METHODS, SYSTEMS AND COMPUTER PROGRAM PRODUCTS FOR MANAGING EXECUTION OF INFORMATION TECHNOLOGY (IT) PROCESSES

• US 20070266138A1
• Filed: 05/07/2007
• Published: 11/15/2007
• Est. Priority Date: 05/09/2006
• Status: Active Grant

• Current Assignee: NetIQ Corporation (Open Text Corporation)
• Original Assignee: NetIQ Corporation (Open Text Corporation)
• Inventors: Jones, Mark, Guan, Jiebo, Sharpe, Michael, Park, Stephen, Spire, Edward, Reiner, Roberto
• Granted Patent: US 8,504,679 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0748 in a remote unit communicating with a single-box computer node experiencing an error/fault remote testing G06F11/2294
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

Methods, systems and computer program products are provided for managing information technology (IT) processes for a computer network. An incident report, including associated data, is received from an application monitoring resources on the computer network. Additional data associated with the computer network resources to be obtained based on the incident report is automatically identified and obtained. Related data in a historical database is automatically identified based on the incident report and/or the additional data and the identified related historical data is automatically retrieved. The incident report, the additional data and/or the related historical data are analyzed to identify a responsive process to respond to the incident report.

Claims

1. A method for managing information technology (IT) processes for a computer network, comprising:

receiving an incident report, including associated data, from an application monitoring resources on the computer network;

automatically identifying additional data associated with the computer network resources to be obtained based on the incident report;

automatically obtaining the identified additional data;

automatically identifying related data in a historical database based on the incident report and/or the additional data;

automatically retrieving the identified related historical data; and

analyzing the incident report, the additional data and/or the related historical data to identify responsive process to respond to the incident report.

2. The method of claim 1, wherein the computer network includes a plurality of applications monitoring resources on the computer network and wherein automatically obtaining the identified additional data includes obtaining the additional data from different ones of the applications monitoring resources on the computer network.

3. The method of claim 2, wherein the plurality of applications monitoring resources include an application manager, a security manager and/or a vulnerability manager and wherein the incident report comprises a violation of a service level agreement.

4. The method of claim 1, wherein receiving an incident report is followed by updating the historical database based on the incident report.

5. The method of claim 1, wherein analyzing the incident report comprises providing the incident report, the additional data, the related historical data and/or the identified responsive process to a network administrator in a prioritized ordering based on an evaluation of the relevance of the additional data in view of the related historical data.

6. The method of claim 5, wherein providing the incident report, the additional data, the related historical data and/or the identified responsive process to the network administrator includes generating a process dashboard graphical user interface (GUT) including:

an identification of timeliness of provision of ones of the monitored resources relative to a corresponding benchmark;

a breakdown of time spent in respective ones of a plurality of states associated with provision of the ones of the monitored resources;

an identification of commonalities among the received incident report and other currently pending incident reports;

a comparison of policy execution metrics over a selected period of time; and

/or

a summary of accumulated data in the historical database including a correlation between initial indicators of incident causes and successful remediations, successful remediation instances, a level of usage of the accumulated data, a relation between the usage of the accumulated data and a performance measure of remediations and/or manually entered comments associated with remediation instances.

7. The method of claim 1, wherein the historical database includes a plurality of responsive processes associated with respective incident report types and a plurality of rules for identifying ones of the plurality of responsive processes based on the incident report and/or the additional data and wherein analyzing the incident report includes:

identifying at least one of the plurality of rules to be evaluated responsive to the received incident report; and

evaluating the identified at least one of the plurality of rules.

8. The method of claim 1,wherein analyzing the incident report comprises:

determining if the identified responsive process includes an associated automated remediation process;

providing the incident report, the additional data, the related historical data and/or the identified responsive process to a network administrator in a prioritized ordering based on an evaluation of the relevance of the additional data in view of the related historical data when the identified responsive process does not include an associated automated remediation process; and

automatically executing the associated automated remediation process when the identified responsive process does include an associated automated remediation process.

9. The method of claim 8, wherein analyzing the incident report includes automatically executing the associated automated remediation process.

10. The method of claim 8, wherein analyzing the incident report is followed by:

determining an effectiveness of the identified responsive process in addressing the incident report; and

updating the historical database based on the effectiveness of the identified responsive process.

