Methods, systems and computer program products for managing execution of information technology (IT) processes

• US 8,504,679 B2
• Filed: 05/07/2007
• Issued: 08/06/2013
• Est. Priority Date: 05/09/2006
• Status: Active Grant

• Current Assignee: NetIQ Corporation (Open Text Corporation)
• Original Assignee: NetIQ Corporation (Open Text Corporation)
• Inventors: Spire, Edward, Guan, Jiebo, Sharpe, Michael, Reiner, Roberto, Jones, Mark, Park, Stephen
• Primary Examiner(s): THIAW, CATHERINE B
• Application Number:
  US11/744,983
• Publication Number:
  US 20070266138A1
• Time in Patent Office: 2,283 Days
• Field of Search: 709223-226
• US Class Current: 709/224
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0748 in a remote unit communicating with a single-box computer node experiencing an error/fault remote testing G06F11/2294
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

Methods, systems and computer program products are provided for managing information technology (IT) processes for a computer network. An incident report, including associated data, is received from an application monitoring resources on the computer network. Additional data associated with the computer network resources to be obtained based on the incident report is automatically identified and obtained. Related data in a historical database is automatically identified based on the incident report and/or the additional data and the identified related historical data is automatically retrieved. The incident report, the additional data and/or the related historical data are analyzed to identify a responsive process to respond to the incident report.

Claims

1. A method for managing information technology (IT) processes for a computer network that includes a plurality of applications monitoring resources on the computer network, the method comprising:

receiving an incident report, including associated data, from a first one of the applications monitoring resources on the computer network, wherein the incident report is associated with an identified one of a plurality of resources on the computer network and wherein the incident report is generated without input from any user to the first one of the applications monitoring resources on the computer network;

automatically identifying additional data associated with the identified one of the resources on the computer network to be collected based on the incident report;

automatically collecting the identified additional data directly from a different one of the applications monitoring resources on the computer network responsive to identifying the additional data, wherein the additional data is generated by the different one of the applications monitoring resources on the computer network without input from any user;

automatically identifying related data in a historical database based on the incident report and/or the additional data;

automatically retrieving the identified related historical data; and

analyzing the incident report, the additional data and/or the related historical data to identify a responsive process to respond to the incident report.

2. The method of claim 1, wherein automatically collecting the identified additional data includes collecting the additional data directly from a plurality of different ones of the applications monitoring resources on the computer network and wherein the first one of the applications monitoring resources on the computer comprises an application manager and the plurality of different ones of the applications monitoring resources on the computer network includes a security manager.

3. The method of claim 1, wherein the plurality of applications monitoring resources include an application manager, a security manager and/or a vulnerability manager and wherein the incident report comprises a violation of a service level agreement.

4. The method of claim 1, wherein receiving an incident report is followed by updating the historical database based on the incident report.

5. The method of claim 1, wherein analyzing the incident report comprises providing the incident report, the additional data, the related historical data and/or the identified responsive process to a network administrator in a prioritized ordering based on an evaluation of the relevance of the additional data in view of the related historical data.

6. The method of claim 5, wherein providing the incident report, the additional data, the related historical data and/or the identified responsive process to the network administrator includes generating a process dashboard graphical user interface (GUI) including:

an identification of timeliness of provision of ones of the monitored resources relative to a corresponding benchmark; and

/or

a breakdown of time spent in respective ones of a plurality of states associated with provision of the ones of the monitored resources, wherein generating the process dashboard GUI further includes at least one of generating;

an identification of commonalities among the received incident report and other currently pending incident reports;

a comparison of policy execution metrics over a selected period of time;

or

a summary of accumulated data in the historical database including a correlation between initial indicators of incident causes and successful remediations, successful remediation instances, a level of usage of the accumulated data, a relation between the usage of the accumulated data and a performance measure of remediations and/or manually entered comments associated with remediation instances.

7. The method of claim 5, wherein providing the incident report in a prioritized order includes generating a dashboard graphical user interface (GUI) including a display of an incident summary generated responsive to the received incident report followed by a display of related incidents that are identified as related to the received incident report.

8. The method of claim 5, wherein providing the incident report in a prioritized order includes generating a dashboard graphical user interface (GUI) including a display of a change summary generated responsive to the received incident report followed by a display of related impacts that are identified as related to the change summary.

