as) United States
`a2) Patent Application Publication (0) Pub. No.: US 2012/0041858 Al
`
`(43) Pub. Date: Feb. 16, 2012
`Lewis
`
`US 20120041858A1
`
`(54)
`
`SYSTEM AND METHOD FOR SERVICE
`LEVEL MANAGEMENT
`
`(75)
`
`Inventor:
`
`Lundy Lewis, Mason, NH (US)
`
`(73)
`
`Assignee:
`
`ComputerAssociates Think, Inc.,
`Islandia, NY (US)
`
`(21)
`
`Appl. No.:
`
`13/284,358
`
`(22)
`
`Filed:
`
`Oct. 28, 2011
`
`Related U.S. Application Data
`
`(62)
`
`Division of application No. 09/577,225, filed on May
`23, 2000, now Pat. No. 8,073,721.
`
`(60)
`
`Provisional application No. 60/135,492,filed on May
`24, 1999.
`
`Publication Classification
`
`(51)
`
`Int. Cl.
`(2006.01)
`GO6F 15/173
`(2012.01)
`G060 30/04
`(52) US. Ch. vcccccccccsssssssseeeseessen 705/34; 705/30; 709/223
`
`(57)
`
`ABSTRACT
`
`The system and method described herein may provide service
`level management, wherein business processes may be com-
`posed of services. A state ofthe service may be defined by one
`or more service parameters, which depend upon performance
`of network components that support the service (e.g., com-
`ponent parameters). The state of the service may depend, for
`example, on a collection of service parameter valuesfor avail-
`ability, reliability, security, integrity, and response time. A
`service level agreementis a contract between a supplier anda
`customer that identifies services supported by a network,
`service parameters for the service, and service levels (e.g.,
`acceptable levels for each service parameter).
`
`
`
`
`
` composed of Le
`
`
` Component Parameters
`
`monitored/controlled by
`
`
`
`
`
`
`Transmission Device
`
`
`Transmission Line
`
`
`
`
`
`
`
`monitored/controlled by
`
`O2
`
`is a kind of
`
`
`
`is a kind of
`
`Computer System
`
`Application
`
`
`Google Exhibit 1040
`Google Exhibit 1040
`Google v. Valtrus
`Google v. Valtrus
`
`

`

`Patent Application Publication
`
`Feb. 16,2012 Sheet 1 of 21
`
`US 2012/0041858 Al
`
`10
`
`\
`
`17
`
`13
`
`
`Service Level Reports
`
`
`
`
`
`composed of
`
`composed of
`
`
`
`
`
`mapped
`
`d int
`into
`
`19
`
`
`
`
`composed of
`
` monitored/controlled by|Component Parameters
`
`itS
`
`is a kind of
`An Agent
`
`
`
`Device Agent
`27
`
`Traffic Agent
`22
`
`
`
`
`System Agent
`23
`Computer System
`
`
` Application Agent
`|-24
`
`--25
`Special-Purpose Agent
`
`Multicomponent Agent
`26
`
`
`
`
`Transmission Device
`
`Application
`
`monitored/controlled by
`
`is a kind of
`
`Fig. 7
`
`

`

`Patent Application Publication
`
`Feb. 16,2012 Sheet 2 of 21
`
`US 2012/0041858 Al
`
`Supplier or
`Consumer
`
`
`
`
` Alarm
`
`sa
`
`Trouble
`
`
`
`
`
` Device
`
`Alarm
`
`Notifier
`
`Fig. 3
`
`

`

`Patent Application Publication
`
`Feb. 16,2012 Sheet 3 of 21
`
`US 2012/0041858 Al
`
`The Enterprise -
`
`|
`
`77
`
`On
`
`eR
`
`Overseer
`
`xe. 58
`
`Supplieror .
`Consumer
`.
`
`§9
`
`
` Monitoring Agents
`63-66
`
`Agent Buffers
`67-70
`
`Database Interface
`
`60
`
`t—O.Interface Object
`© Entity Object
`
`Ch Control Object
`
`67
`[_l SLM Database
`
`Fig. 4
`
`
`
`
`ah
`
`Overseer
`
`wf
`
`Supplier or
`Consumer ..
`
`Spectrum
`Data Warehouse
`
`

`

`Patent Application Publication
`
`Feb. 16,2012 Sheet 4 of 21
`
`US 2012/0041858 Al
`
`105
`
`
`
`i Level 3 Behavior |
`. Level
`4 Behavior |
`
`
`107
`saa
`-
`
`
`Level 2 Behavior
`
`Level O Behavior
`
`Fi7. 8
`
`100
`
`
`
`
`
`

