Management system and method for monitoring stress in a network

1. Field of the Invention

The present invention relates to the management of a communications system or network, and more particularly to the monitoring of “stress” in a network.

2. Description of the Related Art

The following description is concerned with a data communications system such as a local area network (LAN), that is an Ethernet network. However, the skilled person will appreciate that the present invention will have more general applicability to other types of managed networks including wireless networks.

A local area network (LAN) typically comprises a plurality of computers, computer systems, workstations and other electronic devices connected together by a common media such as twisted pair or coaxial cable or fibre optic cable. Data can be communicated between devices on the network by means of data packets (or frames) in accordance a predefined protocol.

Computers and other devices connected to a network can be managed or unmanaged devices. A managed device has processing capability which enables it inter alia to monitor data traffic sent from, received at, and passing through the ports of the device. Monitored data associated with the ports of the network device is stored in memory on the network device. Unmanaged devices do not have this processing capability.

It is becoming increasingly common and necessary for an individual to be appointed to manage a network. The appointed network manager (or administrator) utilises a network management station which includes network management hardware and software. In particular, the network management station is able to access management data from managed network devices using an appropriate management protocol (e.g. the SNMP protocol) and display this data for use by the network manager.

Known network management systems simply read the management data from the managed network devices and present this data to the network manager, typically in the form of numeric text, substantially unchanged. The network manager is expected to interpret the data in managing the network.

One of the important tasks of a network manager is to assess the operational performance of the various network devices and links as well as the network as a whole. The network manager needs to know when problems are arising within the network and which particular network devices are responsible for such problems etc.

Typical problems which may affect the performance of a network include:

1. slow operating speed of the network, and individual network devices, leading to slow movement of data traffic across the network, indicated by e.g. slow response time for a given network device;

2. high volumes of data traffic on the network due to e.g. over-utilisation of the network links, network devices and the network as a whole; and

3. high error rates in the transmission of data packets across the network, indicated by e.g. the loss of data packets in a network device and errors in received data packets.

The aforementioned problems which occur in the operation of a network contribute to the poor “health” of a network. The concept of the health of a network is well known in the field of network management. In the present description, however, it is more convenient to refer to the “stress” of a network (or network device or link) rather than its “health”. It will be understood that a high level of stress equates to a low level of health and vice versa. Although the present invention is described as monitoring stress in a network, it will be appreciated that the present invention is equally applicable to monitoring health in a network.

Problems which affect the performance of a network, and therefore contribute to the level of “stress”, may be of greater or lesser significance. For instance, a problem with the operating speed of an end station may be less significant than a problem with the operating speed of a central core device such as a switch. Thus, the level of stress of a network depends upon a number of factors including device type, network media type and the type of problem occurring. The network manager must take all such factors into account when interpreting the management data received from the managed network devices to establish whether the performance of the network is satisfactory.

It would be desirable for a network management system to monitor characteristics of network devices and links which are indicative of problems occurring in a network which contribute to “stress”, (such characteristics are referred to herein as “metrics”) and provide data to the network manager indicative of the level of stress which is easy to interpret. It would further be desirable to determine a value indicating the overall performance of each network object (a “network object” is defined herein as a network device or link) on a network and/or the overall performance of parts of, or all of, the network, so that the network manager would not be required to interpret the monitored data, but could immediately ascertain the performance of the network (or part of the network) from the value provided by the network management system.

In accordance with a first aspect, the present invention provides a method for processing data representing monitored characteristics in a network comprising network devices and links to provide a stress value representing the performance of the network or a part thereof, the method comprising:

obtaining a raw value of data for a monitored characteristic of a network device or link;

comparing said raw value with a predetermined threshold value for said monitored characteristic;

if said raw data value is greater than or equal to said threshold value, providing a stress value equal to a default value, said default value being a maximum or minimum value of a predefined bounded range; and

if said raw value is less than said threshold value, calculating a stress value within said predefined bounded range using an appropriate algorithm for said monitored characteristic.

In accordance with a second aspect, the present invention provides a computer readable medium having a computer program for carrying out the method of the first aspect of the present invention.

In accordance with a third aspect the present invention provides network management apparatus for processing data representing monitored characteristics in a network comprising network devices and links to provide a stress value representing the performance of the network, the apparatus comprising:

a network connection or port for receiving a raw value of data for a monitored characteristic of a network device or link;

a processor for comparing said raw value with a predetermined threshold value for said monitored characteristic obtained from memory; and if the comparison determines that raw data value is greater than or equal to said threshold value, providing a stress value equal to a default value, said default value being a maximum or minimum value of a predefined bounded range; and if the comparison determines that said raw value is less than said threshold value, calculating a stress value within said predefined bounded range using an appropriate algorithm for said monitored characteristic stored in memory.

The present invention thus obtains a value for the stress of a network, network object or part thereof, within a predefined, bounded range, that is to say a “normalised” stress value. Since the stress value is a normalised value, is easy to understand, and requires no interpretation by the network manager.

