Automated service discovery in I.T. environments

• US 9,967,351 B2
• Filed: 09/26/2016
• Issued: 05/08/2018
• Est. Priority Date: 01/31/2015
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Maheshwari, Sonal, Shcherbakov, Vladimir, Goyal, Mehul, Ashpole, David Gustav
• Primary Examiner(s): Maung, Zarni
• Application Number:
  US15/276,762
• Publication Number:
  US 20170019487A1
• Time in Patent Office: 589 Days
• Field of Search: 709221, 709223-229, 709203
• CPC Class Codes: G06F 16/9032 Query formulation
• CPC Class Codes: G06F 3/0484 for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 41/0853 by actively collecting configuration information or by backing up configuration information
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/5012 determining service availability, e.g. which services are available at a certain point in time
• CPC Class Codes: H04L 41/5032 Generating service level reports
• CPC Class Codes: H04L 41/5045 Making service definitions prior to deployment
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

An automatic service monitor in an information technology environment may be equipped to automatically process machine data originating from a running IT environment to identify the entities that perform services in the environment, and to reflect the discovered entities and service associations in the control and configuration data that directs the monitoring operations performed by the system.

Claims

1. A method comprising:

determining one or more entities that provide one or more services, including locating first information indicative of an identification for each of the entities in machine data of a field-searchable event data store, the machine data related to the provision of the one or more services;

correlating second information in the machine data to determine a service association for each of the entities;

updating configuration data of a service monitoring system to reflect the service association for at least one of the entities based at least in part on the identification and the service association of the entity;

thereby transforming machine data to control information directing the operation of the service monitoring system;

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment; and

wherein the method is performed in a computer system comprising one or more processors.

2. The method of claim 1 wherein events of event data store each have a segment of the machine data.

3. The method of claim 1 wherein events of event data store each have a segment of the machine data and a timestamp.

4. The method of claim 1 wherein the field-searchable event data store is accessed in accordance with a late-binding schema.

5. The method of claim 1 wherein the field-searchable event data store is accessed in accordance with a late-binding schema having one or more field extraction rules.

6. The method of claim 1 wherein the machine data is produced by more than one source.

7. The method of claim 1 wherein the machine data is produced by a plurality of sources and has a plurality of different formats.

8. The method of claim 1 wherein the machine data includes data of a network traffic stream.

9. The method of claim 1 wherein the machine data includes data produced by an operating system about active units of work.

10. The method of claim 1 wherein the machine data includes data of a network traffic stream and data produced by an operating system about active units of work.

11. The method of claim 1 wherein the configuration data includes one or more stored definitions.

12. The method of claim 1 wherein updating the configuration data includes adding at least one service definition and at least one entity definition.

13. The method of claim 1 wherein updating the configuration data includes modifying at least one from among an existing service definition and an existing entity definition.

14. The method of claim 1 wherein automatic operations of the service monitoring system are determined at least in part by the configuration data.

15. The method of claim 1 wherein the information indicative of an identification for each of the entities includes a network address.

16. The method of claim 1 wherein the information indicative of an identification for each of the entities includes at least one from among an IP address, a port number, and a hostname.

17. The method of claim 1 wherein the service association includes a service identifier.

18. The method of claim 1 wherein the service association includes a service identifier indicative of a network application.

19. The method of claim 1 wherein each of the one or more services is a network application.

20. The method of claim 1 wherein the activity within the information technology environment includes the performance of the one or more services.

21. The method of claim 1 wherein determining one or more entities that provide a particular service includes distinguishing the one or more entities from potential entities not providing the service.

22. The method of claim 1 wherein determining one or more entities that provide a particular service includes distinguishing the one or more entities from potential entities not providing the service, wherein distinguishing includes comparing communication information.

23. The method of claim 1 wherein determining one or more entities that provide a particular service includes distinguishing the one or more entities from potential entities not providing the service, wherein distinguishing includes determining a number of communication partners for each entity and potential entity.

24. The method of claim 1 further comprising:

causing display of a user interface including a representation of each of the entities and its service association; and

receiving user input to indicate confirmation of at least one correspondence between one of the entities and its service association.

25. The method of claim 1 wherein the first information and the second information overlap in whole or in part.

26. A system comprising:

a memory; and

a processing device coupled with the memory to;

determine one or more entities that provide one or more services, including locating first information indicative of an identification for each of the entities in machine data of a field-searchable event data store, the machine data related to the provision of the one or more services;

correlate second information in the machine data to determine a service association for each of the entities; and

update configuration data of a service monitoring system to reflect the service association for at least one of the entities based at least in part on the identification and the service association of the entity;

thereby transforming machine data to control information directing the operation of the service monitoring system;

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment.

27. The system of claim 26 wherein events of event data store each have a segment of the machine data and a timestamp.

28. The system of claim 26 wherein the field-searchable event data store is accessed in accordance with a late-binding schema.

29. The system of claim 26 wherein the machine data is produced by a plurality of sources and has a plurality of different formats.

30. A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising:

determining one or more entities that provide one or more services, including locating first information indicative of an identification for each of the entities in machine data of a field-searchable event data store, the machine data related to the provision of the one or more services;

correlating second information in the machine data to determine a service association for each of the entities; and

updating configuration data of a service monitoring system to reflect the service association for at least one of the entities based at least in part on the identification and the service association of the entity;

thereby transforming machine data to control information directing the operation of the service monitoring system;

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment.