System and Method for Using SNMP in an Application Server Environment

Abstract

A system and method for sharing security information across multiple SNMP Agents running within a domain, including features such as dynamically extending SNMP MIB to expose customer MBeans with SNMP. The system includes a managed server instance of an application that hosts an SNMP agent. An agent or sub-agent is registered to the SNMP Agent on each managed server and there is a management information base which describes different management attributes that the application server exposes. A network-manager hosts a SNMP manager that communicates with the SNMP Agents. A non-application server specific MBean exposes a set of attributes about the application to the sub-agent and hosts the non-application server specific MBean in a dynamic MIB. The set of attributes are communicated through SNMP by the SNMP Agent to SNMP manager, to extend the SNMP MIB dynamically, and allow the non-application server specific MBean to be exposed through SNMP.

Description

COPYRIGHT NOTICE

A portion of the disclosure of this patent document contains material which is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction by anyone of the patent document or the patent disclosure, as it appears in the Patent and Trademark Office patent file or records, but otherwise reserves all copyright rights whatsoever.

FIELD OF THE INVENTION

The present disclosure relates generally to network management, and particularly to a system and method for using Simple Network Management Protocol (SNMP) functionality in an application server environment.

BACKGROUND

In some Java-based application server environments, a static data structure referred to as a Management Information Base (MIB) is used to describe the different Java beans that the application server exposes. Managed beans (often referred to as MBeans, or custom MBeans) can be created and used by an administrator or application server “customer” to manage applications or services which have been recently deployed onto the application server. In some instances this management can be performed using a network-manager, the Simple Network Management Protocol (SNMP), and one or more SNMP Agents.

However, the network-manager and the SNMP Agent which are associated with a particular application server generally cannot recognize the custom MBeans as SNMP managed resources. A consequence of this is that the network-manager cannot monitor or control custom MBeans, and the attributes which the custom MBeans expose cannot be used within the application server.

Another feature of some Java-based application server environments is that server monitoring information can be exposed through a Java Management Extensions (JMX) interface. JMX provides layered tools and interfaces for managing and monitoring applications, including those deployed on an application server. A JMX layer can receive monitoring information from a MBean server. Within a particular domain, a network-manager's SNMP Agent communicates with other agents in the domain to share information.

Additionally, in a traditional application server, a single SNMP Agent runs within an application server instance, and a network-manager is used to provide a limited view of the domain at a given moment in time. However, generally the network-manager is not continually communicating with managed servers in the domain and in the event of a configuration change at runtime, the application server must be restarted to update the managed servers with the change. Moreover, in many cases the network-manager is either not running or not present on the application server. In these instances, the network-manager may not be able to monitor and communicate with several of the other managed servers on the same domain.

Furthermore, current SNMP protocol standards specify security features that use community strings, which in turn are transmitted as plain text. Because of this, sensitive application server configuration and runtime information can be easily exposed to attackers.

In addition to these nuisances, security aspects such as authentication and privacy must be configured individually for each SNMP Agent on a managed server. Configuring the network-manager to communicate with the agents on the managed servers is a cumbersome task if the domain contains many managed servers.

These and other aspects of server management are areas that embodiments of the present invention are designed to address.

SUMMARY

In accordance with an embodiment, a system is described in which each managed server instance in the domain will have its own SNMP Agent. The administration server's SNMP Agent will provide a domain wide view based on the domain MBean server. The managed server's SNMP Agent will surface the MBean server for that server and can monitor applications on that server. Since there is a SNMP Agent deployed on each managed server, the network-manager has a domain wide view of the application server, and all monitored information is centralized on the network-manager.

In accordance with another embodiment, SNMP Agents on managed servers can act as a master agent to which sub-agents can register. This will enable other platform products to instantiate their own agent independent of an application server and to register it as a sub-agent. Since applications can register their own agent to a sub-agent on a managed server, user-defined MBeans are available to other resources on the application server via SNMP by creating entries into the application server MIB.

In accordance with another embodiment, a system is described in which SNMP provides increased security and support for both Transmission Control Protocol/Internet Protocol (TCP/IP) and Universal Datagram Protocol (UDP) protocols by defining security aspects such as authentication and privacy. This allows user authentication, privacy and authorization based on application server security configuration as opposed to the limited community string based security provided in previous releases of SNMP.

