Method, system and program product for verifying configuration of a computer system

• US 7,627,745 B2
• Filed: 06/30/2006
• Issued: 12/01/2009
• Est. Priority Date: 06/30/2006
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Martinez, Bernard J., Ross, Richard M.
• Primary Examiner(s): ELAMIN, ABDELMONIEM I
• Application Number:
  US11/479,648
• Publication Number:
  US 20080126773A1
• Time in Patent Office: 1,250 Days
• Field of Search: 713/1, 713/2, 709/220, 709/223
• US Class Current: 713/2
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Abstract

A method, system and program product for verifying configuration of a computer system is disclosed. The method includes generating, using a configuration snapshot tool, first and second configuration snapshots of relevant components of a computer system taken at a first and a second point-in-time, respectively, and comparing data in the first configuration snapshot to data in the second configuration snapshot to identify any critical and significant configuration changes while excluding identifying any insignificant configuration changes that do not significantly effect an acceptable level of operation and an intended purpose of the computer system. The method includes alerting as to any critical configuration changes identified, while informing as to any significant configuration changes identified for the computer system. The method further includes defining in a configuration file all the relevant components whose configuration is to be verified, such that relevant components can be added and non-relevant components can be deleted.

Claims

1. A method of verifying configuration of a computer system, said method comprising the steps of:

generating a first point-in-time configuration snapshot containing a first set of configuration data corresponding to a first configuration of each of a set of relevant components of a computer system checked at a first point-in-time, said first point-in-time configuration snapshot being written to a status file;

generating a second point-in-time configuration snapshot containing a second set of configuration data corresponding to a second configuration of said each of said set of relevant components of said computer system checked at a second point-in-time;

comparing said first set of configuration data to said second set of configuration data to identify one or more critical configuration changes and to identify one or more significant configuration changes and to exclude identifying any insignificant configuration changes that do not significantly effect an acceptable level of operation and an intended purpose of said computer system; and

alerting as to each of said one or more critical configuration changes identified, while informing as to each of said one or more significant configuration changes identified for said computer system.

2. The method according to claim 1, wherein each of said generating steps comprises the step of:

providing a configuration snapshot tool for generating said first point-in-time configuration snapshot and said second point-in-time configuration snapshot for said computer system.

3. The method according to claim 2, further comprising the step of:

defining in a configuration file each of said set of relevant components whose configuration data is to be checked by said configuration snapshot tool for generating each of said first point-in-time configuration snapshot and said second point-in-time configuration snapshot for said computer system.

4. The method according to claim 3, wherein each of said generating steps comprises the step of:

running a component script corresponding to a component of said set of relevant components defined for said computer system whose configuration is to be verified.

5. The method according to claim 4, wherein said comparing step further comprises the steps of:

identifying one or more dynamic routes that may have changed from said first point in time configuration snapshot to said second point in time configuration snapshot, wherein said one or more dynamic routes do not cause any corresponding loss in function associated with said one or more dynamic routes; and

identifying one or more persistent routes that should remain the same from said first point in time configuration snapshot to said second point in time configuration snapshot in order to prevent any corresponding loss in function associated with said one or more persistent routes.

6. The method according to claim 5, wherein said defining step further comprises the step of:

adding one or more new relevant components to said set of relevant components defined in said configuration file for verifying configuration of each of said one or more new relevant components added.

7. The method according to claim 6, wherein said defining step further comprises the step of:

deleting one or more existing components from said set of relevant components defined in said configuration file for excluding verifying configuration of each of said one or more existing components deleted.

8. The method according to claim 7, wherein said set of relevant components comprises at least one of:

operating system components, hardware components, disk storage components and network components; and

wherein said first point-in-time configuration snapshot is before a reboot of said system; and

wherein said second point-in-time configuration snapshot is after a reboot of said system.