9. The method of claim 1, wherein the historical database includes a plurality of responsive processes associated with respective incident report types and a plurality of rules for identifying ones of the plurality of responsive processes based on the incident report and/or the additional data and wherein analyzing the incident report includes:

identifying at least one of the plurality of rules to be evaluated responsive to the received incident report; and

evaluating the identified at least one of the plurality of rules.

10. The method of claim 1,wherein analyzing the incident report comprises:

determining if the identified responsive process includes an associated automated remediation process;

providing the incident report, the additional data, the related historical data and/or the identified responsive process to a network administrator in a prioritized ordering based on an evaluation of the relevance of the additional data in view of the related historical data when the identified responsive process does not include an associated automated remediation process; and

automatically executing the associated automated remediation process when the identified responsive process does include an associated automated remediation process.

11. The method of claim 10, wherein analyzing the incident report includes automatically executing the associated automated remediation process.

12. The method of claim 10, wherein analyzing the incident report is followed by:

determining an effectiveness of the identified responsive process in addressing the incident report; and

updating the historical database based on the effectiveness of the identified responsive process, wherein the historical database includes a plurality of responsive processes associated with respective incident report types and a plurality of rules for identifying ones of the plurality of responsive processes based on the incident report and/or the additional data and wherein updating the historical database includes modifying at least one of the plurality of responsive processes that is associated with an incident report type of the received incident report and/or at least one of the plurality of rules based on the effectiveness of the identified responsive process.

13. The method of claim 12, wherein determining the effectiveness includes executing an automated network health check process for the computer network, the automated network health check process including collecting data associated with the identified one of the resources on the computer network after the identified responsive process has been executed.

14. The method of claim 13, wherein updating the historical database includes modifying at least one of the plurality of responsive processes that is associated with an incident report type of the received incident report.

15. The method of claim 14, wherein identifying the related data in the historical database comprises:

identifying an indicator for the received incident report; and

identifying data associated with previous incident reports in the historical database as related historical data based on the identified indicator, the related historical data including an identification of additional data obtained for the previous incident reports and its relevance in remediation of the previous incident reports and an identification of responsive processes used in remediation of the previous incident reports and their success in remediation of the previous incident reports.

16. The method of claim 15, wherein the identified responsive process comprises a plurality of alternative responsive processes and wherein analyzing the incident report includes reporting the identification of additional data obtained for the previous incident reports and its relevance in remediation of the previous incident reports and the identification of responsive processes used in remediation of the previous incident reports and their success in remediation of the previous incident reports to a network administrator and wherein the method further comprises receiving from the network administrator a selection of one of the plurality of alternative responsive processes.

17. The method of claim 16, wherein reporting the identification of additional data includes generating a process dashboard graphical user interface (GUI) including:

an identification of timeliness of provision of ones of the monitored resources relative to a corresponding benchmark;

a breakdown of time spent in respective ones of a plurality of states associated with provision of the ones of the monitored resources;

an identification of commonalities among the received incident report and other currently pending incident reports;

a comparison of policy execution metrics over a selected period of time; and

/or

a summary of accumulated data in the historical database including a correlation between initial indicators of incident causes and successful remediations, successful remediation instances, a level of usage of the accumulated data, a relation between the usage of the accumulated data and a performance measure of remediations and/or manually entered comments associated with remediation instances.

18. A system comprising a data processing apparatus having computer program instructions loaded thereon that are configured to carry out the method of claim 15.

19. A computer program product for managing information technology (IT) processes for a computer network, the computer program product comprising computer program code embodied in a non-transitory computer readable medium, the computer program code comprising program code configured to carry out the method of claim 15.

20. The method of claim 1, wherein receiving an incident report comprises:

receiving a plurality of incident reports;

automatically identifying commonalities among the incident reports; and

providing a special case status to ones of the incident reports with identified commonalities, and wherein analyzing the incident report includes analyzing the incident reports to identifying the responsive process based on the special case status of the incident reports.

21. The method of claim 1, wherein receiving the incident report comprises:

receiving a report of slow response time for a server based application service;

comparing the reported slow response time to a corresponding metric of a service level agreement (SLA) related to the server based application; and

generating the incident report based on the comparison of the reported slow response time to the corresponding metric.

22. The method of claim 1, wherein the incident report is received from a first one of the resources resident on a first device on the computer network and wherein automatically identifying additional data includes automatically identifying additional data associated with a second one of the resources resident on a second device on the computer network, different from the first device, to be collected based on the incident report.

23. The method of claim 1, wherein the responsive process includes remediation operations to be carried out on at least two different devices on the computer network.

