System and method for visualisation of behaviour within computer infrastructure

• US 10,346,744 B2
• Filed: 03/26/2013
• Issued: 07/09/2019
• Est. Priority Date: 03/29/2012
• Status: Active Grant

• Current Assignee: Elasticsearch Global B.V. (Elastic N.V.)
• Original Assignee: Elasticsearch Global B.V. (Elastic N.V.)
• Inventors: Dodson, Stephen
• Primary Examiner(s): Zhen, Li B.
• Assistant Examiner(s): Buss, Benjamin J
• Application Number:
  US13/850,725
• Publication Number:
  US 20130262347A1
• Time in Patent Office: 2,296 Days
• Field of Search: None
• CPC Class Codes: G06F 11/3055 Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available error or fault processing without redundancy G06F11/0703; error detection or correction by redundancy in data representation G06F11/08; error detection or correction by redundancy in operation G06F11/14; error detection or correction by redundancy in hardware G06F11/16
• CPC Class Codes: G06F 11/328 Computer systems status display G06F11/327 takes precedence
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 5/02 Knowledge representation; Symbolic representation
• CPC Class Codes: G06N 7/00 Computing arrangements based on specific mathematical models

Abstract

The field of the disclosure relates generally to a method and system for analyzing behavior of a computer infrastructure and the displaying the behavior of the computer infrastructure in a graphical manner. The system comprises an analytical engine connected to agents running on devices in the computer infrastructure and analyzing continuous data and asynchronous data.

Claims

1. A system for analysing a behaviour of a computer infrastructure, the system comprising:

at least one agent associated with at least one device of the computer infrastructure for monitoring and collecting continuous data on the at least one device and for collecting asynchronous data on the at least one device when changes happen on the at least one device, wherein the asynchronous data includes at least log file data and the continuous data comprises computing resource data regarding the at least one device, the at least one agent forwarding the continuous data and the asynchronous data to a management system;

the management system comprising at least one database storing the continuous data and the asynchronous data including associated time stamps, wherein the continuous data on the at least one device is stored in the at least one database only if a certain threshold value is reached, the management system aggregating the continuous data and the asynchronous data from a plurality of devices that include the at least one device; and

an analytics engine configured to;

analyse relationships between the continuous data and the asynchronous data;

detect a behaviour type of the at least one device of the computer infrastructure based on the analysis;

recognise recurrent patterns between the continuous data and the asynchronous data to further detect the behaviour type;

transfer to a display, an indication of at least one detection of the detected behaviour type as graphic elements, wherein at least one of the graphic elements is linked to the continuous data and the asynchronous data collected by the at least one agent associated with the at least one device, and wherein the graphic elements have different colours or shapes in relation to a degree of impact of the behaviour on the computer infrastructure, further wherein at least a portion of the graphic elements are selectable and open related types of system parameters and the log file data of the continuous data and the asynchronous data within the computer infrastructure;

determine or simulate probabilities of at least a portion of streams of the log file data of the at least one device of the computer infrastructure; and

provide a forecast of possible future performance of the at least one device of the computer infrastructure based on the determination or simulation.

2. The system according to claim 1, the analytics engine being further for adapting the display to indicate the degree of impact on the computer infrastructure of the behaviour type.

3. The system according to claim 1, wherein the continuous data and the asynchronous data is related to a data operation in an application at the at least one device.

4. The system according to claim 1, the continuous data and the asynchronous data being indicative of running processes on the at least one device.

5. The system according to claim 1, wherein the analytics engine is adapted to diagnose an abnormal one of the behaviour type by analysing at least one of a sequence of the at least log file data, temporal parameters of the at least log file data, and the relationships between one or more of the asynchronous data and the continuous data.

6. The system according to claim 1, wherein different ones of graphic elements on the display are linked to different ones of the behaviour types.

7. The system according to claim 6, wherein the different ones of the graphic elements are selectable for opening information panels relating to the linked ones of the behaviour types.

8. The system according to claim 1, wherein the analytics engine is adapted to group the behaviour types and the grouping is represented by a grouping of graphic elements on the display.

9. The system according to claim 1, wherein the analytics engine is a self-learning system.

10. The system according to claim 1, wherein the computer infrastructure is adapted to connect with a data source transferring business and financial data to the computer infrastructure via an interface.

11. The system according to claim 1, wherein the analytics engine is adapted to recognise recurrent patterns by comparing historical data and current data stored in the at least one database.

