System and method for generating and using fingerprints for integrity management

• US 7,707,285 B2
• Filed: 09/27/2006
• Issued: 04/27/2010
• Est. Priority Date: 09/27/2006
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: Integrien Corp. (Broadcom, Inc.)
• Inventors: Marvasti, Mazda A.
• Primary Examiner(s): Follansbee; John
• Assistant Examiner(s): Mejia; Anthony
• Application Number:
  US11/535,787
• Publication Number:
  US 20080077687A1
• Time in Patent Office: 1,308 Days
• Field of Search: 709/224, 702/186, 702/187, 702/179, 706/52, 714/38, 714/39
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis

Abstract

A system and method is provided for capturing and using problem fingerprints in an Information Technology (IT) infrastructure for integrity management. A fingerprint of the transaction topology in an IT infrastructure is automatically captured at various time intervals prior to the occurrence of an event leading to a problem, such as a failure, hard threshold violation, defined transaction violation or user-provided occurrence. The fingerprint provides an indication of the activity and operation of the IT infrastructure immediately preceding the problem event. The captured fingerprint is then used to monitor real-time data in the IT infrastructure operation and activity to look for activity that matches a captured fingerprint to provide an indication of a pending problems before the problems occur. When it is determined that there is sufficient probability a problem event will occur based upon real-time data matching a previously generated problem fingerprint, an alert is generated to provide sufficient notification prior to the occurrence of problem event.

Claims

1. A method of capturing a fingerprint of a problem in an information technology (IT) infrastructure, comprising:

using a computer to;

identifying a problem in the IT infrastructure;

collecting information related to the problem;

analyzing the collected information against a fingerprint creation criteria comprising a first set of rules to determine if the collected information meets a threshold number of rules for fingerprint capture;

assign probability weights to a set of events that characterize a behavior of the IT infrastructure prior to the occurrence of the problem to form a second set of rules when the fingerprint creation criteria have been satisfied; and

capture a fingerprint by create creating a fingerprint comprising the second set of rules if a fingerprint does not exist or updating an existing fingerprint using the second set of rules.

2. The method of claim 1, wherein identification of the problem comprises identify at least one of a failure, a hard threshold violation, and under-identified problem.

3. The method of claim 1, wherein the dynamic thresholding process is used to identify the problem, the dynamic thresholding determination involving a determination of a transaction slowdown on the IT infrastructure.

4. The method of claim 1, wherein the information collecting step comprises:

identifying a problem device in the IT infrastructure;

determining a group of devices in the IT infrastructure that includes the problem device;

determining a number of time cuts in which to obtain information and a time interval for the time cuts;

identifying all transactions within the group of devices that involve the problem device; and

for a given time cut, obtaining a set of all events for the identified transactions.

5. The method of claim 4, wherein the analysis of the collected information to determine if the fingerprint creation criteria have been satisfied comprises:

collecting a the first set of rules describing the probability of a symptom indicating a fingerprint for a given time cut; and

determining if the number of rules in the collected first set of rules meets a certain number defined to be sufficient to satisfy the fingerprint creation criteria.

6. A computer storage medium having program instructions stored thereon executable by a processing unit for capturing a fingerprint of a problem in information technology (IT) infrastructure by performing the steps of:

identifying a problem in the IT infrastructure;

collecting information related to the problem;

analyzing the collected information against a fingerprint creation criteria comprising a first set of rules to determine if the collected information meets a threshold number of rules for fingerprint capture;

assigning probability weights to a set of events that characterize a behavior of the IT infrastructure prior to the occurrence of the problem to form a second set of rules when the fingerprint creation criteria have been satisfied; and

capturing a fingerprint by creating a fingerprint comprising the second set of rules if a fingerprint does not exist or updating an existing fingerprint using the second set of rules.

7. The computer storage medium of claim 6, further comprising program instructions stored thereon for identifying the problem by identifying at least one of a failure, a hard threshold violation, and a user-identified problem.

8. The computer storage medium of claim 6, wherein the dynamic thresholding process is used to identify the problem, the dynamic thresholding determination involving a determination of a transaction slowdown on the IT infrastructure.