`

`Patent Application Publication
`
`Feb. 16,2012 Sheet 5 of 21
`
`US 2012/0041858 Al
`
`Level 2 Abstraction,
`
`13
`
`Level?Abstraction,#2
`Reasoning, Instruction
`
`Level O Abstraction,
`Reasoning,
`Instruction
`
`Reasoning; instruction l
`
`
`|~--—--|_-—_L
`
`
`| I
`
`1ttt{{t |
`
`|l
`
`|...i
`t
`
`Monitoring
`| H
`jute
`ufo|‘Human
`.
`Control | Control
`|
`
`14
`
`
`
`

`

`Patent Application Publication
`
`Feb. 16,2012 Sheet 6 of 21
`
`US 2012/0041858 Al
`
`Interdomain
`Alarms
`
`fo7~_ Level 2:Interdomain
`Alarm Correlation
`
`
`‘Levelf:intradomain
`Introdomain
`4
`126~ plarm-to-Service.
`Alarms
`
`Mapping
`
`
`
`125~ Level! Q: Intradomain
`
`Events
`Event Correlationc-——
`
`

`

`Patent Application Publication
`
`Feb. 16, 2012 Sheet 7 of 21
`
`US 2012/0041858 Al
`
` 146.
`
`Accounting/Billing
`
`
`
`Performance Analysis
`
`
`Data
`Capacity Planning
`| Warehouse
`
`
`
`Data Mining
`
`
`Service Level Reporting
`
`
` Operational
`
`Data 4
`‘Data2
`
`
`
`
` 136 Enterprise.
`
`
` Operational
`
`- Scrubbed
`Data 145
`
`Unscrubbed
`Data 747
`
`Agent 2
`
`
`SSASE
`144 <<
`
`
`Operational
`Operational
`
`
`Database 3
`Database2
`
`
`oS 148
`Accounting
`Data Mart
`
`149
`
`150
`Scrubbed
`SLM
`Data Mart Data 145
`
`
`
`
`
`Unscrubbed
`Data 747
`
`

`

`Patent Application Publication
`
`Feb. 16,2012 Sheet 8 of 21
`
`US 2012/0041858 Al
`
`C48
`
`Accounting
`
`
`Data Mart
`
`
`
`
`Capacity
`DataMart
`
`
`
`49 (150
`SLM
`Scrubbed
`Data Mart! Data 745
`
`Cy”
`
`Data
`Warehouse
`
`Scrubbed
`
`Operational
`Database1
`
`Enterprise
`Agent 1
`
`Enterprise
`Agent 2.
`
`1IZ5
`
`144
`Operationall” Unscrubbed
`
`Database 3] Data 747
`
`
`136
`
`|
`Enterprise
`- Agent 3
`
`Data 745
`
`
`
`
`
`139
`Domain3)
`
`140
`
`

`

`Patent Application Publication
`
`Feb. 16, 2012 Sheet 9 of 21
`
`US 2012/0041858 Al
`
`monitoring
`
`|
`
`
`
`

`

`Patent Application Publication
`
`Feb. 16, 2012 Sheet 10 of 21
`
`US 2012/0041858 Al
`
`all
`alarms
`
`_|event-to-alarm
`mapping
`
`alarm space
`
`
`
`
`
`

`

`Patent Application Publication
`
`Feb. 16,2012 Sheet 11 of 21
`
`US 2012/0041858 Al
`
`Detect events in
`the network
`
`
`
`
`
`For each aspect of network
`operation, map event(s)
`to
`alarm(s)
`
`
`160
`
`167
`
`-
`
`162
`
`Output alarms to
`alarm bucket
`
`Correlate /evaluate alarms
`to determine network
`operation status
`
`Report network operation
`Status
`
`163
`
`164
`
`165
`
`
`
`of network
`
`
`Identify corrective actions
`necessary for desired operation
`
`Implement corrective actions
`or report identified
`corrective actions
`
`Fig. 19
`
`Detect events fora
`specific aspect of
`network operation
`
`Map detected events to
`dn alarm or alarms
`
`16.
`
`6
`
`169 167
`
`Output alarm or alarms
`
`Fig. 20
`
`

`

`Patent Application Publication
`
`Feb. 16,2012 Sheet 12 of 21
`
`US 2012/0041858 Al
`
`
`
`the
`agent
`120
`
`172
`
`Reasoning
`Algorithm
`
`173
`
`
`Fig. 27
`Case Library
`
`177
`
`176
`\
`New
`Problem
`
`the
`world
`—
`
`1770
`
`
`
`
`Working
`Memory
`
`
`
`meeneeeeeeesoon
`
`
`

