Change event correlation

• US 20070005740A1
• Filed: 06/29/2005
• Published: 01/04/2007
• Est. Priority Date: 06/29/2005
• Status: Active Grant

• Current Assignee: Tripwire Incorporated (Belden Inc.)
• Original Assignee: Tripwire Incorporated (Belden Inc.)
• Inventors: DiFalco, Robert, Keeler, Kenneth, Warmack, Robert
• Granted Patent: US 7,620,715 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06

Abstract

An automated method for facilitating management of a data processing environment is disclosed. In various embodiments, the method may include facilitating detecting of a change to an element of a data processing device of the data processing environment. In various embodiments, the method may further included facilitating correlating the change to one or more events associated with the element, and reporting the detected change for the element, supplemented with one or more of the correlated events of the element. Other embodiments of the present invention may include, but are not limited to, apparatus adapted to facilitate practice of the above-described method.

Claims

1. An automated method for facilitating management of a data processing environment comprising:

facilitating detecting of a change to an element of a data processing device of the data processing environment;

facilitating correlating the change to one or more events associated with the element; and

reporting the detected change for the element, supplemented with one or more of the correlated events of the element.

2. The method of claim 1, wherein the facilitating detecting comprises facilitating taking a snapshot of a current state of the element, and comparing the snapshot to a previously taken snapshot of a prior state of the element.

3. The method of claim 2, wherein the prior state is a baseline state.

4. The method of claim 1, wherein the facilitating correlating comprises retrieving the one or more events associated with the element from a first repository of events of the data processing environment, and the method further comprises periodically combing one or more event logs of the data processing device of the data processing environment for events logged for elements of the data processing devices, and depositing the combed events into a second repository.

5. The method of claim 4, wherein at least one of the one of more event logs is created and/or updated by a software of the data processing device.

6. The method of claim 4, wherein the method further comprises facilitating definition of one or more responses upon detecting certain one or more events logged.

9. The method of claim 4, wherein the combing is facilitated via use of a filter.

10. The method of claim 9, wherein the method further comprises facilitating a user in configuring the filter.

11. The method of claim 1, further comprising determining one or more users associated with the one or more correlated events, and the reporting further comprises supplementing the one or more correlated events of the element with the determined one or more users associated with the one or more correlated events.

12. The method of claim 1, wherein the element comprises a file.

13. The method of claim 1, wherein the method further comprises designating a first subset of the plurality of events correlated with the change detected as having a higher probability of having caused the change detected than a second subset of the plurality of events.

14. The method of claim 13, wherein said designating is at least partially facilitated by use of groupings of types of events with types of changes.

15. The method of claim 13, wherein said designating is at least partially facilitated by use of a historical association of events with detected changes.

16. The method of claim 1, wherein the data processing device, is a device selected from the group consisting of a networking device, a server, a desktop computer, a laptop computer, a tablet computer, a personal digital-assistant, a cellular phone, a set top box, and a media player.

17. The method of claim 1, wherein the method is performed to maintain or demonstrate control of an enterprise'"'"'s information technology infrastructure.

18. The method of claim 1, wherein the method is performed to maintain or demonstrate control of an enterprise'"'"'s financial systems or data.

19. The method of claim 1, wherein the method is performed to maintain or demonstrate control of an enterprise'"'"'s business processes.

20. The method of claim 1, wherein the method is performed as part of an audit of an enterprise.

21. The method of claim 20, wherein the method is performed to provide an audit trail for said audit.

22. The method of claim 1, wherein the method is performed to facilitate compliance with governmental laws/regulations regarding establishment and maintenance of an internal control structure and/or procedures for financial reporting.

7. The method of 6, wherein the one or more responses include a change detection scan.

8. The method of 6, wherein the one or more responses include an automatic alert response.

23. An apparatus comprising:

a detection module adapted to facilitate detection of a change to an element of a data processing device of a data processing environment;

a correlation module adapted to facilitate correlation of the change to one or more events associated with the element; and

a reporting module operatively coupled to the detection and correlation modules, and adapted to report the detected change for the element, supplemented with the one or more correlated events of the element.

24. The apparatus of claim 23, wherein the detection module is adapted to facilitate detection by at least taking a snapshot of a current state of the element, and comparing the snapshot to a previously taken snapshot of a prior state of the element.

25. The apparatus of claim 23, wherein the correlation module is adapted to facilitate correlation by at least retrieving the plurality of events associated with the element from a repository of events of the data processing environment, and the apparatus further comprises

a combing module adapted to periodically comb event logs of the data processing device of the data processing environment for events logged for elements of the data processing devices, and deposit the combed events into the repository.

26. The apparatus of claim 25, wherein the apparatus further comprises a response definition module adapted to facilitate definition of one or more responses to finding certain one or more events.

29. The apparatus of claim 25, wherein to the apparatus further comprises a filter adapted to the filter the logged events of the element.

30. The apparatus of claim 29, wherein said filtering is user-configurable.

31. The apparatus of claim 23, wherein the reporting module is further adapted to facilitate supplementing the correlated events of the element with a determined one or more users associated with the one or more correlated events.

32. The apparatus of claim 23, wherein the apparatus further comprises a designation module adapted to facilitate definition of a first subset of the plurality of events correlated with the change detected as having a higher probability of having caused the change detected than a second subset of the plurality of events.

33. The apparatus of claim 23, wherein the apparatus comprises one or more servers adapted to operate the detection and correlation modules.

34. The apparatus of claim 23, wherein the detection, correlation, and reporting modules are adapted to maintain or demonstrate control of one or more selected from the group consisting of an enterprise'"'"'s information technology infrastructure, an enterprise'"'"'s financial systems, an enterprise'"'"'s financial data and an enterprise'"'"'s business processes.

27. The apparatus of 26, wherein the one or more responses include a change detection scan.

28. The apparatus of 26, wherein the one or more responses include an automatic alert response.

35. An apparatus comprising:

a change control subsystem adapted to identify a change to an element of a data processing device of a data processing environment; and

an audit subsystem coupled to the change control subsystem to provide an audit trail of events and/or users associated the change.

36. The apparatus of claim 35, wherein the audit subsystem including a combing module to comb a plurality of logs of the data processing environments for events and/or users associated with the change.