9. A system for checking configuration of a server on a computer network, comprising:

a plurality of servers coupled to a computer network, each server of said plurality of servers comprising of one or more relevant components for performing an intended function of said each server; and

a configuration snapshot tool for creating an initial point-in-time configuration snapshot of a server of said plurality of servers in said computer network, said configuration snapshot tool being configured to run on said server and to exclude in creating said initial point-in-time configuration snapshot any non-relevant components of said one or more relevant components of said server that do not effect said intended function of said remote server, said configuration snapshot tool being configured to compare said initial point-in-time configuration snapshot to a later point-in-time configuration snapshot in order to identify any critical configuration changes and any significant configuration changes in said one or more relevant components that may affect said intended function of said server;

wherein said initial point-in-time configuration snapshot is before a reboot of said server and wherein said later point-in-time configuration snapshot is after a reboot of said server.

10. The system according to claim 9, wherein said configuration snapshot tool is further configured to read from a configuration file that specifies a list of said one or more relevant components whose configuration is to be checked for creating said initial point-in-time configuration snapshot and said later point-in-time configuration snapshot of said server.

11. The system according to claim 10, wherein said configuration snapshot tool is further configured to run a component script corresponding to a relevant component of said set of relevant components whose configuration is to be checked.

12. The system according to claim 11, wherein said configuration snapshot tool is further configured to add one or more additional components to said set of relevant components specified in said configuration file for verifying configuration of said one or more additional components added.

13. The system according to claim 12, wherein said configuration snapshot tool is further configured to delete one or more existing components from said set of relevant components specified in said configuration file for excluding verifying configuration of each of said one or more existing components deleted.

14. The system according to claim 13, wherein said set of relevant components comprises at least one of:

operating system components, hardware components, disk storage components and network components.

15. A computer program product for checking configuration of a computer system, said computer program product comprising:

a computer readable storage medium;

first program instructions to generate, using a configuration checking tool running on said computer system, an initial point-in-time configuration snapshot of said computer system among a plurality of networked computer systems connected via a network, said configuration checking tool including in said initial point-in-time configuration snapshot each relevant component among a set of relevant components of said computer system that affects a functional level of operation of said computer system;

second program instructions to run said configuration checking tool at a later time to generate a later point-in-time configuration snapshot of said computer system, said second program instructions include instructions to compare said later point-in-time configuration snapshot to said initial point-in-time configuration snapshot to identify one or more critical configuration changes and to identify one or more significant configuration changes to any relevant component among said set of relevant components from said initial point-in-time configuration snapshot to said later point-in-time configuration snapshot;

third program instructions to alert, using specific error messages, of said one or more critical configuration changes identified and to inform, using specific warning messages, of said one or more significant configuration changes identified for said computer system, said instructions excluding identifying any insignificant configuration changes that do not significantly affect said functional level of operation of said computer system; and

wherein said first, second and third program instructions are stored on said computer readable storage medium for execution by a central processing unit of said computer system.

16. The computer program product according to claim 15, further comprising:

fourth program instructions to define in a configuration file said set of relevant components whose configuration is to be checked by said configuration checking tool, said fourth program instructions including instructions to add a component to said configuration file and instructions to delete a component from said configuration file;

said fourth program instructions being stored on said computer readable storage medium for execution by a central processing unit of said computer system.

17. The computer program product according to claim 16, wherein said first program instructions include instructions to run a component script corresponding to a component of said set of relevant components defined for said computer system whose configuration is to be checked.

18. The computer program product according to claim 17, wherein said second program instructions include instructions to check dynamic and persistent routes, to check communication to default gateways and servers, to check system clock, to check error log for hardware and software errors, to check load balancing systems, and to check failover systems.

19. The computer program product according to claim 18, wherein said initial point-in-time configuration snapshot is before a reboot of said computer system;

and wherein said later point-in-time configuration snapshot is after a reboot of said computer system.

20. The computer program product according to claim 19, wherein said set of relevant components comprises at least one of:

operating system components, hardware components, disk storage components and network components.