12. A method for analysing a behaviour of a computer infrastructure, the method comprising:

monitoring and collecting, by least one agent, continuous data on at least one device and collecting asynchronous data on the at least one device when changes happen on the at least one device, wherein the asynchronous data includes at least log file data and the continuous data comprises computing resource data regarding the at least one device, the at least one agent forwarding the continuous data and the asynchronous data to a management system;

storing, in at least one database, the continuous data and the asynchronous data including associated time stamps, wherein the continuous data on the at least one device is stored in the at least one database only if a certain threshold value is reached, the management system aggregating the continuous data and the asynchronous data from a plurality of devices that include the at least one device;

analyzing relationships between the continuous data and the asynchronous data;

detecting a behaviour type of the at least one device of the computer infrastructure based on the analysis;

recognizing recurrent patterns between the continuous data and asynchronous data to further detect the behaviour type;

transferring to a display, an indication of at least one detection of the detected behaviour type as graphic elements, wherein at least one of the graphic elements is linked to the continuous data and the asynchronous data collected by the at least one agent associated with the at least one device, and wherein the graphic elements have different colours or shapes in relation to a degree of impact of the behaviour on the computer infrastructure, further wherein at least a portion of the graphic elements are selectable and open related types of system parameters and the log file data of the continuous data and the asynchronous data within the computer infrastructure;

determining or simulating probabilities of at least a portion of streams of the log file data of the at least one device of the computer infrastructure; and

providing a forecast of possible future performance of the at least one device of the computer infrastructure based on the determination or simulation.

13. The method according to claim 12, further comprising adapting the display to indicate the degree of impact on the computer infrastructure of the behaviour type.

14. The method according to claim 12, wherein the continuous data and the asynchronous data are related to a data operation in an application at the at least one device.

15. The method according to claim 12, wherein the continuous data and the asynchronous data are indicative of running processes on the at least one device.

16. The method according to claim 12, further comprising diagnosing an abnormal one of the behaviour type by analysing at least one of a sequence of the at least log file data, temporal parameters of the at least log file data, and the relationships between one or more of the asynchronous data and the continuous data.

17. The method according to claim 12, wherein different ones of graphic elements on the display are linked to different ones of the behaviour types.

18. The method according to claim 17, wherein the different ones of the graphic elements are selectable for opening information panels relating to the linked ones of the behaviour types.

19. A computer-readable program stored on a non-volatile medium which when run on a computer means causes the computer means:

to monitor and collect, by at least one agent, continuous data on at least one device and to collect asynchronous data on the at least one device when changes happen on the at least one device, wherein the asynchronous data includes at least log file data and the continuous data comprises computing resource data regarding the at least one device, the at least one agent forwarding the continuous data and the asynchronous data to a management system;

to store, in at least one database, the continuous data and the asynchronous data including associated time stamps, wherein the continuous data on the at least one device is stored in the at least one database only if a certain threshold value is reached, the management system aggregating the continuous data and the asynchronous data from a plurality of devices that include the at least one device;

to analyze relationships between the continuous data and the asynchronous data;

to detect a behaviour type of the at least one device based on the analysis;

to recognize recurrent patterns between the continuous data and asynchronous data to further detect the behaviour type;

to transfer to a display, an indication of at least one detection of the detected behaviour type as graphic elements, wherein at least one of the graphic elements is linked to the continuous data and the asynchronous data collected by the at least one agent associated with the at least one device, and wherein the graphic elements have different colours or shapes in relation to a degree of impact of behaviour on computer infrastructure, further wherein at least a portion of the graphic elements are selectable and open related types of system parameters and the log file data of the continuous data and the asynchronous data within the computer infrastructure;

to determine or to simulate probabilities of at least a portion of streams of the log file data of the at least one device of the computer infrastructure; and

to provide a forecast of possible future performance of the at least one device of the computer infrastructure based on the determination or simulation.

20. The computer-readable program according to claim 19, wherein the computer means further causes the computer means to adapt the display to indicate the degree of impact on the computer infrastructure of the behaviour type.

21. The computer-readable program according to claim 19, wherein the continuous data and the asynchronous data are related to a data operation in an application at the at least one device.

22. The computer-readable program according to claim 19, wherein the continuous data and the asynchronous data are indicative of running processes on the at least one device.

23. The computer-readable program according to claim 19, wherein the computer means further causes the computer means to diagnose an abnormal one of the behaviour type by analysing at least one of a sequence of the at least log file data, temporal parameters of the at least log file data, and the relationships between one or more of the asynchronous data and the continuous data.

24. The computer-readable program according to claim 23, wherein different ones of graphic elements on the display are linked to different ones of the behaviour types.

25. The computer-readable program according to claim 24, wherein the different ones of the graphic elements are selectable for opening information panels relating to the linked ones of the behaviour types.