(12) United States Patent
`Scarpelli et al.
`
`(16) Patent N6;
`(45) Date of Patent:
`
`US 6,816,898 B1
`Nov. 9, 2004
`
`US006816898B1
`
`(54) INTERFACING EXTERNAL METRICS INTO
`A PERFORMANCE MANAGEMENT SYSTEM
`
`
`
`
`
`(75) Inventors: Joe ScarPelli, Mountain VieW, CA . -
`
`5,748,881 A * 5/1998 Lewis et a1. ................ .. 714/47
`5,796,633 A * 8/1998 Burgess et a1. ........... .. 702/187
`5,819,028 A * 10/1998 Manghirmalani et a1.
`714/57
`
`,
`
`,
`
`
`
`2 * *
`
`
`
`ghaplgelle ~~~~~~~~~~~~~~~~~ ~~ rom erg .... ..
`
`(Us)? Sndhar Sodem’ Santa Clara’ C_A
`(US), Atul Garg; Saratoga, CA (US),
`Alex LeFalve, Sunnyvale’ CA(US)>
`Rajesh Badhe; San Jose; CA (US)
`
`.
`
`_
`
`(73) Assignee: ProactiveNet, Inc.; Alviso; CA (US)
`
`( * ) Notice:
`
`Subject to any disclaimer, the term of this
`patent is extended or adjusted under 35
`U.S.C. 154(b) by 578 days.
`
`(21) APP1-N0~309/640a967
`(22) Filed
`Aug- 16 2000
`'
`’
`(51) Int. Cl.7 ............................................ .. G06F 15/173
`(52) US. Cl. ........................ .. 709/224; 709/223; 714/47
`(58) Field Of Search ............................... .. 709/223, 224;
`714/47
`
`56
`(
`)
`
`References Cited
`
`U.S. PATENT DOCUMENTS
`
`6,327,677 B1 * 12/2001 Garg et a1. . . . . . . .
`6 405 327 B1 * 6
`.
`2002/0013748 A1 * 1/2002 Edmison et a1. ............ .. 705/35
`
`,
`
`,
`
`/2002 Sipple et a1. . . . . . . . . .
`
`. . . .. 714/39
`
`. . . .. 714/37
`
`* cited by examiner
`
`Primary Examiner—Nabil El-Hady
`(74) Attorney, Agent, or Firm—Blakely, Sokoloff; Taylor &
`Zafman LLP
`
`(57)
`
`ABSTRACT
`
`A method and apparatus for network management is
`described. In one embodiment, a method comprises collect
`ing performance data having accompanying meta data
`including information de?ning the performance manage
`ment data and information indicating Operations to be per
`formed on the Performance management data, and generat
`ing output data for display using collected performance
`management data according to the information indicating
`the operations to be performed on the performance manage
`ment data.
`
`5,506,955 A * 4/1996 Chen et a1. ................. .. 714/26
`
`12 Claims, 12 Drawing Sheets
`
`130
`(
`
`150
`l
`
`14‘0
`Service
`Network
`Monitor
`TM
`M t API
`e a + (e.g., Action + Monitor
`Request sys)
`
`110
`
`Sc?pbbased
`Program
`(Gilli/ah)
`
`reme .
`
`120
`
`Polling Rate, lP
`Address, Names &
`Types & Units of
`lnput Parameters
`& Output Variables
`
`Customized
`Graphs
`
`Customized
`Reports
`
`Meta Data
`& User-de?ned
`Data Collected
`by the Service
`Monitor
`
`Network Monitor Collects Meta
`Data & Data De?ned by
`Script-based Programs
`Usin the Service Monitor
`g
`
`170
`
`160
`1
`
`5
`
`.
`
`.
`
`New“
`Compnstng of a
`Plurahty of
`corp?peqlsn
`(e'9"DepP ‘ca '0 5'
`S
`“west
`ervefs, e 0-)
`
`ServiceNow's Exhibit No. 1001
`
`001
`
`

`
`U.S. Patent
`
`Nov. 9, 2004
`
`Sheet 1 0f 12
`
`US 6,816,898 B1
`
`vtoiwz
`
`8.50
`
`{0202
`
`6:82
`
`ServiceNow's Exhibit No. 1001
`
`002
`
`

