(12) INTERNATIONAL APPLICATION PUBLISHED UNDER THE PATENT COOPERATION TREATY (PCT)
`
`(19) World Intellectual Property Organization
`International Bureau
`
`11111111111111111111111111111111111111111111111111111111111111111111111111111111
`
`(43) International Publication Date
`30 November 2000 (30.11.2000)
`
`PCT
`
`(10) International Publication Number
`WO 00/72183 A2
`
`(51) International Patent Classification7:
`
`G06F 17/00
`
`(21) International Application Number: PCT/US00/14175
`
`(22) International Filing Date:
`
`23 May 2000 (23.05.2000)
`
`(25) Filing Language:
`
`(26) Publication Language:
`
`(30) Priority Data:
`60/135,492
`
`English
`
`English
`
`24 May 1999 (24.05.1999) US
`
`(71) Applicant (for all designated States except US): CA(cid:173)
`BLETRON SYSTEMS, INC. [US/US]; 35 Industrial
`Way, Rochester, NH 03867 (US).
`
`(72) Inventor; and
`(75) Inventor/Applicant (for US only): LEWIS, Lundy
`[US/US]; 480 Greenville Road, Mason, NH 03048 (US).
`
`(74) Agent: HENDRICKS, Therese, A.; Wolf, Greenfield &
`Sacks, P.C., 600 Atlantic Avenue, Boston, MA 02210 (US).
`
`(81) Designated States (national): AE, AG, AL, AM, AT, AU,
`AZ, BA, BB, BG, BR, BY, CA, CH, CN, CR, CU, CZ, DE,
`DK, DM, DZ, EE, ES, Fl, GB, GD, GE, GH, GM, HR, HU,
`ID, IL, IN, IS, JP, KE, KG, KP, KR, KZ, LC, LK, LR, LS,
`LT, LU, LV, MA, MD, MG, MK, MN, MW, MX, MZ, NO,
`NZ, PL, PT, RO, RU, SD, SE, SG, Sl, SK, SL, TJ, TM, TR,
`TT, TZ, UA, UG, US, UZ, VN, YU, ZA, ZW.
`
`(84) Designated States (regional): ARIPO patent (GH, GM,
`KE, LS, MW, MZ, SD, SL, SZ, TZ, UG, ZW), Eurasian
`patent (AM, AZ, BY, KG, KZ, MD, RU, TJ, TM), European
`patent (AT, BE, CH, CY, DE, DK, ES, Fl, FR, GB, GR, IE,
`IT, LU, MC, NL, PT, SE), OAPI patent (BF, BJ, CF, CG,
`Cl, CM, GA, GN, GW, ML, MR, NE, SN, TD, TG).
`
`[Continued on next page J
`
`(54} Title: SERVICE LEVEL MANAGEMENT
`
`--- ----------------------------------------------------------------------------------
`iiiiiiiiiiiii ------==
`iiiiiiiiiiiii = ---= ---iiiiiiiiiiiii
`iiiiiiiiiiiii -iiiiiiiiiiiii -iiiiiiiiiiiii
`iiiiiiiiiiiii -iiiiiiiiiiiii
`
`iiiiiiiiiiiii
`!!!!!!!!!!!
`
`iiiiiiiiiiiii
`iiiiiiiiiiiii
`
`!!!!!!!!!!!
`
`iiiiiiiiiiiii
`
`iiiiiiiiiiiii
`
`!!!!!!!!!!!
`
`(57) Abstract: Method and apparatus for service level
`management, wherein business processes are composed
`of services. A state of the service is defined by one or
`more service parameters, and the service parameters de(cid:173)
`pend upon performance of network components that sup(cid:173)
`port the service, e.g., component parameters. The state of
`the service may depend, for example, on a collection of
`service parameter values for availability, reliability, secu(cid:173)
`rity, integrity and response time. A service level agree(cid:173)
`ment is a contract between a supplier and a customer that
`identifies services supported by a network, service param(cid:173)
`eters for the services, and service levels (e.g., acceptable
`levels) for each service parameter.
`
`/ ,,
`
`l Business Plocesses
`
`COifiP06Sd of
`
`('•
`
`/'$1.
`
`,,-,
`
`Service lmll Reports
`
`cornpossd of
`
`rJr
`
`ru
`
`,...Jio
`I SeMce ~.evets I
`
`I
`I
`
`/12.
`I Services I
`
`measUtedby
`
`marked by
`
`/IS'
`SeMce Parameters
`
`I
`I
`
`rnapfHid Into
`composed of
`r'i
`~"'"
`I Components moniloredloonttD/Jed "ff Component Parameters I
`
`/sa kind of
`
`monflored/conttDJJed by
`
`1'2.0
`l An Agent I
`
`isaldndol
`
`:n
`1i'llnsmlsslon Device
`Transmission Una ~-~
`Computer System 2A
`Application
`~30
`
`~,,
`
`1-).2..
`
`7.~
`
`Device Agent
`Ttalllc Agent
`,..,
`System Agent
`AppUcallon Agent
`Speclai-Pui'J)0$8 Agent ~')
`1'1\ .. \trc_,...,_, AJ<• -,.~..
`
`ServiceNow's Exhibit No. 1004
`
`001
`
`

