g., more serious if deviation relates to unavailability of the resource element), and the extent of deviation (i.e., whether the deviation is based on expected operation for hourly, daily or weekly duration).

Abstract: A monitoring system provided according to an aspect of the present invention enables a user to specify one or more resource elements as a group, and compute an Abnormality Index that represents the deviation from a baseline operation of these selected resource elements. In an embodiment, the Abnormality Index is computed as a single number. The user may include any desired attributes of each resource element to be considered in determining deviations. The Abnormality Index represents the number of deviations, the seriousness of deviation (e.g., more serious if deviation relates to unavailability of the resource element), and the extent of deviation (i.e., whether the deviation is based on expected operation for hourly, daily or weekly duration).

Abstract: A monitoring system provided according to an aspect of the present invention enables a user to specify multiple resource elements as a resource pool, and view various aggregate information (e.g., sum, average) for attributes of interest for all the resource elements together. Such a feature is particularly useful in distributed environments where multiple independent resource elements need to be viewed as a single resource pool. The user is provided the flexibility to select the specific resource elements to be included in the resource pool.

Abstract: A system is provided to monitor network performances. The system maintains a database of performance abnormalities, alarms and events from a system of monitored elements. The system automatically identifies a possible cause of a specific alarm by correlating the specific alarm with a plurality of events using the database. The system displays the cause of the specific alarm. The database includes alarms and events of network devices, network systems, and network applications. The specific alarm consists of a notification of an occurrence of the plurality of events.

Abstract: To facilitate gathering of information required for root cause analysis associated with the abnormal behavior of an attribute (“problem attribute”), a user can specify causation attributes associated with the problem attribute. When the abnormal behavior is detected for the problem attribute, the causation attributes are automatically polled and stored in a database. The user can later examine the values of the causation attributes to determine if there is a causal relationship to the abnormal behavior of the problem attribute.

Abstract: A network management system in which an administrator may specify attributes of interest, and the specified attributes are monitored. Graphs/reports corresponding to the specified reports may be generated in a single place (e.g., on a web page) such that the data points for the various attributes maybe correlated easily. The specified attributes may contain attributes which are dynamically created (e.g., counters measuring various aspects related to instances of objects). The network management system provides the ability to discover such attributes using a suitable interface, and selection of such attributes as well.

Abstract: A method and apparatus for network management is described. In one embodiment, a method comprises collecting performance data having accompanying meta data including information defining the performance management data and information indicating operations to be performed on the performance management data, and generating output data for display using collected performance management data according to the information indicating the operations to be performed on the performance management data.

Abstract: Apparatus, methods and computer program products are disclosed that allow the user of an application to customize the graphical user interface (GUI) for the user's needs. The invention engages in a dialog with the user to determine which GUI features are desired by the user. Depending on the user's answers a model representation of the GUI (a configuration) is saved. The invention provides the user with the ability to select and use the saved configurations.

Abstract: Apparatus, methods and computer program products are disclosed for interfacing a client based, multi-threaded API that is written in a first programming language (such as JAVA) with a server based, single-thread API that is written in a second programming language (such as C or C++). The invention uses an object factory to generate a server object for each client. Programmed-method invocations performed on logical objects at the client are communicated to the server object. The server object processes the programmed-method invocation to perform the requested service such as providing network management information services.