11. The method of claim 10, wherein determining the effectiveness includes executing an automated network health check process for the computer network, the automated network health check process including obtaining data associated with a network resource identified in the incident report after the identified responsive process has been executed.

12. The method of claim 11, wherein the historical database includes a plurality of responsive processes associated with respective incident report types and a plurality of rules for identifying ones of the plurality of responsive processes based on the incident report and/or the additional data and wherein updating the historical database includes modifying at least one of the plurality of responsive processes that is associated with an incident report type of the received incident report and/or at least one of the plurality of rules based on the effectiveness of the identified responsive process.

13. The method of claim 12, wherein identifying the related data in the historical database comprises:

identifying an indicator for the received incident report; and

identifying data associated with previous incident reports in the historical database as related historical data based on the identified indicator, the related historical data including an identification of additional data obtained for the previous incident reports and its relevance in remediation of the previous incident reports and/or an identification of responsive processes used in remediation of the previous incident reports and their success in remediation of the previous incident reports.

14. The method of claim 13, wherein the identified responsive process comprises a plurality of alternative responsive processes and wherein analyzing the incident report includes reporting the identification of additional data obtained for the previous incident reports and its relevance in remediation of the previous incident reports and the identification of responsive processes used in remediation of the previous incident reports and their success in remediation of the previous incident reports to a network administrator and wherein the method further comprises receiving from the network administrator a selection of one of the plurality of alternative responsive processes.

15. The method of claim 14, wherein reporting the identification of additional data includes generating a process dashboard graphical user interface (GUI) including:

an identification of timeliness of provision of ones of the monitored resources relative to a corresponding benchmark;

a breakdown of time spent in respective ones of a plurality of states associated with provision of the ones of the monitored resources;

an identification of commonalities among the received incident report and other currently pending incident reports;

a comparison of policy execution metrics over a selected period of time; and

/or

a summary of accumulated data in the historical database including a correlation between initial indicators of incident causes and successful remediations, successful remediation instances, a level of usage of the accumulated data, a relation between the usage of the accumulated data and a performance measure of remediations and/or manually entered comments associated with remediation instances.

16. A system configured to carry out the method of claim 13,

17. A computer program product for managing information technology (IT) processes for a computer network, the computer program product comprising computer program code embodied in a computer readable medium, the computer program code comprising program code configured to carry out the method of claim 13.

18. A system for managing information technology (IT) processes for a computer network, comprising:

a communication interface coupled to the computer network that is configured to receive an incident report, including associated data, from an application monitoring resources on the computer network;

an additional data acquisition module configured to identify additional data associated with the computer network resources to be obtained based on the incident report and to obtain the identified additional data;

a historical data acquisition module configured to identify related data in a historical database based on the incident report and/or the additional data and to retrieve the identified related historical data; and

a data analysis module configured to analyze the incident report, the additional data and/or the related historical data to a identify a responsive process to respond to the incident report.

19. The system of claim 18, further comprising a user report generating module configured to provide the incident report, the additional data, the related historical data and/or the identified responsive process to the network administrator, including generating a process dashboard graphical user interface (GUI) including:

an identification of timeliness of provision of ones of the monitored resources relative to a corresponding benchmark;

a breakdown of time spent in respective ones of a plurality of states associated with provision of the ones of the monitored resources;

an identification of commonalities among the received incident report and other currently pending incident reports;

a comparison of policy execution metrics over a selected period of time; and

/or

a summary of accumulated data in the historical database including a correlation between initial indicators of incident causes and successful remediations, successful remediation instances, a level of usage of the accumulated data, a relation between the usage of the accumulated data and a performance measure of remediations and/or manually entered comments associated with remediation instances.

20. A computer program product for managing information technology (IT) processes for a computer network, the computer program product comprising:

a computer-readable storage medium having computer-readable program code embodied in said medium, said computer-readable program code comprising;

computer-readable program code that receives an incident report, including associated data, from an application monitoring resources on the computer network;

computer-readable program code that identifies additional data associated with the computer network resources to be obtained based on the incident report;

computer-readable program code that obtains the identified additional data;

computer-readable program code that identifies related data in a historical database based on the incident report and/or the additional data;

computer-readable program code that retrieves the identified related historical data; and

computer-readable program code that analyzes the incident report, the additional data and/or the related historical data to a identify a responsive process to respond to the incident report.