`

`WO 00/72183 A2
`
`11111111111111111111111111111111111111111111111111111111111111111111111111111111
`
`Published:
`For two-letter codes and other abbreviations, refor to the "Guid-
`Without international search report and to be republished ance Notes on Codes and Abbreviations" appearing at the begin-
`ning of each regular issue of the PCT Gazette.
`upon receipt of that report.
`
`ServiceNow's Exhibit No. 1004
`
`002
`
`

`

`wo 00/72183
`
`PCT/US00/14175
`
`- 1 -
`
`SERVICE LEVEL MANAGEMENT
`
`BACKGROUND OF THE INVENTION
`
`5
`
`This application claims priority to U.S. provisional Patent Application Serial
`
`No. 601135,492 filed May 24, 1999 entitled METHOD AND APPARATUS FOR SERVICE
`
`LEVEL MANAGEMENT ... by Lundy Lewis.
`
`In the early 1980's, campus-wide computer networks were being installed
`
`principally by universities to enable communication and the sharing of computer resources
`
`I o
`
`between various departments. The networking technology available at that time, and the
`
`scope of deployment were both limited and relatively unsophisticated.
`
`Today, the deployment and maintenance of''enterprise'' networks (i.e., existing
`
`across multiple domains -- e.g., geographical, functional. managerial) occurs on a much
`
`grander scale. The enterprise still consists of network devices, transmission media,
`
`15
`
`computers, and software applications, but there are many more of them and they are
`
`considerably more complex and difficult to manage. Furthermore, enterprises are connected
`
`with other enterprises via the Internet and third-party backbones. and applications are
`
`distributed over all of these. Most global business entities, in addition to large universities,
`
`now employ such sophisticated enterprise networks. Electronic commerce (EC) providers are
`
`20
`
`creating similarly complex global networks, known as "Web server farms'', on which
`
`industries install their Web sites. Industries have to be assured that their customers can
`
`always access their Web sites, that performance will be reasonably good, and that customer
`
`transactions are secure. Management of such distributed Web server farms is yet another
`
`example of the complexities of enterprise management today. Internet service providers also
`
`25
`
`need to manage and provide customers with access to global networks on a 24-hour a day
`
`basis.
`
`SUMMARY OF THE INVENTION
`
`The present invention is directed to various aspects of service level
`
`30 management (SLM), whereby an entity (such as a company, university. Internet service
`
`ServiceNow's Exhibit No. 1004
`
`003
`
`

