Abstract: Apparatus for monitoring a selected tier in a multi-tier computing environment, the apparatus including a context agent and a dynamic tier extension, the context agent associated with the selected tier and coupled with other context agents, each of which is associated with a respective tier, the dynamic tier extension coupled with the context agent and with specific predetermined points of the selected tier, the dynamic tier extension monitoring request traffic passing through the selected tier, the monitored request traffic including at least one entering request received at a request entry port from an adjacent tier, the dynamic tier extension identifying each request in the monitored request traffic and sending at least a request identifier to the context agent, the context agent also receiving information relating to the request context of the entering request from the context agent associated with the adjacent tier, the context agent associating the information relating to the request context of the ente

Abstract: Software program robustness is improved by successfully masking memory safety errors in the software program. For instance, at least some memory safety errors in a software program can be masked by using a runtime memory manager that approximates the semantics of an infinite heap memory manager. In one example, an approximation of an infinite heap memory manager is implemented by configuring a parameterized memory manager with parameter values such as padding to be added to each allocation on the heap and the amount of deferment before executing a call to free memory on the heap. Ideal configurations balance expected robustness with costs such as added memory and processing time. Ideal configurations can be identified through systematic search of a coordinate space of selected parameters. Ideal configurations can also be identified by statistically correlating success/failure data collected from execution of deployed instances of the software program to the configuration of the memory managers used therein.

Abstract: Request grouping rules are maintained for grouping a system request based on information relating to a character string in the system request; call relation sets are created from the system requests sent and received among the servers and stored in the request history by associating the system requests by call relation; the call relation sets are converted into inter-request group call relation sets based on the maintained request grouping rules; along with a frequency of appearance of the request group in the request history, inter-request group call relation patterns are derived for each request group, each inter-request group call relation pattern consisting of the request group invoking and the request group invoked by the request group in question; a rating value is calculated for rating the request groups based on the derived inter-request group call relation pattern.

Abstract: A system, method, and article of manufacture are disclosed for monitoring and resolving problems detected in the application stack. The application stack may include multiple, interpedently application components which collectively provide a unified service. An interactive problem resolution program may monitor and assist users in troubleshooting an application stack installed on a separate computer system. Generally, when a problem in the application stack is detected, the IPR Program may alert users to the problem and provide information about the problem to guide users in taking steps to correct the problem.

Abstract: The present invention generally relates to log message processing such that events can be detected and alarms can be generated. For example, log messages are generated by a variety of network platforms (e.g., Windows servers, Linux servers, UNIX servers, databases, workstations, etc.). Often, relatively large numbers of logs are generated from these platforms in different formats. A log manager described herein collects such log data using various protocols (e.g., Syslog, SNMP, SMTP, etc.) to determine events. That is, the log manager may communicate with the network platforms using appropriate protocols to collect log messages therefrom. The log manager may then determine events (e.g., unauthorized access, logins, etc.) from the log data and transfer the events to an event manager. The event manager may analyze the events and determine whether alarms should be generated therefrom.

Abstract: A monitoring apparatus includes: a reception section that receives information including first use mode information from an first information processing apparatus; a storage section that stores the first use mode information received by the reception section; and a transmission section, when the reception section receives fault information together with the first use mode information from the first information processing apparatus, that transmits information concerning countermeasures against a fault to the first information processing apparatus based on the first use mode information and pieces of second use mode information, stored in the storage section, of second information processing apparatuses which normally operate.

Abstract: Systems and methods for managing problems that are determined to be chronic problems with network devices or circuits are disclosed. The systems and methods receive data indicating a problem with a network device or circuit and determine based on the data a first action to be performed on the network device or circuit. Upon determining that a recurring problem exists for the network device or circuit, a rule set is used to determine if the data indicates a chronic problem. Upon determining that a chronic problem exists for the network device or circuit, the rule set is used to determine a monitoring period for the network device or circuit. Further, within the monitoring period a performance indicator that indicates that the network equipment or circuit is performing acceptably or unacceptably is used to determine further actions for the network device or circuit.

