Reconfigurable Framework for Remote Monitoring and Management of Computer

Systems

Gülşah Yalçın Halit Oğuztüzün

Computer Engineering, Middle East Technical University Computer Engineering, Middle East Technical University
Ankara, Turkey Ankara, Turkey
Email: [email protected] Email: [email protected]

Abstract—Remote Monitoring and Management systems are systems and administrate them from a single center, Remote
information technology software tools to organize and manage Monitoring and Management (RMM) software tools are
client workstations. They are used by many companies that being used by organizations. RMM software generally has
are willing to minimize their labor cost, collect and measure two components, one of which is an admin portal used by
the data of a variety of clients, administrate them from a an IT personnel and the other is agent deployed to managed
single point, in a reliable and secure way. Dynamic profile client computers. With the help of the agents, RMM system
deployment, dynamic reconfiguration of monitors in response identifies newly joined clients and deploys some default and
to changes in clients’ profiles and creating notifications or predefined set of monitoring mechanisms and instructions.
running a procedure on the fly are the main features of remote There is also need for RMM systems to take actions after
monitoring systems which can be fully expressed by Dynamic deployment and show dynamic behaviors during runtime.
Software Product Line Approach. Reconfigurable Framework At this point, the application of Dynamic Software Product
for Remote Monitoring and Management of Computer Systems Line (DSPL) Engineering methodology seems well suited
aims to provide IT service providers with a dynamically for RMM systems. Although there is extensive academic
reconfigurable, reusable and easy to define smart monitoring research on DSPL concepts and techniques, the application
and measurement mechanism. It applies dynamic software areas and best practices in business are still preliminary.
product line concepts which are well defined in academic How DSPL mechanisms are put into practice in RMM
studies but not extensively implemented in business realm.
product families and what are the effectiveness, benefits and
gains in DSPL approach applied to RMM systems are the
It enables information technology management systems with
driving questions for this paper.
reusable and autonomously monitoring software assets.
Index Terms—Remote Monitoring and Management, Dynamic 1.2. Motivation
Software Product Line, Reconfigurability, Runtime Adaptation
A Remote Monitoring and Management System is used
to manage clients workstation remotely by aiming auto-
matic, reliable and maintainable management monitors. The
1. Introduction features of RMM are varying according to the custom needs.
Nevertheless, in all of them, RMM can detect the new
1.1. Problem Statement clients joining the network and then configure and manage
them automatically by the rules prescribed by IT service
Increasing demand for complex multidisciplinary sys- providers. For example, after new client identification is
tems, fast developing technology trends and need for adap- completed, a default profile defined by IT manager or a
tation to a fast evolving world require large scaled, multi em- specific one to this client is deployed to the workstation
ployee companies in almost every field. To ensure the sus- and controls the end user achine remotely. In a security
tainability of the work flow, increase productivity by keep- concerned profile,the manager can define such a rule that
ing employees workstations healthy and consistent, keep Malware Detection monitor starts to watch the computer
servers, network areas or other software systems of company and whenever it detects a virus or spy, it removes the
always up and running, companies hire Information Tech- malware automatically, or creates a notification to user or
nology (IT) staff and managers. Another key point for com- Management Service Providers. As another rule concerned
panies having computer systems is enhancing the quality with, whenever a CPU Monitor detects that CPU usage is
of service and reducing the risks, therefore they budget for exceeding the 70 percentage, then Event Log Monitor also
Management Service Providers (MSP). To reduce the cost to is set up. Considering these features, remote monitoring
employ IT management staff but more importantly diminish and management software is very suitable to model it as
the human errors, automate the management of computer Dynamic Software Product Line. With this motivation, Re-
configurable Framework for RMM Systems emerged which Line (SP L) development is one of leading approaches for
facilitates the construction and configuration of remote mon- large-scale product families in which many of them share