`
`U.S. Patent
`
`Nov. 9, 2004
`
`Sheet 2 0f 12
`
`US 6,816,898 B1
`
`22
`I
`
`31
`)
`
`Network Monitor
`
`30
`l
`Data
`———> Collection
`Module
`___l
`34
`\
`Cognitive
`.
`Srgnature
`Module
`
`Analysis
`Module
`
`I
`38
`
`FIG. 2
`
`32
`l
`Data
`Reduction
`Module
`
`36
`/
`
`Storage
`-
`Dev'ce
`
`Alarm
`Generator
`
`l
`40
`
`ServiceNow's Exhibit No. 1001
`
`003
`
`

`
`ServiceNow's Exhibit No. 1001
`
`004
`
`

`
`U.S. Patent
`
`Nov. 9, 2004
`
`Sheet 4 0f 12
`
`US 6,816,898 B1
`
`§Hbinlsh
`# Copyright: @ 1999 ProactiveNet Inc.
`ti File : remedysh
`# Description : Returns information on the Remedy ARS Service Monitor
`# Author : Steven Snyder
`2 Date : $Date: 1999/06/24
`# This saint takes the foitowing parameters:
`# USER ME- Remedy user iogin
`it PASSWORD: The users password
`1; SERVER: The ip address of the Remedy ARS server
`
`#
`
`# This example executes a binary, passing the usemame, password, sewer to connect to. and the commands
`# to execute. The binary iogins into the server, executes the commands and echoes the data to standard out
`# where it's read by the ProactiveNet s tern.
`#
`etcI ......................................................... .i .................................. .I #
`undies -a
`RESPGNSESCRIPT=lusriarlapiisrcldriverldriver1 .ih
`CONFIGSCRIPT=lusrlarlapiIsroldriverldriverZin
`DRIVER=lusrlarlapilsrcldriverldriver
`CAT-:Ibinlcat
`ECHO-echo # sheii buitt-in
`
`PATH=/binJusrlbin:lusr/sbinJetc
`export PATH
`prognarne='basename $0‘
`
`if[$# -tt 5 1
`then
`$ECHO ‘usage $progname -[oon?glstat1 <ip> <timeout> <usemarne>
`<password>' >&2
`exit 1
`ti
`
`SERVER=$2
`USERNAME=$4
`PASSWORD=$5
`
`n
`gDRiVER $USERNAME $PASSWORD $SERVER $RESPONSESCRIPT
`
`#
`
`g1IB$1I : I en
`gDRtVER SUSERNAME SPASSWORD SSERVER $RESPONSESCRIPT
`exitO
`
`FIG. 4
`
`ServiceNow's Exhibit No. 1001
`
`005
`
`

`
`U.S. Patent
`
`Nov. 9, 2004
`
`Sheet 5 0f 12
`
`US 6,816,898 B1
`
`QIEHE
`
`E
`
`Administration Console
`Qreale _E_dit Iools
`E3 Root
`0=lj Device
`Kg a'ef’xps
`0=lj Health Report
`o-lj AlarmThreshold
`0U A]
`am‘Ru'es
`0=E3 User
`9.5 Advanced
`
`_
`Application Monitor Plug-in Registration
`‘Xenon R equesl Sys
`DlSKlNFO
`mgmbero?sfs
`be‘ mu
`Oracle Ver and SGA
`SAR DISKIOSTAT
`F
`$AR__CPU_lN O
`SAR_MEM_3NFO
`Web Sewer PerlMon
`
`Add
`Edit
`IWamlng: Applet Vl?ndow
`
`Delete
`
`Cancel
`
`I
`
`[Wamingz Applet Window
`
`l
`
`M
`
`FIG. 5
`
`ServiceNow's Exhibit No. 1001
`
`006
`
`

`
`ServiceNow's Exhibit No. 1001
`
`007
`
`

`
`U.S. Patent
`
`Nov. 9, 2004
`
`Sheet 7 0f 12
`
`US 6,816,898 B1
`
`@ Application Monitor Plug-in De?nition
`
`Action Request Sysl
`:emadysh
`
`Cl RequiresRemute?‘qent(Mustnanontnmiavioevlmkrhi?slauwhadagainst).k
`I L_azout Panmnm ][ Output Con?guration m: ‘1%.! Statistics Variabtes}
`cm?gumvonouwvanablesamexpsdadmemmedbymmnauemcnnlgmm pom.
`each on a savanna line va‘ih variabl: nama followed by value (can : VARIABLE NAME=va|ue)
`Theaboveprogramwibbadedasln?msonoonfqura?mdampolu
`
`Script w?gdpaddrwdnmubbllowd by any input parameters mm use! has entered.
`con?gurationdatavatiableswpdledfumaday lypically.Anexampleo1a (‘m?gumlim
`vmuessvm ofme appiica?on naming.
`.
`Con?guration dataismishownhyaphs bulisrepomble.
`
`Name
`'DBTYPE
`?msoussnucsass
`
`Type
`Unit
`1 gm l I
`] [Sting
`l l
`
`ommwm
`|
`I
`l L
`
`lssnvzaucense
`
`J isms
`
`B F
`
`I
`
`l
`
`lvsRslou
`
`Hlsv'w
`I I
`l
`I
`@@
`DEE
`
`FIG. 6B
`
`1~
`
`|
`l
`
`l
`
`| v
`
`ServiceNow's Exhibit No. 1001
`
`008
`
`