`

`wo 00/72183
`
`PCT/US00/14175
`
`- 2 -
`
`provider (ISP), electronic commerce (EC) provider, etc.) may, for example, map components
`
`of a network (i.e., network devices, transmission media, computer systems, and applications)
`
`into services in order to assess the state of those services. The state of those services, referred
`
`to herein as service parameters, may include availability. response time, security, and
`
`5
`
`integrity. For example, EC providers need to assess availability-- their customers want their
`
`Web sites to be available at all times. Their users want quick response time-- they do not
`
`want to experience undue delay when retrieving information or moving around screens. They
`
`need to assess security-- customers want to be assured that no intruders (e.g., competitors)
`
`can sabotage their Web sites, and they want to be assured of secure transactions with respect
`
`1 o
`
`to personal information such as credit card numbers. They need to assess integrity -(cid:173)
`
`customers want the words and pictures on the screens to be clear, accurate and visually
`
`interesting.
`
`Providers of network services may include certain guarantees of service level
`
`management in a service level agreement (SLA). The SLA may quantify systems
`
`15
`
`performance, service availability. backup completions and restore times, and problem
`
`resolution metrics. SLAs may provide financial incentives for exceeding requirements and
`
`penalties for failing to meet perfonnance objectives. Performance metrics (service
`
`parameters) for SLAs may be based on availability to the Internet and measurements of Web
`
`site access times. For example. availability may be defined as the total minutes that a Web
`
`20
`
`server is actually available to the public. Access time may be measured on a regional basis
`
`using benchmarking methods.
`
`Based on current networking technology such as packet marking, differential
`
`services, and switched networks, network service providers can offer different levels (grades)
`
`of service in each of these categories, and customers can choose their preferences. If
`
`25
`
`customers want 100% availability, optimal response time, and maximal security and integrity.
`
`then they would pay more. Otherwise, they would pay less. The customer may select specific
`
`time periods over which various service grades are required. Preferably, the customers can
`
`access a service level agreement form on a Web site. and negotiate with the provider the tern1s
`
`of the agreement.
`
`ServiceNow's Exhibit No. 1004
`
`004
`
`

`

`wo 00/72183
`
`PCT/US00/14175
`
`'") - .) -
`
`One aspect of service level management is monitoring of the various computer
`
`systems, network devices and software applications for both real-time display and historical
`
`reporting. A management system should provide visibility into component operational
`
`parameters that provide meaningful information to the IT staff for maintaining network
`
`5
`
`availability and performance.
`
`Another aspect of service level management is event management -- taking
`
`information from the monitoring agents in various embodiments, logging it, filtering it,
`
`correlating it and determining what actions or notifications, if any, need to take place.
`
`Preferably, the output of event management enables the information technology (IT) staff to
`
`1 o
`
`become proactive in preventing service interruptions by identifying and responding to low(cid:173)
`
`impact events that may be precursors to a more serious event that would cause a service
`
`outage.
`
`Another aspect of service level management is the taking of operational data
`
`obtained by the monitoring agents and transforming it into management information to
`
`15
`
`support the needs of both the business and technical operations within the organization. In
`
`various embodiments, service level reports provide an assessment of service parameters and
`
`service levels in a form adapted to the interests of users. IT staff, business owners, EC
`
`provider, etc.
`
`Other elements of network management that may be useful in providing a
`
`20
`
`specific level of service parameters in a service level agreement include:
`
`+ Configuration asset and change management;
`+ Software distribution;
`+ Problem management and automated fault management;
`+ Trend and performance analysis; and
`
`25
`
`+ Security management.
`
`Many businesses have made a large investment in their computer networks.
`
`This investment is sometimes called the total cost of ownership (TCO) regarding the
`
`enterprise. Most businesses. however. have difficulty understanding the extent to which the
`
`ServiceNow's Exhibit No. 1004
`
`005
`
`

`

`wo 00/72183
`
`PCT/US00/14175
`
`- 4-
`
`enterprise network contributes to business profit. By understanding the services provided by
`
`the enterprise and the relation between profit and services (i.e .. total benefits). then the
`
`business owner can calculate a return on investment (ROI). Service level management (SLM)
`
`helps a business owner understand this relationship between expenditures on enterprise
`
`5
`
`components and the return on investment in regard to the operational efficiencies of the
`
`business.
`
`I.
`
`Service Level Management (SLM)
`
`According to one aspect of the invention. a method and apparatus are provided for
`
`I 0
`
`service level management (SLM). In one embodiment. a method of monitoring a business
`
`process compnses:
`
`•
`
`•
`•
`
`determining one or more services upon which the business process
`
`depends;
`
`determining one or more network components upon which the one or
`
`more services depend: and
`
`monitoring the one or more network components .
`
`15
`
`Component parameters are determined for the network components, the
`
`component parameters are monitored and the monitored values mapped into service
`
`20
`
`parameters. Software agents are utilized to monitor the network components. Service levels
`
`are designated for accepted levels of the service parameters. The service levels may be
`
`incorporated in a service level agreement. Periodic service reports are issued pursuant to the
`
`service level agreement indicating whether the designated service levels have been met.
`
`In another embodiment. a data space is provided comprising service
`
`25
`
`parameters, wherein each service parameter represents a performance indicator of one or more
`
`services whose performance depends upon one or more network components. where the one
`
`or more services are included in a business process.
`
`In another embodiment, an integrated management system is provided
`
`comprising service level management (SLM) for monitoring one or more services; and
`
`ServiceNow's Exhibit No. 1004
`
`006
`
`

