System and method for processing alerts indicative of conditions of a computing infrastructure

• US 10,454,752 B2
• Filed: 06/10/2016
• Issued: 10/22/2019
• Est. Priority Date: 11/02/2015
• Status: Active Grant

• Current Assignee: ServiceNow Incorporated
• Original Assignee: ServiceNow Incorporated
• Inventors: Margalit, Adar, Rimar, Yuval, Shif, Vadim, Hasdai, Netta
• Primary Examiner(s): Louie, Oscar A
• Assistant Examiner(s): Gidado, Oluwatosin M
• Application Number:
  US15/178,855
• Publication Number:
  US 20170126472A1
• Time in Patent Office: 1,229 Days
• Field of Search: 709224
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3055 Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available error or fault processing without redundancy G06F11/0703; error detection or correction by redundancy in data representation G06F11/08; error detection or correction by redundancy in operation G06F11/14; error detection or correction by redundancy in hardware G06F11/16
• CPC Class Codes: G06F 11/34 Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06Q 50/10 Services
• CPC Class Codes: H04L 41/0604 using filtering, e.g. reduction of information by using priority, element types, position or time
• CPC Class Codes: H04L 41/065 involving logical or physical relationship, e.g. grouping and hierarchies
• CPC Class Codes: H04L 41/0686 Additional information in the notification, e.g. enhancement of specific meta-data
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters

Abstract

Systems and methods for processing alerts indicative of conditions of nodes of a computing infrastructure are herein disclosed as comprising, in an implementation, generating a node hierarchy comprising nodes associated with a service model, wherein relationships between the nodes are based on impact rules, identifying alerts related to the node hierarchy, wherein the alerts are indicative of impairments affecting at least a portion of the node hierarchy, and performing impact calculation for nodes of the node hierarchy based on the identified alerts. In an implementation, the impact values may be calculated in parallel for nodes indicated for processing. In an implementation, the nodes associated with the service model represent infrastructure or applicative resources and comprise nodes included in the service model and nodes related to, but not included in, the service model.

Claims

1. A system for processing alerts indicative of conditions of resources of a computing infrastructure, the system comprising:

a server comprising a processor and a memory, wherein the memory includes a configuration management database comprising configuration items representative of a plurality of the resources of the computing infrastructure, and wherein the memory further includes instructions executable by the processor to;

generate a node hierarchy comprising nodes representing respective configuration items in the configuration management database, wherein relationships between the nodes are based on impact rules;

identify alerts indicative of conditions affecting at least a plurality of the nodes of the node hierarchy; and

perform impact calculation for the plurality of nodes of the node hierarchy based on the alerts to;

indicate a first set of nodes of the node hierarchy having respective first severities that changed based on the alerts, wherein the first set of nodes comprises at least a first node and a second node at different levels in the node hierarchy;

calculate respective first impact values in parallel for each node of the first set of nodes based on the respective first severities and the impact rules applicable to the first set of nodes;

indicate a second set of nodes of the node hierarchy having respective second severities that changed based on the respective first impact values; and

calculate respective second impact values in parallel for each node of the second set of nodes based on the respective second severities and the impact rules applicable to the second set of nodes.

2. The system of claim 1, wherein indicating the second set of nodes and calculating the respective second impact values in parallel for each node of the second set of nodes are repeated in response to determining that respective third severities for any nodes of the node hierarchy have changed based on the respective second impact values of the second set of nodes.

3. The system of claim 1, wherein the respective first severities of the first set of nodes or the respective second severities of the second set of nodes comprises a self-severity vector and a contribution vector, wherein the self-severity vector is indicative of a degree to which a functional operation of a node of the first set or the second set may be affected based on the alerts independent of other nodes of the node hierarchy, and wherein the contribution vector is indicative of a degree to which a functional operation of the node may be affected based on an impact value calculated for child nodes of the node.

4. The system of claim 3, wherein the instructions to calculate the respective first impact values in parallel for each node of the first set of nodes includes instructions to:

determine the self-severity vector for each node based on how the impact rules applicable to each node indicate an extent the alerts affect each node,

wherein the respective first impact values for each node are calculated based on the self-severity vector of each node.

5. The system of claim 3, wherein the instructions to calculate the respective second impact values in parallel for each node of the second set of nodes comprises:

determine the self-severity vector for each node based on how the impact rules applicable to each node indicate an extent the alerts affect each node; and

determine the contribution vector for a number of respective child nodes of each node based on how the impact rules applicable to each node define relationships between node and the respective child nodes,

wherein the respective second impact values for each node are calculated in parallel based on the self-severity vector and the contribution vector of each node.

6. The system of claim 1, wherein the instructions to generate the node hierarchy include instructions to:

identify a first set of configuration items associated with an underlying topology of a service model of the computing infrastructure;

identify a second set of configuration items related to the first set of configuration items, wherein the second set of configuration items are not associated with the underlying topology of the service model;

identify a set of impact rules applicable to a plurality of configuration items of the first set of configuration items, the second set of configuration items, or both; and

generate the node hierarchy based on the plurality of configuration items and the set of impact rules,

wherein the relationships between the nodes of the node hierarchy based on the set of impact rules are indicative of dependency connections between parent nodes and child nodes of the node hierarchy.

