System and Method for Generating and Using Fingerprints for Integrity Management

• US 20080077687A1
• Filed: 09/27/2006
• Published: 03/27/2008
• Est. Priority Date: 09/27/2006
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: Integrien Corp. (Broadcom, Inc.)
• Inventors: Marvasti, Mazda A.
• Granted Patent: US 7,707,285 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis

Abstract

A system and method is provided for capturing and using problem fingerprints in an Information Technology (IT) infrastructure for integrity management. A fingerprint of the transaction topology in an IT infrastructure is automatically captured at various time intervals prior to the occurrence of an event leading to a problem, such as a failure, hard threshold violation, defined transaction violation or user-provided occurrence. The fingerprint provides an indication of the activity and operation of the IT infrastructure immediately preceding the problem event. The captured fingerprint is then used to monitor real-time data in the IT infrastructure operation and activity to look for activity that matches a captured fingerprint to provide an indication of a pending problems before the problems occur. When it is determined that there is sufficient probability a problem event will occur based upon real-time data matching a previously generated problem fingerprint, an alert is generated to provide sufficient notification prior to the occurrence of problem event.

Claims

1. A method comprising:

capturing a fingerprint of at least a portion of an information technology (IT) infrastructure;

comparing the fingerprint to captured data; and

preemptively predicting a problem in the IT infrastructure based on the fingerprint comparison.

2. The method of claim 1, wherein at least a portion of the fingerprint comparison is performed using a statistical event-based correlation.

3. The method of claim 1, wherein a learning-based algorithm is utilized to continually adjust the fingerprint analysis and problem prediction steps.

4. The method of claim 1, wherein the fingerprint is device and time independent.

5. The method of claim 4, further comprising applying the device independent fingerprint to transactions occurring in the IT infrastructure.

6. The method of claim 4, wherein the fingerprint represents the operation of at least a portion of the IT infrastructure immediately preceding the occurrence of a problem.

7. The method of claim 1, where the fingerprint is compared to substantially real-time data.

8. A method of capturing a fingerprint of a problem in information technology (IT) infrastructure, comprising:

identifying a problem;

collecting information related to the problem;

analyzing the collected information against a set of rules to determine if fingerprint creation criteria have been satisfied;

assigning probability weights to the rules when the fingerprint creation criteria have been satisfied;

creating a fingerprint utilizing the probability weighted rules.

9. The method of claim 8, further comprising identifying the problem by identifying at least one of a failure, a hard threshold violation, a defined transaction and a user-identified problem.

10. The method of claim 9, wherein the defined transaction is a function of a dynamic thresholding determination.

11. The method of claim 10, wherein the dynamic thresholding determination involves a determination of a transaction slowdown on the IT infrastructure.

12. The method of claim 8, wherein the problem-related information collecting step comprises:

identifying a problem device in the IT infrastructure where the problem is originating;

determining a group of devices in the IT infrastructure that includes the problem device;

determining a number of time cuts in which to obtain information and a time interval for the time cuts;

identifying all transactions within the group of devices that involve the problem device; and

for a given time cut, obtaining a set of all events for the identified transactions, where an event is a condition that indicates abnormal behavior in at least one of a device and a transaction.

13. The method of claim 12, wherein the analysis of the collected information to determine if the fingerprint creation criteria have been satisfied comprises:

collecting a set of rules describing the probability of a symptom indicating a fingerprint for a given time cut; and

determining if the number of rules in the collected set of rules meets a certain number defined to be sufficient to satisfy the fingerprint creation criteria.

14. A machine-readable medium having program instructions stored thereon executable by a processing unit for performing the steps of:

capturing a fingerprint of at least a portion of an information technology (IT) infrastructure;

comparing the fingerprint to captured data; and

preemptively predicting a problem in the IT infrastructure based on the fingerprint comparison.

15. The machine-readable medium of claim 14, further comprising program instructions stored thereon for performing at least a portion of the fingerprint comparison using a learning-based algorithm to continually adjust the fingerprint analysis and problem prediction steps.

16. The machine-readable medium of claim 14, wherein the fingerprint is device and time independent, the medium further comprising program instructions stored thereon for applying the device independent fingerprint to transactions occurring in the IT infrastructure.

17. The machine-readable medium of claim 15, wherein the fingerprint represents the operation of at least a portion of the IT infrastructure immediately preceding the occurrence of a problem.

18. The machine-readable medium of claim 14, further comprising program instructions stored thereon for comparing the fingerprint to substantially real-time data.

