Methods and apparatus for remediation execution

• US 10,291,471 B1
• Filed: 11/28/2016
• Issued: 05/14/2019
• Est. Priority Date: 09/16/2011
• Status: Active Grant

• Current Assignee: Tripwire Incorporated (Belden Inc.)
• Original Assignee: Tripwire Incorporated (Belden Inc.)
• Inventors: Whitlock, David, Gascoigne-Piggford, Guy, Granum, Geoff, Petrie, Mark
• Primary Examiner(s): Maskulinski, Michael
• Application Number:
  US15/362,566
• Time in Patent Office: 897 Days
• CPC Class Codes: G06Q 10/0633 Workflow analysis
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/0816 the condition being an adaptation, e.g. in response to network events
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]

Abstract

Disclosed herein are methods, systems, and articles associated with remediation execution. In embodiments, a set of policy test failures may be selected for remediation. The set of policy test failures may be associated with a computer network with a number of nodes. For each failure within the set of policy test failures, a remediation script may be obtained to remediate a corresponding policy test failure. The remediation scripts may be selectively provided to nodes that are affected by policy test failures, for execution by the nodes. A remediation script result for each remediation script executed may be received. Based upon the remediation script results, it may be determined whether or not execution of the remediation scripts was successful.

Claims

1. A method comprising:

selecting, by a computing device, a set of policy test failures for remediation, the set of policy test failures being associated with a computer network having a plurality of nodes;

obtaining, by the computing device, one or more remediation scripts corresponding to the policy test failures;

providing, by the computing device, the remediation scripts, selectively, to the nodes that are affected by the policy test failures, for execution by the nodes;

subsequent to execution of the remediation scripts, gathering, by the computing device, a list of post-remediation categories from policy tests;

coalescing, by the computing device, duplicate post-remediation categories;

based upon the list of post-remediation categories, determining, by the computing device, post-remediation functions to be performed; and

executing or causing to be executed, by the computing device, one or more of the post-remediation functions.

2. The method of claim 1, further comprising:

eliminating, by the computing device, redundant post-remediation functions.

3. The method of claim 1, further comprising:

queuing, by the computing device, the remediation scripts for providing to the one or more nodes, such that only one remediation script per node is executed at a time.

4. The method of claim 1, further comprising determining whether or not execution of the remediation scripts was successful by determining whether an exit code for a particular remediation script executed at a node has a non-zero value, indicating execution of the particular remediation script at the node failed.

5. The method of claim 1, further comprising:

receiving, by the computing device, from the nodes, a remediation script result for each remediation script executed; and

based upon the remediation script results, determining, by the computing device, whether or not execution of the remediation scripts was successful.

6. The method of claim 1, further comprising:

adding to the policy tests, by the computing device, information including operations required after selective execution of the remediation script at the nodes; and

based upon the information and subsequent to the execution of the remediation scripts, executing or causing to be executed, by the computing device, one or more of the operations within the computer network.

7. The method of claim 6, wherein the information includes one or more services that need to be started subsequent to the selective execution of the remediation scripts, services that need to be stopped subsequent to the selective execution of the remediation scripts, services that need to be re-started subsequent to the selective execution of the remediation scripts, or nodes that need to be re-booted subsequent to the selective execution of the remediation scripts.

8. The method of claim 6, wherein the information further includes one or more of either an identity of each of one or more nodes within the computer network that is affected by the selective execution of the remediation scripts, or the remediation scripts selectively provided to the nodes for execution, or both.

9. An article of manufacture comprising:

a non-transitory computer-readable storage medium; and

a plurality of programming instructions stored on the storage medium and configured to program one or more computing devices, in response to execution of the programming instructions, to perform operations including;

selecting a set of policy test failures for remediation, the policy test failures being associated with a computer network having a plurality of nodes;

obtaining one or more remediation scripts for execution by one or more nodes to remediate the one or more policy test failures;

providing, selectively, the remediation scripts to the nodes that are affected by the policy test failures, for execution by the nodes;

subsequent to execution of all remediation scripts, gathering, by the computing device, a list of post-remediation categories from policy tests;

based upon the list of post-remediation categories, determining, by the computing device, post-remediation functions to be performed;

coalescing, by the computing device, duplicate post-remediation categories; and

executing or causing to be executed, by the computing device, one or more of the post-remediation functions.

10. The article of manufacture of claim 9, wherein the operations further include:

queuing remediation scripts for providing to the one or more nodes, such that only one remediation script per node is executed at a time.

11. The article of manufacture of claim 9, wherein the operations further include determining whether or not execution of the remediation scripts was successful by determining whether an exit code for a particular execution of a remediation script at a node has a non-zero value, indicating the particular execution of the remediation script at the node failed.

12. The article of manufacture of claim 9, wherein the operations further include:

receiving, by the computing device, from the nodes, a remediation script result for each remediation script executed; and

based upon the remediation script results, determining, by the computing device, whether or not execution of the remediation scripts was successful.

13. The article of manufacture of claim 9, wherein the operations further include:

based upon information within the policy tests and subsequent to executing the remediation scripts, executing one or more operations within the computer network.

14. The article of manufacture of claim 13, wherein the information includes one or more services that need to be started subsequent to the selective execution of the remediation scripts, services that need to be stopped subsequent to the selective execution of the remediation scripts, services that need to be re-started subsequent to the selective execution of the remediation scripts or nodes that need to be re-booted subsequent to the selective execution of the remediation scripts.

15. The article of manufacture of claim 13, wherein the information further includes either an identity of each of one or more nodes within the computer network that is affected by execution of the remediation scripts, or one or more of the remediation scripts for execution by the nodes, or both.

16. An apparatus comprising:

one or more processors; and

a non-transitory computer-readable storage medium coupled to the one or more processors, and having stored therein a plurality of programming instructions stored on the storage medium and configured to cause the apparatus, in response to execution of the programming instructions, to;

select a set of policy test failures for remediation, the policy test failures being associated with a computer network having a plurality of nodes;

for a failure within the set of policy test failures, obtain a remediation script for execution by one or more nodes to remediate a corresponding policy test failure;

provide, selectively, the remediation script to the one or more nodes that are affected by the policy test failure, for execution by the nodes;

prior to the execution of the remediation script, harvest a pre-remediation state of each of the nodes that is affected by the policy test failure; and

after execution of the remediation script;

detect one or more nodes having states, content, or both states and content that have changed;

correlate the one or more nodes having states, content, or both states and content that have changed with the nodes to which the remediation script was provided; and

determine, based on the correlation, one or more nodes whose changes were due to the execution of the remediation script.

17. The apparatus of claim 16, wherein the programming instructions are further configured to cause the apparatus, in response to execution of the programming instructions, to:

queue remediation scripts for providing to the one or more nodes, such that only one remediation script per node is executed at a time.

18. The apparatus of claim 16, wherein the programming instructions are further configured to cause the apparatus, in response to execution of the programming instructions, to:

generate a report identifying the one or more nodes whose changes were due to execution of the remediation scripts; and

determine, based on the report, that the one or more nodes whose changes were due to execution of the remediation scripts are not in violation of one or more policy tests as a result of at least one of the changes.