`

`Patent Application Publication
`
`Feb. 16,2012 Sheet 13 of 21
`
`US 2012/0041858 Al
`
`Service 4
`
`Seattle
`
`Bldg 3
`
`Up
`
`190
`
`
`Friday January5 2001 —~~797
`
`
`
`Service2
`Service 3
`
`
`
`
`
`Up
`Up
`Down ,up ati2 PM
`Bldg 1
`
`
`
`
`Bldg2
`Down 8-10PM Down 8-10PM Down 8-10PM
`Up
`
`
`‘Up (Slow)
`Up
`
`
`
`Down, up ?
`
`
`
`Up
`
`Up
`Up(slowly)
`
`Fig 24
`
`ok
`
`notice
`
`alert
`
`alarm
`
`degree
`of
`membership
`
`1
`
`O
`
`10
`
`20
`
`30 40
`load
`
`Fig. 25
`heavy
`
`40
`
`10
`20 30
`load
`Fig. 26
`
`

`

`Patent Application Publication
`
`Feb. 16,2012 Sheet 14 of 21
`
`US 2012/0041858 Al
`
`200
`
`Define
`Grammar
`
`Defin
`Membership
`
`202
`
`Define
`Fuzzy Inference Strategy
`
`.
`
`203
`
`
` 7201
`
`
`
`
`
`
`
`Fig. 27
`
`204
`
`production
`
`monitoring and
`reporting only
`
`213
`
`Parameter
`Monitoring
`
`Fuzzification
`
`
`
`| monitoring and
`!
`contro!
`\-208
`
`
`
`
`
`
`numeric data 29°
`mH - De fuzzification -- 7 —
`
`
`common sense data
`
`
`
`Service
`Parameters
`
`212
`
`
`
`
`5
`
`209
`
`

`

`Patent Application Publication
`
`Feb. 16,2012 Sheet 15 of 21
`
`US 2012/0041858 Al
`
`
`
`
`220~.
`
`target
`
`223~spzService
`Parameter
`
`Fig. 29a
`
`influences
`
`4*'Parameter
`* Split
`
`1$'Parameter
`Split
`Fig. 296
`
`anVorameter
`d2¢ Parameter
`Split
`
`3°¢ parameter
`pitt
`Ss
`:
`3°o Dorameter
`Split
`
`RT>=3
`3749, 45%
`
`Server 11 paging space>685.5
`1229, 75.9%
`
`Server 41 paging space =685.5
`2520,24.7%
`
`RT>=3
`
`Fig. 30
`
`X=NFS Server
`and queued(X)=high
`
`— X=NFS Server
`and queued(X)=low
`
`Fig. 3
`
`Server 11 CPU idle>63
`381,35.2%
`Server.11 CPU idles63
`848, 94.2%
`_ Server 41 batch delay>2.5
`2021,50.6%
`Server 41 batch delay<2.5
`499,0.8%
`
`X= Tracer
`and CPU_load(X)=high
`
`X=Tracer
`and CPU_load(X)=low
`
`X=Server 14
`and CPU_ load{X)=high
`
`X=Server 11
`and CPU_ load(X)= low
`
`

`

`Patent Application Publication
`
`Feb. 16,2012 Sheet 16 of 21
`
`US 2012/0041858 Al
`
`Name
`Address
`Phone
`Email
`
`Policies
`
`Availability:
`
`___ (select 90-100%)
`
`Response Time
`
`___(select 2-5 sec)
`
`Security
`
`"(Integrity
`
`___ {select high- med-low)
`
`___ (select high- med-low)
`
`Go Back
`
`Service Agreement with XYZ Server Form
`
`(Month)
`
`

`

`Patent Application Publication
`
`Feb. 16,2012 Sheet 17 of 21
`
`US 2012/0041858 Al
`
`reoF
`Service Reports
`via Browser
`
`265
`Specialized
`Reporting
`
`266
`Data Mining
`for trend analysis
`
`COED 262
`
`
`
`Data
`Warehouse
`
`
`Off-line, out-of-band management
`(EC and restricted customer access)
`
`Real-time, in-band management
`(EC access only)
`
`L263
`
`selected
`events
`
`Multidomain —|-259
`Alarm Correlation
`
`.
`260
`
`
`
`255
`
`
`Fault
`Definition,
`
`258 257~_| Monitoring,and|— Notification
`
`Control}
`:
`
`
`of SLAs
`L
`=
`Web
`faults
`
`
`Event Mgmt,
`Interface|-
`Reporting,
`
`256~]
`Discovery,Event
`Correlation
`
`
`
`
` server
`device
`. config
`events
`events
`
`
`
`
`~
`Inventory,
`-
`Security
`.
`Management
`
`Configuration,
`
`
`Control over
`NT and Unix
`of Network
`
`
`
`Distribution of
`Devices
`Web Servers
`Servers
`
`
`Software
`
`security
`events
`
`automated
`quit
`Repair
`
`26/
`
`254
`
`EC Enterprise
`
`Fig. 33
`
`250
`
`