`
`U.S. Patent
`
`Nov. 9, 2004
`
`Sheet 8 0f 12
`
`US 6,816,898 B1
`
`E App?ca?m Monitor Plug-in De?nition
`
`I'J Requires RemoieAgemIMustnm on modowoowmoh it's launched ogamuig
`
`Action Request 873
`remedysh
`
`sla?s?wwmvanablesareexpadsdbbemmbymexewtabbmsta?s?cs polls.
`each on a separate van'ahb name Io?md by vaiue (9.9.. : VARIABLE NAME=vdue)
`Tleabovepmgramw?lbehvokadasfolmonshtis?cdatapo?s.
`
`suimstaldpaddmsswnmfollouad by any hpul pammws which user has entered,
`
`Smistics data variables are polied (or many ?mes a day typical" (i.e.. every 15 mmuies).
`Anexampleofasm?s?mvadabb'sresme?n'cofmappica?onmm.
`Statistic: data issmwningaphsmalamswbegenemedbasedm?wi'vame.
`
`Name
`FaAoPAsswoRo
`Icuansmusens
`
`Type
`Unit
`I {moor 1 [1:
`I “Integer
`I I8
`
`Defauitvaiue
`Id In
`lvl I0
`
`IFULLTEXTFIXEDUC
`
`I “integer
`
`I i#
`
`IFULLTEXTFLOATLIC
`
`J linmer
`
`I I!‘
`
`Irumexmoneuc
`
`I ?mrooor J I»
`
`l'l N
`
`['1 1°
`
`IvI I0
`
`IRESPONSETIME
`
`{Somme
`IWRITEFIXEOUG
`
`| HIntager
`
`I W k] I0
`
`llllnww Ilsa
`I “@9934! I?
`
`MI?
`1'] R
`
`IWRITEFLOATING us
`
`I I||mogor__I Is
`
`IvJ I0
`
`IwRnEREAu-oNLYuc
`
`lllnmer ! |#
`
`1'1 [9
`
`I
`
`|
`
`Moreva?abies II Lmsva?abiesj
`E@
`
`IWamingzAppIe! Wimow
`
`.
`
`FIG. 6C
`
`‘
`
`I
`I
`
`I
`
`I
`
`I
`
`l
`
`W E
`l
`
`I
`
`l v
`
`ServiceNow's Exhibit No. 1001
`
`009
`
`

`
`U.S. Patent
`
`Nov. 9, 2004
`
`Sheet 9 0f 12
`
`US 6,816,898 B1
`
`5 Administration Console
`Qreate Edit Iools
`1:! Root
`(5) [3 Device
`®=lj 20720.9 M"
`Add SNMP M0
`
`m
`‘3
`
`Edit
`Delete
`
`e’g Lab-mitt;
`@-
`acsserve
`@123 aoi-i16.w
`0,6 cbsys?
`@qj dbsewer_
`O=lj joes
`©=tj titespeedproactivenetcom
`o=lj ntsserverproactivenetcom
`0=[j server_207.20.93.152
`o-lj stanproactivenetcom
`®=Ej wss4.proactivenet.oom
`©=tj www.amazon,com
`(5H3 WWW-ibm-wm
`é’? wwwc‘cnn'com
`0»
`roups
`0,‘: Wew
`9,5 Hea?h Report
`0=ij AlarmThreshoid
`©=Ej AiarmRules
`O’Ej use’
`EAdxanced
`
`1?;
`Add BOOTP/DHCP Monitor
`Add Checkpoint FireWaii Monitor
`
`Add DNS Monitor
`.
`Add Ft Mo t
`p m m.
`Add iMAP4 MO?itOf
`Add informix/ 3 Monitor
`Add LDAP Monitor
`Add MS_SQL Server Monitor
`Add NFS M .t
`Add NNTP :1'“ c,"
`omtor
`Add Netw°rk N°de
`Add NumberOfFiles Monitor
`Add NumberOfUsers Monitor
`Add Oracle 8 Monitor
`.
`Add POP3 Monitor
`Add Port Monttor
`Add Radius Monitor
`Add SMTP Monitor
`Add Sybase % Monitor
`
`Add Web Transaction Monitor
`Add Xserver Monitor
`
`lwaming: Appiet Window
`
`FIG. 7
`
`ServiceNow's Exhibit No. 1001
`
`010
`
`

