Modification of computing resource behavior based on aggregated monitoring information

• US 9,380,068 B2
• Filed: 08/18/2014
• Issued: 06/28/2016
• Est. Priority Date: 08/18/2014
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Iyer, Shankar Ramasubramanian, Castro, Edison M., Desai, Dhrumit, Galagali, Sangappa, Keerthi, Navanith R., Pichaiyan, Ramesh, Dominique, Maria Auxilia
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): NGUY, CHI D
• Application Number:
  US14/462,183
• Publication Number:
  US 20160050222A1
• Time in Patent Office: 680 Days
• Field of Search: 726/1, 726/13, 726/25
• US Class Current: 1/1
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 47/801 Real time traffic
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A computer system deploys monitoring agents that monitor the status and health of the computing resources. An analysis engine aggregates and analyzes event information from monitoring agents in order to support self-configuration, self-healing, self-optimization, and self-protection for managing the computer resources. If the analysis engine determines that a computing resource for a software application is approaching a critical status, the analysis engine may issue a command to that computing resource in accordance with a selected policy based on a detected event pattern. The command may indicate how the computing resource should change its behavior in order to minimize downtime for the software application as supported by that computing resource. The computer system may also support a distributed approach with a plurality of servers interacting with a central engine to manage the computer resources located at the servers.

Claims

1. A computer system comprising:

a second computing device; and

a first computing device comprising;

a first memory device;

a resource allocation module;

a first shared computing resource; and

a first processing device coupled to the first memory device and configured to perform, based on instructions stored in the first memory device;

in response to an occurrence of an external event, managing a first load level and a second load level of the first shared computing resource by a first software application and a second software application, respectively;

mapping a plurality of policies to a plurality of previous event patterns, wherein the plurality of policies comprises a first policy and a second policy;

determining a first load level and a second load level of the first shared computing resource by the first software application and the second software application, respectively, that are executing on the first computing device;

when the first load level exceeds a first predetermined threshold,

obtaining a first event data stream for the first software application;

selecting a first filter from a plurality of filters for the first software application;

transforming the first event data stream with the first filter to obtain a first detected event pattern;

detecting whether the first detected event pattern comprises an ordered sequence of events; and

when the first detected event pattern matches a first previous event pattern of the plurality of previous event patterns, instructing the resource allocation module to apply the first policy to the first software application for the first shared computing resource, and wherein detecting whether the first detected event pattern comprises the ordered sequence of events before instructing the resource allocation to apply the first policy; and

when the second load level exceeds a second predetermined threshold,

obtaining a second event data stream for the second software application;

selecting a second filter from a plurality of filters for the second software application, wherein the second filter is different from the first filter;

transforming the second event data stream to obtain a second detected event pattern; and

when the second detected event pattern matches a second previous event pattern of the plurality of previous event patterns, instructing the resource allocation module to apply the second policy to the second software application for the first shared computing resource;

wherein when the first detected event pattern does not match any of the plurality of previous event patterns, sending an event request to the second computing device, wherein the event request includes event information indicative of the first detected event pattern; and

receiving an event response from the second computing device, wherein the event response is indicative of whether the first detected event pattern matches any event pattern that has occurred in the computer system.

2. The computer system of claim 1, further comprising:

a third computing device;

wherein the second computing device includes;

a second memory device; and

a second processing device coupled to the second memory device and configured to perform, based on instructions stored in the second memory device;

receiving the event request from the first computing device;

generating an inquiry whether the first detected event pattern occurred at the third computing device; and

when the inquiry is indicative that the first detected event pattern previously occurred at the third computing device, returning the event response with a returned policy to the first computing device.

3. The computer system of claim 2, wherein the third computing device includes:

a third memory device; and

a third processing device coupled to the third memory device and configured to perform, based on instructions stored in the third memory device;

when the first detected event pattern matches one of a plurality of previously occurring event patterns at the third computing device, returning the event response with the returned policy.

4. The computer system of claim 2, wherein the second processing device is further configured to perform, based on instructions stored in the second memory device:

when the inquiry is not indicative that the first detected event pattern did not previously occur at any computing device in the computer system, creating a new event pattern; and

updating the first computing device and the third computing device with the new event pattern.

5. The computer system of claim 4, wherein the second processing device is further configured to perform, based on instructions stored in the second memory device:

determining a new policy for the new event pattern.

6. The computer system of claim 1, wherein the first processing device is further configured to perform, based on instructions stored in the first memory device:

when the first detected event pattern matches a fourth previous event pattern of the plurality of previous event patterns, applying a fourth policy to the first software application for the first shared computing resource, wherein the plurality of policies includes the fourth policy.

7. The computer system of claim 1, wherein:

the first shared computing resource comprises a computer memory resource; and

the first processing device is further configured to perform, based on instructions stored in the first memory device;

adjusting an allocation of the computer memory resource for the first software application in accordance with the first policy.

8. The computer system of claim 1, wherein the first processing device is further configured to perform, based on instructions stored in the first memory device:

filtering an input stream for the first shared computing resource by the first software application; and

obtaining the first event data stream from the filtered input stream.

9. The computer system of claim 1, wherein the first processing device is further configured to perform:

receiving an indication indicative that an external event has occurred;

correlating the external event to one of a plurality usage patterns; and

applying a corresponding policy associated with said one usage pattern to the first software application for the first shared computing resource.