`

`Patent Application Publication
`
`Feb. 16,2012 Sheet 18 of 21
`
`US 2012/0041858 Al
`
`_ Standard -|Syttogic DataCrystal
`
`
`Browser.
`’ Reports
`Mining Tool
`
`64'
`
`265"
`
`266"
`
`262'
`
`SSIES
`
`
`
`
`Spectrum
`Data Worehouse
`
`Off-line out-of-band management
`(EC andrestricted customer access)
`
`Real-time, in-band management
`(ECaccess only)
`
`2595.
`
`'
`
`selected
`events
`
`MicroMuse
`NetCool
`
`[.259'
`
`i
`
`HelpDesk
`
`a
`
`260'
`
`‘
`
`261
`
`259"
`
`Metrix .
`Web Console
`
`an
`
`227~\
`
`ics Service
`
`:_|
`
`Management
`~ Spectrum
`Consolidated
`256
`Enterprise
`
`
`Console
`
`
`
`contig
`security
`
`
`eventsevents events
`
`
`
`
`
`BNC Patrol
`Spectrum
`Axent
`
`
`Monitorin
`Infrastructure
`System
`Novadigm |
`
`
`
`
`
`
`Agents °
`Monitoring
`Monitoring
`EMD
`
`
`
`
`Agents
`Agents
`
`
`
`
`foults
`
`SpectroRx
`
`254!A
`
`EC Enterprise
`
`~250
`
`Fig.34
`
`

`

`Feb. 16,2012 Sheet 19 of 21
`
`FileView
`
`_®a5°aa 5an
`
`e6@2>—ay
`
`yoQ
`
`a.
`>z
`nae
`
`°o2 wa =w
`
`n
`oO
`
`Patent Application Publication
`
`US 2012/0041858 Al
`
`>—
`
`o £oa c
`
`a=
`
`c° ES—
`
`

`

`Patent Application Publication
`
`Feb. 16, 2012 Sheet 20 of 21
`
`US 2012/0041858 A1
`
`
`XXXXXKXX]_|.,£82Pollad|XXXXxXX[|4BJUNODWUDIVS
`MalaOly
`088
`C82:MIAOld9suylos:zt}orsuuloe-ao}uiosyAopsaupamLl]adpospuny40JOHODWISLtSOI=sIU[OE:ZHO}
`
`
`
`Jo.Aaq40}1{lo
`
`
`euesescieea)OOOORESpaxi4XXXXKK[|XXXKAXKX
`suulOog:gd]wosyAopsany
`fioyySExxx)[__]Ppouled|XXXXXXK[aKKKX¥XXXXX|ALILIQDJIDADUN>SRRRRRE[|XKHKXXKKXXKK|Bur
`
`
`
`
`
`
`
`
`sjuswaeiby[9Ad]BdIAIBSsiyfOd:aporsuulo¢g:go]wiosyADpia4
`[TOOL]Ajsaaesyim[=wupiyuD310819papssoxauasqspypoysaiuyAudJI
`
`
`
`
`
`
`ieJa:s1y[Jousayf_JusougADPI|OH
`XXXKKKSayJOSAUossAnpanyos
`|soy]814Jtfopuns
`
`.°.wo2Appun
`
`==SIUJOEZOSs4yJOe:BO]wosADpsanyL
`
`
`ca]Asowsi4:x!jUdWOsBdODSPUD]JoWSadj
`
`
`
`uoluljadAOsIUOW
`
`$2}0QAppiioH
`
`ZL'9z'at'Goz‘ole'’s'hbt
`
`
`
`swo.4}AppsnyD
`
`
`
`
`
`
`
`.SILOSEOLSAylog-Bo]wosyADpuow
`
`
`
`mainAIAWOYVIS182
`
`
`
`
`
`
`
`SUN;UMOG]:OWONJOHUOW
`
`9¢Bly
`
`

`

`Patent Application Publication
`
`Feb. 16,2012 Sheet 21 of 21
`
`US 2012/0041858 Al
`
`290
`Business /Enterprise |“.
`
`CORBA
`
`Servi
`
`ervice
`
`SNMP
`
`25
`
`TINA /CORBA
`
`
`
`
`
`Management Layer
`
`
`
`
`Network
`
`292
`
`
`
`SNMP
`
`Network Element
`Managément Layer
`
`293
`
`SNMP
`
`Network Element
`Layer
`.
`
`Fig. 37
`
`294
`
`Business Process
`Management
`
`
`
`Service Level
`Mandgement
`
`Enterprise
`Management
`
`
`
`
`
`
` Application
`
`
`
`Network
`Management
`
`|
`
`| Systems
`Management
`
`Management
`
`
`Fig. 38
`
`
`
`|
`
`Troffic
`Management
`
`
`
`|:
`
`

