Enterprise management system for normalization, integration and correlation of business measurements with application and infrastructure measurements

• US 7,568,019 B1
• Filed: 02/14/2003
• Issued: 07/28/2009
• Est. Priority Date: 02/15/2002
• Status: Active Grant

• Current Assignee: Entrust Corp.
• Original Assignee: Entrust Incorporated (Entrust Corp.)
• Inventors: Relan, Peter, Bhargava, Sunil, Stern, Michael Barrett
• Primary Examiner(s): Follansbee, John
• Assistant Examiner(s): Patel, Dhairya A
• Application Number:
  US10/367,578
• Time in Patent Office: 2,356 Days
• Field of Search: None
• US Class Current: 709/223
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling

Abstract

A method is provided for monitoring, predicting performance of, and managing Business Operations by the simultaneous, real-time Integration, Normalization and Correlation of direct measurements at the Business Layer and other Layers of Business Operations. The other Layers considered, may include, for example, Application and Infrastructure Layers. The system enables the user to automate sophisticated management tasks by Correlating measurements of activity, performance and availability at all Layers of Business Operations. Significantly, the techniques described herein extend the domain of the Correlations across real-time measurements from all Layers of Business Operations, giving central importance to the measurements in the Business Layer within the Correlations.

Claims

1. A computer-implemented method for managing a Business Operation, comprising:

collecting measurements from an Infrastructure Layer, wherein said Infrastructure Layer measurements are associated with said business operation;

wherein said Infrastructure Layer includes one or more infrastructure objects upon which an Application Layer is implemented, said infrastructure objects including network, systems, storage, or middleware elements;

concurrent with collecting measurements from said Infrastructure Layer, collecting measurements from said Application Layer, wherein Application Layer measurements are associated with said Business Operation;

wherein said Application Layer includes one or more application objects upon which a Business Layer is implemented, said application objects including application services or application components;

concurrent with collecting measurements from said Infrastructure Layer and said Application Layer, collecting measurements from said Business Layer, wherein said Business Layer measurements are associated with said Business Operation;

wherein said Business Layer includes one or more business objects, said business objects including business services, business traffic, or business transactions;

based on the measurements collected from each of the Infrastructure Layer, the Application Layer, and the Business Layer generating a first set of Events;

wherein each Event in the first set of Events is a data structure indicating an observed state change or phenomenon occurrence at one of the Infrastructure Layer, the Application Layer, and the Business Layer;

based on the first set of Events and a plurality of policies applied to Events in the first set of Events, generating a second set of Events;

wherein the second set of Events includes;

(a) a third set of Events that occurred at the Business Layer;

(b) a fourth set of Events that occurred at the Application Layer; and

(c) a fifth set of Events that occurred at the Infrastructure Layer;

correlating Events from the third set of Events with Events from at least one of the fourth set of Events or the fifth set of Events;

wherein the method is performed by one or more computing devices.

2. The method of claim 1 further comprising modeling said Business Operation as an instance of an enterprise Model of Layers of Business Operation, said Layers of Business Operation including:

said Infrastructure Layer, wherein said Infrastructure Layer includes Software Infrastructure Monitored Objects that enable the operation of the Application Layer Monitored Objects, and Network Infrastructure Monitored Objects that enable the operation of Software Infrastructure Monitored Objects;

said Application Layer, wherein said Application Layer includes Monitored Objects that enable the operation of Business Layer Monitored Objects;

said Business Layer, wherein said Business Layer includes Monitored Objects that enable Business Operations;

Associations that include Containment, Dependency and Hosting relationships between Monitored Objects in the Business layer, Application layer and Infrastructure layer; and

wherein said Model associates Business Layer Events and Business Layer Monitored Objects to Application Layer Events and Application Layer Monitored Objects and further to Infrastructure Layer Events and Infrastructure Layer Monitored Objects.

3. The method of claim 2 wherein:

the Monitored Objects in the Business Layer include at least one of Business Services, Business Service Operations, and Business Traffic Groups;

the Monitored Objects in the Application Layer include at least one of Application Services and Application Components;

the Monitored Objects in the Application Layer include at least one of Application Services and Application Components;

the Software Infrastructure Monitored Objects include at least one of Web Servers, Application Servers, and Database Servers; and

the Network Infrastructure Monitored Objects include at least one of Hosts and IP interfaces.

