Service monitoring interface reflecting by-service mode

• US 10,305,758 B1
• Filed: 09/22/2017
• Issued: 05/28/2019
• Est. Priority Date: 10/09/2014
• Status: Active Grant

• Current Assignee: Splunk Inc.
• Original Assignee: Splunk Inc.
• Inventors: Bhide, Alok Anant, Bettaiah, Vineetha, Lazerowitz, Ross Andrew
• Primary Examiner(s): Woolcock, Madhu
• Application Number:
  US15/713,592
• Time in Patent Office: 613 Days
• Field of Search: 709224
• CPC Class Codes: G06F 11/00 Error detection; Error correction; Monitoring error detection, correction or monitoring in information storage based on relative movement between record carrier and transducer G11B20/18; monitoring, i.e. supervising the progress of recording or reproducing G11B27/36; in static stores G11C29/00
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/301 where the computing system is a virtual computing platform, e.g. logically partitioned systems virtual machines G06F9/45533; logical partitioning of resources G06F9/5077
• CPC Class Codes: G06F 11/328 Computer systems status display G06F11/327 takes precedence
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3419 by assessing time
• CPC Class Codes: G06F 11/3447 Performance evaluation by modeling
• CPC Class Codes: G06F 11/3452 Performance evaluation by statistical analysis
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 16/24565 Triggers; Constraints
• CPC Class Codes: G06F 16/2477 Temporal data queries
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 16/972 Access to data in other repository systems, e.g. legacy data or dynamic Web page generation
• CPC Class Codes: G06F 2201/81 Threshold
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: H04L 41/147 for predicting network behaviour
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5032 Generating service level reports
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/0817 : by checking functioning
• CPC Class Codes: H04L 43/16 : Threshold monitoring
• CPC Class Codes: H04L 67/51 : Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 69/329 : in the application layer [OSI layer 7]

Abstract

Network connected devices are controlled via the transmission of action messages to prevent or correct conditions that impair the operation of the networked information technology (IT) assets. The service monitoring system (SMS) monitoring the IT environment groups together related notable events that are received during system operation. Automatic processes dynamically determine grouping operations that automatically correlate the events without requiring, for example, a set of declarative grouping rules. Events grouping may be performed on a by-service basis to facilitate the complex processing of predicting undesirable system conditions that may be prevented or reduced by transmission of the action messages to the appropriate assets.

Claims

1. A method comprising:

causing display of a service-monitoring user interface on a client machine, the service-monitoring user interface comprising a region having an interactive element;

receiving at a server machine over a network connection a client machine transmission indicative of a user interaction with the interactive element to indicate a by-service mode;

creating a set of by-service seed group definitions in response to the client machine transmission and updating a record of seed group membership in computer storage by automatically classifying a plurality of received notable events into seed group membership based on the seed group definitions;

detecting a pattern of predictor event type occurrences among the plurality of received notable events classified into the seed group membership associated with a particular one of the seed group definitions;

transmitting, in response to detecting the pattern, an action message to at least one target action device over a network to cause the performance of a preventive action;

wherein at least one of the plurality of received notable events results from a correlation search over at least one key performance indicator (KPI), each KPI relating to a service having a stored service definition that identifies one or more entities that provide the service, each entity having stored entity definition information that identifies machine data produced by or about the entity from one or more sources, and each KPI being defined by a search query that produces a value derived from at least some of the machine data identified by the entity definition information of the one or more entities, the value indicative of a measure of the service relating to that KPI at a point in time or during a period of time;

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment; and

wherein the method is performed by one or more processing devices.

2. The method of claim 1 wherein the at least one target action device is a machine in the information technology environment.

3. The method of claim 1 wherein the action message is directed to a command interface of the at least one target action device and the at least one target action device is a machine in the information technology environment.

4. The method of claim 1 wherein each of the received notable events includes an identification of an associated service.

5. The method of claim 1 wherein the pattern of predictor event type occurrences is based on a predictor rule associating one or more predictor event types with a response action type.

6. The method of claim 1 wherein the pattern of predictor event type occurrences is based on a predictor rule associating one or more predictor event types with a response action type, and the response action type is related to the preventive action.

7. The method of claim 1 wherein the pattern of predictor event type occurrences is based on a predictor rule associating one or more predictor event types with a response action type, and the predictor rule includes information about an occurrence timeframe.

8. The method of claim 1 wherein the pattern of predictor event type occurrences is based on a predictor rule associating one or more predictor event types with a response action type, and the predictor rule includes information about an occurrence timeframe and a prediction action.

9. The method of claim 1 wherein the pattern of predictor event type occurrences is based on a predictor rule associating one or more predictor event types with a response action type, and the predictor rule includes information about an occurrence timeframe, a prediction action, and matching criteria.

10. The method of claim 1 wherein automatically classifying the plurality of received notable events into seed group membership occurs in or near realtime.

