Method and system for improved in-line management of an information technology network

• US 20060015597A1
• Filed: 06/24/2004
• Published: 01/19/2006
• Est. Priority Date: 06/24/2004
• Status: Active Grant

• Current Assignee: Insitesource Corporation
• Original Assignee: Bluehawk Networks, Inc.
• Inventors: Britton, Ron, Scott, Marlin, Meyer, Stephen, Hand, Roger
• Granted Patent: US 8,032,620 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis

Abstract

A system and a method for leveraging human knowledge held by system administrators to support improved or optimal management of an information technology network. The present invention monitors and records the states and values key management indicators related to actions taken by a human system administrator in improving a perceived sub-optimal state of the information technology network. The present invention predicts the effect of command in situations later occurring, and optionally suggests actions to a system administrator. The method of the present invention optionally enables embodiments of the present invention to automatically select one or more preferred system commands and execute the selected command or commands.

Claims

1. A method for administrating an information technology network, the information technology network including a plurality of computing elements, and the information technology network having at least two key performance indicators each associated with a parameter of the information technology system, the method comprising:

providing data to a human operator regarding the information technology system via a computer workstation;

recording the key performance data in a current incident record; and

enabling the human operator to selectively record the data in the current incident record.

2. The method of claim 1, wherein the operator is enabled to select data for storage by highlighting by means of a computer mouse.

3. The method of claim 1, wherein a plurality of incident records are authored and stored, each incident record related to a separate incident of the information technology network

4. The method of claim 3, wherein the each incident record and the current incident record each includes a key management indicator, each key management indicator having a plurality of key performance indicators ordered in accordance with a same syntax, whereby the key management indicators may be compared to determine a degree of similarity of each two key management indicators.

5. The method of claim 3, wherein the human operator is enabled to view, edit and annotate at least one incident record by means of the workstation.

6. The method of claim 4, wherein a software program is provided, the software program for determining the degree of similarity between the key management indicator of the current incident record and the individual key management indicators of the plurality of incident records, and for selecting at least one similar incident record, the key management indicator of the at least one similar incident record meeting a pre-established degree of similarity with the key management indicator of the current incident record.

7. The method of claim 6, wherein the software program is enabled to issue at least one command to the information technology network, the command selected from the at least one similar incident record of the plurality of incident records.

8. The method of claim 7, wherein the method further comprises recording the at least one command in the current incident record.

9. The method of claim 8, wherein the method further comprises a result of the execution of the at least one command in the current incident record.

10. A method for administrating an information technology network, the information technology network including at least two information technology systems, and the information technology network having at least two key performance indicators each associated with a parameter of the information technology system, the method comprising:

provide a plurality of incident records, each incident record containing information related to a separate incident, and each incident record containing values of the at least two key performance indicators and commands issued in response to the occurrence of the values of the two key performance indicators;

providing a software program, the software program for comparing current values of the at least two key performance indicators with the values of the at least two key performance indicators of each of the incident records and for selecting at least one similar incident record, wherein the values of the at least two key performance indicators of the similar incident record are substantially approximate to the current values of the at least two key performance indicators; and

automatically executing at least one command of the similar incident record.

11. The method of claim 10, wherein the method further comprises informing a human operator of the current values of the at least two key parameters and the executed command by means of the computer network.

12. The method of claim 10, wherein the method further comprises providing a policy engine, the policy engine prohibiting the automatic execution of certain commands.

13. The method of claim 12, wherein the method further comprises enabling the policy engine to automatically execute commands by means of the information technology network.

14. The method of claim 10, wherein the method further comprises enabling a human operator to selectively record the current values of the at least two key parameters and the executed command in a current incident record and by means of the computer network.

15. A system for administrating an information technology network, the system coupled with the information technology system, and the information technology network including a plurality of computing elements, and the information technology network having at least two key performance indicators each associated with a parameter of the information technology system, the system comprising:

means to provide data to a human operator regarding the information technology system via a computer workstation;

means to record the key performance data in a current incident software record; and

means to enable the human operator to selectively record the data in the current incident software record.

16. The system of claim 15, wherein the system further comprises means to enable the operator to select data for storage in the current incident software record.

17. The method of system of claim 16, wherein the system further comprises means to record and store a plurality of incident records, each incident record related to a separate incident of the information technology network

18. The system of claim 17, wherein the each incident record and the current incident record each includes a key management indicator, each key management indicator having a plurality of key performance indicators ordered in accordance with a same syntax, whereby the key management indicators may be compared to determine a degree of similarity of each two key management indicators.

19. The system of claim 18, wherein the system further comprises means to enable the human operator to view, edit and annotate at least one incident record.

20. The system of claim 18, wherein the system further comprises means to issue at least one command to the information technology network, the command selected from the at least one similar incident record of the plurality of incident records.