`
`U.S. Patent
`
`Nov. 9, 2004
`
`Sheet 10 0f 12
`
`US 6,816,898 B1
`
`E
`Qreate Edit {001%
`{3 Root
`9 :1 Device
`Q G 207.20.90.100
`9 (3 Action Request Sys Moniior
`Q E3 Action Request Sys
`_
`D ARS
`E
`o-l‘j Network Node
`ep? NumberOfUsers Monitor ——-—-——-
`0-13 Lab_router1.proactivanetcom
`J cm?guraum I 9011"“ \
`0=lj acsservaproactivenetcom
`0- I: aol-i16.websys.aol.com
`
`Q-Cj CPU dbservenpruac?vanetoom
`0,6 i095
`0- lj litespeedproactivenetoom
`erg nfsservenproac?venetcom
`0’
`server_207.20.93.152
`O-lj stanproac’dveneLcom
`O-C'j wss4.proactivenewom
`O-E? www.mlazonnom
`0d: wwwjbmmm
`e-ggul'mo'mmm
`9’: “a”
`0- (:1 Heath Report
`9-1: AlaxmThreshcld
`3% 23am
`
`_
`FIX“ User
`tnstanoe Name IARS
`Server License Server
`
`Version a2
`Password I
`Usemame [ssnyder
`
`4
`
`lwaming: Applet \Mndow
`
`I Warning: Qplet Window
`
`FIG. 8
`
`A
`
`u
`
`f
`
`n
`
`I
`
`I
`
`ServiceNow's Exhibit No. 1001
`
`011
`
`

`
`U.S. Patent
`
`Nov. 9, 2004
`
`Sheet 11 0f 12
`
`US 6,816,898 B1
`
`g ProactiveNet - Netscape
`
`ProactiveNe! Guard
`
`Grwp FIRE
`summary
`
`WM
`w
`
`a
`
`5
`
`4
`
`a 3
`2
`1
`
`207.2093198/ARS
`Wednesday 0811111999 :0 Thursday 08/12/1999
`
`zsomo
`
`mm
`
`2500000
`
`_\
`
`3
`
`‘°°°°°°
`W
`
`Zoomin-Om
`Axis E]
`Maxvaluml
`MM“: l:_
`
`' q) qbéml. ".13, 5. n
`01)
`
`4* 4*
`4* v“ v“
`v“
`<3‘ 0”“ $9 84* a? $5’ a? 039 e‘? 84$ 69 @‘9 <9’
`|—- cuRmnusERs --— RssPousErmE I
`
`DB TYPE 11x21: USERLICENSEInstIm: name SERVER ucsrqss SounxlP vmsaon pasmn‘luscmlmc
`SQL~SybascllO
`was
`IScrvet
`lmzosnszisz
`‘None ‘ssnyde:
`
`0L“) 01mm:
`
`2M1‘.
`mm Hem
`WabServePerformanca
`Monitorigg
`a_zu1
`|
`‘ Custom Gfaphs
`I
`lHeallh Ravens
`)
`(Adminimtim
`M3 Customize Graph ‘'0! 2011033198 ARS
`l3 FULLTEXT FIXED uc
`‘i: 52] CURRENT USERS
`1] FULL TEXT no»: 1.10 [I FULLTEXT NONE uc m assponsm'mm
`
`S -.- -' m Page
`
`Su?sm
`
`A P'm'VeNet
`
`(Max 4)
`
`El mum FIXED uc C1 WRITE FLOATING LIC
`C] 50]. DB TIME
`E] wmrs nun-ONLY me
`
`D Bndine
`
`C] an:
`
`vFIG. 9
`
`ServiceNow's Exhibit No. 1001
`
`012
`
`