Abstract: A network device may include logic configured to detect that an event has occurred in the network device, determine an XML document structure based on the detected event, and generate an XML document with the determined structure including information relating to the detected event.

Abstract: Automated estimation that a hardware or software change is correlated with one or more problem events. In addition to identifying that a change has occurred, one or more problem events are identified that have occurred after the change. Problem events are then correlated with the change using a distance measure between the change and the at least one correlated problem event. For most, if not all, of the distance measure, the greater the distance measure, the less the change is correlated with each correlated problem event. The distance measure may be a time interval, an activity-weighted interval, or any other type of distance measure.

Abstract: The present invention relates to computers executing in time-share mode, under the control of their operating systems, a number of separate and independent application programs. The present invention relates in particular to the networks of onboard computer networks of IMA type executing application programs written independently of the hardware specifications of the computers and not permanently resident in the computers. The method of the present invention associates with the digital core of each computer of the network a monitoring state machine operating independently and in having the monitoring state machine monitor the correct observance by the associated computer of the time sequencing of the tasks and memory partition allocations. Furthermore, the monitoring state machines can be configured to execute monitoring service applications of time-out or watchdog type to which the application programs executed by the computers of the network can subscribe.

Abstract: An interface circuit for a single logic input pin of an electronic system, comprising a decoder for converting a pulse coded signal applied to said pin to a sequence of logic low and logic high values, and a state machine responsive to said sequence of logic values to switch the electronic system between different modes of operation.

Abstract: Intelligent network tap port aggregators for use in monitoring a network and methods for use therein are presented including: a number of device interface terminals for receiving network feeds; a tap structure coupled with device interface terminals, the tap structure configured to monitor the second network feeds and to aggregate the network feeds into an aggregated network feed; a monitor interface terminal coupled to the tap structure for providing the aggregated network feed to a network monitor; and a display coupled to the tap structure and configured to display selected network parameters corresponding to the network feeds. In some embodiments, the intelligent network tap port aggregator also includes: a network controller coupled with the tap structure for providing communication between the tap structure and a number of managing devices; and a managing device interface coupled with the network controller for providing Internet access to the network controller.

Abstract: A generalized trace and log facility is employed to collect data, including data associated with the first occurrence of an error. The facility provides standardized application programming interfaces to be used to collect data, print the data, and forward the data to a support team, if desired.

Abstract: A method is implemented in a computer infrastructure having computer executable code tangibly embodied on a computer readable storage medium having programming instructions. The programming instructions are operable to receive disruption data for an enterprise and determine optimal selected disruption data from the received disruption data. Additionally, the programming instructions are operable to correlate triggering events of the optimal selected disruption data to one or more systemic root cause categories and identify a systemic root cause based on the triggering events of the optimal selected disruption data. Furthermore, the programming instructions are operable to determine an optimal enterprise solution set based on the identified systemic root cause and determine an optimal enterprise transformation set based on the optimal enterprise solution set.

Abstract: A diagnostic system in an aspect-oriented data processing environment is provided. The environment comprises a data processing system having an operating system for executing an application, wherein the application comprises an object class. The environment also comprises means for loading the object class at runtime and storage means for storing a diagnostic aspect. An aspect implements concerns (e.g. logging, security) that cross-cut the application. The object class of the application is loaded at runtime and the diagnostic aspect is read from the storage means. The means for loading now combines the object class with the diagnostic aspect, so that for example, diagnostics can be captured and repairs on the application can be carried out.

Abstract: Automatically notifying, in response to an event associated with a particular server and/or application on a network, only appropriate person(s) such as, for example, only the IT member(s) responsible for supporting the server and/or application. The work schedules and the work schedule exceptions of one or more persons may be taken into account when determining whom to notify of an event on a network. Event information may be received. In response, subscription information for a plurality of subscribers may be accessed, which may include any of: one or more applications for which the subscriber is responsible; one or more servers for which the subscriber is responsible; a work schedule of the subscriber for receiving notifications, and one or more exceptions to this schedule. At least one subscriber may be selected by comparing this information to the event information, and a notification may be sent to the at least one subscriber.