`

`US 2012/0041858 Al
`
`Feb. 16, 2012
`
`SYSTEM AND METHOD FOR SERVICE
`LEVEL MANAGEMENT
`
`CROSS-REFERENCE TO RELATED
`APPLICATIONS
`
`[0001] This applicationis a divisional of U.S. patent appli-
`cation Ser. No. 09/577,225, entitled “Service Level Manage-
`ment,”filed May 23, 2000, which claimsthe benefit of U.S.
`Provisional Patent Application Ser. No. 60/135,492, entitled
`“Method and Apparatus for Service Level Management in
`Large Global Business,” filed May 24, 1999, the contents of
`which are hereby incorporated by referencein their entirety.
`
`BACKGROUNDOF THE INVENTION
`
`In the early 1980’s, campus-wide computer net-
`[0002]
`works were being installed principally by universities to
`enable communication andthe sharing ofcomputer resources
`between various departments. The networking technology
`available at that time, and the scope of deployment, were both
`limited andrelatively unsophisticated.
`[0003]
`Today, the deployment and maintenance of “enter-
`prise” networks(i.e., existing across multiple domains—e.g.,
`geographical, functional, managerial) occurs on a much
`granderscale. The enterprisestill consists ofnetwork devices,
`transmission media, computers, and software applications,
`but there are many more of them andthey are considerably
`more complex anddifficult to manage. Furthermore, enter-
`prises are connected with other enterprises via the Internet
`and third-party backbones, and applications are distributed
`overall of these. Most global businessentities, in addition to
`large universities, now employ such sophisticated enterprise
`networks. Electronic commerce (EC) providers are creating
`similarly complex global networks, known as “Web server
`farms,” on whichindustriesinstall their Web sites. Industries
`have to be assuredthat their customers can always access their
`Websites, that performancewill be reasonably good,andthat
`customertransactions are secure. Managementof such dis-
`tributed Web server farmsis yet another example of the com-
`plexities of enterprise management today. Internet service
`providers also need to manage and provide customers with
`access to global networks on a 24-hour a day basis.
`
`SUMMARYOF THE INVENTION
`
`[0004] The present invention is directed to various aspects
`of service level management (SLM), wherebyan entity (such
`as a company, university, Internet service provider (ISP),
`electronic commerce (EC) provider, etc.) may, for example,
`map components of a network (i.e., network devices, trans-
`mission media, computer systems, and applications)into ser-
`vices in orderto assess the state ofthose services. The state of
`
`those services, referred to herein as service parameters, may
`include availability, responsetime, security, and integrity. For
`example, EC providers need to assess availability—their cus-
`tomers want their Web sites to be availableat all times. Their
`users want quick response time—they do not wantto experi-
`ence undue delay whenretrieving information or moving
`around screens. They need to assess security—customers
`want to be assured that no intruders (e.g., competitors) can
`sabotage their Websites, and they wantto be assured of secure
`transactions with respect to personal information such as
`credit card numbers. They need to assess integrity—custom-
`ers want the words and pictures on the screens to be clear,
`accurate and visually interesting.
`
`Providers of network services may include certain
`[0005]
`guarantees of service level management in a service level
`agreement (SLA). The SLA may quantify systems perfor-
`mance,service availability, backup completions andrestore
`times, and problem resolution metrics. SLAs may provide
`financial incentives for exceeding requirements and penalties
`for failing to meet performance objectives. Performance met-
`rics (service parameters) for SLAs may be based onavailabil-
`ity to the Internet and measurements ofWebsite access times.
`For example, availability may be defined asthe total minutes
`that a Web serveris actually available to the public. Access
`time may be measuredon a regional basis using benchmark-
`ing methods.
`[0006] Based on current networking technology such as
`packet marking,differential services, and switched networks,
`network service providers can offer different levels (grades)
`of service in each of these categories, and customers can
`choosetheir preferences. If customers want 100% availabil-
`ity, optimal response time, and maximal security and integ-
`rity, then they would pay more. Otherwise, they would pay
`less. The customer may select specific time periods over
`which various service grades are required. Preferably, the
`customers can access a service level agreement form ona Web
`site, and negotiate with the provider the terms of the agree-
`ment.
`
`[0007] One aspectof service level managementis monitor-
`ing of the various computer systems, network devices and
`software applicationsfor both real-time display and historical
`reporting. A management system should provide visibility
`into componentoperational parameters that provide mean-
`ingful information to the IT staff for maintaining network
`availability and performance.
`[0008] Another aspect of service level managementis event
`management—taking information from the monitoring
`agents in various embodiments, loggingit, filtering it, corre-
`lating it and determining what actionsornotifications, if any,
`need to take place. Preferably, the output of event manage-
`mentenablesthe information technology (IT) staffto become
`proactive in preventing service interruptions by identifying
`and responding to low-impact events that may be precursors
`to a moreserious event that would cause a service outage.
`[0009] Another aspect of service level managementis the
`taking of operational data obtained by the monitoring agents
`and transforming it into managementinformation to support
`the needs ofboth the business and technical operations within
`the organization.
`In various embodiments, service level
`reports provide an assessmentof service parameters andser-
`vice levels in a form adaptedto the interests of users, IT staff,
`business owners, EC provider, etc.
`[0010] Other elements ofnetwork managementthat may be
`useful in providing a specific level of service parameters in a
`service level agreement include:
`[0011] Configuration asset and change management;
`[0012]
`Software distribution;
`[0013]
`Problem managementand automated fault man-
`agement;
`[0014] Trend and performance analysis; and
`[0015]
`Security management.
`[0016] Many businesses have made a large investment in
`their computer networks. This investmentis sometimescalled
`the total cost of ownership (TCO) regarding the enterprise.
`Most businesses, however, have difficulty understanding the
`extent to which the enterprise network contributes to business
`profit. By understanding the services provided by the enter-
`
`