`

`wo 00/72183
`
`PCT/US00/14175
`
`- 5 -
`
`component management (CM) for managing network components; wherein a business process
`
`is composed of the one or more services. and the services are composed of the network
`
`component. In addition, a business process management (BPM) may be integrated for
`
`managing the business process.
`
`5
`
`In another embodiment. a method of providing service level management is
`
`provided comprising detem1ining services required by a business process, and determining
`
`service parameters marked by service levels for each service.
`
`In another embodiment, a service level management system is provided
`
`wherein a service depends on at least one network component. the system comprising one or
`
`I 0 more agents for receiving component parameters and mapping the component parameters into
`
`service parameters. and a user interface for generating service level reports which include the
`
`mapped service parameters, wherein the component parameters represent a state of at least
`
`one network component.
`
`15
`
`II.
`
`In another aspect of the invention. a method and apparatus are provided for
`
`reactive and deliberative service level management (SLM). In one embodiment. a method for
`
`managing information is provided which comprises:
`+
`
`providing a plurality of monitoring agents for monitoring components
`
`20
`
`25
`
`of a network. each monitoring agent receiving events of a select type
`
`from the network components and resolving such events into alarms;
`
`transmitting the alarms from all monitoring agents to a common
`
`management agent, which resolves the alarms to produce correlated
`
`alarms; and
`
`transmitting the correlated alarms to a common service level
`
`management agent to reason across the network as to causes of the
`
`+
`
`+
`
`events.
`
`ServiceNow's Exhibit No. 1004
`
`007
`
`

`

`wo 00/72183
`
`PCT/US00/14175
`
`- 6-
`
`Events is used broadly herein and may include various operational data from a network
`
`component. including events and statistics. The event may be generated and transmitted
`
`automatically by the network component to an agent monitoring the component. or the agent
`
`may poll the network component for the information. The method may further comprise
`
`5
`
`relating the component information to a service upon which a business process depends, the
`
`component information representing operational data of one or more monitored components.
`
`and further determining a state of the business process based upon the component information.
`
`wherein the component information determines a measured level of service and wherein the
`
`level of service affects the operation of the business process, and further reporting to a user
`
`I 0
`
`information regarding at least one of a group including availability. faults. configuration.
`
`integrity, security, reliability, performance. and accounting of the measured level of service.
`
`In another embodiment, a method of multileveL multi-domain alarm to service
`
`mapping is provided comprising:
`
`15
`
`20
`
`25
`
`(a) conducting intradomain event correlation at a first level, wherein:
`
`input events are received by a monitor provided for each domain:
`
`instructions provide control for each domain; and
`
`input events are interpreted and correlated for each domain:
`
`(b) conducting intradomain alarm-to-service mapping at a second level.
`
`wherein:
`
`input events are received by a monitor provided for each domain:
`
`instructions provide control for each domain; and
`
`input events are interpreted and correlated for each domain: and
`
`(c) conducting interdomain alarm correlation at a third level, wherein:
`
`input events are received by a monitor provided for each domain:
`
`instructions provide control for each domain; and
`
`input events are interpreted and correlated across multiple
`
`domains.
`
`In another embodiment. a multilevel architecture for service level management
`
`30
`
`of a network is provided. the architecture performing the method comprising:
`
`ServiceNow's Exhibit No. 1004
`
`008
`
`