In accordance with another embodiment, the security aspects of SNMP are centralized. In configuring the security aspects, each managed server on the application server can host its own SNMP Agent. The SNMP manager, which monitors all SNMP Agents, can communicate directly to the individual SNMP Agents on each managed server to get monitoring data. Embodiments of the present invention centralize this configuration. Credential information is configured across the domain in one location, which allows all SNMP Agents on the application server domain to share information.

These and additional features and advantages are described in further detail below.

BRIEF DESCRIPTION OF THE FIGURES

FIG. 1 shows a graphical representation of a system, comprising an administration server host, management information base, and a plurality of managed servers, in accordance with an embodiment.

FIG. 2 shows a graphical representation of a management information base in accordance with an embodiment.

FIG. 3 shows a graphical representation of a managed device, including agent/sub-agent architecture in accordance with an embodiment.

FIG. 4 shows a graphical representation of communication between a managed device and a network-manager.

FIG. 5 shows a SNMP Agent exposing manageable attributes of a managed device through SNMP in accordance with an embodiment.

FIG. 6 shows a diagram of a system in accordance with an embodiment, and shows the components used to dynamically extend SNMP MIB to expose a MBean with SNMP.

FIG. 7 shows a flow diagram in accordance with an embodiment, and illustrates a method to dynamically extend SNMP MIB to expose customer MBean with SNMP.

FIG. 8 shows a diagram to share security information across multiple SNMP Agents running within a domain for authentication and privacy in accordance with an embodiment.

FIG. 9 shows a flow diagram in accordance with an embodiment, and illustrates a method to share security information across multiple SNMP Agents running within a domain.

DETAILED DESCRIPTION

In accordance with an embodiment, a system is described in which each of a plurality of managed servers hosts a SNMP agent that can communicate with an SNMP Agent on an administration server. This allows a network-manager to access SNMP Agents hosted on managed servers. Since there is a SNMP Agent running within the managed server, the SNMP Agent on the managed server can make use of a local MBean server that is also running on the managed server, and monitor applications on that server. Furthermore, since there is a SNMP Agent deployed on each managed server, the network-manager has a domain wide view of the application servers, and all monitored information is centralized on the network-manager's SNMP Agent.

In accordance with an embodiment, each SNMP Agent on a managed server will act as a master agent to which sub-agents can register. This will allow other platform products to instantiate their own SNMP Agent independent of the application server and register it as a sub-agent. A MIB hosts MBeans defined by customers. The dynamic MIB differs from a MIB for application server MBeans in that it is defined at runtime. Since other platform product's can register their own agent to a sub-agent on a managed server, entries can be created in the application server MIB by exposing the attributes of customer defined MBEANS to SNMP. This allows user-defined MBeans within the application server framework to be made available to other resources on the application server, and allows the application server MIB to be extended dynamically.

FIG. 1 shows a graphical representation of a system, comprising an administration server host, management information base, and a plurality of managed servers, in accordance with an embodiment. As shown in FIG. 1, each managed server instance 32 and 33 hosts one or a plurality of applications 38 including MBean 40, a SNMP Agent 34, and one or more sub-agent 36. An administration server 24 running on host machine 20 includes SNMP Agent 28 that can provide a domain wide view over each of the MBean server via SNMP. In accordance with an embodiment, the JMX MBeans expose management functions of their applications. When SNMP Agent 34 collects information from a managed server, the name and attribute of the MBean from which data is collected is specified. The administration server can then provide the central point of control for configuring and monitoring the entire domain. A SNMP manager exchanges monitoring and control information about systems and network resources through the SNMP Agent 28. The SNMP Agent then queries the managed server's SNMP Agent for the requested information, and uses it to populate the MIB 26.

In accordance with an embodiment, the MIB can be a database, data structure, or other set of data or information, that is used to manage devices (such as routers and switches) in a communications network. Any system or network resource that is manageable through the exchange of information can be considered a managed resource. Manageable attributes of the resources are referred to herein as objects, and are accessed using a network-management protocol such as the SNMP protocol. The SNMP protocol facilitates the exchange of information between a network-manager and a managed resource.

