Incident management for complex information technology platforms

• US 10,666,715 B2
• Filed: 05/08/2017
• Issued: 05/26/2020
• Est. Priority Date: 05/08/2017
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Chen, Xiao Ling, Gao, Xue Feng, Li, Fei, Ruan, Ren Yi, Zhang, Qing Feng
• Primary Examiner(s): Nguyen, Thanh T
• Application Number:
  US15/589,093
• Publication Number:
  US 20180324062A1
• Time in Patent Office: 1,114 Days
• CPC Class Codes: H04L 41/0636 based on a decision tree analysis
• CPC Class Codes: H04L 41/0686 Additional information in the notification, e.g. enhancement of specific meta-data
• CPC Class Codes: H04L 41/0816 the condition being an adaptation, e.g. in response to network events
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

A system, method and program product for managing incidents in a complex IT environment. A system is described that includes: a discovery module that analyzes an IT infrastructure and generates a topology of components and users; a monitoring module that compares ongoing activities of the IT infrastructure with a pattern repository to identify potential problems; a relationship manager that generates relationship maps of components and users based on the topology, determines whether an identified potential problem comprises an incident, and in response to detecting an incident: correlates the incident with a root cause, and determines a responsible admin and set of impacted users based on the relationship maps; and an operation engine that notifies the responsible admin and set of impacted users of the incident.

Claims

1. An incident management system for a complex information technology (IT) infrastructure, comprising:

a discovery module that analyzes an IT infrastructure and generates a topology of components and users;

a monitoring module that compares ongoing activities of the IT infrastructure with a pattern repository to identify potential problems, including comparing a result from a proactive modeling based on at least one predictive analytic technology with the pattern repository;

a relationship manager that generates relationship maps of components and users based on the topology, determines whether an identified potential problem comprises an incident, and in response to detecting an incident;

correlates the incident with a root cause, and

determines a responsible admin and set of impacted users based on the relationship maps; and

an operation engine that notifies the responsible admin and set of impacted users of the incident.

2. The incident management system of claim 1, wherein the topology includes a user topology and at least one component topology, where the at least one component topology is selected from a group of a hardware topology, a software/services topology, and a network topology.

3. The incident management system of claim 2, wherein the relationship maps include a mapping between users and components.

4. The incident management system of claim 1, wherein the incident comprises one of a current loss of cloud services or a predicted loss of cloud services.

5. The incident management system of claim 1, wherein the root cause is determined with a binary tree.

6. The incident management system of claim 1, wherein the monitoring module updates the topology when a change in the infrastructure is detected.

7. The incident management system of claim 1, wherein the pattern repository is updated after the incident is detected and root cause is determined.

8. A computer program product stored on a computer readable storage medium, which when executed by a computing system, provides incident management for a complex information technology (IT) infrastructure, the program product comprising:

program code that analyzes an IT infrastructure and generates a topology of components and users;

program code that compares ongoing activities of the IT infrastructure with a pattern repository to identify potential problems, including comparing a result from a proactive modeling based on at least one predictive analytic technology with the pattern repository;

program code that generates relationship maps of components and users based on the topology, determines whether an identified potential problem comprises an incident, and in response to detecting an incident;

correlates the incident with a root cause, and

determines a responsible admin and set of impacted users based on the relationship maps; and

program code that notifies the responsible admin and set of impacted users of the incident.

9. The program product of claim 8, wherein the topology includes a user topology and at least one component topology, where the at least one component topology is selected from a group of a hardware topology, a software/services topology, and a network topology.

10. The program product of claim 9, wherein the relationship maps include a mapping between users and components.

11. The program product of claim 8, wherein the incident comprises one of a current loss of cloud services or a predicted loss of cloud services.

12. The program product of claim 8, wherein the root cause is determined with a binary tree.

13. The program product of claim 8, further comprising program code that updates the topology when a change in the infrastructure is detected.

14. The program product of claim 8, wherein the pattern repository is updated after the incident is detected and root cause is determined.

15. A computerized method that performs incident management for a complex information technology (IT) infrastructure, the method comprising:

analyzing an IT infrastructure and generating a topology of components and users;

comparing ongoing activities of the IT infrastructure with a pattern repository to identify potential problems, including comparing a result from a proactive modeling based on at least one predictive analytic technology with the pattern repository;

generating relationship maps of components and users based on the topology;

determining whether an identified potential problem comprises an incident, and in response to detecting an incident;

correlating the incident with a root cause, and

determining a responsible admin and set of impacted users based on the relationship maps; and

notifying the responsible admin and set of impacted users of the incident.

16. The method of claim 15, wherein the topology includes a user topology and at least one component topology, where the at least one component topology is selected from a group of a hardware topology, a software/services topology, and a network topology.

17. The method of claim 15, wherein the relationship maps include a mapping between users and components.

18. The method of claim 15, wherein the incident comprises one of a current loss of cloud services or a predicted loss of cloud services.

19. The method of claim 15, wherein the root cause is determined with a binary tree.

20. The method of claim 15, further comprising updating the topology when a change in the infrastructure is detected.