`

`wo 00/72183
`
`PCT/US00/14175
`
`- 7-
`
`+
`
`+
`
`providing a reactive level for monitoring components in the network
`
`to provide service level management: and
`
`providing a next higher level of a more deliberative decision-making
`
`for providing service level management.
`
`In yet another embodiment. a system is provided for managing the network
`
`5
`
`comprising:
`
`an agent operable to receive operational data from at least one
`
`component ofthe netYvork. the at least one component being related to a service on
`
`10
`
`which a business process depends: and
`
`a correlator operable to determine a state of the business process based
`
`upon the operational data. wherein the operational data of the component determines a
`
`measured level of service and wherein the level of service affects the operation of the
`
`business process.
`
`15
`
`In yet another embodiment, a system for managing the network is provided
`
`comprising:
`
`one or more agents operable to receive operational data from at least
`
`one component of the network. the at least one component being related to a service on
`
`which a business process depends. wherein the agent is configured to determine a state
`
`20
`
`of the business process based upon the operational data, wherein the operational data
`
`of the component determines a level of service, and wherein the level of service affects
`
`the operation of the business process.
`
`In a still further embodiment. a method is provided comprising:
`
`providing a plurality of monitoring agents for monitoring components
`
`25
`
`of a network. each monitoring agent receiving events of a select type from the network
`
`and resolving such events into alarms:
`
`transmitting the alarms from all agents to a common management
`
`agent. which resolves the alarms to produce correlated alarms: and
`
`ServiceNow's Exhibit No. 1004
`
`009
`
`

`

`wo 00/72183
`
`PCT/US00/14175
`
`- 8 -
`
`transmitting the correlated alarms to a common service level
`
`management agent to reason across the network as to causes of the events.
`
`III.
`
`5
`
`for SLM
`
`According to another aspect of the invention, a method and apparatus are
`
`provided for event correlation in service level management (SLM). In one embodiment, a
`
`system for providing service level management in a network is provided, wherein a service is
`
`composed of network components and a state of the service depends on the state of the
`
`network components. the system comprising:
`+ multiple monitoring agents to each monitor a respective aspect of
`
`1 o
`
`15
`
`operation of the network, each monitoring agent to detect one or
`
`more events relative to the respective aspect of operation and to
`
`generate an alarm as a function of the one or more detected events;
`
`and
`+ an alarm correlation agent to receive the one or more alarms from
`
`the monitoring agents to determine a state of a service and, if
`
`necessary, to issue one or more instructions to establish a desired
`
`state of the service.
`
`20
`
`In preferred embodiments, the monitoring agents comprise at least one of:
`
`an infrastructure monitoring agent to monitor operation of the network
`
`infrastructure;
`
`a computer system monitoring agent to monitor operation of at least one
`
`computer system on the network;
`
`25
`
`a network traffic monitoring agent to monitor traffic on the network
`
`an application monitoring agent to monitor operation of at least one
`
`application operating on the network;
`
`a trouble-ticketing agent to receive reports of problems by users with
`
`respect to operation of the network;
`
`ServiceNow's Exhibit No. 1004
`
`010
`
`

`

`wo 00/72183
`
`PCT/US00/14175
`
`- 9
`
`a response time monitoring agent to monitor a response time of a
`
`communication on the network;
`
`a device monitoring agent to monitor operation of a device on the
`
`network; and
`
`a multi component monitoring agent comprising an aggregate of any of
`
`the above monitoring agents.
`
`The monitoring agents and alarm correlation agents may be various reasoning agents, such as:
`
`a rule-based reasoning agent:
`
`a model-based reasoning agent:
`
`a state-transition graph based reasoning agent;
`
`a code book based reasoning agent; and
`
`a case-based reasoning agent.
`
`In another embodiment, a system provides service level management in a
`
`network. wherein a service is composed of network components and the state of the service
`
`depends on the state of the network components, the system comprising:
`
`a first monitoring agent to monitor a respective first aspect of operation of the
`
`network, the first monitoring agent to detect one or more events relative to the first
`
`5
`
`10
`
`15
`
`20
`
`aspect of operation and to generate an alarm as a function of the one or more detected
`
`events;
`
`a second monitoring agent to monitor a respective second aspect of operation
`
`of the network. different from the first aspect. the second monitoring agent to detect
`
`one or more events relative to the second aspect of operation and to generate an alarm
`
`25
`
`as a function of the one or more detected events: and
`
`an alarm repository to receive one or more alarms from each of the first and
`
`second monitoring agents.
`
`In another embodiment. a system provides service level management in a
`
`network having at least one monitoring agent to monitor at least one aspect of operation and to
`
`30
`
`generate an alarm as a function of one or more detected events, wherein a service is composed
`
`ServiceNow's Exhibit No. 1004
`
`011
`
`