itors by applying the dynamic reconfiguration and asset the same components and have variable and configurable
reuse approaches guided by a variability model. options and requirements. Software product line approach
aims to create a product portfolio with lower cost and high
1.3. Contributions quality by adopting reusable software components. However
the more important need; adaptation to variable systems and
Reconfigurable Framework for RMM Systems con- environment, sensing the changes in context conditions have
tributes the software engineering domain by exploring the led to a newer approach: Dynamic Software Product Lines
applicability of DSPL methodology in the Remote Moni- [2]. In todays large and heterogeneous systems, determin-
toring and Management domain. Although the framework ing the requirements and features before deployment phase
addresses computer systems, it can also be a guide for is not enough, instead there is an emerging challenge to
monitoring systems in other application fields. handle variability during runtime. DSPL approach supports
to define the variability points of a system for both pre and
1.4. Organization post deployment stages and then suggests feature activation
and deactivation mechanisms to handle autonomous decision
In the rest of the paper, initially the background for making and then dynamic reconfiguration of software assets
RMM and DSPL concepts, then commonality and variation during execution. [3]
points analysis of RMM systems is given, which is an impor- Dynamic software product lines provide following prop-
tant phase for dynamic software product line development. erties:
Then the details of the framework in terms of architec-
ture, self awareness and dynamic binding mechanism and • Adaptation to dynamically varying system and en-
reusable assets are explained. vironment needs.
• Dynamic reconfiguration of product by applying au-
tonomous decision making at runtime.
2. Background • Support for wide range of product families with the
help of reusable software components.
2.1. Remote Monitoring and Management • Management of variability driven by an explicit
variability model.
Remote Monitoring and Management is software tool
used by IT/Management service providers to manage and
organize their client systems. A RMM system enables 2.3. Variability Modeling with Feature Models in
Managed Service Providers to setup monitors over client DSPL
computers/systems to gather information and data pertain-
ing to how the system is performing and to supervise the
security and performance related issues. With the help of A distinguishing aspect of a DSPL from manual-
monitoring mechanism, MSPs or technical support team managing systems in general is that a DSPL must possess
can execute management tasks autonomously [1]. Remote a variability model explicitly, variability management and
Monitors are, in general, shaped with three main concerns: dynamic adaptation mechanisms must be using this model.
Security, Performance and Communication. Under these In a product family, the most important thing to maxi-
categories; TCP, Network Bandwidth, CPU, RAM, Folder mize the reuse of product components is determination of
Size, File Size, Malware Detection and many other monitors commonalities and variabilities between them. Every single
are set to clients and their workstations are managed by ser- aspect that is common or distinct can be accepted as a
vice providers remotely. An autonomous and self-adaptive variant for this product family. It is crucial to identify the
remote monitoring and management software is preferred goals for a system, ask domain questions and give explicit
by many company because it helps reduce labor cost and answers to these questions, and in return they are also
replace the error prone manual management systems. Instead another variability points/variants [4] On the other hand,
of wasting hours for employed IT support teams, RMM a product also can have some internal states and vary
software with a single IT manager can organize the client by the environmental changes during execution cycles. To
machines automatically by minimizing human factor and adopt product to the resulting conditions, some features are
solve the issues without interrupting the client. activated or deactivated and the system needs to evolve and
achieve self adaptation. All possible features that can be
active for a product or system are also variation points.
2.2. Dynamic Software Product Lines
"Commonalities and variabilities are modeled
To react to dynamic needs originating from humans, from the perspective of product features, âĂIJs-
system or environmental changes and new feature demands takeholder visible characteristics of productsâĂİ
in software intensive products, new approaches and so- in a product line that are of stakeholders concern.
lutions have appeared in the literature. Software Product [4]
 Remote Monitoring