`
`ServiceNow's Exhibit No. 1001
`
`013
`
`

`
`US 6,816,898 B1
`
`1
`INTERFACING EXTERNAL METRICS INTO
`A PERFORMANCE MANAGEMENT SYSTEM
`
`FIELD OF THE INVENTION
`
`The present invention pertains to the ?eld of network
`management. More particularly, this invention pertains to
`the ?eld of interfacing With netWork management.
`
`BACKGROUND OF THE INVENTION
`
`NetWorks are used to interconnect multiple devices, such
`as computing devices, and alloW the communication of
`information betWeen the various interconnected devices.
`Many organiZations rely on netWorks to communicate infor
`mation betWeen different individuals, departments, Work
`groups, and geographic locations. In many organiZations, a
`netWork is an important resource that must operate effi
`ciently. For eXample, netWorks are used to communicate
`electronic mail (e-mail), share information betWeen
`individuals, and provide access to shared resources, such as
`printers, servers, and databases. A netWork failure or inef
`?cient operation may signi?cantly affect the ability of cer
`tain individuals or groups to perform their required func
`tions.
`A typical netWork contains multiple interconnected
`devices, including computers, servers, printers, and various
`other netWork communication devices such as routers,
`bridges, sWitches, and hubs. The multiple devices in a
`netWork are interconnected With multiple communication
`links that alloW the various netWork devices to communicate
`With one another. If a particular netWork device or netWork
`communication link fails, multiple devices, or the entire
`netWork, may be affected.
`NetWork management is the process of managing the
`various netWork devices and netWork communication links
`to provide the necessary netWork services to the users of the
`netWork. Typical netWork management systems collect
`information regarding the operation and performance of the
`netWork and analyZe the collected information to detect
`problems in the netWork. For eXample, a high netWork
`utiliZation or a high netWork response time may indicate that
`the netWork (or a particular device or link in the netWork) is
`approaching an overloaded condition. In an overloaded
`condition, netWork devices may be unable to communicate
`at a reasonable speed, thereby reducing the usefulness of the
`netWork. In this situation, it is important to identify the
`netWork problem and the source of the problem such that the
`proper netWork operation can be restored.
`The operations performed by the netWork management
`system are often controlled via softWare on one or more
`computer systems. Typically, in the prior art, a determination
`is ?rst made to determine What the application is and then
`softWare is created to control hoW to administer it, hoW to
`control it, hoW to con?gure it, and hoW to display it. The
`result is softWare that is very speci?c to the types of data that
`is being collected, stored, analyZed and displayed. Because
`of this, there is neW code Written for each application and
`stored for use in the system. As developing such softWare is
`time consuming and expensive, it Would be advantageous to
`reduce the amount of softWare development in netWork
`management systems.
`Furthermore, typical computer netWork management sys
`tems collecting data from components Within a netWork,
`these netWork management systems usually collect typical
`infrastructure information only, such as server response
`time, and netWork parameters such as packets transmitted,
`
`15
`
`25
`
`35
`
`40
`
`45
`
`55
`
`65
`
`2
`packets lost, etc. They do not collect speci?c business
`oriented data useful in commercial applications. In fact,
`management or business-oriented data is usually neglected
`by current netWork management system. For example, a
`typical netWork management system does not keep track of
`the number of tickets sold in an airline’s Web site, even
`though the statistics on the number of tickets sold Would be
`very useful to an airline using the netWork management
`system. In this situation, the company usually has its oWn
`netWork management staff to generate a script-based pro
`gram to collect this particular piece of information, in
`addition to the data already collected by the system installed.
`Although the script-based program is relatively simple to
`generate, additional effort is required to integrate the cus
`tomiZed data collected (e. g., the number of tickets sold in the
`airline’s Web site) With the typical data collected by the
`netWork management system. Even more effort and time is
`required to analyZe these different types of data in order to
`maintain the netWork and to troubleshoot.
`
`SUMMARY OF THE INVENTION
`
`In one embodiment, a method comprises collecting per
`formance data having accompanying meta data including
`information de?ning the performance management data and
`information indicating operations to be performed on the
`performance management data, and generating output data
`for display using collected performance management data
`according to the information indicating the operations to be
`performed on the performance management data.
`
`BRIEF DESCRIPTION OF THE DRAWINGS
`
`The invention is illustrated by Way of eXample and not
`limitation in the ?gures of the accompanying draWings, in
`Which like references indicate similar elements, and in
`Which:
`FIG. 1 illustrates an embodiment of a netWork environ
`ment.
`FIG. 2 illustrates and embodiment of a netWork monitor
`capable of detecting problems or potential problems in a
`netWork environment.
`FIG. 3 illustrates a data How diagram of monitoring
`system for monitoring a netWork of components.
`FIG. 4 is an eXample of a script-based program, provided
`to the claimed invention.
`FIG. 5 shoWs an eXemplary embodiment of an adminis
`tration console WindoW displayed to alloW the user to
`register the script-based program as a service monitor in a
`netWork monitor.
`FIG. 6A shoWs an eXemplary embodiment of the appli
`cation monitor plug-in de?nition WindoW, With an “Input
`Parameters” page displayed.
`FIG. 6B shoWs an eXemplary embodiment of the appli
`cation monitor plug-in de?nition WindoW, With an “Output
`Con?guration Variables” page displayed.
`FIG. 6C shoWs an eXemplary embodiment of the appli
`cation monitor plug-in de?nition WindoW, With an “Output
`Statistics Variables” page displayed.
`FIG. 7 shoWs an eXemplary embodiment of an adminis
`tration console WindoW With a neW service monitor added.
`FIG. 8 shoWs an eXemplary embodiment of an adminis
`tration console WindoW to activate a service monitor.
`FIG. 9 shoWs a graph generated by a netWork monitor of
`the data collected using an action request system monitor.
`FIG. 10 illustrates an embodiment of a computer system
`that can be used With the present invention.
`
`ServiceNow's Exhibit No. 1001
`
`014
`
`

