Abstract: A system for collecting and aggregating data from network entities for a data consuming application is described. The system includes a data collector layer to receive network flow information from the network entities and to produce records based on the information. The system also includes a flow aggregation layer fed from the data collection layer and coupled to a storage device. The flow aggregation layer receiving records produced by the data collector layer and aggregates received records. The system can also include an equipment interface layer coupled to the data collector layer and a distribution layer to obtain selected information stored in the storage device and to distribute the select information to a requesting, data consuming application.

Abstract: A data collection system includes a plurality of node host computers. Each node host computer has a node manager, at least one processing node and a data manager. The data manager delivers network records between processing nodes. The processing nodes include an input queue and an output queue. In some embodiments at least one of the nodes has a plurality of output queues. The processing nodes are arranged in configurable chains of processing nodes. The chains are disposed across one or more of the plurality of host computers to process network records. The at least one processing node having the plurality of output queues can couple records from the plurality of output queues to input queues of corresponding processing nodes, based on a selected distribution method and/or selected content of records. The system can include an administrative client that displays a graphical user interface and an administrative server communicating with the node host computers and the administrative client.

Abstract: A method for mapping data path connections includes accessing information representing a data path between a software application and a storage system, the information is collected from the software application by an agent, accessing information representing the data path between the storage system and the software application, a portion of the information is collected from the storage system by an agent, determining connections associated with the data path, and mapping the data path connections to form a connection map.

Abstract: A system and method is provided for managing information. Information is aggregated from multiple data sources into a data warehouse wherein the information can be provided to software applications. Disparate information from multiple sources is processed and stored in the data warehouse. Processing may include filtering, collation, compression, and mapping information into database fields of the warehouse. In one aspect, information stored in the warehouse may be network management data.

Abstract: Apparatus and method for distributed object filtering of objects transferred between a client and server. The objects may be alarms transferred between a network management server and one or more network management applications. The apparatus and method further includes applying a plurality of policy-based filters to the alarms. The filters may be named and stored in a database, and application of the policy-based filters may be scheduled for different times. The same policy-based filters may be applied to one or more multiple network management applications. The system and method provides increased performance and reliability of passing objects from a server to a client application.

Abstract: Fault management and recovery in a distributed network accounting system includes classifying nodes in the system according to complexity of processing in the node. For nodes of relatively low processing complexity, context check-pointing a state of processing in the nodes to permit automatic recovery of the node to the nodes' most recent processing context checkpoint; and for nodes of relatively high complexity, producing a directed graph of the programmable nodes that controls a flow of data and control of processing through the system, and producing a dynamic modification of the directed graph to automatically fail-over to redundant back-up nodes based on thresholds established for the component hosts.

Abstract: A system and method is provided for managing information. Information is aggregated from multiple data sources into a data warehouse wherein the information can be provided to software applications. Disparate information from multiple sources is processed and stored in the data warehouse. Processing may include filtering, collation, compression, and mapping information into database fields of the warehouse. In one aspect, information stored in the warehouse may be network management data.

Abstract: Fault management and recovery in a distributed network accounting system includes classifying nodes in the system according to complexity of processing in the node. For nodes of relatively low processing complexity, context check-pointing a state of processing in the nodes to permit automatic recovery of the node to the nodes' most recent processing context checkpoint; and for nodes of relatively high complexity, producing a directed graph of the programmable nodes that controls a flow of data and control of processing through the system, and producing a dynamic modification of the directed graph to automatically fail-over to redundant back-up nodes based on thresholds established for the component hosts.

Abstract: Configuration management of managed objects is performed based upon performance data. Configuration management is performed on varying levels according to the amount of interpretation of the performance data that is required. A new configuration for an object is determined based upon the performance data, and the object is reconfigured according to the new configuration. Analysis may be performed at varying levels by a reactive analyzer and a deliberative analyzer.

Abstract: Buffer element for communication network, including a first buffer memory to store communication units corresponding to a first quality of service (QOS) level, and a second buffer memory to store communication units corresponding to a second quality of service level. A buffer manager selectively stores communication units from the first and second buffers based on the corresponding quality of service level, and retrieves communication units from the first and second buffer memories. The buffer manager includes a sorter unit for selectively storing based on the quality of service level. The buffer element may further include a depth adjuster to adjust the depth of the first and second buffer memory.