Resource Security Performance Energy

Utilization

CPU
Services Monitor Event Log Idle State
Folder
Monitor Monitor Monitor
Size
Monitor Disk Space
Monitor
File Size Process
Monitor Monitor RAM Monitor

Malware
Detection

Access Intrusion Detection

Restriction
Online(Web Offline Feature
Injection) Dectection
Detection Monitor Excludes Mandatory Feature
Monitor

Optional Feature

USB Detection CD/DVD Detection Network Traffic TCP Monitor Ping

Multiple Choice
Monitor Monitor Monitor Monitor

Single Choice

Excludes Requires

Figure 1: Remote Monitoring System Feature Model

3. Feature Model of RMM Systems and it will be working as a background task. It

should enable IT technician to configure RMM for
In the RMM systems, management involves monitoring different type of user groups as well as individual
of workstations and collecting the monitor outputs. There- users.
fore determination of monitors according to the profile of • Performance Attribute: RM must be functioning for
clients is the initial step of system development. For the up to 2000 online clients at a time.
Commonality and Variability management(C&V) of Remote
Monitoring (RM), which is the building block of DSPLs,
3.2. Solution Space Dimension
we adopt the aspect and viewpoint oriented approach in-
troduced by Kyo C. Kang and Hyesun Lee in [4]. C&V
• Capabilities: Clients can have different profiles in
of a product line can be modeled in many different ways
accordance with the several categories such as Re-
based on different viewpoints adhering to the principle of
source Utilization, Security, Performance and En-
separation of concerns. In the problem space, user goals
ergy. According to profile applied to a client work-
and objectives, required quality attributes, and product usage
station, different monitors are dynamically loaded or
contexts are typically modeled in product line engineering.
unloaded at run time.
In the solution space, C&V is modeled for the functional
• Operating Environment: Windows (XP and later)
dimension (i.e., capabilities, services), the operating envi-
ronmental dimension (e.g., operating systems, middleware), Figure 1 shows the constructed Remote Monitoring Sys-
and the design dimension (e.g., domain technologies). tem Feature Model by using the FORM approach [5]. The
model reflects only functional dimension of common and
3.1. Problem Space Dimension variable points belonging to RMMs, and other dimensions
are out of the scope of this paper. Every monitor depicted
Some variability points are derived from the goals that in the model represents a feature of the RMM system. The
are addressed by different assets of a software product activation and deactivation of these features determine the
line. These goals shape the product features and also the current configuration of the system. For some product lines
variability model of product line in return. From this point there may exist potentially conflicting or dependent features,
of view, it is useful to identify following concepts for C&V RMM system modeled in this framework also has these
of Remote Monitoring systems: kind of features. For example, when Malware Detection
• The goal: Enable IT staff with a remote monitoring Monitor or its sub feature Online (Web Injection) Detection
and management system for the clients. is chosen by IT manager for this client, Network Traffic
• Usage Context: Remote Monitoring and Manage- Monitor must also be activated to control the injections. On
ment will be available for various operating systems the other hand, because Online Malware Detection means
 TABLE 1: Feature Dictionary of RMM System

Feature Definition

This feature is the first of four main and abstract features of the RMM system. It has four child feature
Resource Utilization watching the different sources of computer systems: Folder Size, File Size, Process and Service Monitors.
Resource Utilization feature is mandatory and the system must have at least one child feature of it.

This feature continuously watches the size of predefined folder, if the size of it becomes higher than the
Folder Size Monitor
specified value, this value is reported to the system immediately.

This feature continuously watches the size of predefined file, if the size of it becomes higher than the
File Size Monitor
specified value, this value is reported to the system immediately.

This feature continuously watches the predefined process or set of processes, if the running state of
Process Monitor
process changes, status is reported to the system immediately.

This feature continuously watches the predefined service or set of services, if the running state of
Service Monitor
processes changes, status is reported to the system immediately.
This feature is the second of four main and abstract features of the RMM system. This optional feature
Security aims to detect security vulnerabilities on computer systems. It has 3 different child feature : Access
Restriction, Malware Detection, Intrusion Detection.
This abstract feature watches the drivers of computer systems with restricted access to drivers. USB
Access Restriction Detection and CD/DVD Detection Monitors are the concrete child of this feature. When Access
Restriction is activated, one of these features must also be activated.

USB Detection Monitor This feature continuously monitors the USB drive and reports the existence of drive to the system when
it is detected

CD/DVD Detection Monitor This feature continuously monitors the CD/DVD drive and reports the existence of drive to the system
when it is detected
This is an abstract feature to monitor the malware attacks to computer systems. When Security feature is
Malware Detection activated, this feature must also be activated. Two concrete child features; Online and Offline Detection
Monitors can be alternatively active in a system.
This concrete feature monitors the attacks that can take place over the Internet. When this feature is
Online Detection Monitor activated, Network Traffic Monitor feature must also be activated. Idle State Monitor cannot be active
when this feature is active.
This concrete feature monitors the changes in operating system caused by the applications of computer
Offline Detection Monitor systems. It reports the security vulnerability to the system. Event Log Monitor must also be activated
when this feature is activated.
This feature is an abstract feature to detect the unauthorized entry to the system. Intrusion Detection
Intrusion Detection Monitor must be activated when Security feature is activated. At least one of three concrete child of it;
Network Traffic, TCP and Ping Monitors must also be activated.

