Management of decommissioned server assets in a shared data environment

• US 9,917,754 B2
• Filed: 11/16/2015
• Issued: 03/13/2018
• Est. Priority Date: 11/16/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Childress, Rhonda L., Kumhyr, David B., Spisak, Michael J.
• Primary Examiner(s): Lim, Krisna
• Application Number:
  US14/941,776
• Publication Number:
  US 20170141983A1
• Time in Patent Office: 848 Days
• CPC Class Codes: H04L 41/065 involving logical or physical relationship, e.g. grouping and hierarchies
• CPC Class Codes: H04L 41/147 for predicting network behaviour
• CPC Class Codes: H04L 41/20 Network management software packages
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/0823 Errors, e.g. transmission errors
• CPC Class Codes: H04L 61/103 across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 67/1034 Reaction to server failures by a load balancer
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching

Abstract

Embodiments of the present invention provide systems and methods for monitoring decommissioned servers in a shared data environment. Embodiments of the present invention can be used to aggregate information associated with an environment from external resources, and calculate a baseline of server activity from the aggregated information. When new information is received, it is compared to the baseline of server activity in order to determine a possible misuse of the server assets, when inconsistencies are detected between the baseline of activity and the new information.

Claims

1. A method for monitoring decommissioned servers, the method comprising:

aggregating, by one or more processors, information associated with an environment, from a plurality of resources;

analyzing, by one or more processors, the aggregated information associated with the environment;

calculating, by one or more processors, a baseline of server activity, based on the aggregated information associated with the environment, wherein the baseline of server activity, based on the aggregated information associated with the environment, comprises;

SLA information, contracts information, network monitoring information, and a comparison of network activity from an address resolution protocol (ARP) cache data;

determining, by one or more processors, whether new information associated with the environment is consistent with the baseline of server activity; and

responsive to determining that the new information associated with the environment is not consistent with the baseline of server activity, identifying the new information as a possible misuse.

2. The method of claim 1, wherein the plurality of resources are located external to a server resource.

3. The method of claim 1, wherein information associated with an environment comprises:

network traffic information, incident problem and change systems information, and network device logs.

4. The method of claim 1, wherein aggregating, by one or more processors, information associated with an environment, from a plurality of resources, comprises at least one of:

receiving directly, by one or more processors, the information associated with the environment;

receiving, by one or more processors, the information associated with the environment using electronic versions of documentation, comprising a service level agreement (SLA) or a contract; and

receiving, by one or more processors, the information associated with the environment from a network management program.

5. The method of claim 1, wherein analyzing, by one or more processors, the aggregated information associated with the environment, further comprises:

applying, by an analytics engine, analytics to the aggregated information, wherein the analytics engine is configured to analyze traffic spikes of decommissioned servers.

6. The method of claim 1, wherein determining, by one or more processors, whether new information associated with the environment is consistent with the baseline of server activity comprises:

analyzing, by one or more processors, a source of network traffic, a type of network traffic, and an amount of network traffic.

7. A computer program product for monitoring decommissioned servers, the computer program product comprising:

a computer readable storage medium and program instructions stored on the computer readable storage medium, the program instructions comprising;

program instructions to aggregate information associated with an environment, from a plurality of resources;

program instructions to analyze the aggregated information associated with the environment;

program instructions to calculate a baseline of server activity, based on the aggregated information associated with the environment, wherein the baseline of server activity, based on the aggregated information associated with the environment, comprises;

SLA information, contracts information, network monitoring information, and a comparison of network activity from an address resolution protocol (ARP) cache data;

program instructions to determine whether new information associated with the environment is consistent with the baseline of server activity; and

program instructions to, responsive to determining that the new information associated with the environment is not consistent with the baseline of server activity, identify the new information as a possible misuse.

8. The computer program product of claim 7, wherein the plurality of resources are located external to a server resource.

9. The computer program product of claim 7, wherein the information associated with an environment comprises:

network traffic information, incident problem and change systems information, and network device logs.

10. The computer program product of claim 7, wherein the program instructions to aggregate information associated with an environment, from a plurality of resources, comprises at least one of:

program instructions to receive directly the information associated with the environment;

program instructions to receive the information associated with the environment using electronic versions of documentation, comprising a service level agreement (SLA) or a contract; and

program instructions to receive the information associated with the environment from a network management program.

11. The computer program product of claim 7, wherein the program instructions to analyze the aggregated information associated with the environment, further comprise:

program instructions to apply analytics to the aggregated information, wherein an analytics engine is configured to analyze traffic spikes of decommissioned servers.

12. The computer program product of claim 7, wherein the program instructions to determine whether new information associated with the environment is consistent with the baseline of server activity comprises:

program instructions to analyze a source of network traffic, a type of network traffic, and an amount of network traffic.

13. A computer system for monitoring decommissioned servers, the computer system comprising:

one or more computer processors;

one or more computer readable storage media;

program instructions stored on the one or more computer readable storage media for execution by at least one of the one or more processors, the program instructions comprising;

program instructions to aggregate information associated with an environment, from a plurality of resources;

program instructions to analyze the aggregated information associated with the environment;

program instructions to calculate a baseline of server activity, based on the aggregated information associated with the environment, wherein the baseline of server activity, based on the aggregated information associated with the environment, comprises;

SLA information, contracts information, network monitoring information, and a comparison of network activity from an address resolution protocol (ARP) cache data;

program instructions to determine whether new information associated with the environment is consistent with the baseline of server activity; and

program instructions to, responsive to determining that the new information associated with the environment is not consistent with the baseline of server activity, identify the new information as a possible misuse.

14. The computer system of claim 13, wherein the plurality of resources are located external to a server resource.

15. The computer system of claim 13, wherein the information associated with an environment comprises:

network traffic information, incident problem and change systems information, and network device logs.

16. The computer system of claim 13, wherein the program instructions to aggregate information associated with an environment, from a plurality of resources, comprises at least one of:

program instructions to receive directly the information associated with the environment;

program instructions to receive the information associated with the environment using electronic versions of documentation, comprising a service level agreement (SLA) or a contract; and

program instructions to receive the information associated with the environment from a network management program.

17. The computer system of claim 13, wherein the program instructions to analyze the aggregated information associated with the environment, further comprise:

program instructions to apply analytics to the aggregated information, wherein an analytics engine is configured to analyze traffic spikes of decommissioned servers.

18. The computer system of claim 13, wherein the program instructions to determine whether new information associated with the environment is consistent with the baseline of server activity comprises:

program instructions to analyze a source of network traffic, a type of network traffic, and an amount of network traffic.