24. A computer system for managing information technology (IT) processes for a computer network that includes a plurality of applications monitoring resources on the computer network, the system comprising:

a communication interface coupled to the computer network that is configured to receive an incident report, including associated data, from a first one of the applications monitoring resources on the computer network, wherein the incident report is associated with an identified one of the resources on the computer network and wherein the incident report is generated without input from any user to the first one of the applications monitoring resources on the computer network;

an additional data acquisition module executing on a processor of the computer system configured to identify additional data associated with the identified one of the resources on the computer network to be collected based on the incident report and to collect the identified additional data directly from a different one of the applications monitoring resources on the computer network responsive to identifying the additional data, wherein the additional data is generated by the different one of the applications monitoring resources on the computer network without input from any user;

a historical data acquisition module executing on a processor of the computer system configured to identify related data in a historical database based on the incident report and/or the additional data and to retrieve the identified related historical data; and

a data analysis module executing on a processor of the computer system configured to analyze the incident report, the additional data and/or the related historical data to a identify a responsive process to respond to the incident report.

25. The system of claim 24, further comprising a user report generating module executing on a processor of the computer system configured to provide the incident report, the additional data, the related historical data and/or the identified responsive process to the network administrator, including generating a process dashboard graphical user interface (GUI) for display on a display of the computer system including:

an identification of timeliness of provision of ones of the monitored resources relative to a corresponding benchmark; and

/or

a breakdown of time spent in respective ones of a plurality of states associated with provision of the ones of the monitored resources, wherein generating the process dashboard GUI further includes at least one of generating;

an identification of commonalities among the received incident report and other currently pending incident reports;

a comparison of policy execution metrics over a selected period of time; and

/or

a summary of accumulated data in the historical database including a correlation between initial indicators of incident causes and successful remediations, successful remediation instances, a level of usage of the accumulated data, a relation between the usage of the accumulated data and a performance measure of remediations and/or manually entered comments associated with remediation instances.

26. A computer program product for managing information technology (IT) processes for a computer network that includes a plurality of applications monitoring resources on the computer network, the computer program product comprising:

a non-transitory computer-readable storage medium having computer-readable program code embodied in said medium, said computer-readable program code comprising;

computer-readable program code that receives an incident report, including associated data, from a first one of the applications monitoring resources on the computer network, wherein the incident report is associated with an identified one of the resources on the computer network and wherein the incident report is generated without input from any user to the first one of the applications monitoring resources on the computer network;

computer-readable program code that identifies additional data associated with the identified one of the resources on the computer network to be collected based on the incident report;

computer-readable program code that collects the identified additional data directly from a different one of the applications monitoring resources on the computer network responsive to identifying the additional data, wherein the additional data is generated by the different one of the applications monitoring resources on the computer network without input from any user;

computer-readable program code that identifies related data in a historical database based on the incident report and/or the additional data;

computer-readable program code that retrieves the identified related historical data; and

computer-readable program code that analyzes the incident report, the additional data and/or the related historical data to a identify a responsive process to respond to the incident report.

27. A method for managing information technology (IT) processes for a computer network that includes a plurality of applications monitoring resources on the computer network, the method comprising:

defining a plurality of exceptional events for the computer network, each of the defined plurality of exceptional events having an associated combination of detected events;

receiving a plurality of reports of detected events from ones of the plurality of applications monitoring resources on the computer network, wherein an incident report is generated without input from any user to a first one of the applications monitoring resources on the computer network;

comparing the plurality of reports of detected events to the associated combinations of detected events of the exceptional events to detect an occurrence of one of the exceptional events on the computer network, the plurality of reports of detected events including associated data;

identifying additional data associated with the resources on the computer network to be obtained based on detected occurrence of one of the exceptional events;

obtaining the identified additional data responsive to identifying the additional data, wherein the additional data is generated by a different one of the applications monitoring resources on the computer network without input from any user;

automatically identifying related data in a historical database based on the incident report and/or the additional data;

automatically retrieving the identified related historical data; and

analyzing the plurality of reports of detected events including associated data, the additional data and/or the related historical data to identify a responsive process to respond to the incident report.

28. The method of claim 27, wherein the plurality of exceptional events includes hardware failures, software failures, over-utilized resources and slow response times.

29. The method of claim 27, wherein obtaining the identified additional data includes querying any of the plurality of application monitoring resources that did not provide any of the plurality of reports of detected events used to detect the occurrence of one of the exceptional events.