Appliance for storing, managing and analyzing problem determination artifacts

• US 8,943,364 B2
• Filed: 04/30/2010
• Issued: 01/27/2015
• Est. Priority Date: 04/30/2010
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Bourne, Donald A., Meli, Roger M., Norton, Carolyn H., Wallace, Thomas S., Wamboldt, Michael L.
• Primary Examiner(s): TRUONG, LOAN
• Application Number:
  US12/771,389
• Publication Number:
  US 20110271150A1
• Time in Patent Office: 1,733 Days
• Field of Search: 714/26, 714/25, 714/39, 714/47.3
• US Class Current: 714/26
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0748 in a remote unit communicating with a single-box computer node experiencing an error/fault remote testing G06F11/2294
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/1446 Point-in-time backing up or restoration of persistent data

Abstract

Systems and methods of managing problem determination (PD) data provide for obtaining PD data from a plurality of data sources via an input/output (I/O) interface of a data management device and storing the PD data to a memory of the data management device. In addition, an automated diagnostic analysis of the PD data may be conducted on the data management device. An automated discovery manager may provide the ability to find new sources of PD data and to either reconfigure remote systems to send data to the data management device or to automatically retrieve data from remote systems on a configurable schedule. Dynamically updateable database of symptom information can also be used, wherein the data management device may include a dynamically updateable set of analysis modules with which to conduct analysis on the PD data.

Claims

1. A computer-implemented method comprising:

downloading an analysis policy from a symptom database server, wherein the analysis policy defines a priority to analyze problem determination data;

querying an agent residing on a target machine to identify a source of the problem determination data and executing a remote command on a target machine to identify the source of the problem determination data when the target machine does not include the agent, wherein the source includes at least one of an application, a network device, a storage device, a database and a server;

obtaining the problem determination data from the source via an input/output (I/O) interface of a data management device;

storing the problem determination data to a computer readable storage medium of the data management device;

updating a discovery database based on the source if the discovery database does not contain the source;

conducting an automated diagnostic analysis of the problem determination data on the data management device based on the analysis policy, wherein the automated diagnostic analysis uses the analysis policy to detect a predetermined pattern of events indicating an operational problem;

generating at least one of an event and a report based on the automated diagnostic analysis; and

repeating the querying or executing, obtaining, storing, updating, conducting and generating for a plurality of sources.

2. The method of claim 1, wherein obtaining the problem determination data includes transmitting configuration data to at least one source, wherein the configuration data instructs the at least one source to transmit the problem determination data to the data management device.

3. The method of claim 1, wherein obtaining the problem determination data includes retrieving the problem determination data from at least one source.

19. The method of claim 1, wherein the source is identified to be an application associated with at least one of a process and a signature file, and wherein an identifier associated with one or more of the process and the signature file is added to the discovery database when the application is a newly discovered source.

4. A data management device comprising:

a processor;

an input/output (I/O) interface; and

a computer readable storage medium having computer usable code stored thereon, where, if executed by the processor, the computer usable code causes the data management device to;

download an analysis policy from a symptom database server, wherein the analysis policy is to define a priority to analyze the problem determination data,

query an agent residing on a target machine to identify a source of the problem determination data and execute a remote command on a target machine to identify the source of the problem determination data when the target machine does not include the agent, wherein the source includes at least one of an application, a network device, a storage device, a database and a server,

obtain the problem determination data from the source via the input/output (I/O) interface,

store the problem determination data to the computer readable storage medium,

update a discovery database based on the source if the discovery database does not contain the source,

conduct an automated diagnostic analysis of the problem determination data based on the analysis policy, wherein the automated diagnostic analysis is to use the analysis policy to detect a predetermined pattern of events indicating an operational problem,

generate at least one of an event and a report based on the automated diagnostic analysis, and

repeat the querying or executing, obtaining, storing, updating, conducting and generating for a plurality of sources.