Abstract: A method of programming a programmable logic device (PLD), in accordance with an embodiment, includes receiving trigger unit information of a logic analyzer via a software interface for monitoring internal PLD signals and providing trigger unit output signals based on the internal PLD signals for the corresponding trigger units; and receiving trigger expression information of the logic analyzer via the software interface as a text string of logic operators and operands, wherein the operands represent the trigger unit output signals. The method may further include generating configuration data based on the trigger unit information and the trigger expression information; and providing the configuration data to the PLD, wherein a trigger expression based on the trigger expression information is stored within memory of the PLD.

Abstract: A protocol analyzer for analyzing traffic on a bus. A system includes a tap, a pod and an analyzer. The tap includes differential inputs for the bus. One of the differential inputs is a line from the bus and the other is a reference input that has been divided. The reference input enables the system to determine whether data on the bus is high or low even in situations where the operating voltage of the bus is unknown.

Abstract: In general, this disclosure describes techniques of controlling communications occurring in a unified communications system. As described herein, a directory is established at a server system that hosts the unified communications system. The directory includes a plurality of hierarchically-organized categories. Each category specifies a set of users. One or more conferences may be associated with each of the categories. All communications occurring in the unified communications system occur within the context of one of the conferences. A user can only communicate within a conference if the conference is associated with the category that specifies a set of users that includes the user. By appropriately structuring the categories in the directory and the sets of users specified by the categories, the techniques of this disclosure may serve to prevent a user from using the unified communications system to communicate with certain other individuals.

Abstract: Described is a technology by which software instrumentation data collected from user program sessions are analyzed, including by determining program usage metrics and/or command usage metrics. Information representative of the program usage metrics and/or the command usage metrics is output, such as in the form of a report. The software instrumentation data may be further analyzed, such as to determine at least one usage trend over time, and to determine user groups. For example, a usage subset of sessions that meet specified session usage criteria based on a set of session data may be located, along with a subset of users based on users whose sessions meet specified user criteria. The usage and user subsets may be combined via Boolean logic to produce a result set.

Abstract: A method of semi-automatic data collection, data analysis and model generation for performance analysis of computer networks and software is provided. The invention provides a graphical user interface which indicates the overall data flow in the performance analysis process and guides the user through the proper sequence of steps in that process. Underneath the graphical user interface, the invention provides software tools which include novel data pipeline for transformation of network traces, resource data and application data into organized hash tables, and further into spreadsheets for introduction into computer network simulation programs. The invention also provides novel algorithms for recognizing transaction and parentage between transactions from low level network trace data. The invention further provides novel methods of visualization of trace data and transaction and parentage associations.

Abstract: In an in-operation system check processing device, an automatic exploration unit automatically checks presence/absence of devices of the in-operation system and relationship between the devices according to the design data of the in-operation system. A check list storage unit contains information on check conditions concerning problems of the devices constituting a network system found afterward. A system check unit detects a problem existing in the actual in-operation system by collating the design data and the result of the automatic exploration with the check conditions stored in the check list storage unit. A caution information output unit outputs caution information relating to the problem. Thus, it is possible to prevent a failure which may be caused in the in-operation system with a high probability and improve the operation quality.

Abstract: Service and network management events are correlated, enabling a user to correlate all the application and network events that stem from a common fault without requiring repeated and exhaustive capturing of detailed knowledge of the network assets, the topological relationships and all possible events.

Abstract: A method, apparatus and program storage device for providing control of statistical processing of error data over a multitude of sources using a dynamically modifiable DFT rule set is disclosed. The dispersion frame technique is extended in the present invention to provide dispersion frame rules with user-defined parameters thereby creating a dynamically modifiable rule set.

Abstract: Implementations of client health validation using historical data are described. In one implementation, historical data on a client, such as a laptop, attempting to access a network is scanned. The historical data can come in many forms, including cookies and application data caches saved on the client. The historical data can be used to assess a health of the client. For example, if historical data stored in an application data cache indicates interactions between the client and a website known to disseminate malicious agents, the client can be assessed to have unacceptable health. Alternately, if the historical data indicates that the client has not interacted with enough suspicious sources to constitute a danger to the network, the client can be assessed to have acceptable health. In such a case, the client can be allowed to access the network.

