A Framework for Situation-Aware Monitoring

Stacks Image 377
Heed helps a user know when and what to monitor.

Heed is a scale and framework to help observers of complex systems evaluate which situations need scrutiny and when, along with an example heed-based interface that encourages the development of situation awareness. By presenting the importance of attending to each situation on a scale instead of in a binary state, observers are able to classify which situations need their attention and which can be safely ignored, and by presenting how that importance is changing, they can predict when a situation might need their attention. The heed framework makes it possible for observers to describe situations in terms of a rich set of conditions and logical operators, and the interface enables them to refine their descriptions and perceive the importance of attending each situation.
Objective vs. Subjective Monitoring Tools

Monitoring is a complex task, and is limited by an observer's vigilance. Observer's attention to monitor must inevitably compete with their many other duties. To decide when and what to monitor, many observer's rely on their experience, their knowledge, and even their gut. These are all subjective qualities. However, most monitoring applications are purely objective tools that only convey sensor readings. To support subjectivity, a monitoring tool must make it possible for an observer to describe and define their knowledge to the application. The heed framework is a means of describing that knowledge in terms of what situations to attend to.
Monitoring for Abnormal Conditions
A common monitoring goal is to identify a situation wherein a system is operating abnormally. The NOT operator enables an observer to define a situation in terms of normal conditions, and then, using the NOT operator, the observer can know the less normal a situation, the more important it is to attend.
Stacks Image 378
Monitoring Independent Conditions
Let's face it, there are a whole lot of situations an observer monitors for, and they don't all depend on one another. In that case, it's valuable to compact many independent situations into a single display. By using the OR operator, many situations can be represented by a single heed value; namely the highest heed value of the constituent situations.
Stacks Image 379
Monitoring Dependent Conditions
Most situations that observers monitor for in complex environments depend on many conditions that all depend on one another. E.g. a server might need attention when CPU load is high and while disk activity is high and while network activity is high. Each independently is not cause for much concern, but all together needs attention. The AND operator enables observers to combine dependent conditions to describe a situation that needs their attention. The more each condition is met, the more the heed of the whole situation increases.
Stacks Image 380
Monitoring with Mitigating Conditions
Many situations that observers monitor for, which might be mistaken for abnormal may actually be as expected, given mitigating circumstance. E.g. processor load is typically low, unless a nightly backup is underway; in other words, high processor load during a nightly backup does not make it an important situation to pay attention to. By enabling the observer to include mitigating circumstances in the heed calculation, the overall heed representation is able to remain more trustworthy.
Stacks Image 381
  • More details about the Heed framework can be found in my dissertation (10MB pdf).
  • See how Heed has been applied in four unique applications.