FIG. 2 illustrates a MIB in accordance with an embodiment. As shown in FIG. 2, MIB 41 is comprised of a database or data structure 43, which in turn includes a hierarchical list of managed objects in the domain. Objects 45 and 47 represent managed resources (for example a router, or a switch) which can be monitored by the network-manager. Selected attributes 49 and 51 of a managed device are used by the network-manager to manage the network-device, and can be shared with other servers in the domain.

In accordance with an embodiment, SNMP management is based on an agent/manager model. Network and System Administrators use the network-managers together with the SNMP protocol to monitor network-attached devices for conditions that warrant administrative attention. A network-manager exchanges monitoring and control information about system and managed resources with distributed software processes that are referred to as agents. The agents (also referred to as SNMP Agents) in turn respond to network-manager requests for information. A computer running a SNMP Agent software can be considered a SNMP Agent, wherein the running SNMP service or agent software responds to information requests from one or multiple network-management systems. In accordance with an embodiment the SNMP service can also be configured to determine which statistics are tracked, and which management systems are authorized to request information.

In accordance with an embodiment, a SNMP Agent is a network-management software module that resides in a managed device or managed resource. The agents function as “collection devices” which gather and send data via SNMP about the managed device or resource, in response to a request from a network-manager.

In accordance with an embodiment, each SNMP Agent on the managed servers can act as a master agent to which one or more sub-agents can register. The network-manager views the sub-agent and the agent as one entity. The sub-agent provides an extensibility mechanism to dynamically generate MIB entries for custom or user MBeans. This allows for the monitoring and management of deployed MBeans through SNMP, by allowing other resources to expose their MIB as a sub-agent to the network-manager.

FIG. 3 illustrates a SNMP Agent and a managed device in accordance with an embodiment. As shown in FIG. 3, a managed device 61 hosts a SNMP Agent 65 and sub-agent 67. The agent/subagent pair will be viewed as a single entity by the network-manager. Platform devices can instantiate their own SNMP Agent independent of the application server and register it as a sub-agent, and the attributes of those devices are then available within the attributes exposed by SNMP Agent 65 and sub-agent 67 to the network-manager. As also shown in FIG. 3, resource 69 represents a platform device. In accordance with an embodiment, resources expose their MIB to sub-agent 67. SNMP Agent 65 then has local knowledge of manageable attributes 63 pertaining to managed device 61, and translates that information into a form compatible with SNMP.

FIG. 4 shows a graphical representation of the communication between a managed device and a network-manager in accordance with an embodiment. As shown in FIG. 4, SNMP Agent 95 exposes management data on managed device 91 and resource 97 as variables to network manager 81 using the SNMP protocol. The network-manager relies upon a database of definitions and information about the properties of managed resources and the services the agents support. This comprises the MIB. In accordance with an embodiment, when new agents are added to extend the management reach of a manager, the manager is provided with a new MIB component that defines the manageable features of the resources managed through that agent. The manageable attributes of resources, as defined in a SNMP-compliant MIB, are referred to as managed objects. Defining the heterogeneous components of an enterprise's distributed systems within a common MIB on the management station provides a unified perspective and single access point for managing system and network resources.

In accordance with an embodiment, several technologies are available that supply tools for managing and monitoring applications, system objects, devices (e.g. printers) and service oriented networks. For example, JMX is a Java-based technology that supplies tools for managing resources, in which the resources are represented by objects called MBeans. The JMX application server is supported by a variety of software vendors. Resources on the server can use JMX MBeans to expose their management functions. In accordance with an embodiment, a MBean is a Java class that is developed per JMX specifications, and can provide getter and setter operations for each management attributes within a managed resource, collect statistics (e.g., performance and resource usage) along with additional management operations that the resource makes available. As described above, resources on an application server can use SNMP and the agent/manager model to monitor those resources. In accordance with an embodiment, the system allows attributes exposed through the JMX layer ton also be exposed through SNMP to a network-manager within the same domain.

FIG. 5 illustrates a managed resource comprising a MBean and SNMP Agent in accordance with an embodiment. As shown in FIG. 5, application 101 is a managed resource that collects and stores application attributes 105. JMX layer 109 supplies the tools for managing and monitoring, amongst other things, applications. A MBean represents applications running on the JMX layer. MBean 103 is used both to get and set the configuration of application 101, and also collects statistics (for example, performance and resource usage) pertaining to application 101. SNMP Agent 107 inspects MBean 103, and exposes that information through SNMP 111.

