Change audit method, apparatus and system

• US 7,822,724 B2
• Filed: 08/16/2005
• Issued: 10/26/2010
• Est. Priority Date: 07/03/2002
• Status: Active Grant

• Current Assignee: Tripwire Incorporated (Belden Inc.)
• Original Assignee: Tripwire Incorporated (Belden Inc.)
• Inventors: DiFalco, Robert A., Warmack, Robert L., Keeler, Kenneth L.
• Primary Examiner(s): Robinson; Greta L
• Assistant Examiner(s): Wilcox; James J
• Application Number:
  US11/205,544
• Publication Number:
  US 20050278191A1
• Time in Patent Office: 1,897 Days
• Field of Search: None
• US Class Current: 707/695
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: Y10S 707/966 Distributed

Abstract

A method for facilitating management of a data processing environment is disclosed. In various embodiments, the method may include facilitating homogeneous monitoring of a plurality of heterogeneous data processing nodes of the data processing environment, the homogeneous monitoring including facilitating detecting one or more changes of one or more elements of the plurality of heterogeneous data processing nodes. In various embodiments, the method may further include facilitating performing one or more actions in response to detecting the one or more changes. Other embodiments of the present invention may include, but are not limited to, apparatuses and systems adapted to facilitate practice of the above-described method.

Claims

1. A computer-implemented method for facilitating management of a data processing environment on a system comprising one or more processors, the method comprising:

monitoring, by the one or more processors, a plurality of heterogeneous data processing nodes of the data processing environment;

detecting, by the one or more processors, one or more changes of one or more elements of the plurality of heterogeneous data processing nodes; and

performing, by the one or more processors, one or more actions in response to detecting the one or more changes, the one or more actions including a reconciliation response;

wherein the reconciliation response comprises;

creating, by the one or more processors, in digital form, a first memorialization file comprising at least one indication of at least one of the one or more changes;

comparing, by the one or more processors, the first memorialization file to a second memorialization file comprising at least one indication of one or more changes that were known by a change agent;

determining, by the one or more processors, based at least in part on the comparison, that one or more changes indicated in the first memorialization file that were known by the change agent are intended changes; and

determining, by the one or more processors, based at least in part on the comparison, that one or more changes indicated in the first memorialization file that were not known by the change agent are unintended changes.

2. The method of claim 1, wherein the detecting one or more changes comprises taking snapshots of states of one or more elements of the plurality of heterogeneous data processing nodes by the one or more processors.

3. The method of claim 2, wherein at least some of the snapshots are stored in a data warehouse.

4. The method of claim 1, wherein said monitoring the plurality of heterogeneous data processing nodes comprises defining, by the one or more processors, a first logical grouping of one or more data processing nodes to be monitored, the one or more data processing nodes corresponding to one or more data processing node-types.

5. The method of claim 4, wherein said monitoring further comprises defining, by the one or more processors, a second logical grouping of one or more rules to be asserted against at least a subset of the first logical grouping of data processing nodes, each of said one or more rules identifying criteria for detecting an operational state change of one or more data processing nodes.

6. The method of claim 5, wherein said monitoring further comprises generating, by the one or more processors, one or more monitoring tasks, each of said monitoring tasks defining which ones of the second logical grouping of rules are to be asserted against which ones of the first logical grouping of one or more data processing nodes.

7. The method of claim 1, wherein the one or more actions comprise one or more selected from the group consisting of an alert response, a baseline response, and modifying a severity state of at least one of the one or more changes detected.

8. The method of claim 1, wherein the reconciliation response further comprises determining, by the one or more processors, whether at least one of the one or more changes was authorized, including learning of a submission of a request, in digital form, to make a modification.

9. The method of claim 8, wherein said determining whether at least one of the one or more changes was authorized further includes determining, by the one or more processors, whether to allow the requested modification to be scheduled or assigned for implementation, in response to learning of the submission of the request.

10. The method of claim 9, wherein said determining whether at least one of the one or more changes was authorized further includes conditionally indicating, one or more processors, allowance of the requested modification, based at least in part on the result of the determining whether to allow the requested modification to be scheduled or assigned for implementation.

