Apparatus, method and article of manufacture for managing changes on a compute infrastructure

• US 20050120101A1
• Filed: 06/11/2002
• Published: 06/02/2005
• Est. Priority Date: 06/11/2001
• Status: Abandoned Application

• Current Assignee: Verifichi LLC
• Original Assignee: Verifichi LLC
• Inventors: Nocera, David
• Application Number:
  US10/480,566
• Publication Number:
  US 20050120101A1
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 41/0813 characterised by the conditions triggering a change of settings
• CPC Class Codes: H04L 41/0856 by backing up or archiving configuration information
• CPC Class Codes: H04L 41/0869 Validating the configuration within one network element
• CPC Class Codes: H04L 41/0889 Techniques to speed-up the configuration process

Abstract

Provided herein is a system and method for detecting unauthorized and accidental changes to a compute infrastructure. In an exemplary embodiment of the present invention, the system comprises: Manager Nodes (e.g., Managers, Managers with Gateways), Gateways, and Managed Nodes (e.g., Managed Nodes with Agents, Agentless Managed Nodes, Managed Software Components, such as application software, and Managed Special Devices). Agents are comprised of multiple Simple or Dynamic Beans that are used to manage list of Attributes. Simple Beans manage fixed lists of Attributes and Dynamic Beans manage variable lists of Attributes. The system provides for specialized reporting of unauthorized or accidental changes to the compute infrastructure by, among other things, enabling the Attributes to be reported as a single attribute and/or as a group of attributes.

Claims

1. In a network having a plurality of nodes having related attributes, a computer-implemented method of detecting and reporting unauthorized changes within said network, comprising:

providing a baseline node having predefined baseline attributes associated therewith;

selecting at least one target node having target attributes associated therewith;

comparing said baseline attributes with said target attributes;

generating a display comprising drill down details of said comparison results and said baseline and target attributes.

2. The method as in claim 1 further comprising:

encapsulating said comparison results and generating a display comprising drill down details of said encapsulated comparison results and said baseline and target attributes;

3. In a network having a plurality of nodes having related attributes, a computer-implemented method of detecting and reporting unauthorized changes within said network, comprising the steps of:

providing a set of predefined baseline attributes;

selecting a group of target nodes, each group member having target attributes associated therewith;

comparing said set of predefined baseline attributes with said target attributes of said group members to detect change; and

generating a display comprising drill down details of said comparison results and said baseline and target attributes.

4. The method as in 3 wherein said generating step further comprises:

encapsulating said comparison results and generating an interactive display comprising drill down details of said encapsulated comparison results and said baseline and target attributes.

5. The method as in 3 wherein the target node group comprises at least one target node, subgroups of target nodes or a combination thereof.

6. In a network having a plurality of nodes having related attributes, a computer-implemented method of detecting and reporting unauthorized changes within said network, comprising the steps of:

providing a group of baseline attributes;

selecting a target node having target attributes associated therewith;

comparing said group of baseline attributes with said target attributes to detect change; and

generating a display comprising drill down details of said comparison results and said baseline and target attributes.

7. The method as in 6 wherein said generating step further comprises the step of:

encapsulating said comparison results and generating an interactive display comprising drill down details of said comparison results and said baseline and target attributes.

8. The method as in 6 wherein said target node comprises at least one target node, subgroups of target nodes or a combination thereof.

9. The method as in 6 wherein said baseline attributes group comprises a set of baseline attributes, at least one subgroup of baseline attributes, or a combination thereof.

10. In a network having a plurality of nodes having related attributes, a computer-implemented method of detecting and reporting authorized changes within said network, comprising:

providing a baseline attribute having an attribute transformation function;

selecting a target node having a target attribute;

comparing said attribute transformation function with said target attribute to detect change; and

generating a display comprising drill down details of said comparison results and said baseline and target attributes.

12. The method as in claim 10 further comprising the steps of:

providing an attribute group having an aggregation function; and

associating said attribute transformation function with said attribute group,

wherein said attribute transformation function references said aggregation function thereby combining said aggregation function and said transform function into a single value for comparison and reporting purposes.

11. The method as in 10 wherein said generating step further comprises the step of:

encapsulating said comparison results and generating an interactive display comprising drill down details of said comparison results and said baseline and target attributes.