In accordance with an embodiment, an inter-related set of application resources that are managed as single unit is referred to as a domain. A domain includes one or more servers. Within each domain, one server is an administration server, while other servers in the domain are referred to as managed servers. The administration server provides the central point of control for configuring and monitoring the entire domain and also has the ability to run the SNMP service. When the SNMP service is enabled for a domain, the administration server is functioning as the SNMP Agent for that domain.

FIG. 6 shows an illustration of a system for dynamically extending SNMP MIB to expose customer MBeans using SNMP in accordance with an embodiment. As shown in FIG. 6, domain 120 is an inter-related set of server resources that are managed as a unit. Domain 120 includes one or more servers. Within the domain is administration server 124, one or more managed server 150, and SNMP manager 132. In accordance with an embodiment, each managed server instance in the domain hosts a SNMP Agent. For example, FIG. 6 shows managed server 150 hosting SNMP Agent 144. In accordance with an embodiment, there can also be multiple managed servers in a domain, each hosting a SNMP Agent. The administration server's SNMP Agent 126 provides a domain wide view over the MBean server via SNMP. In accordance with an embodiment, managed server 150 uses JMX MBean 154 to expose management function 156 of application 151. When SNMP Agent 144 collects information from managed server 150, the name and attribute of the MBean from which data is collected is specified. Administration server 125 can then provide the central point of control for configuring and monitoring the entire domain 120. SNMP manager 132 exchanges monitoring and control information about systems and network resources through SNMP Agent 126. When configuring and monitoring a managed server 150, SNMP manager 132 communicates to SNMP Agent 126, which then queries the managed server's 150 SNMP Agent 144 for the requested information. In accordance with some embodiments, if SNMP manager 132 has been granted write access to the SNMP Agent 144, then SNMP manager 132 can also initiate a change to that SNMP Agent's configurations.

In accordance with an embodiment, the SNMP manager relies upon a database of definitions and information about properties of managed servers. For example, in accordance with an embodiment, a managed server's MBean 528 exposes managed server's attributes to SNMP Agent 144, which then communicates these attributes to the SNMP Agent located on the administration server. This information is used to populate MIB 128. When new SNMP Agents are added to extend the management reach of manager 132, then SNMP manager 132 must be provided with a new MIB component that defines the manageable features of the additional resources that are managed through that agent.

In accordance with an embodiment, application 151 exposes manageable resources 156 to MBean 154, and sub-agent 152 determines the attributes of MBean 154. The SNMP Agent on the managed resource can be considered as publishing data and/or monitoring data, and can be segmented as an agent and one or more sub-agents, in which the sub-agent attaches to the SNMP Agent and, as described above, are viewed as a single entity by the network-manager. The sub-agent monitors data and that data becomes available to an external SNMP manager. SNMP Agent 144 on the managed server then exposes that information to SNMP Agent 126 on the administration server. The administration server's SNMP Agent 126 then extends MIB 128 to add that information. In this manner MIB 128, which would otherwise be static, is extended at run time. This also allows any SNMP manager which is communicating with a SNMP Agent running on the domain to be aware of non-application server specific MBeans, and customer MBeans.

FIG. 7 shows a flowchart for a process to dynamically extend SNMP MIB to expose non-application server specific MBeans with SNMP in accordance with an embodiment. As shown in FIG. 7, in step 181, each managed server instance in the application server domain hosts a SNMP Agent. This agent provides a view of the JMX Runtime MBeanServer over SNMP. In addition, each managed server has its own SNMP Agent that will be a master agent for other non application server SNMP Agents. A sub-agent provides a means to dynamically generate MIB entries for user MBeans. In step 183 a SNMP Agent on the managed server acts as a master agent to which sub-agents can register. In accordance with an embodiment, the master-subagent architecture mandates unique object identifiers (OlDs) for each subagent. This allows non-application specific applications to expose their attributes as a sub-agent to the application server master agent. In step 185 a dynamic MIB is created that hosts all non-application server specific MBeans registered in the Runtime MBean Server. In accordance with an embodiment, the system uses a SNMP table defined in the MIB for each non-application server specific MBean type, in which all instances of this type appear as a row in the SNMP table. This MIB is defined at runtime and a sub-agent registered with the managed server's SNMP Agent acts as a master agent. In step 187 a customer MBean is used to manage and expose a set of attributes about a non-application server specific application. In step 189 the customer MBean exposes those attributes to the sub-agent registered to the SNMP Agent on the administration server. In step 191 the SNMP Agent makes these attributes available through SNMP to any SNMP manager which is communicating with the SNMP Agent on the same application server.