Abstract: Performance monitors (PMs) are provided in a system to identify the execution time for data being transferred within the system and determine operation parameters of the system based on the rate data is transferred. The operation parameters are then used to configure hardware within the system. The PMs can provide a histogram of the transactions usable to evaluate system performance. The PMs can provide a time line diagram of the transactions to show the specific order the transactions occurred. The PMs can be provided in a multi-port memory controller (MPMC) to monitor the speed of read and write transactions from the MPMC ports, and used to configure logic within the MPMC to maximize the rate of data flow.

Abstract: A visual representation of performance data is displayed for a target application. The visual representation includes a visual indicator associated with a visual element of the target application. The visual indicator graphically illustrates a processing cost for the associated visual element with respect to other visual elements in the target application. The processing cost for the visual element includes a relative and/or absolute processing cost. The processing cost may be separated into different categories, such as animation, layout, rendering, and the like.

Abstract: Semiconductor device circuits and methods are provided for adjusting core processor performance and energy-efficiency based on usage metrics. Metric detection, performance state selection, and adjustment are done in digital logic hardware without intervening input from system software or firmware, thus greatly speeding the processor performance adjustment. Mapping usage and state information to desired processor power-performance states is also provided in circuitry rather than firmware or power control software. The mapping values may be programmable software or firmware, but detection, selection, and adjustment occur automatically in hardware without intervening input from firmware or software.

Abstract: The invention relates to a data processing system comprising a central processing unit, a first memory coupled to the central processing unit for storing variable data values, an eventing engine coupled to the central processing unit and the memory to monitor in real-time at least one of the variable data values and determine the occurrence of an event based on the at least one of the variable data values, and a debug module coupled to the central processing unit and to the eventing engine for receiving the at least one of the variable data values in real time to conduct a real-time debugging of the program.

Abstract: A system and method is provided for capturing and using problem fingerprints in an Information Technology (IT) infrastructure for integrity management. A fingerprint of the transaction topology in an IT infrastructure is automatically captured at various time intervals prior to the occurrence of an event leading to a problem, such as a failure, hard threshold violation, defined transaction violation or user-provided occurrence. The fingerprint provides an indication of the activity and operation of the IT infrastructure immediately preceding the problem event. The captured fingerprint is then used to monitor real-time data in the IT infrastructure operation and activity to look for activity that matches a captured fingerprint to provide an indication of a pending problems before the problems occur.

Abstract: A wireless local area network (WLAN) is monitored by receiving transmissions exchanged between one or more stations and an access point (AP) in the WLAN using a detector located in the WLAN. A database is compiled based on the received transmissions. The received transmissions are analyzed to determine the state of a station. The compiled database and the determined state of the station are used to diagnose connectivity problems of the station.

Abstract: Systems, methods, and software used in performing automated diagnosis and identification of or forecasting service level object states. Some embodiments include building classifier models based on collected metric data to detect and forecast service level objective (SLO) violations. Some such systems, methods, and software further include automated detecting and forecasting of SLO violations along with providing alarms, messages, or commands to administrators or system components. Some such messages include diagnostic information with regard to a cause of a SLO violation. Some embodiments further include storing data representative of system performance and detected and forecast system SLO states. This data can then be used to generate reports of system performance including representations of system SLO states.

Abstract: A method and system for protecting an application that implements a communication protocol against exploitation of a communication-based vulnerability is provided. A protection system provides a protection policy that specifies how to recognize messages that expose a specific vulnerability and specifies actions to take when the vulnerability is exposed. A protection policy specifies the sequence of messages and their payload characteristics that expose a vulnerability. The protection system may specify the sequences of messages using a message protocol state machine. A message protocol state machine of an application represents the states that the application transitions through as it receives various messages. The message protocol state machine of the protection policy may be a portion of the message protocol state machine of the application relating to the vulnerability. The protection system uses the message protocol state machine to track the states that lead up to the exposing of the vulnerability.