Embodiments of the present invention will now be described, by way of example, with reference to the accompanying drawings, in which:

FIG. 1 is a block diagram of a typical network having a network management system according to a preferred embodiment of the present invention;

FIG. 2 is a stress mapping graph for a first stress metric which may be monitored by the network management system in accordance with the present invention;

FIG. 3 is a stress mapping graph for a second stress metric which may be monitored by the network management system in accordance with the present invention; and

FIG. 4 is a flow chart showing the steps carried out by a computer program in accordance with a preferred embodiment of the present invention.

FIG. 1 shows a typical network 1 incorporating a network management system according to a preferred embodiment of the present invention. The network 1 includes a network management station 3 A which incorporates the necessary hardware and software for network management. In particular, the network management station includes a processor, a memory and a disk drive, and preferably also a modem for internet access, as well as user interfaces such as a keyboard and mouse, and a visual display unit. Network management application software in accordance with the present invention is loaded into the memory of management station 3 A for processing data as described in detail below. The network management station 3 A is connected by network media links 5 to a plurality of managed network devices including core devices such as network switch 7 , hubs 11 , a router (not shown) and end stations, which may be managed or unmanaged, including personal computers 3 and workstations. The network may also include unmanaged devices, for example peripheral devices such as printers etc.

The network management station 3 A is capable of communicating with the managed network devices such as network switch 7 and hubs 11 by means of a network management protocol (e.g. the SNMP protocol) in order to obtain network management data. Each managed device includes a processor which monitors and stores data in memory on the device, and such data may be represented to an external management station by a MIB (management information base), as is well known in the art, including data relating to inter alia data traffic at the device. A typical managed device monitors data contained in a number of MIBs, (of which one or more contains data used in the present invention). An example of a MIB containing network management data is MIB-II (formerly MIB-I) as specified by the IETF (Internet Engineering Task Force) in specification RFC1213. MIB-II is common to most vendors' core devices and any network management system should preferably be capable of reading and utilising management data from MIB-II. Furthermore, the network management system of the preferred embodiment of the present invention is additionally capable of reading and utilising more complex management data contained in such MIBs as RMON (Remote Monitoring MIB, RFC1271), RMON2 (Remote Monitoring MIB 2, RFC2021), the standard bridge MIB (RFC1493), the standard repeater MIB (RFC1516), or any proprietary MIBs produced by original equipment manufacturers (e.g. the 3Com Remote Poll MIB).

In accordance with the preferred embodiment of the present invention, the network management station 3 A obtains data about a certain metric for a network object which is indicative of the level of “stress” of the network object. For example, the station 3 A may request from a managed device, such as switch 7 , a single piece of information (called an “object instance” or SNMP variable) from a MIB about a particular state of the device such as the current error rate in data packets sent from and received at one of its ports. In accordance with the present invention, the data obtained from the MIB is processed using a predetermined “mapping algorithm” for error rate in a port of the switch to obtain a “normalised” stress value (as explained in more detail below). The normalised stress value may be displayed on the visual display unit of the network management station or otherwise communicated to the network manager, e.g. via a printer or through another application such as a word processing application. The normalised stress value represents the perceived level of stress of the network device (i.e. a level which takes into account all relevant factors including the type and location of the network device) which can be readily understood by the network manager as indicating whether the level of stress is acceptable.

The network management system may also obtain metric data for a network object without accessing a MIB in a managed device. For example, the network management station 3 A may send a signal to a device over a link which prompts a response from the device (e.g. by IP ICMP echo or IP Ping, as is known in the art). The network management station will itself then monitor the time taken to receive a response from the device. The normalised stress value is then determined using a predetermined “mapping algorithm” for the monitored metric.

The following tables represent examples of the information/characteristics which the network management system, according to the preferred embodiment of the present invention, monitors. In the tables, the monitored information/characteristic is called a “metric” and the typical level of the raw measured value which represents an unacceptably high level of stress (i.e. poor performance) is called the “default threshold”. The default threshold is set by the vendor of the network management system but may adjustable by the user, if required.

Examples of metrics obtained by the network management station from a network device are shown in Table 1. These stress metrics are examples of characteristics monitored by the network management system to ensure that parts of the network devices (i.e. discrete hardware or software components) are operating in an acceptable fashion.

(Note that not all devices will have all of the functions indicated by the metric. The network management station of the preferred embodiment only sends signals appropriate for each network device to obtain the metrics for that device).

Examples of metrics obtained by the network management station requesting information contained in a MIB in a managed network device such as switch 7 are shown in Table 2. These stress metrics are examples of the characteristics monitored in a core device to determine whether errors and bottlenecks of data traffic (due to excessive traffic) are occurring in the device.

(Note that the metrics listed in Table 2 are monitored and stored in most layer 2 switching devices such as bridges or switches.)

