CONFIGURATION CHANGE REALIZATION ASSESSMENT AND TIMELINE BUILDER

• US 20170310738A1
• Filed: 04/20/2016
• Published: 10/26/2017
• Est. Priority Date: 04/20/2016
• Status: Active Grant

• Current Assignee: Nicira Incorporated (Broadcom, Inc.)
• Original Assignee: Nicira Incorporated (Broadcom, Inc.)
• Inventors: BANSAL, Kaushal
• Granted Patent: US 10,506,022 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 8/654 using techniques specially adapted for alterable solid state memories, e.g. for EEPROM or flash memories
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Techniques disclosed herein provide an approach for assessing configuration change realization and building timelines. In one embodiment, an event parser parses relevant log(s) of a computing system to identify events of interest therein and associated tasks. Examples of tasks include publishing a firewall or persisting a firewall rule, each of which may involve multiple events in a particular order. Upon identifying an initial event of a task, the event parser instantiates a state machine associated with the task to verify the occurrence of subsequent events in the task in the appropriate order. The event parser may verify whether configuration changes made by a user have been realized in the system based on the completion of tasks associated with the configuration changes. In addition, data associated with tasks may be persisted in a datastore and used to generate reports.

Claims

1. A method of assessing configuration change realization in a datacenter, comprising:

parsing log messages received from a plurality of computing systems of the datacenter;

identifying from the parsing of the log messages a first event, the first event being associated with a task that corresponds with a configuration change being made to one or more of the computing systems, and the task including predefined subsequent events that are expected to occur after the first event;

identifying from the parsing each of the subsequent events of the task; and

when each of the subsequent events of the task are identified from the parsing of the log messages, generating a report which indicates a realization of the configuration change associated with the task.

2. The method of claim 1, wherein

the computing systems are virtualized computing systems, and

the configuration change is propagated to and made in a plurality of hypervisors in the virtualized computing systems.

3. The method of claim 2, wherein the configuration change includes at least one of publishing a logical firewall and persisting a firewall rule.

4. The method of claim 3, wherein the one or more logs are collected from the plurality of hypervisors and from an application used to manage the logical firewall.

5. The method of claim 1, wherein the task, the plurality of events of the task, and an order of the events are specified in a properties file.

6. The method of claim 1, wherein an order of the events in the task includes a strict ordering between a first plurality of the events of the task and a non-strict ordering between a second plurality of the events of the task.

7. The method of claim 1, wherein

parsing the change log includes determining a time when each of the identified events occurred, and

the generated report further indicates at least one of a time taken to realize the configuration change and a timeline of the events.

8. The method of claim 1, wherein the generated report further indicates configuration change realization times over time.

9. A non-transitory computer-readable storage medium containing a program which, when executed by one or more processors, performs operations for assessing configuration change realization in a datacenter, the operations comprising:

parsing log messages received from a plurality of computing systems of the datacenter;

identifying from the parsing of the log messages a first event, the first event being associated with a task that corresponds with a configuration change being made to one or more of the computing systems, and the task including predefined subsequent events that are expected to occur after the first event;

identifying from the parsing each of the subsequent events of the task; and

when each of the subsequent events of the task are identified from the parsing of the log messages, generating a report which indicates a realization of the configuration change associated with the task.

10. The non-transitory computer-readable storage medium of claim 9, wherein

the computing systems are virtualized computing systems, and

the configuration change is propagated to and made in a plurality of hypervisors in the virtualized computing systems.

11. The non-transitory computer-readable storage medium of claim 10, wherein the configuration change includes at least one of publishing a logical firewall and persisting a firewall rule.

12. The non-transitory computer-readable storage medium of claim 11, wherein the one or more logs are collected from the plurality of hypervisors and from an application used to manage the logical firewall.

13. The non-transitory computer-readable storage medium of claim 9, wherein the task, the plurality of events of the task, and an order of the events are specified in a properties file.

14. The non-transitory computer-readable storage medium of claim 9, wherein an order of the events in the task includes a strict ordering between a first plurality of the events of the task and a non-strict ordering between a second plurality of the events of the task.

15. The non-transitory computer-readable storage medium of claim 9, wherein

parsing the change log includes determining a time when each of the identified events occurred, and

the generated report further indicates at least one of a time taken to realize the configuration change and a timeline of the events.

16. The non-transitory computer-readable storage medium of claim 9, wherein the generated report further indicates configuration change realization times over time.

17. A system, comprising:

a processor; and

a memory, wherein the memory includes a program executable in the processor to perform operations for assessing configuration change realization in a datacenter, the operations comprising;

parsing log messages received from a plurality of computing systems of the datacenter,

identifying from the parsing of the log messages a first event, the first event being associated with a task that corresponds with a configuration change being made to one or more of the computing systems, and the task including predefined subsequent events that are expected to occur after the first event,

identifying from the parsing each of the subsequent events of the task, and

when each of the subsequent events of the task are identified from the parsing of the log messages, generating a report which indicates a realization of the configuration change associated with the task.

18. The system of claim 17, wherein

the computing systems are virtualized computing systems, and

the configuration change is propagated to and made in a plurality of hypervisors in the virtualized computing systems.

19. The system of claim 18, wherein the configuration change includes at least one of publishing a logical firewall and persisting a firewall rule.

20. The system of claim 17, wherein an order of the events in the task includes a strict ordering between a first plurality of the events of the task and a non-strict ordering between a second plurality of the events of the task.