Abstract: Techniques for system (syslog) messages are provided. As syslog messages are generated a dual sequence number is maintained for each syslog message. The first sequence number is consistent for each syslog message and represents a total number of syslog messages received. The second sequence number is maintained as a total message count for a specific session for which a syslog message is assigned.

Abstract: A method and system to profile applications are provided. The system may include a capture module to capture resources consumption data for an application and a requirements generator to generate resources requirement data for the application. The resources requirement data may be generated by the requirements generator utilizing the resource consumption data. The system may further include a profile generator to generate a profile for the application. The profile may comprise the resources consumption data and the resources requirement data.

Abstract: Resource availability profiles are received, wherein each resource availability profile describes a resource associated with a server. Each resource is assigned a plurality of weights corresponding to a plurality of policies. The weights are determined by, for each of the plurality of the policies, determining a weight for each resource based a given policy and selected information in the resource availability profiles corresponding to the resources. The method further comprises determining a policy from the plurality of the policies corresponding to a given a context associated with a connection request. A first of the load-balanced servers is selected for the connection request based on the weights assigned to the plurality of resources for the policy for the given context.

Abstract: A method and system for processing directives included in management events are disclosed. A method for handling management events includes detecting an event generated upon an occurrence relating to a device, such as a network device. The device related occurrence has a characteristic. A directive, appropriate to this characteristic, is included with the event format. The event is directed to a management entity, which interprets the directive and handles the event by processing it according to the directive. Such preprocessing directives included in the events allow recipients of the events to decide what to do with them, e.g., with the messages therein, and thus help prevent inadvertent loss of information conveyed in these events.

Abstract: The real time availability of a group of network elements is determined based upon both a real time availability value for each of the network elements and cooperation relationships between the network elements. The cooperation relationships reflect both the topological relationships between the network elements, i.e., how the network elements are connected, and the extent to which network elements interact with each other effectively. For relatively small groups of network elements, where the cooperation relationships are not overly complex, the real time availability is determined directly from the real time availability value for each of the network elements and cooperation relationships between the network elements. Decomposition and recombination are used to determine the real time availability of large groups of network elements based on specific formulas for basic network element topology models.

Abstract: An approach for processing events generally involves receiving event data that specifies one or more attributes of an event that has occurred. A determination is made whether the event data satisfies one or more event cancellation criteria. If so, then event report data is provided to a recipient, such as an application layer. The event report data specifies at least one attribute of the event that occurred. If the event data does not satisfy the one or more event cancellation criteria, then the event data is not provided to the recipient and the event is canceled. The cancellation criteria may include policy-based rules that may specify event cancellation based upon, for example, event frequency, correlation window size, particular information associated with an event, or other management application rules. The particular cancellation criteria used may vary from application to application. Furthermore, the cancellation criteria used for any particular application may be dynamic and change over time.

Abstract: Event processing in rate limited network devices is described. An event receiver is notified of a backlog condition and may respond by increasing the rate limit for the network device. If an event queue on the network device overflows, event messages may be diverted to an event message overflow store or to a network location. Later, the messages may be retrieved after the overflow condition has cleared. As a result, critical messages or events such as Syslog messages are not lost when a rate limited network device cannot deliver the messages to a network management station.

Abstract: A uniquely configured data structure is used to store event information for each network entity, where logical and physical dependency relationships among entities are captured in the data structure. For each entity, the data structure is configured to store (a) a “genuine event set”, which includes a list of events that originated in association with the entity; and (b) a “derived event set”, which includes a list of records in which each record is associated with an event that originated in association with an entity that has a dependency relationship (e.g., layering or topological) with the entity. The derived event set may simply comprise references to the genuine event sets for entities that have a dependency relationship with the entity.

Abstract: An approach is provided for characterizing the dynamic availability behavior of network elements using metrics that indicate patterns of availability of a network element over time. The metrics provide an indication of stability and instability of a network element and include one stability metric and three instability metrics. The stability metric is a stability order that indicates how long an operational state holds with respect to a prior operational state. The instability metrics include an instability order, a repeatability order and a multiplicity order. The instability order indicates how quickly a network element changes operational states. The repeatability order indicates short-term instability within a vicinity of a change in operational state. The multiplicity order indicates long-term instability. The metrics may be used alone, or in various combinations, by network management applications to better manage network elements.

Abstract: A method is disclosed for a method for measuring the availability of a network element or service. For each network element N, a current real availability value CRAVN and a current time value CTVN are associated with network element N. Additionally, for each network element N, an operational state value OSVN is associated with network element N. At a later time, indicated by a new time value NTVN, a new real availability value NRAVN for network element N is determined based on the current availability value CRAVN, the current time value CTVN, the new time value NTVN, and the operational state value OSVN. The new real availability value NRAVN is stored. Thus, each separate network element N may be associated with a separate real availability value that accurately reflects the availability of network element N specifically, regardless of any availability approximated for network element N's type.