Abstract: A method and system for creating trace triggers from non-concurrent events, the system comprising: a trace trigger mechanism including: a plurality of multiplexers for breaking down a plurality of signals into a plurality of groups of signals; a pattern match mechanism for matching the plurality of signals to form a plurality of events, and a trace array trigger control block to perform one or more functions on the plurality of independently controlled events in order to create flexible trace trigger controls from non-concurrent events to control the starting and stopping of a data gathering function such as is used to capture trace data.

Abstract: Disclosed is a computer implemented method, computer program product, and apparatus for generating diagnostic data for a thread. A service processor may begin by executing the computer usable program code to allocate a first thread to a monitoring function. The service processor determines if a second thread is running, wherein the second thread is associated with an operation. The service processor obtains an object pointer from a list of running threads, wherein the object pointer references a time data structure associated with the second thread, the time data structure comprising a maximum running time interval and a check time. The service processor calculates the check time as a maximum running time interval added to an initially sampled timestamp. The service processor determines if a current time exceeds the check time. In addition, the service processor generates an error log, responsive to a determination that the current time exceeds the check time.

Abstract: A notification and response system utilizes an administrator interface to transmit an attendance messages from an administrator to a contact devices for guardians, employees, and students associated with an institution. The system comprises a dynamic information database that includes guardian, employee and student contact data, priority information, and response data. The administrator initiates distribution of the attendance message based upon grouping information, priority information, and the priority order. The message is transmitted through at least two industry standard protocol simultaneously to groups of guardian, employee, and student contact devices based upon priority information. Once the attendance message is received by the guardian, employee, or student contact devices, the guardian, employee, and student contact devices transmit a response through the industry standard protocol back to the dynamic information database.

Abstract: The invention includes a method and apparatus for validating system properties exhibited in execution traces. In one embodiment, a method for testing a system under test (SUT) includes determining a system testing result for the SUT using at least one structured term generated by monitoring an execution trace of the SUT using at least one parameterized pattern. A test procedure is executed for the SUT. The test procedure has at least one parameterized pattern associated therewith. An execution trace generated during execution of the test procedure is parsed, where the execution trace includes unstructured information and the execution trace is parsed using the at least one parameterized pattern to identify at least one matching pattern. A system testing result for the SUT is determined using at least one structured term that is generated using the at least one matching pattern. In this manner, behavior of the system under test during the test procedure may be validated.

Abstract: A graphics processing unit has a reduced memory space shadow memory as a source of state information for performing validation of commands. The reduced memory space shadow memory is smaller in size than a full version of state variables associated with an abstract state machine representation of a class of commands received from a software driver.

Abstract: A system and method are disclosed for testing operation of a memory card within an electronic host device. The system includes a flat flexible cable, or strip, for electrically coupling between the memory card slot in a host device and a test assembly. The test assembly may have a card slot for accepting an external memory card, and a debug header for receiving a cable connected to a debug apparatus such as a logic analyzer and/or an oscilloscope.

Abstract: A diagnostic information management system having a field controller which sends diagnostic information indicating contents of a failure which occurs in the field, to a viewer via a network; and the viewer which displays the diagnostic information sent from the field controller, on a screen. The field controller has a storage section which stores diagnostic information that becomes master diagnostic information of the whole system. The viewer compares the diagnostic information held by itself with the master diagnostic information, and obtains the difference diagnostic information from the field controller side.

Abstract: Use of configuration information to specify particular conditions under which trace events are to be logged. When accessing trace events generated by various modules, configuration data is referred to specifying condition(s) under which the trace events should be logged. If the log condition(s) are satisfied, the trace events are logged. Otherwise, they may be discarded. Thus, the number of trace events in the log may be significantly reduced to those trace events that satisfy conditions of interest to an evaluator.

Abstract: A system or method for automated management of compliance of a target asset to a predetermined requirement including receiving a predetermined requirement for compliance testing of one of a plurality of assets, comparing the received predetermined requirement to one or more stored compliance requirements to identify whether one or more stored compliance requirements corresponds to the received predetermined requirement, selecting a target asset from among the plurality of assets, transmitting the new compliance requirement, receiving results responsive to the transmitted new compliance requirement, and validating the received results to determine compliance of the target asset with the predetermined requirement as identified in the received results.