`

`wo 00/72183
`
`PCT /US00/1417 5
`
`- I 0
`
`of network components and the state of the service depends on the state of the network
`
`components. the system comprising an alarm correlation agent to receive the one or more
`
`alarms from the at least one monitoring agent to determine the state of a service and, if
`
`necessary, to issue one or more instructions to establish a desired state of the service.
`
`5
`
`In another embodiment, a method provides service level management in the
`
`network, wherein the service is composed of network components and a state of the service
`
`depends on the state of the network components. the method comprising:
`
`10
`
`15
`
`monitoring one or more aspects of operation of the network and detecting one
`
`or more events relative to of the one or more aspects of operation;
`
`generating an alarm for a respective aspect of network operation as a function
`
`of the respccti ve detected one or more events: and
`
`correlating the one or more alarms and determining a state of the service as a
`
`function of the correlated alarms.
`
`In another embodiment. a computer program product is provided comprising:
`
`a computer readable medium;
`
`computer program instructions on the computer-readable medium. wherein the
`
`computer program instructions. when executed by a computer. directs the computer to
`
`perform a method of providing service level management in a network. wherein a
`
`service is composed of network components and a state of the service depends on a
`
`20
`
`state of the network components, the method comprising:
`
`monitoring one or more aspects of operation of the network and detecting one
`
`or more events relative to the one or more aspects of operation:
`
`generating an alarm for a respective aspect of network operation as a function
`
`of the respective detected one or more events: and
`
`25
`
`correlating the one or more alarms and determining a state of a service as a
`
`function of the correlated alarms.
`
`In another embodiment. a system provides ser\'ice level management in the
`
`network. wherein the service is composed of network components and a state of the service
`
`depends on the state ofthe network components. the system comprising:
`
`ServiceNow's Exhibit No. 1004
`
`012
`
`

`

`wo 00/72183
`
`PCT/US00/14175
`
`- 11 -
`
`means for monitoring one or more aspects of operation of the network and
`
`detecting one or more events relative to the one or more aspects of network operation:
`
`means for generating an alarm for a respective aspect of network operation as a
`
`function of the respective detected one or more events; and
`
`means for correlating the one or more alarms and determining a state of the
`
`service as a function of the correlated alarms.
`
`In a further embodiment, a system provides service level management in the
`
`network, wherein the service is composed of network components and a state of the service
`
`depends on the state ofthe network components, the system comprising:
`
`multiple monitoring agents to each monitor a respecti\'e aspect of operation of
`
`the network. each monitoring agent to detect one or more events relative to the
`
`respective aspect of operation and generate an alarm as a function of the one or more
`
`detected events; and
`
`5
`
`10
`
`each monitoring agent including an alarm correlation agent to receive one or
`
`15
`
`more alarms from the other monitoring agents for consideration in the step of
`
`generating the alarm as a function of the one or more detected events; and
`
`each monitoring agent including a control agent to issue one or more
`
`instructions regarding the respective aspect of operation of the network in order to
`
`establish a desired state of a service.
`
`20
`
`In another embodiment a computer program product is provided comprising:
`
`a computer readable medium;
`
`computer program instructions on the computer readable medium, wherein the
`
`computer program instructions. when executed by a computer. direct the computer to
`
`perform a method of providing service level management in a network, wherein a
`
`25
`
`service is composed of network components and a state of the service depends on a
`
`state of the network components, the method comprising. for each of a plurality of
`
`agents:
`
`monitoring one or more aspects of the respective operation of the network and
`
`detecting the one or more events relative to the respective one or more aspects of
`
`30
`
`operation:
`
`ServiceNow's Exhibit No. 1004
`
`013
`
`