This feature checks the network traffic of computer system at the specified frequency and when the
Network Traffic Monitor
percentage of usage exceeds the specified threshold, it reports the percentage to the system.

This feature monitors the specified TCP Port at the specified frequency. It reports the state changes and
TCP Monitor
the list of connected clients to the system.

This feature pings the specified URL at the specified frequency and reports the packet loss percentage
Ping Monitor
when the it exceeds the specified threshold.
This mandatory feature is the third of four main and abstract features of the RMM system. It has four
Performance child feature monitoring the components that can be a measure of performance: CPU, Disk Space, RAM
and Event Log Monitors. At least one of these coexisting features must be active in the system.

This feature watches the percentage of CPU usage and reports to the system together with the current
CPU Monitor
value when the specified percentage value is exceeded.

This feature keeps track of the usage of disk space, reports to the system together with the current value
Disk Space Monitor
when the specified percentage is exceeded.

This feature keeps track of RAM usage, reports the system together with the current value when the
RAM Monitor
specified percentage is exceeded.
This feature monitors the Event Log component of Windows Operating System, reports error log to the
Event Log Monitor system together with application name. This feature can also be configured to track error logs for a
specific application.

Energy This optional feature is the last of four main and abstract features of the RMM system. It has one child
feature: Idle State Monitor.
It is a concrete feature that monitors the idle state of the system. It continuously checks the indicators of
Idle State Monitor idle state; whether the screen protector is active, a user input is present or the mouse and the keyboard
are not used for a certain period of time. It reports the idle state changes to the system.
Figure 2: Remote Monitoring System Software Components

that possibly workstation user is online and there is an active

network traffic over computer, RMM system excludes the
Idle State Monitor.

4. The Framework as a DSPL

Figure 3: Remote Monitoring System Activity Diagram
A RMM system consists of two components; the first
component which is the portal assists IT staff/manager to example, a RAMMonitor can be implemented in a way
create and manage monitors and the second one which is the that it observes the RAM usage periodically and creates a
agent manages client workstations according to the profiles notification to IT manager if the usage exceeds 70 percent-
assigned them. The framework provides an infrastructure age. To handle notifications and collect the outputs gener-
to implement the second part of Remote Monitoring and ated by monitors, MonitorResultCollector class is presented
Management systems. by the framework. The results of monitors are interpreted
as new states of features by MonitorResultCollector and
4.1. Architecture resulting configuration is sent to FeatureActivator through
MonitorManager. FeatureActivator interprets the output and
Reconfigurable Framework for RMM Systems adopts examines if any new activation or deactivation is required.
the component based architectural style. After the latest If there is any change, new set of features are sent to
configuration is determined according to the profiles of a ConfigurationValidator to check possible conflicts. As it is
client, the monitor components related with the activated stated in the Feature Model of RMM Systems section of
features are set up. A change in a profile means that there is a this article , RMM have some conflicting and interdependent
need for new configuration and new active features in accor- features therefore ConfigurationManager must handle these
dance with these configuration. The features correspond to situations.
monitors, which are dynamically reconfigurable components
on RMM systems. 4.2. Context Awareness & Dynamic Binding
Framework defines a generic and abstract monitor named
SmartMonitor and enable the product line engineer to define The set of active features make up the current config-
specialized monitors according to the different features of uration of RMM system. New profile deployment is the
product. All monitors in the product line of RMM are trigger to create a new configuration and consequently a
derived from this class and the specification of monitors set of active features. Whenever new profile is gathered
differ in accordance with the different behavior of remote by the RMM agent of client workstation during execution,
monitoring mechanisms (See Figure 2). reconfiguration of agent is needed. Besides that, during the
SmartMonitor implements the AbstractPlugin interface silent execution, some conditions arise that affect the states
which enables monitors to run as reconfigurable plug-ins. of the features. For example, an IT manager can define a
MonitorManager component of the framework facilitate profile in such a way that, whenever Idle State Monitor
plug-in loading or unloading with the help of PluginLoader detects that workstation is in idle state at some point, Offline
class. SmartMonitors can be dynamically created at run- Detection Monitor of Security Feature must be activated
time and they watch the client system, apply a procedure (See Figure 3). The FeatureActivor component of the frame-
if threshold exceeds or the specific condition is met. For work is responsible to determine which features must be
 RAM, Event Log, Folder Size, File Size, Process and Ser-
a)
DSPL vice Monitors. These are predefined software components
System
and they can be utilized on different RMM implementations
as is or can be reconfigured according to different operating
F1 F2
c1
Condition X true, F1 active
c2 environment and system needs.