Abstract: Apparatus and method for distributed object filtering of objects transferred between a client and server. The objects may be alarms transferred between a network management server and one or more network management applications. The apparatus and method further includes applying a plurality of policy-based filters to the alarms. The filters may be named and stored in a database, and application of the policy-based filters may be scheduled for different times. The same policy-based filters may be applied to one or more multiple network management applications. The system and method provides increased performance and reliability of passing objects from a server to a client application.

Abstract: Network capacity evaluation and planning is performed based upon the traffic across the links of the network. Once a link's traffic volume has been measured, it is compared with the link's traffic capability, and the resulting parameters compared with the traffic and capability of other links of the network to create measures of network capacity and balance. Then, simulated changes to the network configuration may be made by substituting simulated traffic volume amounts and capabilities for selected link traffic measurements and capabilities, and the resulting measures of network capacity and balance may then be compared to determine whether the simulated changes represent a preferred network configuration.

Abstract: Apparatus and method for distributed object filtering of objects transferred between a client and server. The objects may be alarms transferred between a network management server and one or more network management applications. The apparatus and method further includes applying a plurality of policy-based filters to the alarms. The filters may be named and stored in a database, and application of the policy-based filters may be scheduled for different times. The same policy-based filters may be applied to one or more multiple network management applications. The system and method provides increased performance and reliability of passing objects from a server to a client application.

Abstract: Network capacity evaluation and planning is performed based upon the traffic across the links of the network. Once a link's traffic volume has been measured, it is compared with the link's traffic capability, and the resulting parameters compared with the traffic and capability of other links of the network to create measures of network capacity and balance. Then, simulated changes to the network configuration may be made by substituting simulated traffic volume amounts and capabilities for selected link traffic measurements and capabilities, and the resulting measures of network capacity and balance may then be compared to determine whether the simulated changes represent a preferred network configuration.

Abstract: Control of network surveillance in communications networks is accomplished by dividing the surveillance task into two sub-tasks. The first sub-task automatically identifies communications within the network which are to be monitored. Such identification is accomplished by the application of a reasoning system to data received from the network. The identification of the data to be monitored is received by the second sub-task along with network topology information. The second sub-task also applies a reasoning system to this data in order to configure probes and switches within the network so that the identified data can be captured.

Abstract: Availability of a computer network is determined by analyzing specific pairs of source/destination devices in the network and alternative paths between them. The topology of the network is analyzed so as to determine all paths between the devices and the availability of devices on each path is determined. If any one alternative path is available, this is included in the determination of network availability. Further, a relative weight may be assigned to various devices/paths on the network depending on usage or other parameters. The availability information is then presented in the format of a report card where specific source/destination pairs and the paths therebetween are chosen as indicia of the network's availability.

Abstract: Apparatus and method for learning current network behavior and predicting future behavior which utilizes a state transition graph. The graph includes nodes which represent network states, and arcs which represent trends in observable network parameters that result in a transition from a current state to another state. For example, a watch service may be instituted on multiple ports of a router, and the observed network traffic on the ports over time may be transformed into a state transition graph that represents network behavior. The network states may be labeled such as "good", or "bad", etc., according to a predetermined performance criteria. Once a state transition graph is constructed, the system may then monitor the current state and current trends of the network parameters in order to predict and display future network states. The system may include an automatic warning signal for alerting a user that the network is headed in the direction of a problematic state.

Abstract: Data compression and decompression are performed on a series of data points, by expressing a plurality of data points as an equation or a series of equations. Variable accuracies, and accordingly variable compression ratios, may be provided. Multiple versions of the compressed data, with corresponding multiple accuracy levels, and resulting multiple decompressions may be displayed for comparison. The method and apparatus may be used for storing network statistical data.

Abstract: Traffic on a communications network is evaluated based on intra-subnet and inter-subnet traffic volumes. Values indicative of such volumes and of the overall network balance are displayed, along with alternative node topologies which may be evaluated and displayed. The overall network performance is based on equalizing intra-subnet traffic volume and minimizing inter-subnet traffic volume.

Abstract: In a communications network, a request manager simultaneously dispatches a number of requests to servers corresponding to at least one domain of interest that is specified by a client. Multiple responses are received and a single collated response is sent back to the client that initiated the request. A request context table is provided which includes an anchor context and dependent contexts corresponding to each of the servers, and a session count for tracking receipt of all responses for each server. An internal cache of server addresses is also maintained.