`

`US 2012/0041858 Al
`
`Feb. 16, 2012
`
`prise and the relation between profit and services(1.e., total
`benefits), then the business owner can calculate a return on
`investment (ROI). Service level management (SLM)helps a
`business owner understandthis relationship between expen-
`ditures on enterprise components and the return on invest-
`mentin regard to the operationalefficiencies of the business.
`[0017]
`I. Service Level Management (SLM)
`[0018] According to one aspect of the invention, a method
`and apparatus are provided for service level management
`(SLM). In one embodiment, a method of monitoring a busi-
`ness process comprises:
`[0019]
`determining one or moreservices upon whichthe
`business process depends;
`[0020]
`determining one or more network components
`upon which the one or more services depend; and
`[0021] monitoring the one or more network components.
`[0022] Component parameters are determinedfor the net-
`work components, the component parameters are monitored
`and the monitored values mapped into service parameters.
`Software agents are utilized to monitor the network compo-
`nents. Service levels are designated for accepted levels of the
`service parameters. The service levels may be incorporated in
`a service level agreement. Periodic service reports are issued
`pursuantto the service level agreement, indicating whether
`the designated service levels have been met.
`[0023]
`In another embodiment, a data space is provided
`comprising service parameters, wherein each service param-
`eter represents a performance indicator of one or moreser-
`vices whose performance depends uponone or more network
`components, where the one or moreservices are included in a
`business process.
`[0024]
`In another embodiment, an integrated management
`system is provided comprising service level management
`(SLM) for monitoring one or more services; and component
`management
`(CM)
`for managing network components;
`wherein a business process is composed of the one or more
`services, and the services are composedof the network com-
`ponent. In addition, a business process management (BPM)
`may be integrated for managing the business process.
`[0025]
`In another embodiment, a method of providing ser-
`vice level managementis provided comprising determining
`services required by a business process, and determining
`service parameters marked by service levels for each service.
`[0026]
`Inanother embodiment, a service level management
`system is provided wherein a service dependson at least one
`network component, the system comprising one or more
`agents for receiving componentparameters and mapping the
`component parameters into service parameters, and a user
`interface for generating service level reports which include
`the mapped service parameters, wherein the component
`parameters represent a state of at least one network compo-
`nent.
`
`II. Reactive and Deliberative SLM
`[0027]
`In another aspect of the invention, a method and
`[0028]
`apparatus are provided for reactive and deliberative service
`level management (SLM). In one embodiment, a method for
`managing information is provided which comprises:
`[0029]
`providing a plurality of monitoring agents for
`monitoring components of a network, each monitoring
`agent receiving events of a select type from the network
`components and resolving such events into alarms;
`[0030]
`transmitting the alarms from all monitoring
`agents to a common management agent, which resolves
`the alarms to produce correlated alarms; and
`
`transmitting the correlated alarms to a common
`[0031]
`service level management agent to reason across the
`network as to causes of the events.
`
`[0032] Events are used broadly herein and may include
`various operational data from a network component, includ-
`ing events andstatistics. The event may be generated and
`transmitted automatically by the network component to an
`agent monitoring the component, or the agent may poll the
`network component for the information. The method may
`further comprise relating the component information to a
`service upon which a business process depends, the compo-
`nent information representing operational data ofone or more
`monitored components, and further determining a state ofthe
`business process based upon the component information,
`wherein the component information determines a measured
`level of service and wherein the level of service affects the
`
`operation of the business process, and further reporting to a
`user information regarding at least one of a group including
`availability, faults, configuration, integrity, security, reliabil-
`ity, performance, and accounting of the measured level of
`service.
`
`In another embodiment, a method of multilevel,
`[0033]
`multi-domain alarm to service mapping is provided compris-
`ing:
`(a) conducting intra-domain event correlation at a
`[0034]
`first level, wherein:
`[0035]
`input events are received by a monitor provided
`for each domain;
`[0036]
`instructions provide control for each domain; and
`[0037]
`input events are interpreted and correlated for
`each domain;
`[0038]
`(b) conducting intra-domain alarm-to-service map-
`ping at a secondlevel, wherein:
`[0039]
`input events are received by a monitor provided
`for each domain;
`[0040]
`instructions provide control for each domain; and
`[0041]
`input events are interpreted and correlated for
`each domain; and
`[0042]
`(c) conducting inter-domain alarm correlation at a
`third level, wherein:
`[0043]
`input events are received by a monitor provided
`for each domain;
`[0044]
`instructions provide control for each domain; and
`[0045]
`input events are interpreted and correlated across
`multiple domains.
`[0046]
`Inanother embodiment, a multilevel architecture for
`service level managementof a network is provided,the archi-
`tecture performing the method comprising:
`[0047]
`providing a reactive level for monitoring compo-
`nents in the network to provide service level manage-
`ment; and
`[0048]
`providing a next higher level of a more delibera-
`tive decision-making for providing service level man-
`agement.
`[0049]
`Inyet another embodiment, a system is provided for
`managing the network comprising:
`[0050]
`anagent operable to receive operational data from
`at least one component of the network, the at least one
`componentbeing related to a service on which a busi-
`ness process depends; and
`[0051]
`acorrelator operable to determine a state of the
`business process based upon the operational data,
`wherein the operational data of the component deter-
`
`