Condition Y true, F3 active

Condition Z true F4 active

F3 F4
5. Discussion and Future Work
c)
Reconfigurable Framework for Remote Monitoring and
b)
Management of Computer Systems deals with the functional
c1 = {F2} requirements of RMM systems. Work is ongoing to imple-
c2 = {F1,F2} c3 c4 ment the framework based on the dynamic software product
c3 = {F1,F2,F3} line paradigm.
c4 = {F1,F2,F4} Regarding feature model given in Section 3, only func-
tional dimension of commonality and variability points are
Figure 4: Configuration Validation Example evaluated and related monitors are brought up as features of
RMM system. For future work, non functional requirements
and design decisions of such systems will also be addressed
activated or deactivated conforming to the changes in profile and an extended feature model will be provided.
or client workstation modifications (results of the monitors
as stated in the previous example) and dynamically binds the 6. Acknowledgements
necessary configuration to the running system by passing a
set of features to ConfigurationValidator component. This This work has been supported by TÜBİTAK ARDEB
behavior of the system is called as context awareness and 1001 program under grant number 215E188. Technical sup-
self adaptation on post deployment phase of the product. port has been provided by Comodo Group, Inc., Ankara.
To explain the approach applied in framework more
simply, four featured DSPL system can be given as an References
example (See Figure 4.a). In such a system with the given
feature model, four different configurations are possible: c1, [1] CGS, “What is Remote Monitoring and Maintenance (RMM)?.”
c2, c3 and c4. In all these configurations F2 is included http://searchitchannel.techtarget.com/definition, Accessed 5 March.
because it is a must feature, and either F3 or F4 is present 2016.
alternatively (See Figure 4.b) The system always monitors [2] R. Capilla, J. Bosch, P. Trinidad, A. Ruiz-Cortés, and M. Hinchey,
the changes in its execution environment and captures the “An Overview of Dynamic Software Product Line Architectures and
Techniques: Observations From Research and Industry,” Journal of
conditions X, Y and Z. When the current configuration is c1 Systems and Software, vol. 91, pp. 3–23, 2014.
and condition X is true, F1 is eligible to be activated but con-
[3] C. Cetina, V. Pelechano, P. Trinidad, and A. R. Cortés, “An Architec-
figuration validation mechanism checks that the resulting set tural Discussion on DSPL,” in SPLC (2), pp. 59–68, Citeseer, 2008.
of features F1,F2 does not contain any contradiction and this
[4] R. Capilla, J. Bosch, K.-C. Kang, et al., “Systems and Software
configuration is one of the available configurations(which is Variability Management,” Concepts Tools and Experiences, p. 32,
c2). As an another example, the fulfillment of condition Y 2013.
requires the activation of F3 feature. It is safe to activate this [5] K. C. Kang, S. Kim, J. Lee, K. Kim, E. Shin, and M. Huh, “FORM:
feature if the current configuration is c2, because resulting A feature Oriented Reuse Method With Domain Specific Reference
configuration will be c3 which is in the available list, but it is Architectures,” Annals of Software Engineering, vol. 5, no. 1, p. 143,
not safe if the current configuration is c1 or c4 because there 1998.
are no such feature sets like {F2,F3} and {F1,F2,F3,F4} in
the possible configurations (See Figure 4.c).

4.3. Reuse of Assets

All software components of the framework are designed

in such a way that they can be reused for different prod-
ucts in remote monitoring and management system product
families.
Components like MonitorManager, AbstractPlugin or
SmartMonitor are the generic classes defined by the frame-
work. It also presents a set of already implemented and
ready to use monitors. They are performance and resource
utilization concerned monitors including CPU, Disk Space,