SYSTEM AND METHOD FOR GENERATING AND USING FINGERPRINTS FOR INTEGRITY MANAGEMENT

• US 20100131645A1
• Filed: 01/25/2010
• Published: 05/27/2010
• Est. Priority Date: 09/27/2006
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: VMware, Inc. (Broadcom, Inc.)
• Inventors: Marvasti, Mazda A.
• Granted Patent: US 8,266,279 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis

Abstract

A system and method is provided for capturing and using problem fingerprints in an Information Technology (IT) infrastructure for integrity management. A fingerprint of the transaction topology in an IT infrastructure is automatically captured at various time intervals prior to the occurrence of an event leading to a problem, such as a failure, hard threshold violation, defined transaction violation or user-provided occurrence. The fingerprint provides an indication of the activity and operation of the IT infrastructure immediately preceding the problem event. The captured fingerprint is then used to monitor real-time data in the IT infrastructure operation and activity to look for activity that matches a captured fingerprint to provide an indication of a pending problems before the problems occur. When it is determined that there is sufficient probability a problem event will occur based upon real-time data matching a previously generated problem fingerprint, an alert is generated to provide sufficient notification prior to the occurrence of problem event.

Claims

1. A method comprising:

capturing a fingerprint comprising a set of rules that describe the behavior of at least one metric of an information technology (IT) infrastructure;

comparing the fingerprint to an incoming data stream; and

preemptively predicting a potential problem in the IT infrastructure based on the fingerprint comparison;

wherein each rule describes the probability of a symptom for a specific time cut, each time cut being a number to time units prior to the occurrence of a problem.

2. The method of claim 1, wherein at least a portion of the fingerprint comparison is performed using a statistical event-based correlation.

3. The method of claim 1, wherein each fingerprint is created by:

identifying a problem in the IT infrastructure;

collecting information related to the problem;

analyzing the collected information to determine if fingerprint creation criteria are satisfied, the fingerprint creation criteria comprising an intermediate set of rules to determine if the collected information meets a threshold number of rules for fingerprint capture;

forming the set of rules from the collected information when the fingerprint creation criteria are satisfied;

capturing the fingerprint or updating an existing fingerprint using the set of rules.

4. The method of claim 1, wherein the fingerprint is device and time independent.

5. The method of claim 4, further comprising applying the device independent fingerprint to transactions occurring in the IT infrastructure.

6. The method of claim 4, wherein the fingerprint represents the operation of at least a portion of the IT infrastructure preceding the occurrence of a problem.

7. The method of claim 1, wherein the incoming data stream is substantially real-time data.

8. A machine-readable medium having program instructions stored thereon executable by a processing unit for:

capturing a fingerprint comprising a set of rules that describe the behavior of at least one metric of an information technology (IT) infrastructure;

comparing the fingerprint to an incoming data stream; and

preemptively predicting a potential problem in the IT infrastructure based on the fingerprint comparison;

wherein each rule describes the probability of a symptom for a specific time cut, each time cut being a number to time units prior to the occurrence of a problem.

9. The machine-readable medium of claim 8, further comprising program instructions executable by a processing unit for capturing the fingerprint:

identifying a problem in the IT infrastructure;

collecting information related to the problem;

analyzing the collected information to determine if fingerprint creation criteria are satisfied, the fingerprint creation criteria comprising an intermediate set of rules to determine if the collected information meets a threshold number of rules for fingerprint capture;

forming the set of rules from the collected information when the fingerprint creation criteria are satisfied;

capturing the fingerprint or updating an existing fingerprint using the set of rules.

collecting information related to a problem;

analyzing the collected information to determine if fingerprint creation criteria are satisfied, the fingerprint creation criteria comprising an intermediate set of rules to determine if the collected information meets a threshold number of rules for fingerprint capture;

forming the set of rules from the collected information when the fingerprint creation criteria are satisfied;

capturing the fingerprint or updating an existing fingerprint using the set of rules.

10. The machine-readable medium of claim 9, wherein the fingerprint represents the operation of at least a portion of the IT infrastructure preceding the occurrence of a problem.

11. The machine-readable medium of claim 8, wherein the fingerprint is device and time independent, the medium further comprising program instructions stored thereon for applying the device independent fingerprint to transactions occurring in the IT infrastructure.

12. The machine-readable medium of claim 8, wherein the incoming data stream is substantially real-time data.

13. A device comprising:

a fingerprint capturing module for capturing a fingerprint comprising a set of rules that describe the behavior of at least a portion of an IT infrastructure;

a fingerprint comparison module for comparing the fingerprint to an incoming data stream; and

a problem prediction module for preemptively predicting a potential problem in the IT infrastructure based on the fingerprint comparison;

wherein each rule describes the probability of a symptom for a specific time cut, each time cut being a number to time units prior to the occurrence of a problem.

14. The system of claim 13, wherein the fingerprint comparison module performs at least a portion of the fingerprint comparison using a statistical event-based correlation.

15. The system of claim 13, wherein the fingerprint capturing modules comprises a fingerprint generator that is adapted to:

identify a problem in the IT infrastructure;

collect information related to the problem;

analyze the collected information to determine if fingerprint creation criteria are satisfied, the fingerprint creation criteria comprising an intermediate set of rules to determine if the collected information meets a threshold number of rules for fingerprint capture;

form the set of rules from the collected information when the fingerprint creation criteria are satisfied;

capture the fingerprint or updating an existing fingerprint using the set of rules.

16. The system of claim 13, wherein the fingerprint is device and time independent, further wherein the fingerprint comparison module applies the device independent fingerprint to transactions occurring in the IT infrastructure.

17. The system of claim 13, wherein the fingerprint represents the operation of at least a portion of the IT infrastructure immediately preceding the occurrence of a problem.

18. The system of claim 13, wherein the incoming data stream is substantially real-time data.