System for monitoring computerized services

• US 10,785,119 B2
• Filed: 04/19/2017
• Issued: 09/22/2020
• Est. Priority Date: 04/19/2017
• Status: Active Grant

• Current Assignee: ServiceNow Incorporated
• Original Assignee: ServiceNow Incorporated
• Inventors: Makovsky, Bnayahu
• Primary Examiner(s): Lazaro, David R
• Assistant Examiner(s): Khurshid, Zia
• Application Number:
  US15/491,164
• Publication Number:
  US 20180309634A1
• Time in Patent Office: 1,252 Days
• Field of Search: 709224
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 43/20 the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
• CPC Class Codes: H04L 43/50 Testing arrangements

Abstract

A computerized service including interconnected components within a computer network is monitored using entry points of a service model corresponding to the computerized service. A discovery process is performed by a discovery mechanism based on an initial entry point of a computerized service. A service model is generated based on results of the discovery process. The service model includes indications of a plurality of components of the computerized service and indications of a plurality of entry points including the initial entry point and at least one additional entry point used for communication between ones of the plurality of components. Using a monitoring mechanism, at least one entry point of the plurality of entry points is tested using at least one protocol associated with the at least one entry point. An event generated based on the test is then processed, such as to identify alerts associated with the computerized service.

Claims

1. A system for monitoring a computerized service including a plurality of interconnected components within a computer network, the system comprising:

an agent device within the computer network, the agent device comprising;

a first memory; and

a first processor, wherein the first memory includes first instructions executable by the first processor to;

using a discovery mechanism, perform a discovery process based on an initial entry point of the computerized service; and

using a monitoring mechanism, test an entry point of a plurality of entry points using at least one protocol associated with the entry point, wherein the plurality of entry points comprises the initial entry point and the plurality of entry points are respective attributes of the plurality of interconnected components that are indicative of respective communication connections to the plurality of interconnected components, wherein testing the entry point comprises transmitting a test message to the entry point using the at least one protocol and determining a metric based on a response to the test message, and wherein the metric indicates one or more of a disrupted connection to a first interconnected component of the plurality of interconnected components, a slow response time for accessing the first interconnected component, and a content mismatch between the first interconnected component and a second interconnected component of the plurality of interconnected components; and

a management system external to the computer network, the management system comprising;

a second memory; and

a second processor, wherein the second memory includes second instructions executable by the second processor to;

receive results of the discovery process from the agent device;

generate a service model based on the results of the discovery process, the service model including indications of the plurality of the interconnected components and additional indications of the initial entry point and at least one additional entry point of the plurality of entry points used for communication between ones of the plurality of interconnected components;

and

process an event generated based on the metric in response to a determination that the metric breaches a threshold associated with the metric;

wherein a firewall prevents the management system from accessing the plurality of interconnected components, and the agent device initiates a connection between the agent device and the management system to communicate data to the management system through the firewall.

2. The system of claim 1, wherein the first instructions to perform the discovery process based on the initial entry point of the computerized service include instructions to:

transmit a discovery probe to an interconnected component of the plurality of interconnected components to determine one or more associated entry points of the entry point, wherein the interconnected component is referenced by the initial entry point.

3. The system of claim 1, wherein the second instructions to generate the service model based on the results of the discovery process include instructions to:

associate ones of the plurality of entry points with the ones of the plurality of interconnected components.

4. The system of claim 1, wherein the first instructions to test the entry point of the plurality of entry points using the at least one protocol associated with the entry point include instructions to:

select a subset of the plurality of entry points based on an entry point type or a configuration item type.

5. The system of claim 1, wherein the first instructions include instructions to:

determine whether to test the entry point using the at least one protocol based on a status indication of the service model.

13. The system of claim 1, wherein the second instructions include instructions to perform an impact calculation operation against the service model based on the event to determine a change in status of one or more interconnected components of the plurality of interconnected components.

6. A method for monitoring a computerized service including a plurality of interconnected components within a computer network, the method comprising:

performing, via a discovery mechanism of an agent device within the computer network, a discovery process based on an initial entry point of the computerized service;

receiving, via a management system external to the computer network, results of the discovery mechanism from the agent device;

generating, via the management system, a service model based on the results of the discovery process, the service model including indications of the plurality of the interconnected components and additional indications of the initial entry point and at least one additional entry point of a plurality of entry points used for communication between ones of the plurality of interconnected components;

using a monitoring mechanism, testing, via the agent device, an entry point of the plurality of entry points using at least one protocol associated with the entry point, wherein the plurality of entry points comprises the initial entry point and the plurality of entry points are respective attributes of the plurality of interconnected components that are indicative of respective communication connections to the plurality of interconnected components, wherein testing the entry point comprises transmitting a test message to the entry point using the at least one protocol and determining a metric based on a response to the test message, and wherein the metric indicates one or more of a disrupted connection to a first interconnected component of the plurality of interconnected components, a slow response time for accessing the first interconnected component, and a content mismatch between the first interconnected component and a second interconnected component of the plurality of interconnected components; and

processing, via the management system, an event generated based on the metric in response to a determination that the metric breaches a threshold associated with the metric;

wherein a firewall prevents the management system from accessing the plurality of interconnected components, and the agent device initiates a connection between the agent device and the management system to communicate data to the management system through the firewall.

7. The method of claim 6, wherein performing the discovery process based on the initial entry point of the computerized service comprises:

transmitting, via the agent device, a discovery probe to an interconnected component of the plurality of interconnected components to determine one or more associated entry points of the entry point, wherein the interconnected component is referenced by the initial entry point.

8. The method of claim 6, wherein generating the service model based on the results of the discovery process comprises:

associating, via the management system, ones of the plurality of entry points with the ones of the plurality of interconnected components.

9. The method of claim 6, wherein testing the entry point of the plurality of entry points using the at least one protocol associated with the entry point comprises:

selecting a subset of the plurality of entry points based on an entry point type or a configuration item type.

10. The method of claim 6, the method comprising:

determining, via the agent device, whether to test the entry point using the at least one protocol based on a status indication of the service model.

11. A non-transitory computer-readable storage medium comprising processor-executable routines that, when executed by a processor, facilitate a performance of operations to monitor a computerized service including a plurality of interconnected components within a computer network, the operations comprising:

initiating a connection through a firewall to a management system external to the computer network, wherein the firewall prevents the management system from accessing the plurality of interconnected components;

receiving, from the management system, a command to test an entry point included in a service model associated with the computerized service, wherein the entry point is an attribute of an interconnected component of the plurality of interconnected components that is indicative of a communication connection to the interconnected component, wherein the command to test the entry point comprises a command to transmit a test message to the entry point using at least one protocol associated with the entry point and determine a metric based on a response to the test message, and wherein the metric indicates one or more of a disrupted connection to a first interconnected component of the plurality of interconnected components, a slow response time for accessing the first interconnected component, and a content mismatch between the first interconnected component and a second interconnected component of the plurality of interconnected components;

transmitting the test message to the entry point using the at least one protocol associated with the entry point;

generating an event based on the metric in response to a determination that the metric breaches a threshold associated with the metric; and

transmitting the event to the management system.

12. The non-transitory computer-readable storage medium of claim 11, the operations comprising:

receiving, from the management system, a monitoring mechanism configured to process the command by transmitting the test message and generating the event.