7. The system of claim 1, wherein the instructions include instructions to:

update the node hierarchy in response to an impact calculation or a change being made to an impact rule, a configuration item represented by a node of the node hierarchy, or both.

8. The system of claim 1, wherein the instructions include instructions to:

generate data indicative of a graphical representation of the node hierarchy to output on a display device.

9. The system of claim 1, wherein the instructions include instructions to:

identify a current severity for a node of the node hierarchy;

indicate the node in response to a determination that a severity associated with an identified alert is not equal to the current severity; and

indicate child nodes of the node,

wherein the node and the child nodes are indicated as nodes having severities that changed based on the alerts.

10. A method for processing alerts indicative of conditions of resources of a computing infrastructure comprising a configuration management database comprising configuration items representative of at least a plurality of the resources of the computing infrastructure, the method comprising:

generating a node hierarchy comprising nodes representing respective configuration items in the configuration management database, wherein relationships between the nodes are based on impact rules;

identifying alerts indicative of conditions affecting at least a plurality of the nodes of the node hierarchy; and

performing impact calculation for the plurality of nodes of the node hierarchy based on the alerts, comprising;

indicating a first set of nodes of the node hierarchy having respective first severities that changed based on the alerts, wherein the first set of nodes comprises at least a first node and a second node at different levels in the node hierarchy;

calculating respective first impact values in parallel for each node of the first set of nodes based on the respective first severities and the impact rules applicable to the first set of nodes;

indicating a second set of nodes of the node hierarchy having respective second severities that changed based on the respective first impact values; and

calculating respective second impact values in parallel for each node of the second set of nodes based on the respective second severities and the impact rules applicable to the second set of nodes.

11. The method of claim 10, wherein indicating the second set of nodes and calculating the respective second impact values in parallel for each node of the second set of nodes are repeated in response to determining that respective third severities for any nodes of the node hierarchy have changed based on the respective second impact values of the second set of nodes.

12. The method of claim 10, wherein the respective first severities of the first set of nodes or the respective second severities of the second set of nodes comprises a self-severity vector and a contribution vector, wherein the self-severity vector is indicative of a degree to which a functional operation of a node of the first set or the second set may be affected based on the alerts independent of other nodes of the node hierarchy, and wherein the contribution vector is indicative of a degree to which a functional operation of the node may be affected based on an impact value calculated for child nodes of the node.

13. The method of claim 12, wherein calculating the respective first impact values in parallel for each node of the first set of nodes comprises:

determining the self-severity vector for each node based on how the impact rules applicable to each node indicate an extent the alerts affect each node,

wherein the respective first impact values for each node are calculated based on the self-severity vector of each node.

14. The method of claim 12, wherein calculating the respective second impact values in parallel for each node of the second set of nodes comprises:

determining determine the self-severity vector for each node based on how the impact rules applicable to each node indicate an extent the alerts affect each node; and

determine the contribution vector for a number of respective child nodes of each node based on how the impact rules applicable to each node define relationships between node and the respective child nodes,

wherein the respective second impact values for each node are calculated in parallel based on the self-severity vector and the contribution vector of each node.

15. The method of claim 10, wherein generating the node hierarchy comprises:

identifying a first set of configuration items associated with an underlying topology of a service model of the computing infrastructure; and

identifying a second set of configuration items related to the first set of configuration items, wherein the second set of configuration items are not associated with the underlying topology of the service model;

identifying a set of impact rules applicable to a plurality of configuration items of the first set of configuration items, the second set of configuration items, or both; and

generating the node hierarchy based on the plurality of configuration items and the set of impact rules,

wherein the relationships between the nodes of the node hierarchy based on the set of impact rules are indicative of dependency connections between parent nodes and child nodes of the node hierarchy.

16. The method of claim 10, comprising:

updating the node hierarchy in response to an impact calculation or a change being made to an impact rule, a configuration item represented by a node of the node hierarchy, or both.

17. The method of claim 10, comprising:

generating data indicative of a graphical representation of the node hierarchy to output on a display device.

18. The method of claim 10, comprising:

identifying a current severity for a node of the node hierarchy;

indicating the node in response to determining that a severity associated with an identified alert is not equal to the current severity; and

indicating child nodes of the node,

wherein the node and the child nodes are indicated as nodes having severities that changed based on the alerts.

19. A system, comprising:

a memory; and

a processor configured to execute instructions stored in the memory to;

generate a node hierarchy based on configurable impact rules applicable to a plurality of nodes associated with a service model;

identify alerts relating to the node hierarchy;

perform impact calculation in parallel for each node of the node hierarchy affected by the alerts, wherein the node hierarchy comprises at least a first node and a second node at different levels in the node hierarchy, and wherein performing impact calculation in parallel for each node comprises;

indicating a first set of nodes of the node hierarchy having respective first severities that changed based on the alerts, wherein the first set of nodes comprises the first node and the second node;

calculating a first impact value in parallel for each node of the first set of nodes based on the respective first severities and the configurable impact rules applicable to the first set of nodes;

indicating a second set of nodes of the node hierarchy having respective second severities that changed based on the first impact value of each node of the first set of nodes; and

calculating a second impact value in parallel for each node of the second set of nodes based on the respective second severities and the configurable impact rules applicable to the second set of nodes; and

update the node hierarchy in response to performing the impact calculation in parallel for each node.