9. The computer storage medium of claim 6, further comprising program instructions stored thereon for collecting the problem-related information by:

identifying a problem device in the IT infrastructure;

determining a group of devices in the IT infrastructure that includes the problem device;

determining a number of time cuts in which to obtain information and a time interval for the time cuts;

identifying all transactions within the group of devices that involve the problem device; and

for a given time cut, obtaining a set of all events for the identified transactions.

10. The computer storage medium of claim 9, further comprising program instructions stored thereon for analyzing the collected information to determine if the fingerprint creation criteria have been satisfied by:

collecting a the first set of rules describing the probability of a symptom indicating a fingerprint for a given time cut; and

determining if the number of rules in the collected first set of rules meets a certain number defined to be sufficient to satisfy the fingerprint creation criteria.

11. A device comprising:

a fingerprint generator in an information technology (IT) infrastructure, wherein the fingerprint generator is adapted to;

identify a problem in the IT infrastructure;

collect information related to the problem;

analyze the collected information against a fingerprint creation criteria comprising a first set of rules to determine if the collected information meets a threshold number of rules for fingerprint creature;

assign probability weights to set of events that characterize a behavior of the IT infrastructure prior to the occurrence of the problem to form a second set of rules when the fingerprint creation criteria are satisfied; and

capture a fingerprint by create creating a fingerprint comprising the second set rules if a fingerprint does not exist or updating an existing fingerprint using the second set of rules.

12. The device of claim 11, wherein the problem is identified by at least one of a failure, a hard threshold violation, and a user-identified problem.

13. The device of claim 11, wherein a dynamic thresholding process is used to identify the problem, the dynamic threshold determination involving a determination of a transaction slowdown on the IT infrastructure.

14. The device of claim 11, wherein the device is further adapted to collect information by:

identifying a problem device in the IT infrastructure;

determining a group of devices in the IT infrastructure that includes the problem device;

determining a number of time cuts in which to obtain information and a time interval for the time cuts;

identifying al transactions within the group of devices that involve the problem device; and

for a given time cut, obtaining a set of all events for the identified transactions.

15. The device of claim 14, wherein the fingerprint creation criteria are satisfied by;

collecting a the first set of rules describing the probability of a symptom indicating a fingerprint for a given time cut; and

determining if the number of rules in the collected first set of rules meets a certain number defined to be sufficient to satisfy the fingerprint creation criteria.

16. A device comprising:

using a computer to identify a problem in the IT infrastructure;

collect information related to the problem;

analyze the collected information to determine if fingerprint creation criteria, the fingerprint creation criteria comprising a first set of rules, to determine if the collected information meets a threshold number of rules for fingerprint capture have been satisfied;

assign probability weights to set of events that characterize a behavior of the IT infrastructure to form a second set of rules when the fingerprint creation criteria are satisfied; and

capture a fingerprint by create creating a fingerprint comprising the second set of rules or updating an existing fingerprint using the second set of rules,

wherein the second set of rules reflects a state of a transaction the IT infrastructure at a time cut prior to the occurrence of the problem.

17. The method of claim 16, further comprising identifying the problem by identifying at least one of a failure, a hard threshold violation, and a user-identified problem.

18. The method of claim 16, wherein a dynamic thresholding process is used to identify the problem, the dynamic thresholding determination involving a determination of a transaction slowdown on the IT infrastructure.

19. The method of claim 16, wherein the problem-related information collecting step comprises:

identifying a problem device in the IT infrastructure where the problem is originating;

determining a group of devices in the IT infrastructure that includes the problem device;

determining a number of time cuts in which to obtain information and a time interval for the time cuts;

identifying all transactions within the group of devices that involve the problem device; and

for a given time cut, obtaining a set of all events for the identified transactions.

20. The method of claim 16, wherein the analysis of the collected information to determine if the fingerprint creation criteria have been satisfied comprises:

collecting a the first set of rules describing the probability of a symptom indicating a fingerprint for a given time cut; and

determining if the number of rules in the collected first set of rules meets a certain number defined to be sufficient to satisfy the fingerprint creation criteria.