19. A machine-readable medium having program instructions stored thereon executable by a processing unit for capturing a fingerprint of a problem in information technology (IT) infrastructure by performing the steps of:

identifying a problem;

collecting information related to the problem;

analyzing the collected information against a set of rules to determine if fingerprint creation criteria have been satisfied;

assigning probability weights to the rules when the fingerprint creation criteria have been satisfied;

creating a fingerprint utilizing the probability weighted rules.

20. The machine-readable medium of claim 19, further comprising program instructions stored thereon for identifying the problem by identifying at least one of a failure, a hard threshold violation, a defined transaction and a user-identified problem.

21. The machine-readable medium of claim 20, wherein the defined transaction is a function of a dynamic thresholding determination.

22. The machine-readable medium of claim 21, wherein the dynamic thresholding determination involves a determination of a transaction slowdown on the IT infrastructure.

23. The machine-readable medium of claim 19, further comprising program instructions stored thereon for collecting the problem-related information by:

identifying a problem device in the IT infrastructure where the problem is originating;

determining a group of devices in the IT infrastructure that includes the problem device;

determining a number of time cuts in which to obtain information and a time interval for the time cuts;

identifying all transactions within the group of devices that involve the problem device; and

for a given time cut, obtaining a set of all events for the identified transactions, where an event is a condition that indicates abnormal behavior in at least one of a device and a transaction.

24. The machine-readable medium of claim 24, further comprising program instructions stored thereon for analyzing the collected information to determine if the fingerprint creation criteria have been satisfied by:

collecting a set of rules describing the probability of a symptom indicating a fingerprint for a given time cut; and

determining if the number of rules in the collected set of rules meets a certain number defined to be sufficient to satisfy the fingerprint creation criteria.

25. A system comprising:

a fingerprint capturing module for capturing a fingerprint of at least a portion of an information technology (IT) infrastructure;

a fingerprint comparison module for comparing the fingerprint to captured data; and

a problem prediction module for preemptively predicting a problem in the IT infrastructure based on the fingerprint analysis.

26. The system of claim 25, wherein the fingerprint comparison module performs at least a portion of the fingerprint comparison using a statistical event-based correlation.

27. The system of claim 25, wherein system uses a learning-based algorithm to continually adjust the fingerprint comparison performed by the fingerprint comparison module and the problem prediction performed by the problem prediction module.

28. The system of claim 25, wherein the fingerprint is device and time independent, further wherein the fingerprint comparison module applies the device independent fingerprint to transactions occurring in the IT infrastructure.

29. The system of claim 25, wherein the fingerprint represents the operation of at least a portion of the IT infrastructure immediately preceding the occurrence of a problem.

30. The system of claim 25, where the fingerprint comparison module performs the fingerprint comparison to substantially real-time data.

31. A system of capturing a fingerprint of a problem in information technology (IT) infrastructure, comprising:

a problem identifying module for identifying a problem;

an information collecting module for collecting information related to the problem;

a fingerprint creation criteria module for analyzing the collected information against a set of rules to determine if fingerprint creation criteria have been satisfied;

a probability weight module for assigning probability weights to the rules when the fingerprint creation criteria have been satisfied;

a fingerprint creation module for creating a fingerprint utilizing the probability weighted rules.

32. The system of claim 31, wherein the problem identifying module identifies the problem by identifying at least one of a failure, a hard threshold violation, a defined transaction and a user-identified problem.

33. The system of claim 32, wherein the defined transaction is a function of a dynamic thresholding determination.

34. The system of claim 33, wherein the problem identifying module performs the dynamic thresholding determination using a determination of a transaction slowdown on the IT infrastructure.

35. The system of claim 31, wherein the information collecting module collects problem-related information by:

identifying a problem device in the IT infrastructure where the problem is originating;

determining a group of devices in the IT infrastructure that includes the problem device;

determining a number of time cuts in which to obtain information and a time interval for the time cuts;

identifying all transactions within the group of devices that involve the problem device; and

for a given time cut, obtaining a set of all events for the identified transactions, where an event is a condition that indicates abnormal behavior in at least one of a device and a transaction.

36. The system of claim 35, wherein the fingerprint creation criteria module determines if the fingerprint creation criteria have been satisfied by:

collecting a set of rules describing the probability of a symptom indicating a fingerprint for a given time cut; and

determining if the number of rules in the collected set of rules meets a certain number defined to be sufficient to satisfy the fingerprint creation criteria.