`
`US 6,816,898 B1
`
`3
`DETAILED DESCRIPTION
`A method and apparatus for performance monitoring and
`management in a networked environment is described. In
`the following description, numerous details are set forth to
`provide a thorough understanding of the present invention.
`It Will be apparent, hoWever, to one skilled in the art, that the
`present invention may be practiced Without these speci?c
`details. In other instances, Well-knoWn structures and
`devices are shoWn in block diagram form, rather than in
`detail, in order to avoid obscuring the present invention.
`Some portions of the detailed descriptions that folloW are
`presented in terms of algorithms and symbolic representa
`tions of operations on data bits Within a computer memory.
`These algorithmic descriptions and representations are the
`means used by those skilled in the data processing arts to
`most effectively convey the substance of their Work to others
`skilled in the art. An algorithm is here, and generally,
`conceived to be a self-consistent sequence of steps leading
`to a desired result. The steps are those requiring physical
`manipulations of physical quantities. Usually, though not
`necessarily, these quantities take the form of electrical or
`magnetic signals capable of being stored, transferred,
`combined, compared, and otherWise manipulated. It has
`proven convenient at times, principally for reasons of com
`mon usage, to refer to these signals as bits, values, elements,
`symbols, characters, terms, numbers, or the like.
`It should be borne in mind, hoWever, that all of these and
`similar terms are to be associated With the appropriate
`physical quantities and are merely convenient labels applied
`to these quantities. Unless speci?cally stated otherWise as
`apparent from the folloWing discussion, it is appreciated that
`throughout the description, discussions utiliZing terms such
`as “processing” or “computing” or “calculating” or “deter
`mining” or “displaying” or the like, refer to the action and
`processes of a computer system, or similar electronic com
`puting device, that manipulates and transforms data repre
`sented as physical (electronic) quantities Within the com
`puter system’s registers and memories into other data
`similarly represented as physical quantities Within the com
`puter system memories or registers or other such informa
`tion storage, transmission or display devices.
`The present invention also relates to apparatus for per
`forming the operations herein. This apparatus may be spe
`cially constructed for the required purposes, or it may
`comprise a general purpose computer selectively activated
`or recon?gured by a computer program stored in the com
`puter. Such a computer program may be stored in a computer
`readable storage medium, such as, but is not limited to, any
`type of disk including ?oppy disks, optical disks,
`CD-ROMs, and magnetic-optical disks, read-only memories
`(ROMs), random access memories (RAMs), EPROMs,
`EEPROMs, magnetic or optical cards, or any type of media
`suitable for storing electronic instructions, and each coupled
`to a computer system bus.
`The algorithms and displays presented herein are not
`inherently related to any particular computer or other appa
`ratus. Various general purpose systems may be used With
`programs in accordance With the teachings herein, or it may
`prove convenient to construct more specialiZed apparatus to
`perform the required method steps. The required structure
`for a variety of these systems Will appear from the descrip
`tion beloW. In addition, the present invention is not
`described With reference to any particular programming
`language. It Will be appreciated that a variety of program
`ming languages may be used to implement the teachings of
`the invention as described herein.
`
`1O
`
`15
`
`25
`
`35
`
`40
`
`45
`
`55
`
`65
`
`4
`Amachine-readable medium includes any mechanism for
`storing or transmitting information in a form readable by a
`machine (e.g., a computer). For example, a machine
`readable medium includes read only memory (“ROM”);
`random access memory (“RAM”); magnetic disk storage
`media; optical storage media; ?ash memory devices;
`electrical, optical, acoustical or other form of propagated
`signals (e.g., carrier Waves, infrared signals, digital signals,
`etc.); etc.
`OvervieW
`In the present invention, generic modules, as Well as the
`data storage, receive data and are able to process the data
`using information that accompanies the data. Thus, the data
`is fed into module, regardless of its type, from the environ
`ment that created it. A meta data de?nition accompanies the
`data and indicates What it is that is being collected and What
`is to be done With the data being collected. For eXample, the
`meta data may indicate that an alarm is to be associated With
`the data or may indicate hoW to administer. Thus, in order to
`enable or add a neW application to monitor a neW element,
`the module that obtains the data and returns a value and
`de?ne What is to be done With the data. Then, the others
`modules, such as the stage module, the analysis module and
`the presentation module understand What is de?ned in the
`data to take the corresponding operations or actions, based
`on the meta data that indicates What operations or actions to
`perform on or With the data.
`For eXample, the user interface may change by What is in
`the meta data. Thus, While one application may shoW 4
`variables, the receipt of neW data With different meta data
`may result in the display of 19 variables. The same can be
`said about hiding variables. Thus, the only inputs that are
`needed to collect data and the meta data indicating the
`operations to be performed on the collected data. In other
`Words, the system takes in arbitrary data and user interface
`is able to display it.
`The modules that receive and process the data are part of
`a performance management system. In one embodiment, the
`performance management system comprises an e-business
`performance management system. The performance man
`agement system may monitor the netWork as Well as appli
`cations. In one embodiment, the performance management
`system provides real time monitoring of Internet transaction
`performance to address the reliability and responsiveness of
`on-line businesses to their customers and partners. The
`system characteriZes overall end-to-end e-transaction
`response time and response times doWn to the sub
`transaction level, so that quick isolation of hot spots and
`bottlenecks can be detected. The system also identi?es
`response times at the e-commerce sub-transaction level, the
`Web app server level, and the underlying database levels, as
`Well as for performance variables at the device level for the
`netWork, load balancers, ?reWalls and servers.
`In one embodiment, scripts or other applications may be
`incorporated into the system. For eXample, scripts matter to
`perform performance monitoring or management may be
`used and incorporated into the system. An API enables easy
`integration of custom scripts that have been Written to gather
`speci?c information and useful business metrics, including
`site traf?c, orders received, abandoned orders and sales.
`In one embodiment, a graphical user interface is used to
`enable to de?ne the name of the application, the script of
`application, along With a set of attributes (e.g., input, output,
`etc.). The user’s program must generate the output.
`Ameta application programming interface (API) provides
`a user interface for the performance management system,
`netWork performance monitoring and management. It alloWs
`
`ServiceNow's Exhibit No. 1001
`
`015
`
`