`

`US 2012/0041858 Al
`
`Feb. 16, 2012
`
`mines a measuredlevel of service and wherein thelevel
`[0071] The monitoring agents and alarm correlation agents
`may bevarious reasoning agents, such as:
`of service affects the operation of the business process.
`[0072]
`a rule-based reasoning agent;
`[0052]
`In yet another embodiment, a system for managing
`[0073]
`a model-based reasoning agent;
`the network is provided comprising:
`[0074]
`astate-transition graph based reasoning agent;
`[0053]
`one or more agents operable to receive opera-
`[0075]
`acode bookbased reasoning agent; and
`tional data from at least one componentof the network,
`[0076]
`acase-based reasoning agent.
`the at least one componentbeing related to a service on
`[0077]
`In another embodiment, a system provides service
`whicha business process depends, wherein the agentis
`level management in a network, wherein a service is com-
`configured to determine a state of the business process
`posed of network components and the state of the service
`based upon the operational data, wherein the operational
`dependsonthe state of the network components, the system
`data of the component determinesa level of service, and
`comprising:
`wherein the level of service affects the operation of the
`business process.
`a first monitoring agent to monitor a respective
`[0078]
`[0054]
`Inastill further embodiment, a method is provided
`first aspect of operation of the network, the first moni-
`comprising:
`toring agent to detect one or more eventsrelative to the
`[0055]
`providing a plurality of monitoring agents for
`first aspect of operation and to generate an alarm as a
`function of the one or more detected events;
`monitoring components of a network, each monitoring
`agent receiving events of a select type from the network
`
`[0079] asecond monitoring agent to monitorarespective
`and resolving such events into alarms;
`second aspect of operation of the network, different
`[0056]
`transmitting the alarms from all agents to a com-
`from the first aspect, the second monitoring agent to
`mon management agent, which resolves the alarms to
`detect one or more eventsrelative to the second aspect of
`produce correlated alarms; and
`operation and to generate an alarm as a function of the
`[0057]
`transmitting the correlated alarms to a common
`one or more detected events; and
`service level management agent to reason across the
`[0080]
`an alarm repository to receive one or more alarms
`networkas to causes of the events.
`from eachof the first and second monitoring agents.
`[0058]
`III. Event Correlation for SLM
`[0081]
`In another embodiment, a system provides service
`[0059] According to another aspect of the invention, a
`level managementina network havingat least one monitoring
`method and apparatus are provided for event correlation in
`agent to monitor at least one aspect of operation and to gen-
`service level management (SLM). In one embodiment, a sys-
`erate an alarm as a function of one or more detected events,
`tem for providing service level managementin a network is
`wherein a service is composed of network components and
`provided, wherein a service is composed of network compo-
`the state of the service depends on the state of the network
`nents and a state of the service depends on the state of the
`components, the system comprising an alarm correlation
`network components, the system comprising:
`agent to receive the one or more alarmsfrom the at least one
`[0060] multiple monitoring agents to each monitor a
`monitoring agent to determinethe state of a service and, if
`respective aspect of operation of the network, each
`necessary, to issue one or more instructions to establish a
`desired state of the service.
`monitoring agent to detect one or more events relative to
`the respective aspect of operation and to generate an
`alarm as a function of the one or more detected events;
`and
`
`an alarm correlation agent to receive the one or
`[0061]
`more alarms from the monitoring agents to determine a
`state of a service and, if necessary, to issue one or more
`instructions to establish a desired state of the service.
`
`In preferred embodiments, the monitoring agents
`[0062]
`comprise at least oneof:
`[0063]
`an infrastructure monitoring agent to monitor
`operation of the network infrastructure;
`[0064]
`acomputer system monitoring agent to monitor