Sharing of Security Information

In accordance with another embodiment, a system is described in which SNMP provides increased security and support for both Transmission Control Protocol/Internet Protocol (TCP/IP) and Universal Datagram Protocol (UDP) protocols by defining security aspects such as authentication and privacy. This allows user authentication, privacy and authorization based on application server security configuration as opposed to the limited community string based security provided in previous releases of SNMP.

In accordance with another embodiment, the security aspects of SNMP are centralized. In configuring the security aspects, each managed server on the application server can host its own SNMP Agent. The SNMP manager, which is monitoring all SNMP Agents, can communicate directly to the individual SNMP Agents on each managed server to get monitoring data. Embodiments of the present invention centralize this configuration. Credential information is configured across the domain in one location, which allows all SNMP Agents on the application server domain to share information.

FIG. 8 shows an illustration of a system to share security information across multiple SNMP Agents running within a domain for authentication and privacy in accordance with an embodiment. As shown in FIG. 8, each of a plurality of managed devices 201-207 can host a SNMP Agent. Each SNMP Agent on managed devices 201-207 communicates with SNMP manager 211 on network-manager 209. Credential information can be configured on SNMP manager 211 and communicated using a data replication service 214 to each SNMP Agent in the domain. In this respect, credential information is configured across the domain in one location. Since all SNMP Agents on managed devices communicate with the SNMP manager, all SNMP Agents on the application server domain can share credential information.

FIG. 9 shows a flowchart for a process to share security information across multiple SNMP Agents running within a domain in accordance with an embodiment. As shown in FIG. 9, in step 221 each managed server instance in the application server domain hosts a SNMP Agent. This agent provides a view of the JMX Runtime MBeanServer over SNMP. In step 223 the SNMP manager monitors each SNMP Agent running on the different managed servers, and can directly communicate with each individual SNMP Agent to obtain monitoring data. In step 225 the SNMP manager configures security aspects of SNMP. This allows the configuration of SNMP security aspects to be centralized at the SNMP manager. Since all SNMP Agents communicate with the SNMP manager, using, for example, a data replication service, each agent can communicate with one another through the SNMP manager. In step 227, agents in the domain share security information amongst each other. Since these security configurations are made available to all agents from the SNMP manager, only the SNMP manager is configured, rather than each individual agent. This provides advantages over the cumbersome task of configuring the security aspects of each SNMP Agent individually.

The present invention may be conveniently implemented using a conventional general purpose or a specialized digital computer or microprocessor programmed according to the teachings of the present disclosure. Appropriate software coding can readily be prepared by skilled programmers based on the teachings of the present disclosure, as will be apparent to those skilled in the software art.

In some embodiments, the present invention includes a computer program product which is a storage medium (media) having instructions stored thereon/in which can be used to program a computer to perform any of the processes of the present invention. The storage medium can include, but is not limited to, any type of disk including floppy disks, optical discs, DVD, CD-ROMs, microdrive, and magneto-optical disks, ROMs, RAMs, EPROMs, EEPROMs, DRAMs, VRAMs, flash memory devices, magnetic or optical cards, nanosystems (including molecular memory ICs), or any type of media or device suitable for storing instructions and/or data.

The foregoing description of embodiments of the present invention has been provided for the purposes of illustration and description. It is not intended to be exhaustive or to limit the invention to the precise forms disclosed. Many modifications and variations will be apparent to one of ordinary skill in the relevant arts. For example, steps preformed in the embodiments of the invention disclosed can be performed in alternate orders, certain steps can be omitted, and additional steps can be added. The embodiments were chosen and described in order to best explain the principles of the invention and its practical application, thereby enabling others skilled in the art to understand the invention for various embodiments and with various modifications that are suited to the particular used contemplated. It is intended that the scope of the invention be defined by the claims and their equivalents.