5. The data management device of claim 4, wherein the computer usable code, if executed by the processor, causes the data management device to,

download computer usable code to implement an analysis module,

install the analysis module in an analysis engine of the data management device, and

use the analysis module to conduct the automated diagnostic analysis and generate at least one of the event and the report based on the automated diagnostic analysis.

6. The data management device of claim 4,

wherein the source is to include at least one of an application, a network device, a storage device, a database and a server.

7. The data management device of claim 4, wherein the computer usable code, if executed by the processor, causes the data management device to transmit configuration data to at least one source, wherein the configuration data is to instruct the at least one source to transmit the problem determination data to the data management device based on a scheduling policy.

8. The data management device of claim 4, wherein the computer usable code, if executed by the processor, causes the data management device to retrieve the problem determination data from at least one source.

9. A computer-implemented method comprising:

downloading an analysis policy from a symptom database server, wherein the analysis policy defines a priority to analyze the problem determination data;

querying an agent residing on a target machine to identify a source of the problem determination data and executing a remote command on a target machine to identify the source of the problem determination data when the target machine does not include the agent, wherein the source includes at least one of an application, a network device, a storage device, a database and a server;

obtaining the problem determination data from the source via an input/output (I/O) interface of a data management device;

storing the problem determination data to a memory of the data management device;

updating a discovery database based on the source if the discovery database does not contain the source;

conducting an automated diagnostic analysis of the problem determination data on the data management device based on the analysis policy, wherein the automated diagnostic analysis uses the analysis policy to detect a predetermined pattern of events indicating an operational problem;

generating at least one of an event and a report based on the automated diagnostic analysis; and

repeating the querying or executing, obtaining, storing, updating, conducting and generating for a plurality of sources.

10. The method of claim 9, further including:

download computer usable code to implement an analysis module;

install the analysis module in an analysis engine of the data management device; and

use the analysis module to conduct the automated diagnostic analysis and generate at least one of the event and the report based on the automated diagnostic analysis.

11. The method of claim 9

wherein the source includes at least one of an application, a network device, a storage device, a database and a server.

12. The method of claim 9, wherein obtaining the problem determination data includes transmitting configuration data to at least one source, wherein the configuration data instructs the at least one source to transmit the problem determination data to the data management device based on a scheduling policy.

13. The method of claim 9, wherein obtaining the problem determination data includes retrieving the problem determination data from at least one source.

14. A computer program product comprising:

a non-transitory computer readable storage medium; and

computer usable code stored on the non-transitory computer readable storage medium, where, if executed by a processor, the computer usable code causes a data management device to;

download an analysis policy from a symptom database server, wherein the analysis policy is to define a priority to analyze problem determination data,

query an agent residing on a target machine to identify a source of the problem determination data and execute a remote command on a target machine to identify the source of the problem determination data when the target machine does not include the agent, wherein the source includes at least one of an application, a network device, a storage device, a database and a server,

obtain the problem determination data from the source,

store the problem determination data to a memory,

update a discovery database based on the source if the discovery database does not contain the source,

conduct the automated diagnostic analysis of the problem determination data based on the analysis policy, wherein the automated diagnostic analysis is to use the analysis policy to detect a predetermined pattern of events indicating an operational problem,

generate at least one of an event and a report based on the automated diagnostic analysis, and

repeat the querying or executing, obtaining, storing, updating, conducting and generating for a plurality of sources.

15. The computer program product of claim 14, wherein the computer usable code, if executed by the processor, causes the data management device to,

download computer usable code to implement an analysis module,

install the analysis module in an analysis engine of the data management device, and

use the analysis module to conduct the automated diagnostic analysis and generate at least one of the event and the report based on the automated diagnostic analysis.

16. The computer program product of claim 14

wherein the source is to include at least one of an application, a network device, a storage device, a database and a server.

17. The computer program product of claim 14, wherein the computer usable code, if executed, causes the data management device to transmit configuration data to at least one source, wherein the configuration data is to instruct the at least one source to transmit the problem determination data to the data management device based on a scheduling policy.

18. The computer program product of claim 14, wherein the computer usable code, if executed, causes the data management device to retrieve the problem determination data from at least one source.