11. The method of claim 1 wherein automatically classifying the plurality of received notable events into seed group membership and detecting the pattern of predictor event type occurrences occur in or near realtime.

12. The method of claim 1 wherein detecting the pattern of predictor event type occurrences includes searching a subset of notable events limited to a particular time period.

13. The method of claim 1 wherein detecting the pattern of predictor event type occurrences includes searching a subset of notable events limited to a particular time period based at least in part on a time parameter of a prediction rule.

14. The method of claim 1 wherein the pattern of predictor event type occurrences is based on predictor event types of a predictor rule.

15. A system comprising:

a memory; and

a processing device coupled with the memory to perform operations comprising;

causing display of a service-monitoring user interface on a client machine, the service-monitoring user interface comprising a region having an interactive element;

receiving at a server machine over a network connection a client machine transmission indicative of a user interaction with the interactive element to indicate a by-service mode;

creating a set of by-service seed group definitions in response to the client machine transmission and updating a record of seed group membership in computer storage by automatically classifying a plurality of received notable events into seed group membership based on the seed group definitions;

detecting a pattern of predictor event type occurrences among the plurality of received notable events classified into the seed group membership associated with a particular one of the seed group definitions; and

transmitting, in response to detecting the pattern, an action message to at least one target action device over a network to cause the performance of a preventive action;

wherein at least one of the plurality of received notable events results from a correlation search over at least one key performance indicator (KPI), each KPI relating to a service having a stored service definition that identifies one or more entities that provide the service, each entity having stored entity definition information that identifies machine data produced by or about the entity from one or more sources, and each KPI being defined by a search query that produces a value derived from at least some of the machine data identified by the entity definition information of the one or more entities, the value indicative of a measure of the service relating to that KPI at a point in time or during a period of time;

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment.

16. The system of claim 15 wherein the at least one target action device is a machine in the information technology environment.

17. The system of claim 15 wherein the action message is directed to a command interface of the at least one target action device and the at least one target action device is a machine in the information technology environment.

18. The system of claim 15 wherein each of the received notable events includes an identification of an associated service.

19. The system of claim 15 wherein the pattern of predictor event type occurrences is based on a predictor rule associating one or more predictor event types with a response action type.

20. The system of claim 15 wherein the pattern of predictor event type occurrences is based on a predictor rule associating one or more predictor event types with a response action type, and the response action type is related to the preventive action.

21. The system of claim 15 wherein the pattern of predictor event type occurrences is based on a predictor rule associating one or more predictor event types with a response action type, and the predictor rule includes information about an occurrence timeframe.

22. The system of claim 15 wherein the pattern of predictor event type occurrences is based on a predictor rule associating one or more predictor event types with a response action type, and the predictor rule includes information about an occurrence timeframe and a prediction action.

23. The system of claim 15 wherein the pattern of predictor event type occurrences is based on a predictor rule associating one or more predictor event types with a response action type, and the predictor rule includes information about an occurrence timeframe, a prediction action, and matching criteria.

24. The system of claim 15 wherein automatically classifying the plurality of received notable events into seed group membership occurs in or near realtime.

25. The system of claim 15 wherein automatically classifying the plurality of received notable events into seed group membership and detecting the pattern of predictor event type occurrences occur in or near realtime.

26. The system of claim 15 wherein detecting the pattern of predictor event type occurrences includes searching a subset of notable events limited to a particular time period.

27. The system of claim 15 wherein detecting the pattern of predictor event type occurrences includes searching a subset of notable events limited to a particular time period based at least in part on a time parameter of a prediction rule.

28. The system of claim 15 wherein the pattern of predictor event type occurrences is based on predictor event types of a predictor rule.

29. A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising:

causing display of a service-monitoring user interface on a client machine, the service-monitoring user interface comprising a region having an interactive element;

receiving at a server machine over a network connection a client machine transmission indicative of a user interaction with the interactive element to indicate a by-service mode;

creating a set of by-service seed group definitions in response to the client machine transmission and updating a record of seed group membership in computer storage by automatically classifying a plurality of received notable events into seed group membership based on the seed group definitions;

detecting a pattern of predictor event type occurrences among the plurality of received notable events classified into the seed group membership associated with a particular one of the seed group definitions; and

transmitting, in response to detecting the pattern, an action message to at least one target action device over a network to cause the performance of a preventive action;

wherein at least one of the plurality of received notable events results from a correlation search over at least one key performance indicator (KPI), each KPI relating to a service having a stored service definition that identifies one or more entities that provide the service, each entity having stored entity definition information that identifies machine data produced by or about the entity from one or more sources, and each KPI being defined by a search query that produces a value derived from at least some of the machine data identified by the entity definition information of the one or more entities, the value indicative of a measure of the service relating to that KPI at a point in time or during a period of time;

wherein the machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment.

30. The non-transitory computer readable storage medium of claim 29 wherein the action message is directed to a command interface of the at least one target action device and the at least one target action device is a machine in the information technology environment.