`
`US 6,816,898 B1
`
`5
`the user to rapidly and directly integrate one or more
`script-based programs into network performance monitoring
`and management. The data types de?ned in the script-based
`programs will be incorporated into the data of network
`performance monitoring and management. Thus, it saves the
`user time and effort in integrating and analyzing the data
`with meta data.
`FIG. 1 illustrates an embodiment of a network environ
`ment in which the present invention can be implemented.
`The network environment of FIG. 1 contains multiple net
`work devices coupled to one another using a pair of net
`works 10 and 12. In particular, a pair of workstations 14 and
`a pair of servers 16 are coupled to network 10. Additionally,
`a printer 18 and a network monitor 22 are coupled to
`network 10. A network device 20 (such as a router, bridge,
`switch or gateway) is coupled to both network 10 and
`network 12. Network device 20 allows network data to be
`exchanged between network 10 and network 12, thereby
`allowing network devices coupled to network 10 to com
`municate with other network devices coupled to network 12.
`Another pair of workstations 14 and a server 16 are also
`coupled to network 12. Although FIG. 1 shows four work
`stations and three servers, a particular network environment
`may contain any number of workstations, servers, printers,
`or other network devices interconnected with one another in
`any con?guration. Networks 10 and 12 may use any com
`munication protocol and may utiliZe any network topology.
`Additionally, network 10 and network 12 may use different
`protocols and different network topologies. If different pro
`tocols or different topologies are used, then network device
`20 is required to translate or otherwise convert data between
`the two different protocols or two different topologies.
`Network monitor 22 is coupled to network 10, but is
`capable of monitoring network devices, interfaces, and
`communication links associated with network 10 as well as
`network 12. Network monitor 22 is also able to monitor the
`operation and performance of various sub-systems,
`components, or applications contained within a network
`device. For example, network monitor 22 can monitor the
`CPU performance, memory utiliZation, and application
`response time of workstations and servers contained in the
`network environment. Although a single network monitor 22
`is shown in FIG. 1, in an alternate embodiment of the
`invention, a separate network monitor is coupled to network
`12. In this embodiment, network monitor 22 monitors net
`work devices, interfaces, and communication links associ
`ated with network 10, while the network monitor coupled to
`network 12 monitors network devices, interfaces, and com
`munication links associated with network 12. In other
`embodiments of the invention, a single network monitor 22
`is capable of monitoring network devices, interfaces, and
`communication links associated with three or more different
`networks.
`FIG. 1 illustrates an exemplary network environment.
`Those of ordinary skill in the art will appreciate that the
`teachings of the present invention can be used with any
`number of network environments and network con?gura
`tions. Furthermore, the teachings of the present invention
`can be used to monitor any network device, system,
`component, or application for which information can be
`gathered, either directly or indirectly. Additionally, the
`present invention is capable of monitoring any communica
`tion link or interface within a network or between a network
`and a network device. Although FIG. 1 illustrates network
`monitor 22 as a separate network device, network monitor
`22 may be incorporated into another network device, such as
`server 16.
`
`10
`
`15
`
`20
`
`25
`
`30
`
`35
`
`40
`
`45
`
`50
`
`55
`
`60
`
`65
`
`6