Abstract: An approach for determining compression intervals generally involves determining a compression interval based upon frequencies of event instances. According to the approach, event data is received that specifies instances of an event. The event data is analyzed and a compression interval is determined based upon frequencies of the instances of the event. The compression interval is selected to provide a balance between insufficient compression (under compression) and poor performance associated with over compression. Event compression may then be performed using the compression interval and report data may be generated that specifies the occurrence of the event.

Abstract: An isolation approach for network users associated with elevated risk is disclosed for protecting networks. In one approach a method comprises the computer-implemented steps of determining a user identifier associated with a network device that has caused a security event in a network; causing the network device to receive a network address that is selected from a subset of addresses within a specified pool associated with suspected malicious network users; and configuring one or more security restrictions with respect to the selected network address.

Abstract: A method of managing performance data and accounting data that are generated in a computer network comprises collecting performance data from the network using one or more collector blades that are installed into a data collection manager at a time when the data collection manager is executed; determining whether the performance data satisfies one or more thresholding rules, and if so, generating and sending one or more performance messages; filtering the performance data using one or more filters; aggregating the performance data; and correlating the performance data with other data received from one or more network management subsystems.

Abstract: A method of providing performance trend information from a device in a packet-switched network to a network management station comprises maintaining in the device one or more state variables that store values associated with data processing functions of the device; storing in the device a trend indicator value and a trend tendency value, both associated with a particular state variable among the state variables; periodically sampling the particular state variable to obtain one or more sampled values; determining and updating the trend indicator value with a direction of change in the sampled values of the particular state variable over a particular time; determining and updating the trend tendency value with a rate of change in the one or more sampled values of the particular state variable over the particular time; and sending the trend indicator value and the trend tendency value to the network management station.

Abstract: A method and mechanism for communicating an alarm in a computer network is provided. An alarm system enables a MSP to accurately determine which device within a computer network is associated to a received alarm. Initially, an event is detected on a device on the computer network. An alarm is propagated to an alarm identification component. The alarm identification component augmenting the alarm with identification information to result in creating an augmented alarm. Thereafter, the augmented alarm is transmitted to a network operations center for the computer network. The network operations center may process the alarm using the additional information in the alarm. Accordingly, using the augmented alarm, the MSP is able to accurately determine the identity of the originating device, regardless of whether the customer site of the originating device uses NAT or a private IP addressing scheme.

Abstract: Methods and mechanisms for preventing deadlock in a policy-based computer system are disclosed. In one embodiment, the method includes various machine-implemented steps, such as a step of receiving policy information based upon decisions about system configurations. At least one policy includes at least one action that has a post condition. Satisfaction of the post condition triggers at least one subsequent action or decision. The policy includes an indication whether the at least one subsequent action or decision should proceed if the action fails to satisfy the post condition. The at least one action is executed. Then, if the action fails to satisfy the post condition, a determination is made whether the at least one subsequent action or decision can proceed based upon the indication.

Abstract: Approaches are described for capturing illegal and undesired behavior for network components and for interactions between components. One approach comprise specifying one or more states and state transitions for one or more components or interactions between components, wherein at least one composite state transition is specified, and generating a notification corresponding to a specified state or state transition when the state or state transition occurs. These approaches provide a holistic view of the entire state space of a network or component or component interactions, and allow undesired or illegal states to be captured in a timely manner.

Abstract: A method for correlating output of distributed processes includes receiving certain information at a first process of multiple distributed processes that perform one computer application. The information includes a unique identifier for a particular instance of the application that is different from any other identifier for any other instance of the application. The unique identifier is included in data written by the first process to a first data structure. Based on the unique identifier, the data in the first data structure is correlated with data in a different, second data structure written by a different, second process.

Abstract: Event processing in rate limited network devices is described. An event receiver is notified of a backlog condition and may respond by increasing the rate limit for the network device. If an event queue on the network device overflows, event messages may be diverted to an event message overflow store or to a network location. Later, the messages may be retrieved after the overflow condition has cleared. As a result, critical messages or events such as Syslog messages are not lost when a rate limited network device cannot deliver the messages to a network management station.

Abstract: A method is disclosed for adaptively coupling processing components in a distributed system. In one aspect, a second component requests an interaction with a first component by sending a service access request to access a first service of the first component. The service access request specifies parameters relating to a proposed level of coupling between the first component and the second component. The second component receives a service response from the first component; the service response specifies counter-proposed parameters relating to a proposed level of coupling between the first component and the second component. The second component determines whether the service response indicates that the first service may be provided. If so, then an agreed-upon level of coupling is established between the first component and second component, and the components interact to receive the service. The level of coupling among the components may be re-negotiated at any time by exchanging values in a coupling context.