SYSTEM AND METHOD FOR HANDLING EVENTS INVOLVING COMPUTING SYSTEMS AND NETWORKS USING FABRIC MONITORING SYSTEM

• US 20160315822A1
• Filed: 04/20/2016
• Published: 10/27/2016
• Est. Priority Date: 04/24/2015
• Status: Active Grant

• Current Assignee: Goldman Sachs & Co. LLC (Goldman Sachs Group Incorporated)
• Original Assignee: Goldman Sachs & Company (Goldman Sachs Group Incorporated)
• Inventors: Anderson, Robert, Berman, Ilia, Billis, Keith, Joshi, Amol
• Granted Patent: US 10,652,103 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/0633 Workflow analysis
• CPC Class Codes: G06Q 10/0635 Risk analysis of enterprise or organisation activities
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 41/5074 Handling of user complaints or trouble tickets

Abstract

A method includes receiving, at a fabric monitoring system, information identifying occurrences of events in an enterprise system having multiple computing or networking systems. The events occur on or involve computing or networking devices in the computing or networking systems, and the events are identified using rules accessible by the fabric monitoring system. The method also includes processing, using the fabric monitoring system, the information in real-time to identify the occurrences of the events and to assign the events to multiple situations. The events are assigned to the situations using one or more processing models accessible by the fabric monitoring system. The method further includes outputting information identifying the situations.

Claims

1. A method comprising:

receiving, at a fabric monitoring system, information identifying occurrences of events in an enterprise system comprising multiple computing or networking systems, the events occurring on or involving computing or networking devices in the computing or networking systems, the events identified using rules accessible by the fabric monitoring system;

processing, using the fabric monitoring system, the information in real-time to identify the occurrences of the events and to assign the events to multiple situations, the events assigned to the situations using one or more processing models accessible by the fabric monitoring system; and

outputting information identifying the situations.

2. The method of claim 1, wherein the fabric monitoring system is scalable in multiple dimensions, one dimension associated with a number of computing nodes operating in the fabric monitoring system, another dimension associated with a number of stripes, each stripe comprising a portion of the fabric monitoring system or a separate instance of the fabric monitoring system.

3. The method of claim 1, further comprising:

storing information associated with the events and situations, including information about the events and situations and information about how the situations are resolved, to provide an audit trail for the events and situations.

4. The method of claim 1, further comprising:

obtaining the rules from one or more policies, at least a portion of the one or more policies defined by at least one user using a monitoring definition language.

5. The method of claim 1, wherein the one or more processing models define how to categorize the events and identify the situations, the one or more processing models including:

at least one user-defined model defined by at least one user; and

at least one analytical model defining one or more analytical functions that operate using the information identifying the occurrences of the events.

6. The method of claim 1, wherein:

the information identifying the occurrences of the events is processed using multiple stripes, each stripe comprising a portion of the fabric monitoring system or a separate instance of the fabric monitoring system; and

transmitting synthetic events between the stripes to support cross-stripe correlations of the events or situations.

7. The method of claim 6, wherein different stripes process events that are associated with at least one of:

different assets in the computing or networking systems;

different locations in which the computing or networking systems are deployed;

different deployments of hardware, software, or firmware in the computing or networking systems;

different business units using the computing or networking systems; and

different types of business being transacted using the computing or networking systems.

8. The method of claim 1, wherein the events comprise at least one of

current states of the computing or networking devices in the computing or networking systems;

changes in the current states of the computing or networking devices in the computing or networking systems;

anomalies in the computing or networking devices in the computing or networking systems; and

occurrences of defined conditions within the computing or networking systems.

9. The method of claim 1, wherein outputting the information identifying the situations comprises:

providing information identifying at least one of the situations to an automated agent that automatically resolves the at least one situation.

10. The method of claim 1, wherein outputting the information identifying the situations comprises:

providing information identifying at least one of the situations to a ticketing agent that generates at least one notification for personnel, the at least one notification identifying the at least one situation.

11. A system comprising:

a fabric monitoring system comprising multiple computing nodes and multiple communication links coupling the computing nodes, the fabric monitoring system configured to;

receive information identifying occurrences of events in an enterprise system comprising multiple computing or networking systems, the events occurring on or involving computing or networking devices in the computing or networking systems, the events identified using rules accessible by the fabric monitoring system;

process the information in real-time to identify the occurrences of the events and to assign the events to multiple situations, the events assigned to the situations using one or more processing models accessible by the fabric monitoring system; and

output information identifying the situations.

12. The system of claim 11, wherein the fabric monitoring system is scalable in multiple dimensions, one dimension associated with a number of the computing nodes operating in the fabric monitoring system, another dimension associated with a number of stripes, each stripe comprising a portion of the fabric monitoring system or a separate instance of the fabric monitoring system. 20

13. The system of claim 11, wherein the fabric monitoring system is further configured store information associated with the events and situations, including information about the events and situations and information about how the situations are resolved, to provide an audit trail for the events and situations. 25

14. The system of claim 11, further comprising:

a repository configured to store one or more policies comprising the rules, at least a portion of the one or more policies defined by at least one user using a monitoring definition language.

15. The system of claim 11, wherein the one or more processing models define how to categorize the events and identify the situations, the one or more processing models including:

at least one user-defined model defined by at least one user; and

at least one analytical model defining one or more analytical functions that operate using the information identifying the occurrences of the events.

16. The system of claim 11, wherein:

the system comprises multiple stripes, each stripe comprising a portion of the fabric monitoring system or a separate instance of the fabric monitoring system;

each stripe is configured to process at least a portion of the information identifying the occurrences of the events; and

each stripe is configured to generate and transmit synthetic events to other stripes in order to support cross-stripe correlations of the events or situations.

17. The system of claim 16, wherein each stripe is configured to generate at least some of the synthetic events upon identification of situations by that stripe.

18. The system of claim 16, wherein different stripes are configured to process events that are associated with at least one of:

different assets in the computing or networking systems;

different locations in which the computing or networking systems are deployed;

different deployments of hardware, software, or firmware in the computing or networking systems;

different business units using the computing or networking systems; and

different types of business being transacted using the computing or networking systems.

19. The system of claim 11, wherein the events comprise at least one of:

current states of the computing or networking devices in the computing or networking systems;

changes in the current states of the computing or networking devices in the computing or networking systems;

anomalies in the computing or networking devices in the computing or networking systems; and

occurrences of defined conditions within the computing or networking systems.

20. The system of claim 11, wherein the fabric monitoring system is configured to output the information identifying the situations by providing information identifying at least one of the situations to an automated agent that automatically resolves the at least one situation.

21. The system of claim 11, wherein the fabric monitoring system is configured to output the information identifying the situations by providing information identifying at least one of the situations to a ticketing agent that generates at least one notification for personnel, the at least one notification identifying the at least one situation.

22. A non-transitory computer readable medium containing computer readable program code that, when executed by computing nodes of a fabric monitoring system, cause the computing nodes to:

receive information identifying occurrences of events in an enterprise system comprising multiple computing or networking systems, the events occurring on or involving computing or networking devices in the computing or networking systems, the events identified using rules accessible by the fabric monitoring system;

process the information in real-time to identify the occurrences of the events and to assign the events to multiple situations, the events assigned to the situations using one or more processing models accessible by the fabric monitoring system; and

output information identifying the situations.