10. The computer system of claim 1, wherein the first processing device is further configured to perform, based on instructions stored in the first memory device:

determining a third load level of a second shared computing resource by the first software application that is executing on the first computing device;

when the third load level exceeds a third predetermined threshold, obtaining a third event data stream for the first software application;

processing the third event data stream to obtain a third detected event pattern; and

when the third detected event pattern matches a third previous event pattern of the plurality of previous event patterns, applying a third policy to the first software application for the second shared computing resource.

11. The computer system of claim 1, wherein the second computing device comprises a second processing device and a second memory device and wherein the second processing device is further configured to perform, based on instructions stored in the second memory device:

managing a fourth load level of the first shared computing resource for a third software application, wherein the third software application is executing on the second computing device and wherein the first shared computing resource is located on the first computing dev ice;

when the fourth load level exceeds a fourth predetermined threshold, obtaining a fourth event data stream for the third software application;

selecting a third filter from a plurality of filters for the third software application;

transforming the fourth event data stream with the third filter to obtain a fourth detected event pattern; and

when the fourth detected event pattern matches a fourth previous event pattern of the plurality of previous event patterns, applying a fourth policy to the third software application for the first shared computing resource.

12. A computer-assisted method for managing a computer system, the method comprising:

in response to an occurrence of an external event, determining, by a first computing device, a first load level and a second load level of a first shared computing resource by a first software application and a second software application, respectively, that are executing on the first computing device;

when the first load level exceeds a first predetermined threshold,

obtaining, by the first computing device, a first event data stream for the first software application;

selecting a first filter from a plurality of filters for the first software application;

transforming, by the first computing device, the first event data stream with the first filter to obtain a first detected event pattern;

detecting whether the first detected event pattern comprises an ordered sequence of events;

when the first detected event pattern matches any event pattern of a plurality of previous event patterns accessed from a coupled memory device, applying, by the first computing device, a first policy to the software application for the first shared computing resource, and wherein detecting whether the first detected event pattern comprises the ordered sequence of events before applying the first policy;

when the first detected event pattern does not match said any event pattern, sending, by the first computing device, a first event request to a second computing device, wherein the first event request includes event information indicative of the first detected event pattern; and

receiving, by the first computing device, a first event response from the second computing device, wherein the first event response is indicative of whether the first detected event pattern matches a first previously occurring event pattern that has occurred in the computer system;

when the second bad level exceeds a second predetermined threshold,

obtaining , by the first computing device, a second event data stream for the second software application;

selecting a second filter from a plurality of filters for the second software application, where in the second filter is different from a first filter;

transforming, by the first computing device, the second event data stream with the second filter to obtain a second detected event pattern; and

when the second detected event pattern matches one of the plurality of previous event patterns accessed from a coupled memory device, applying, by the first computing device, a second policy to the second software application for the first shared computing resource.

13. The method of claim 12, further comprising:

when the first event response is indicative that the first detected event pattern did not previously occur at any computing device in the computer system, creating a new event pattern;

updating the first computing device with the new event pattern; and

determining a new policy for the new event pattern.

14. The method of claim 12, further comprising:

triggering a second analysis of a third event data stream when a system failure at the first computing device is detected;

processing the third event data stream to obtain a third detected event pattern;

when the third detected event pattern matches a third previous event pattern of the plurality of previous event patterns, applying a third policy to recover from the system failure at the first computing device;

when the third detected event pattern does not match any of the plurality of previous event patterns, sending a second event request to a second computing device, wherein the event request includes event information indicative of whether the third detected event pattern has occurred in the computer system; and

receiving a second event response from the second computing device, wherein the event response is indicative whether the third detected event pattern matches a third previously occurring event pattern that has occurred in the computer system.

15. The method of claim 12, further comprising:

determining a third load level of a second shared computing resource by a third software application that is executing on the first computing device;

when the third load level exceeds a third predetermined threshold, obtaining a third event data stream for the third software application;

selecting a third filter from the plurality of filters, wherein the third filter is different from the first and second filters;

transforming the third event data stream with the third filter to obtain a third detected event pattern; and

when the third second detected event pattern matches any event pattern of the plurality of previous event patterns, applying a third policy to the third software application for the second shared computing resource.

16. A non-transitory computer-readable storage medium storing computer-executable instructions that, when executed, cause a processor at least to perform operations comprising:

in response to an occurrence of an external event, detecting a first load level and a second load level of a shared computing resource by a first software application and a second software application, respectively, wherein the first and second applications are executing on a first computing device;

when the first bad level exceeds a first predetermined threshold,

obtaining an analysis of a first event data stream for the first software application;

transforming the first event data stream with a first filter for the shared computing resource to obtain a first detected event pattern;

detecting whether the first detected event pattern comprises an ordered sequence of events;

when the first detected event pattern matches a first previous event pattern of a plurality of previous event patterns, applying a first policy to the first software application for the shared computing resource, and wherein detecting whether the first detected event pattern comprises the ordered sequence of events before applying the first policy;

when the first detected event pattern does not match any event pattern, sending, by the first computing device, a first event request to a second computing device, wherein the first event request includes event information indicative of the first detected event pattern;

receiving, by the first computing device, a first event response from the second computing device, wherein the first event response is indicative of whether the first detected event pattern matches a first previously occurring event pattern that has occurred in a computer system; and

when the second load level exceeds a second predetermined threshold,

obtaining a second event data stream for the second software application;

transforming the second event data stream with a second filter for the shared computing resource to obtain a second detected event pattern; and

when the second detected event pattern matches a second previous event pattern of the plurality of previous event patterns, applying a second policy to the second software application for the shared computing resource.