`

`wo 00/72183
`
`PCT/US00/14175
`
`- 12 -
`
`generating an alarm for the respective aspect of network operation as a function
`
`of the respective detected one or more events; and
`
`communicating with the other agents to access events or alarms in the
`
`respective operation of the other monitoring agent, and correlating these events or
`
`5
`
`alarms from other monitoring agents in the alarm generated for the respective aspect of
`
`network operation.
`
`IV.
`
`Display of SLM
`
`According to another aspect of the invention. a method and apparatus are
`
`I 0
`
`provided for display of service level management (SLM). In one embodiment. a display
`
`comprises an identification of one or more services, a location of the one or more services, a
`
`state of the one or more services, wherein a business process is composed of the one or more
`
`services and the services depend on the operation of one or more components in the network.
`
`In various embodiments. the state may comprise one or more of availability. reliability,
`
`15
`
`performance, fault configuration, integrity and security. According to a method embodiment
`
`for providing service status. the display is provided to users of the service. According to one
`
`embodiment an apparatus comprises a display that indicates a service in the state of a service.
`
`where the service is composed of network components and the state of the service depends on
`
`the state of the network components.
`
`In another embodiment. a method of managing a network is provided
`
`comprising:
`
`+
`+
`
`•
`
`discovery of network components;
`
`root cause analysis to determine a cause of a degradation in the
`
`service due to a degradation in the network; and
`
`providing a business impact analysis for effective services and users.
`
`20
`
`25
`
`The discovery may include discovery of network infrastructure. systems. and
`
`applications resources in the network. The root cause analysis may determine whether a
`
`network degradation is due to the infrastructure, systems or applications resources. The
`
`ServiceNow's Exhibit No. 1004
`
`014
`
`

`

`wo 00/72183
`
`PCT/US00/14175
`
`- 13 -
`
`business impact analysis may include a fault isolation among the infrastructure. systems. and
`
`applications resources. The business impact analysis may' also include the locations of
`
`affected users, and a projected cost of the service degradation. The method may further
`
`include providing physical and logical topological maps detailing the network components
`
`5
`
`and the services. The method may be provided for management of various types of networks.
`
`including enterprise networks, service provider networks, electronic commerce provider
`
`networks, Internet access provider networks, and broadband cable networks. The method may
`
`further include proactively supplying suggested resolutions to the service degradation. The
`
`method may further comprise automatically taking corrective action to correct the service
`
`1 o
`
`degradation. The business impact analysis may include one or more of service reliability.
`
`service availability. service performance, service security, and service integrity.
`
`V.
`
`Component to Service Mapping
`
`According to another aspect of the invention. a method and apparatus is
`
`15
`
`provided for component to service mapping in system level management (SLM). In one
`
`embodiment, a method of determining a state of a service is provided. the service being
`
`composed of network components, and the service affecting operation of a business process.
`
`the method comprising determining the state of one or more of the network components.
`
`Further, the states ofthe network components may be correlated to the services to determine a
`
`20
`
`net state at a designated time of the service. The net state of the service may include an
`
`intended or scheduled state degradation.
`
`According to another embodiment. a method provides for monitoring a state of
`
`a service, the service being composed of components of a network. and the service affecting
`
`operation of the business process, the method comprising:
`
`25
`
`monitoring the network components to determine the state of the service, and
`
`\vhen the state of the service is degraded, determining a cause of the degraded service
`
`by performing one or more of:
`
`testing the components,
`
`querying a database,
`
`30
`
`modifying the components, and
`
`ServiceNow's Exhibit No. 1004
`
`015
`
`

`

`wo 00/72183
`
`PCT/US00/14175
`
`- 14-
`
`implementing a reasoning algorithm.
`
`In another embodiment, a method provides monitoring a state of a service
`
`defined by service parameters, wherein the service is composed of network components and
`
`the service affects operation of a business process, the method including monitoring and
`
`5
`
`controlling the service parameters by monitoring and controlling component parameters of the
`
`network components. wherein the component parameters are mapped to the service
`
`parameters.
`
`According to another embodiment. a system is provided for determining a state
`
`of the service. the service being composed of network components. and the service affecting
`
`I 0
`
`operation of a business process. the system comprising agents for monitoring and determining
`
`the state of one or more of the network components. The system may comprise a correlator
`
`for receiving the state of the one or more network components and correlating the same to
`
`determine a net state. at a designated time. of the service. The system may include a scheduler
`
`for implementing an intended degradation of the state of one or more of the network
`
`15
`
`components and communicating the intended degradation to the correlator. Each of the
`
`monitoring agents may correlate events to alarms for its respective network components. and
`
`the correlator may receive alarms from the monitoring agents.
`
`20
`
`25
`
`VI.
`
`Service Analysis
`
`According to another aspect of the invention, a method and apparatus are
`
`provided for service analysis in service level management (SL~1). In one