Claims

1. A system to dynamically extend a SNMP MIB to expose a customer MBean with SNMP comprising: a managed server instance of an application that hosts a SNMP Agent;an agent or sub-agent registered to said SNMP Agent on each managed server;a management information base which describes different management attributes that the application server exposes; anda network-manager that hosts a SNMP manager that communicates with said SNMP Agents,wherein a non-application server specific MBean exposes a set of attributes about the application to the sub-agent and hosts the non-application server specific MBean in a dynamic MIB, and wherein the set of attributes are communicated through SNMP by the SNMP Agent to a SNMP manager, to extend the SNMP MIB dynamically, and allow the non-application server specific MBean to be exposed through SNMP.

2. The system of claim 1 wherein each managed server instance in the domain has its own SNMP Agent.

3. The system of claim 1 wherein the SNMP Agent on the managed server acts as a master agent to which a sub-agent can register.

4. The system of claim 1 wherein the SNMP manager exchanges monitoring and control information about systems and network resources through the SNMP Agent on an administration server.

5. The system of claim 1 wherein the network-manager views the sub-agent and the SNMP Agent as one entity, and wherein the sub-agent provides an extensibility mechanism to dynamically generate the MIB entries for a custom MBean.

6. The system of claim 1 further comprising a non-application specific application that exposes an attribute to an application server's master agent, wherein as a result of the non-application specific application exposing the attribute to the application server's master agent a dynamic MIB is created that hosts non-application server specific MBeans.

7. A method to dynamically extend a SNMP MIB to expose a customer MBean with SNMP comprising the steps of: hosting a SNMP Agent on each managed server instance of an application server in a domain;registering a sub-agent to said SNMP Agent on each managed server;creating a dynamic MIB that hosts all non-application server specific MBeans managing and exposing a set of attributes about a non-application server specific application by a MBean;exposing those attributes to the sub-agent registered to the SNMP Agent on the managed server by said MBean;communicating said attributes through SNMP by the SNMP Agent to a SNMP manager which is communicating with the SNMP Agent running on the same application server;wherein making said attributes available through SNMP to any SNMP manager extends the SNMP MIB to add said attributes into the SNMP MIB.

8. The method of claim 7 wherein each managed server instance in the domain has its own SNMP Agent.

9. The method of claim 7 wherein said SNMP Agent provides a read-only access to a MBean server.

10. The method of claim 7 wherein said SNMP Agent on said managed server will be configurable.

11. The method of claim 7 wherein each SNMP entity has a unique id within an application server domain.

12. The method of claim 7 further comprising the steps of: configuring security aspects of SNMP on said SNMP manager, wherein the security aspects are centralized to said SNMP manager;wherein a SNMP manager which is monitoring SNMP Agents running on different managed servers can directly go to individual SNMP Agents on those server to configure security aspects;wherein the SNMP Agents can share information with other SNMP Agents in the domain.

13. A computer readable medium including instructions stored thereon which when executed cause the computer to perform the steps of: hosting a SNMP Agent on each managed server instance of an application server in a domain;registering a sub-agent to said SNMP Agent on each managed server;creating a dynamic MIB that hosts all non-application server specific MBeans;managing and exposing a set of attributes about a non-application server specific application by a MBean;exposing those attributes to the sub-agent registered to the SNMP Agent on the managed server by said MBean;communicating said attributes through SNMP by the SNMP Agent to a SNMP manager which is communicating with the SNMP Agent running on the same application server;wherein making said attributes available through SNMP to any SNMP manager extends the SNMP MIB to add said attributes into the SNMP MIB.

14. The computer readable medium of claim 13 wherein each managed server instance in the domain has its own SNMP Agent.

15. The computer readable medium of claim 13 wherein said SNMP Agent provides a read-only access to a MBean server.

16. The computer readable medium of claim 13 wherein said SNMP Agent on said managed server will be configurable.

17. The computer readable medium of claim 13 wherein each SNMP entity has a unique id within an application server domain.

18. The computer readable medium of claim 13 further comprising instructions stored thereon which when executed cause the computer to perform the steps of: configuring security aspects of SNMP on said SNMP manager, wherein the security aspects are centralized to said SNMP manager;wherein a SNMP manager which is monitoring SNMP Agents running on different managed servers can directly go to individual SNMP Agents on those server to configure security aspects;wherein the SNMP Agents can share information with other SNMP Agents in the domain.