`operation of at least one computer system on the net-
`work;
`a network traffic monitoring agent to monitor
`[0065]
`traffic on the network;
`to monitor
`[0066]
`an application monitoring agent
`operation of at least one application operating on the
`network;
`[0067]
`a trouble-ticketing agent to receive reports of
`problems by users with respect to operation of the net-
`work;
`a response time monitoring agent to monitor a
`[0068]
`response time of a communication on the network;
`[0069]
`adevice monitoring agent to monitor operation of
`a device on the network; and
`[0070]
`a multi-component monitoring agent comprising
`an aggregate of any of the above monitoring agents.
`
`In another embodiment, a method provides service
`[0082]
`level management in the network, wherein the service is
`composed of network components anda state of the service
`dependsonthe state of the network components, the method
`comprising:
`[0083] monitoring one or more aspects of operation of
`the network and detecting one or more eventsrelative to
`of the one or more aspects of operation;
`[0084]
`generating an alarm for a respective aspect of
`network operation as a function of the respective
`detected one or more events; and
`[0085]
`correlating the one or more alarms and determin-
`ing a state of the service as a function of the correlated
`alarms.
`
`In another embodiment, a computer program prod-
`[0086]
`uct is provided comprising:
`[0087]
`a computer readable medium;
`[0088]
`computer program instructions on the computer-
`readable medium, wherein the computer program
`instructions, when executed by a computer, directs the
`computer to perform a methodofprovidingservice level
`management in a network, wherein a service is com-
`posed of network components anda state of the service
`depends on a state of the network components, the
`method comprising:
`[0089] monitoring one or more aspects of operation of
`the network and detecting one or more eventsrelative to
`the one or more aspects of operation;
`
`

`

`US 2012/0041858 Al
`
`Feb. 16, 2012
`
`generating an alarm for a respective aspect of
`[0090]
`network operation as a function of the respective
`detected one or more events; and
`[0091]
`correlating the one or more alarms and determin-
`ing a state of a service as a function of the correlated
`alarms.
`
`IV. Display of SLM
`[0106]
`[0107] According to another aspect of the invention, a
`method and apparatus are provided for display of service
`level management (SLM). In one embodiment, a display
`comprises an identification ofone or moreservices, a location
`ofthe one or moreservices, a state ofthe one or moreservices,
`wherein a business process is composed of the one or more
`In another embodiment, a system provides service
`[0092]
`services and the services depend on the operation of one or
`level management in the network, wherein the service is
`more components in the network. In various embodiments,
`composed of network components andastate of the service
`the state may comprise one or moreofavailability, reliability,
`dependsonthe state of the network components, the system
`performance,
`fault, configuration,
`integrity and security.
`comprising:
`According to a method embodiment for providing service
`[0093] means for monitoring one or more aspects of
`status, the display is providedto users of the service. Accord-
`operation of the network and detecting one or more
`ing to one embodiment, an apparatus comprisesa display that
`events relative to the one or more aspects of network
`indicates a servicein the state of a service, where the service
`operation;
`is composed of network components and the state of the
`[0094] means for generating an alarm for a respective
`service depends onthestate of the network components.
`aspect of network operation as a function ofthe respec-
`[0108]
`In another embodiment, a method of managing a
`tive detected one or more events; and
`network is provided comprising:
`[0095] meansfor correlating the one or more alarms and
`[0109]
`discovery of network components;
`determining a state of the service as a function of the
`[0110]
`root cause analysis to determine a cause of a
`correlated alarms.
`degradation in the service due to a degradation in the
`network; and
`Ina further embodiment, a system provides service
`[0096]
`level management in the networ