Abstract: A classifier classifies data to identify a class of the data. Based on the identified class, at least one action to apply to the given data item is determined according to the data management policy, where the data management policy specifies a plurality of actions to apply for different classes of data items.

Abstract: A computer-implemented method for detecting alarm conditions, the method involving receiving at a first time a trigger notification describing a monitored occurrence on a network; setting a redundancy window to begin at the first time and to end at an expiration time; designating a first alarm condition to represent the trigger notification; receiving a second notification at a second time after the first time, the second notification describing the monitored occurrence; and determining whether a second alarm condition exists by testing whether the second time is within the redundancy window.

Abstract: A classifier classifies data to identify a class of the data. Based on the identified class, at least one action to apply to the given data item is determined according to the data management policy, where the data management policy specifies a plurality of actions to apply for different classes of data items.

Abstract: The network fault manager described herein may include one or more processors configured to detect alarms. For example, the one or more processors may periodically sample rates at which similar events that relate to occurrences on a network arrive, compare the periodically sampled rates to a first threshold, and determine whether a preexisting alarm exists. In response to a number of the periodically sampled rates that exceeded the first threshold within a preceding time window exceeding a second threshold and the preexisting alarm not existing, the one or more processors may assert a first alarm. Otherwise, if the number of periodically sampled rates that exceeded the first threshold within the preceding time window exceeds the second threshold but the preexisting alarm does exist, the one or more processors may maintain the preexisting alarm for a predetermined time period.

Abstract: The network fault manager described herein may include one or more processors configured to detect alarms. For example, the one or more processors may periodically sample rates at which similar events that relate to occurrences on a network arrive, compare the periodically sampled rates to a first threshold, and determine whether a preexisting alarm exists. In response to a number of the periodically sampled rates that exceeded the first threshold within a preceding time window exceeding a second threshold and the preexisting alarm not existing, the one or more processors may assert a first alarm. Otherwise, if the number of periodically sampled rates that exceeded the first threshold within the preceding time window exceeds the second threshold but the preexisting alarm does exist, the one or more processors may maintain the preexisting alarm for a predetermined time period.

Abstract: The network fault manager described herein may generate an alarm data table having various columns and rows respectively corresponding to different alarm data fields and different alarms. The alarm data table may be associated with a primary key that includes a subset of the different data fields in the multiple columns to uniquely represent the different alarms in the multiple rows. In response to removing one or more of the different alarm data fields in the subset from the primary key, the primary key may non-uniquely represent the different alarms in a plurality of the multiple rows. Thus, the alarm data table may be collapsed to combine the different alarms non-uniquely represented in the plurality of the multiple rows into one combined row uniquely representing the different alarms, whereby the collapsed alarm data table may replace the plurality of the multiple rows with the combined row.

Abstract: A method of monitoring an element in a computer network including monitoring a preselected variable relating to that element; defining a threshold for the monitored preselected variable; establishing a sliding window in time; repeatedly generating a time above threshold value, the time above threshold value being a measure of an amount of time during which the monitored variable exceeded the threshold during the sliding window of time; detecting when the time above threshold value exceeds a condition window value; and in response to detecting when the time above threshold value exceeds the condition window, generating an alarm.

Abstract: A method of merging a list of newly found network elements and a list of previously known network elements includes arranging the newly found network elements in a hierarchical structure, and determining one or more device matches between each network device in the list of newly found network elements and one or more network devices in the list of previously known network elements. The method further includes, for each of the one or more device matches, determining one or more network element matches between the newly found network element and the corresponding previously stored network device. The method also includes updating the previously found network device corresponding to each of the one or more device matches with the corresponding newly found network device.

Abstract: A method of monitoring an element in a computer network including monitoring a preselected variable relating to that element; defining a threshold for the monitored preselected variable; establishing a sliding window in time; repeatedly generating a time above threshold value, the time above threshold value being a measure of an amount of time during which the monitored variable exceeded the threshold during the sliding window of time; detecting when the time above threshold value exceeds a condition window value; and in response to detecting when the time above threshold value exceeds the condition window, generating an alarm.

Abstract: A method of processing data received at a local system in response to polling a remote device, wherein the local system includes a local clock, the method involving: sending a first poll to the remote device; receiving a response from the remote device to the first poll, the response to the first poll containing data and a time stamp indicating when the remote device responded to the first poll; for the data received in response to the first poll, computing a first time by using both a time that was derived from the local clock for a previous poll of the remote device and also the time stamp contained in the response to the first poll; comparing the computed first time to information that the local system stored in connection with the first poll, wherein the information that the local system stored in connection with the first poll was derived from the local clock; and determining how to process the data received in response to the first poll based on comparing the computed first time to the information that

Abstract: A method of monitoring an element in a computer network including monitoring a preselected variable relating to that element; defining a threshold for the monitored preselected variable; establishing a sliding window in time; repeatedly generating a time above threshold value, the time above threshold value being a measure of an amount of time during which the monitored variable exceeded the threshold during the sliding window of time; detecting when the time above threshold value exceeds a condition window value; and in response to detecting when the time above threshold value exceeds the condition window, generating an alarm.

Abstract: A computer-implemented method for detecting alarm conditions, the method involving receiving at a first time a trigger notification describing a monitored occurrence on a network; setting a redundancy window to begin at the first time and to end at an expiration time; designating a first alarm condition to represent the trigger notification; receiving a second notification at a second time after the first time, the second notification describing the monitored occurrence; and determining whether a second alarm condition exists by testing whether the second time is within the redundancy window.

Abstract: A method provides for merging lists of newly found and old network elements. The method comprises receiving the list of newly found elements and deriving a potential key value for a portion of the newly found elements from configuration data associated therewith and a key format. The method also updates one of the old elements with the configuration data of a newly found keyed element having the same key. The method compares attributes of newly found elements for components to attributes of old network elements for attribute matches and reports matches. The report lists matching old elements and newly found elements as unresolved if either one does not have a unique key.

Abstract: A method provides for merging lists of newly found and old network elements. The method comprises receiving the list of newly found elements and deriving a potential key value for a portion of the newly found elements from configuration data associated therewith and a key format. The method also updates one of the old elements with the configuration data of a newly found keyed element having the same key. The method compares attributes of newly found elements for components to attributes of old network elements for attribute matches and reports matches. The report lists matching old elements and newly found elements as unresolved if either one does not have a unique key.

Abstract: A method of monitoring an element in a computer network including monitoring a preselected variable relating to that element; defining a threshold for the monitored preselected variable; establishing a sliding window in time; repeatedly generating a time above threshold value, the time above threshold value being a measure of an amount of time during which the monitored variable exceeded the threshold during the sliding window of time; detecting when the time above threshold value exceeds a condition window value; and in response to detecting when the time above threshold value exceeds the condition window, generating an alarm.

Abstract: A method for collecting and reporting monitored data for network traffic, which has been accumulated by a plurality of remote probes. The method includes making a series of polling requests for lists of monitoring data to each probe and receiving the requested lists. Each list has traffic count values that are identified by at least a sampling time, a source address, a destination address and a probe identifier. The method also includes calculating the traffic observed by each probe between successive sampling times and apportioning the calculated traffic data among a single set of consecutive temporal intervals and selecting best counts to avoid overcounting.