Examples of metrics obtained by the network management station from a network device such as a half duplex Ethernet interface or port on a network device are shown in Table 3. These stress metrics are examples of characteristics monitored to identify problems occurring at the ports of network devices such as over-utilisation of the link connected to the port.

(Note that the metrics listed in Table 3 are monitored and stored for each port in most managed network devices which support a MIB capable of monitoring traffic flow on a port (e.g. MIB-II, RMON, repeater MIB, or a similar operating MIB).)

Finally, an example of a metric obtained by the network management station requesting data from a managed network device which supports a proprietary MIB, for example a MIB of 3Com Corporation, is response time from far end of link, which has a typical default threshold of 1000 milliseconds. The network management station requests from the network device this data, and the processor in the network device sends a signal to the far end of the link and times the period for a response to be received. The monitored response time is then provided to the management station as a raw value indicative of problems relating to the speed of transmission of data across the network.

A normalised stress value is determined by the network management system of the preferred embodiment using an appropriate algorithm as discussed in more detail below, based on a) the characteristics of the information being requested; b) the type of managed device being monitored, and c) the type of media to which the device is attached. In the embodiment, the stress value is “normalised” for all stress metrics within a predefined, bounded range. In the preferred embodiment the range is 0-100 where 100 is an unacceptable level of stress. As mentioned previously, the stress value for each metric is determined using an appropriate “stress mapping” algorithm which considers the aforementioned factors a) to c) to provide an appropriate level of perceived stress in the range 0 to 100 to the user. In particular, the stress mapping applied to any monitored value will always return a stress value in the same range i.e. 0 to 100. The stress mapping algorithms for all monitored values (i.e. all metrics for all network objects) are designed such that a given reported stress value always has the same meaning for the user, no matter which raw monitored value (i.e. metric) was used to generate the stress value. A better understanding of the manner of implementation of the stress mapping algorithms, which are predetermined by the vendor of the network management system, will be appreciated from Examples 1 and 2.

the blade's own monitored stress (i.e. the stress derived using measurable metrics on the blade itself); and

the worst stress of any of the ports (or interfaces) on that blade

the unit's own monitored stress; and

the worst stress of any of the blades inserted in that unit (as determined in Step 1)

Step 3: The stress of each network device is determined to be the worst of:

the device's own monitored stress; and

the worst stress of any of the units which are part of the device (as determined in Step 2)

The overall stress of the network can then be determined, for example to be the worst of the stresses of all of the network objects within the network.

The overall stress of the network is thus the worst stress of any individual monitored component within the network.

Alterative Aggregation Strategies

Other more advanced aggregation strategies may follow the strategy of Example 3, but with the following additions:

1. For a unit or blade, also consider the effect that the bad performance of that component has on the parent component's ability to support other constituents.

For example, a blade which is under high stress may affect the performance of other blades if it congests the common, shared backplane. A unit which is under high stress may affect the performance of a network device if it congests the device's single interface onto the network.

2. For the network device, unit or blade, the stress of the component may be determined to be worse or better than just the worst of the constituent components.

For example, the stresses of the interfaces on a blade may be 60, 70 and 80. But the network management system may intelligently decide that this combination of very high stresses means that the blade itself is stressed to, say, 90. If the stresses were 10, 10 and 80, the management application may decide that this single high stress does not warrant a blade stress of 80, but perhaps only 50.

As described above, in accordance with a preferred embodiment of the present invention, the network management system monitors a plurality of stress metrics for all of the managed devices on the network, and in addition to aggregating the data for each object (e.g. device) to form an overall stress value for that object (e.g. device), the network management system may additionally aggregate together the overall object stress values of all of the network objects to provide an overall stress value for the network. Alternatively, the network management system may aggregate the worst of the underlying stresses of each of the devices, or at each network level, to provide the overall network stress values. In the latter case, the overall network stress value will represent the stress value of the least healthy device or component across the whole network.

The network management station in accordance with the invention may monitor stress periodically or in response to commands from the network manager.

As will be appreciated from the foregoing, in accordance with a preferred embodiment, the present invention is implemented in the form of a software application which may be provided in the form of a computer program on a computer readable medium. The computer readable medium may be a disk which can be loaded in the disk drive of network management station 3 A or the computer system carrying the website or other form of file server (e.g. FTP) of, for example, the supplier of network devices, which permits downloading of the program by a management station over the internet.

The program steps 101 to 107 are illustrated in FIG. 4 and have been described above.

As the skilled person will appreciate, various modifications may be made to the described embodiments and examples. For instance, as previously mentioned, if the invention is applied to determine a health value in a network, it will be appreciated that the same metrics, raw values and default thresholds will be applicable as for stress, as described above. However, the mapping algorithms will differ, and the default threshold will return the minimum value within the normalised range indicating poor health. The network manager will then need to look for low values of health to detect potential problems in the network.

The present invention is intended to include all such modifications and equivalents which fall within the scope of the present invention as defined in the accompanying claims.