`FIG. 2 illustrates an embodiment of a network monitor 22
`capable of detecting problems or potential problems in a
`network environment. Network monitor 22 includes a data
`collection module 30 that collects information from various
`devices or applications, such as information regarding net
`work utiliZation (or device utilization), lost packets,
`response time, or number of errors. Data collection module
`30 collects information regarding the operation or perfor
`mance of the network environment on one or more com
`munication links 31. Data collection module 30 can collect
`data from any number of networks and any number of
`network devices or applications. Data collection module 30
`is coupled to a data reduction module 32, which reduces the
`collected data by reducing the granularity of the data over
`time and performing statistical reduction of the data, as
`discussed below.
`Data reduction module 32 is coupled to a cognitive
`signature module 34 and a storage device 36. Cognitive
`signature module 34 generates and maintains multiple
`dynamic cognitive signatures based on the data collected
`from the network. A cognitive signature represents the
`normal operating mode for a particular network device,
`network interface, system, application, or communication
`link with which the cognitive signature is associated. The
`cognitive signature is based on actual historical data col
`lected regarding the operation and performance of the net
`work environment. The cognitive signature is dynamic, such
`that it is continually updated to include the most recent data
`collected by the data collection module.
`In a particular embodiment of the invention, a separate
`cognitive signature is provided for each day of the week. A
`cognitive signature for a particular day of the week may
`include data separated into multiple time periods (e.g., each
`hour of the day). For example, a cognitive signature for
`Tuesday may include a particular time period that represents
`the normal operating mode (based on collected historical
`data) for a particular network device from 9:00 am. to 10:00
`am. on Tuesday. A cognitive signature for Saturday may
`include a time period that represents the normal operating
`mode for a particular network interface from 2:00 pm. to
`3:00 pm. on Saturday. Additional details regarding cogni
`tive signatures are discussed below.
`In the embodiment of FIG. 2, cognitive signature module
`34 receives data from data reduction module 32. In this
`embodiment, the granularity of the collected data has
`already been reduced when received by cognitive signature
`module 34. In an alternate embodiment of the invention,
`cognitive signature module 34 may receive data directly
`from data collection module 30. In this alternate
`embodiment, cognitive signature module 34 receives the
`actual data collected, rather than a reduced set of data. Thus,
`the cognitive signatures can be generated using the actual
`data without any loss of detail due to averaging or other data
`reduction procedures.
`Storage device 36 may be any type of mechanism capable
`of storing data, such as a random access memory (RAM),
`disk drive, or tape drive. Storage device 36 is capable of
`receiving data from data reduction module 32, cognitive
`signature module 34, and an analysis module 38. Analysis
`module 38 receives collected data from data collection
`module 30, and receives one or more cognitive signatures
`from cognitive signature module 34. Analysis module 38
`analyZes current performance or operation of the network
`environment by comparing the data collected via the net
`work with the cognitive signatures, which represent past
`performance or operation of the network environment at
`similar times for similar devices, systems, or applications.
`
`ServiceNow's Exhibit No. 1001
`
`016
`
`

`
`US 6,816,898 B1
`
`7
`Ana