11. The method of claim 1, wherein the reconciliation response further comprises determining, by the one or more processors, whether at least one of the one or more changes conforms with a conformance authority, the conformance authority having one or more guidelines.

12. The method of claim 1, further comprising correlating, by the one or more processors, one of the one or more changes to one or more events associated with an element of the one or more elements;

and

reporting, by the one or more processors, the detected change for the element, supplemented with one or more of the correlated events of the element.

13. The method of claim 1, wherein at least one of the data processing nodes is a device selected from the group consisting of a networking device, a server, a desktop computer, a laptop computer, a tablet computer, a personal digital assistant, a cellular phone, a set top box, and a media player.

14. The method of claim 1, wherein the method further comprises using the one or more determined unintended changes to maintain or demonstrate control of an enterprise'"'"'s information technology infrastructure.

15. The method of claim 1, wherein the method further comprises using the one or more determined unintended changes to maintain or demonstrate control of an enterprise'"'"'s financial systems or data.

16. The method of claim 1, wherein the method further comprises using the one or more determined unintended changes to maintain or demonstrate control of an enterprise'"'"'s business processes.

17. The method of claim 1, wherein the method further comprises using the one or more determined unintended changes to perform an audit of an enterprise.

18. The method of claim 17, wherein using the one or more determined unintended changes to perform an audit comprises providing an audit trail for an audit.

19. The method of claim 1, wherein the method further comprises using the one or more determined unintended changes to facilitate compliance with governmental laws/regulations regarding establishment and maintenance of an internal control structure and/or procedures for financial reporting.

20. A system comprising:

a computer processor; and

a storage medium coupled to the processor and having stored therein instructions, that, when executed on a computer processor, cause the processor to perform a method, the method comprising;

monitoring a plurality of heterogeneous data processing nodes of a data processing environment;

detecting one or more changes of one or more elements of the plurality of heterogeneous data processing nodes; and

performing one or more actions in response to detecting the one or more changes, including a reconciliation response;

wherein the reconciliation response comprises;

creating, in digital form, a first memorialization file comprising at least one indication of at least one of the one or more changes;

comparing the first memorialization file to a second memorialization file comprising at least one indication of one or more changes that were known by a change agent;

determining, based at least in part on the comparison, that one or more changes indicated in the first memorialization file that were known by the change agent are intended changes; and

determining, based at least in part on the comparison, that one or more changes indicated in the first memorialization file that were not known by the change agent are unintended changes.

21. The system of claim 20, wherein the method further comprises:

taking snapshots of states of one or more elements of the plurality of heterogeneous data processing nodes; and

storing at least some of the snapshots in a data warehouse.

22. The system of claim 20, wherein the method further comprises:

defining a first logical grouping of one or more data processing nodes to be monitored, the one or more data processing nodes corresponding to one or more data processing node-types;

defining a second logical grouping of one or more rules to be asserted against at least a subset of the first logical grouping of data processing nodes, each of said one or more rules identifying criteria for detecting an operational state change of one or more data processing nodes; and

generating one or more monitoring tasks, each of said monitoring tasks defining which ones of the second logical grouping of rules are to be asserted against which ones of the first logical grouping of one or more data processing nodes.

23. The system of claim 20, wherein the one or more actions comprise one or more selected from the group comprising of an alert response and a baseline response.

24. The system of claim 20, wherein the reconciliation response further comprises:

determining whether at least one of the one or more changes was authorized, including learning of a submission of a request, in digital form, to make a modification;

determining whether to allow the requested modification to be scheduled or assigned for implementation, in response to learning of the submission of the request; and

conditionally indicating allowance of the requested modification, based at least in part on the result of the determining whether to allow the requested modification to be scheduled or assigned for implementation.

25. The system of claim 20, wherein the reconciliation response further comprises determining whether at least one of the one or more changes conforms with a conformance authority, the conformance authority having one or more guidelines.

26. The system of claim 20, wherein the method further comprises maintaining or demonstrating control of one or more selected from the group consisting of an enterprise'"'"'s information technology infrastructure, an enterprise'"'"'s financial systems, an enterprise'"'"'s financial data and an enterprise'"'"'s business processes.