Apparatus and method for analysing a computer infrastructure

• US 8,543,689 B2
• Filed: 12/10/2010
• Issued: 09/24/2013
• Est. Priority Date: 12/10/2009
• Status: Active Grant

• Current Assignee: Elasticsearch Global B.V. (Elastic N.V.)
• Original Assignee: Prelert Incorporated (Elastic N.V.)
• Inventors: Dodson, Stephen
• Primary Examiner(s): BAROT, BHARAT
• Application Number:
  US12/965,226
• Publication Number:
  US 20110145400A1
• Time in Patent Office: 1,019 Days
• Field of Search: 709204-207, 709223-224
• US Class Current: 709/224
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/2294 by remote test
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network

Abstract

A system and method for analyzing a computer infrastructure. The system and method analyses messages sent and received within the computer infrastructure to determine a system model and exception data.

Claims

1. A method for identifying a malfunction in operation of a computer infrastructure comprising:

collecting a first plurality of messages relating to the operation of a plurality of first devices belonging to the computer infrastructure;

collecting a second plurality of messages relating to the operation of a plurality of second devices belonging to the computer infrastructure;

storing, in a data store, the first plurality of messages and the second plurality of messages in a predefined period of time to form an historic data items stored in the data store,

correlating, by an analytics engine, the first plurality of messages and the second plurality of messages and producing a system model of at least part of the computer infrastructure, wherein the analytics engine (50) is adapted to identify expected patterns associated within the historic system data items to produce the system model,

generating a unified data stream from a third plurality of messages relating to the operation of the computer infrastructure; and

comparing the unified data stream with the system model to generate an exception data indicative of a malfunction.

2. An apparatus for identifying a malfunction in operation of a computer infrastructure comprising:

a plurality of first devices belonging to the computer infrastructure and generating a first plurality of messages;

a plurality of second devices belonging to the computer infrastructure and generating a second plurality of messages,

a data store for storing the first plurality of messages and the second plurality of messages wherein the first plurality of messages and the second plurality of messages in a predefined period of time forms historic data items stored in the data store;

and

an analytics engine for correlating the first plurality of messages and the second plurality of messages and producing a system model of at least part of the computer infrastructure, wherein the analytics engine is adapted to identify expected patterns associated within the historic system data items to produce the system model and

wherein the analytics engine is further adapted to generate a unified data stream from a third plurality of messages relating to the operation of the computer infrastructure and to compare the unified data stream with the system model to generate an exception data indicative of a malfunction.

3. The apparatus of claim 2, wherein the plurality of first devices is at least one of a server, a router, a peripheral device and a user terminal.

4. The apparatus of claim 2, wherein the plurality of first devices is at least one of a server, a router, a peripheral device and a user terminal.

5. The apparatus of claim 2, further comprising a plurality of third devices connected to the computer infrastructure and generating a third plurality of messages, wherein the plurality of third devices comprises at least one of a server, a router, a peripheral device and a user terminal and wherein the analytics engine is further adapted to analyze the messages from the plurality of third devices and correlating the messages from the plurality of third devices with the messages from at least one of the plurality of second devices and the plurality of first devices, thereby complementing the system model.

6. The apparatus of claim 2, further comprising an external data feed connected to the computer infrastructure.

7. A computer storage medium storing non-transitory computer-executable instructions for performing method for identifying a malfunction in operation of a computer infrastructure comprising:

collecting a first plurality of messages relating to the operation of a plurality of first devices belonging to the computer infrastructure;

collecting a second plurality of messages relating to the operation of a plurality of second devices belonging to the computer infrastructure;

storing, in a data store, the first plurality of messages and the second plurality of messages in a predefined period of time to form an historic data items stored in the data store;

correlating, by an analytics engine, the first plurality of messages and the second plurality of messages and producing a system model of at least part of the computer infrastructure, wherein the analytics engine is adapted to identify expected patterns associated within the historic system data items to produce the system model;

generating a unified data stream from a third plurality of messages relating to the operation of the computer infrastructure; and

comparing the unified data stream with the system model to generate an exception data indicative of a malfunction.