4. A computer-readable storage medium storing one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 3.

5. A computer-readable storage medium storing one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 2.

6. The method of claim 1 further comprising:

performing discovery of application interactions in the Application Layer; and

performing discovery of workflows and business processes in the Business Layer.

7. The method of claim 6 further comprising the step of using said discovery of application interactions in the Application Layer and said discovery of workflows and business processes in the Business Layer to aid in correlating Events across each layer of the Business Operation by enriching a model of layers for the Business Operation through such discovery.

8. A computer-readable storage medium storing one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 7.

9. A computer-readable storage medium storing one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 6.

10. The method of claim 1 further comprising:

tracing Probable Cause of issues observed at the Business Layer to issues in the Application Layer or Infrastructure Layer by using Events from the third set of Events Anchor Events in the step of correlating Events; and

determining an impact on the Business Operation from said Events from the third set of Events;

assigning the impact to Events in at least one of the fourth set of Events or the fifth set of Events.

11. A computer-readable storage medium storing one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 10.

12. The method of claim 1 further comprising:

defining Business Exception Events in terms of complex combinations of cumulative technical and business Indicators including Service Level indicators;

generating real-time notifications of the occurrence of said Business Exception Events; and

determining at least one underlying Probable Causes that caused the Business Exception Event;

wherein the Business Exception Events are in the third set of Events.

13. A computer-readable storage medium storing one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 12.

14. The method of claim 1 wherein the steps of collecting measurements and correlating Events from the Infrastructure Layer, the Application Layer, and the Business Layer are performed in real time, concurrent with the Business Operation.

15. A computer-readable storage medium storing one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 14.

16. A computer-readable storage medium storing one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 1.

17. The method of claim 1 wherein the step of generating Events includes generating Normalized Events by translating measurements into a common Event format, wherein the common Event format comprises a common structure for event attributes described in a data model.

18. A computer-readable storage medium storing one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 17.

19. The method of claim 1, further comprising automatically identifying, by the information system, one or more Events in the Application Layer or Infrastructure Layer that are Probable Causes of issues observed at the Business Layer;

wherein the step of automatically identifying is performed without user intervention.

20. A computer-readable storage medium storing one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 19.

21. The method of claim 1, wherein collecting measurements from each of the Infrastructure Layer, Application Layer, and Business Layer comprises monitoring structured network traffic at each of the Infrastructure Layer, Application Layer, and Business Layer.

22. A computer-readable storage medium storing one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 21.

23. The method of claim 1, wherein:

the step of generating the first set of Events comprises generating a stream of structured network traffic, said structured network traffic comprising the first set of Events, wherein the first set of Events is a set of messages transmitted by one or more applications over the network;

the step of generating the second set of Events comprises;

receiving Events in the first set of Events over the network, and generating Normalized Events based on the the received Events.

24. A computer-readable storage medium storing one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 23.

25. The method of claim 1, further comprising determining that a first particular Event from the Business Layer correlates to a second particular Event from one of the Infrastructure Layer or Application Layer.

26. A computer-readable storage medium storing one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 25.

27. The method of claim 1, wherein the plurality of policies includes policies that are conditioned upon elements of two or more Events in the first set of Events.

28. A computer-readable storage medium storing one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 27.

29. The method of claim 1, wherein Events in the first set of Events or the second set of Events include at least one of a Business Event, Application Event, Infrastructure Event, Transaction Event, Threshold Event, Status Change Event, Activity Event, Exception Event, Service Level Objective Violation, Performance Event, Managed Object Event, Admin Event, or Traffic Event.

30. A computer-readable storage medium storing one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 29.

31. The method of claim 1, wherein the first set of Events comprises one or more particular Events, each event of said one or more particular Events corresponding to a direct measurement of an attribute of an object;

wherein the object is one of the infrastructure objects, application objects, or business objects;

wherein the event specifies one of (a) the direct measurement;

(b) a change in the direct measurement;

(c) a state indicated by the direct measurement;

or (d) a state change indicated by the direct measurement.

32. A computer-readable storage medium storing one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 31.

33. The method of claim 1, wherein the collected measurements include a particular measurement reflecting a particular business transaction, wherein the first set of Events includes one or more Events based on the particular measurement.

34. A computer-readable storage medium storing one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 33.

35. The method of claim 1, wherein correlating Events comprises correlating Alerts associated with Events.

36. A computer-readable storage medium storing one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 35.

37. The method of claim 1, wherein the second set of Events comprises one or more Alerts.

38. A computer-readable storage medium storing one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 37.