Method and apparatus for managing components in an IT system

• US 8,037,195 B2
• Filed: 01/15/2009
• Issued: 10/11/2011
• Est. Priority Date: 12/12/2001
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Wheeler, Blair Francis, Beaman, Peter Demarest, Barbrow, David Jay, Kowalczyk, Stanislaw, Anuszczyk, Jeffrey John, Bhathena, Firdaus
• Primary Examiner(s): Follansbee; John
• Assistant Examiner(s): Madamba; Glenford
• Application Number:
  US12/354,645
• Publication Number:
  US 20090125758A1
• Time in Patent Office: 999 Days
• Field of Search: 709/224, 714/28
• US Class Current: 709/229
• CPC Class Codes: G06F 8/70 Software maintenance or management
• CPC Class Codes: G06F 9/44505 Configuring for program initiating, e.g. using registry, configuration files
• CPC Class Codes: H04L 41/0253 using browsers or web-pages for accessing management information
• CPC Class Codes: H04L 41/0604 using filtering, e.g. reduction of information by using priority, element types, position or time
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]

Abstract

A system and method for collecting information on components in an information technology (IT) system. This embodiment features discovering components in the IT system, determining at least one dependency between two or more of the discovered components, and tracking changes to the discovered components and the dependency between two or more of the discovered components. The discovery of components can be carried out using fingerprints of components, which can include key elements of the component that exist in a full model of all of the elements of the component.

Claims

1. A non-transitory computer-readable medium storing program instructions executable to:

store a fingerprint specifying a plurality of attributes of a component of an information technology (IT) system;

automatically discover the existence of the component in the IT system using the fingerprint, wherein automatically discovering the existence of the component comprises;

receiving a plurality of event messages indicating a plurality of real-time events that occur in the IT system, wherein each event message matches a respective attribute specified by the fingerprint; and

determining that event messages matching each attribute of the plurality of attributes specified by the fingerprint have been received;

wherein the plurality of event messages includes a first event message indicating a first real-time event selected from the following real-time events;

a file creation, a file deletion, a file modification, a registry key creation, a registry key deletion, or a registry key modification.

2. The non-transitory computer-readable medium of claim 1, wherein the component is a software application.

3. The non-transitory computer-readable medium of claim 1, wherein the first real-time event is a file creation, a file deletion, or a file modification.

4. The non-transitory computer-readable medium of claim 1, wherein the first real-time event is a registry key creation, a registry key deletion, or a registry key modification.

5. The non-transitory computer-readable medium of claim 1, wherein the plurality of event messages includes a first event message indicating detection of a particular element of the component in the IT system.

6. The non-transitory computer-readable medium of claim 1, wherein the program instructions are further executable to:

after discovering the existence of the component, receive a subsequent event message indicating that an element of the component was deleted; and

indicate that the component has been damaged in response to the subsequent event message.

7. The non-transitory computer-readable medium of claim 1, wherein the program instructions are further executable to:

after discovering the existence of the component, receive one or more subsequent event messages indicating that one or more elements of the component were deleted; and

indicate that the component has been uninstalled from the IT system in response to the one or more subsequent event messages.

8. The non-transitory computer-readable medium of claim 1, wherein the program instructions are further executable to track changes to the component after discovering the component.

9. The non-transitory computer-readable medium of claim 1, wherein the program instructions are further executable to:

store a subfingerprint specifying one or more attributes of a refinement of the component;

in response to discovering the component, perform one or more commands to obtain information regarding the component; and

automatically discover the refinement of the component in the IT system by matching the information regarding the component to the one or more attributes of the refinement of the component specified by the subfingerprint.

10. The non-transitory computer-readable medium of claim 9, wherein the refinement of the component is a particular version of the component, wherein discovering the refinement of the component comprises discovering that the particular version of the component exists in the IT system.

11. The non-transitory computer-readable medium of claim 9, wherein the refinement of the component is an optional piece of the component, wherein discovering the refinement of the component comprises discovering that the optional piece of the component exists in the IT system.

12. A system comprising:

one or more processors; and

memory storing program instructions;

wherein the program instructions are executable by the one or more processors to;

store a fingerprint specifying a plurality of attributes of a component of an information technology (IT) system;

automatically discover the existence of the component in the IT system using the fingerprint, wherein automatically discovering the existence of the component comprises;

receiving a plurality of event messages indicating a plurality of real-time events that occur in the IT system, wherein each event message matches a respective attribute specified by the fingerprint; and

determining that event messages matching each attribute of the plurality of attributes specified by the fingerprint have been received;

wherein the plurality of event messages includes a first event message indicating a first real-time event selected from the following real-time events;

a file creation, a file deletion, a file modification, a registry key creation, a registry key deletion, or a registry key modification.

13. The system of claim 12, wherein the component is a software application.

14. The system of claim 12, wherein the first real-time event is a file creation, a file deletion, or a file modification.

15. The system of claim 12, wherein the first real-time event is a registry key creation, a registry key deletion, or a registry key modification.

16. The system of claim 12, wherein the program instructions are further executable by the one or more processors to track changes to the component after discovering the component.

17. The system of claim 12, wherein the program instructions are further executable by the one or more processors to:

store a subfingerprint specifying one or more attributes of a refinement of the component;

in response to discovering the component, perform one or more commands to obtain information regarding the component; and

automatically discover the refinement of the component in the IT system by matching the information regarding the component to the one or more attributes of the refinement of the component specified by the subfingerprint.

18. The system of claim 17, wherein the refinement of the component is a particular version of the component, wherein discovering the refinement of the component comprises discovering that the particular version of the component exists in the IT system.

19. The system of claim 17, wherein the refinement of the component is an optional piece of the component, wherein discovering the refinement of the component comprises discovering that the optional piece of the component exists in the IT system.

20. A method, comprising:

a computer system storing a fingerprint specifying a plurality of attributes of a component of an information technology (IT) system;

automatically discovering the existence of the component in the IT system using the fingerprint, wherein automatically discovering the existence of the component comprises;

receiving a plurality of event messages indicating a plurality of real-time events that occur in the IT system, wherein each event message matches a respective attribute specified by the fingerprint; and

determining that event messages matching each attribute of the plurality of attributes specified by the fingerprint have been received;

wherein the plurality of event messages includes a first event message indicating a first real-time event selected from the following real-time events;

a file creation, a file deletion, a file modification, a registry_key creation, a registry_key deletion, or a registry_key modification.