13. In a network having a plurality of nodes having associated node attributes, a computer-implemented method of detecting and reporting unauthorized changes within said network, said method comprising:

providing a manager node having predefined baseline attributes for use in detecting changes to said node attributes;

providing a node having node attributes to be managed by said manager node;

providing a database associated with said manager node for storing node attribute change information;

said manager node;

     1) polling said node attributes to detect differences between said baseline attributes and said node attributes; and

     2) updating said database with data relating to reflect said detected differences.

14. The method as in claim 13 further comprising the step of reporting information related to said detected differences.

15. The method as in claim 14 wherein the reporting step further comprises the step of:

genera ting an interactive display comprising drill down details of said detected differences.

16. The method as in claim 13 wherein said node has an agent associated therewith, said agent comprises a control bean and a dynamic bean;

said manager updates said control bean with said predefined baseline attributes.

17. In a computer-implemented network comprising a plurality of agentless nodes, a method for managing change events occurring within said network and initiated by said plurality of agentless nodes, said method comprising:

providing an agentless node;

providing a manager node for managing said agentless node, and

providing a gateway node situated between said manager node and said agentless node;

said gateway node configured to interface with said manager node and said agentless node to provide a bridge therebetween to enable said agentless node to notify said manager node of a change event affecting said agentless node.

18. A method as in claim 17, wherein said manager node also comprises a database for storing said agentless node change event information.

19. A method as in 18, further comprising the step of reporting said agentless node change event information.

20. The method as in claim 19 wherein said reporting step further comprises the step of:

encapsulating said agentless node change event information and generating an interactive display comprising drill down details of said agentless node change event information.

21. The method as in 20, wherein said agentless node change event information is encapsulated into a digital check sum.

22. In a computer network having a plurality of nodes comprising one or more attributes having associated attribute tests, a method for scheduling the execution of said attribute tests to manage change events within said network, said method comprising:

providing an attribute test having a trigger condition associated therewith;

monitoring said network to detect said trigger condition; and

automatically executing said attribute test in response to said trigger condition.

23. A computer-readable medium having stored thereon an archive object data structure for use in a computer-implemented network comprising a plurality of nodes, said archive object data structure to store information relating to change events occurring within said network, said archive object data structure comprising:

an archive field containing data representing node state information; and

a first interface that receives and stores said node state information in said archive field,

a second interface that extracts said stored node state information from said archive field, and

a comparison behavior that compares incoming node state information with stored node state information to detect change events occurring within said network.

24. In a JAVA JMX network having a plurality of nodes, a method for extending the Java JMX framework to manage non-Java applications without utilizing a JMX adapter, said method comprising:

providing a non-Java application to be managed;

providing a Java management bean object for managing said non-Java application;

said Java management bean object, 1) invoking a non-Java system command to perform a predefined test having predefined parameters associated with said non-Java application;

2) processing and reporting the results of said non-Java system command invocation;

wherein said Java management bean object comprises;

a first bean field containing data representing said results of said non-Java system command invocation,

a second bean field containing predefined benchmark data,

a first exposed bean interface to receive incoming non-Java system command invocation results information,

a second exposed bean interface to invoke said non-Java system command;

a first bean behavior to store said non-Java system command invocation results information in said command results field,

a second bean behavior to compare said incoming non-Java system command invocation information with said stored non-Java system command invocation information to detect and report changes therebetween, and

a third bean behavior to trigger an alert notification when said non-Java system command invocation information comparison results deviate from said predefined benchmark data.

25. A method as in claim 24 wherein said bean object is simple or dynamic.

26. A method as in claim 24 wherein said invoking step is done interactively or via a schedule.

27. In a JAVA JMX network embodying the Java JMX framework, a method for extending said Java JMX framework without utilizing a JMX adapter to manage a non-Java application executing within said network, said method comprising:

providing a system command interpreter for interpreting a non-Java system command invoked by said non-Java application into a Java JMX command; and

providing a Java bean object having a pipe coupled to said system command interpreter, said Java bean object for sending said non-Java system command to said system command interpreter via said pipe.

28. In a computer-implemented network having a plurality of nodes, a method for providing a data warehouse to store network information relating to interactions among said nodes, said method comprising the steps of:

providing target nodes;

providing manager nodes for managing said target nodes;

providing a database associated with said target and manager nodes to store information relating to the interaction among said manager nodes and said target nodes;

providing archive objects associated with said manager nodes, said archive objects to store information relating to the interaction among said manager nodes and said target nodes; and

determining and distributing said manager-target node interaction information between said archive objects and said database.

29. A method as in claim 28, further comprising retrieving and aggregating said archive object'"'"'s manager-target node interaction information and reporting said aggregated information.