Abstract: To enable easy and quick identification of the location of a fault in a virtualized environment, a physical server 20 is communicatively connected with a management server 10 accumulating and storing a first event history of a history of events having occurred in the virtual server 212 and a second event history of a history of events having occurred in the physical server 20. On receiving an event relating to a fault of a business process 2122 operating in the virtual server 212, the management server 10 searches the event histories as accumulated and stored for the second event history on the virtual server 212 having transmitted the same event and the first event history obtained from the table as stored on the physical server 20 implementing the virtual server 212 having transmitted the event, and identifies a cause of the fault based on a result of the search.

Abstract: A method and system for ordering and aggregating log streams. Log streams for events from different sources are received. If different sources have different recording cycles, or time epochs, that lead to different temporal granularities, then all of the log streams are combined into a single time epoch that is equal to the longest time epoch. Log streams from sources having shorter time epochs continue to retain information about their original time epochs, in order to retain information about the order of the events in those log streams. The log streams are re-ordered, both before and after being integrated into the aggregate log, by acquiring additional data from the different sources, thus permitting the likely cause/effect relationship between events.

Abstract: A data collector for a massively parallel computer system obtains call-return stack traceback data for multiple nodes by retrieving partial call-return stack traceback data from each node, grouping the nodes in subsets according to the partial traceback data, and obtaining further call-return stack traceback data from a representative node or nodes of each subset. Preferably, the partial data is a respective instruction address from each node, nodes having identical instruction address being grouped together in the same subset. Preferably, a single node of each subset is chosen and full stack traceback data is retrieved from the call-return stack within the chosen node.

Abstract: A method for controlling a light signal is provided. The method is suitable for a computer system. The method includes interrupting an original service of the light signal and obtaining the authority to control the light signal. The method also includes controlling the operation of the light signal according to a current status of the computer system.

Abstract: In a method and a device for monitoring and reestablishment of a number of processes in a distributed application environment, wherein each process is associated with a process group and all processes of a process group are functionally dependent on one another, a process can be automatically excepted from the monitoring and automatically admitted again into the monitoring. All processes of a process group are automatically monitored and, in the event that a termination is identified, all processes in the process group are automatically restarted.

Abstract: A method, computer readable medium and computer system for repairing a failed network connection between a client system and a network is disclosed. In a first aspect, the method preferably includes collecting real time connectivity information by the client system and utilizing the real time connectivity information by the client system to establish a connection with the network. In a second aspect, a computer system coupled to a network includes at least one network adapter for monitoring and collecting real time connectivity information from the network, memory for storing the real time connectivity information, and a processor coupled to the memory and to the at least one network adapter, where the processor is configured to execute program instructions for utilizing the real time connectivity information to repair a failed network connection between the computer system and the network.

Abstract: A method and system for ordering and aggregating log streams. Log streams for events from different sources are received. If different sources have different recording cycles, or time epochs, that lead to different temporal granularities, then all of the log streams are combined into a single time epoch that is equal to the longest time epoch. Log streams from sources having shorter time epochs continue to retain information about their original time epochs, in order to retain information about the order of the events in those log streams. The log streams are reordered, both before and after being integrated into the aggregate log, by acquiring additional data from the different sources, thus permitting the likely cause/effect relationship between events.

Abstract: A test system is disclosed wherein a device under test (DUT) includes a trace logic analyzer (TLA) that receives and stores test data. The test system includes both a master tester and a slave tester. The slave tester operates at a high speed data rate substantially faster than that of the master tester. The master tester instructs the TLA to monitor data that the DUT receives from the slave tester to detect a predetermined data pattern within the data. The slave tester transmits data including the predetermined data pattern to the DUT. The DUT receives the data. When the TLA in the DUT detects the predetermined data pattern in the received data, the TLA stores that data pattern as a stored data pattern. The master tester retrieves the stored data pattern and compares the stored data pattern with the original predetermined data pattern. If the master tester determines that the stored data pattern is the same as the original predetermined data pattern, then the master tester generates a pass result.