SYSTEMS AND METHODS FOR VISUAL CORRELATION OF LOG EVENTS, CONFIGURATION CHANGES AND CONDITIONS PRODUCING ALERTS IN A VIRTUAL

• US 20110197094A1
• Filed: 02/05/2010
• Published: 08/11/2011
• Est. Priority Date: 02/05/2010
• Status: Active Grant

• Current Assignee: Tripwire Incorporated (Belden Inc.)
• Original Assignee: Tripwire Incorporated (Belden Inc.)
• Inventors: Wagner, Andrew
• Granted Patent: US 8,868,987 B2
• Time in Patent Office: Days
• US Class Current: 714/20
• CPC Class Codes: G06F 11/301 where the computing system is a virtual computing platform, e.g. logically partitioned systems virtual machines G06F9/45533; logical partitioning of resources G06F9/5077
• CPC Class Codes: G06F 11/3051 Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs verification or detection of system hardware configuration G06F11/2247
• CPC Class Codes: G06F 11/3082 the data filtering being achieved by aggregating or compressing the monitored data
• CPC Class Codes: G06F 11/328 Computer systems status display G06F11/327 takes precedence
• CPC Class Codes: G06F 8/71 Version control security arrangements therefor G06F21/57; Configuration management

Abstract

Embodiments of the present disclosure provide methods and systems for detecting and correlating log events, configuration changes and conditions producing alerts within a virtual infrastructure. Other embodiments may be described and claimed.

Claims

1. A method comprising:

monitoring a virtual infrastructure for events, the events comprising event occurrences, configuration changes, relationship changes, and conditions that produce an alert;

maintaining a record of events that occur within the virtual infrastructure; and

displaying the record of events along a timeline.

2. The method of claim 1, further comprising:

generating an alert in response to a configuration change;

detecting the configuration change and the alert at the same time;

displaying the detected configuration change and the detected alert together in an entry on the timeline.

3. The method of claim 1, wherein said displaying comprises displaying the timeline on a display.

4. The method of claim 1, wherein said displaying comprises printing the timeline on a print medium.

5. The method of claim 1, further comprising:

generating an alert;

correlating the alert with a first virtual object of the virtual infrastructure; and

linking the first virtual object with a second virtual object of the virtual infrastructure.

6. The method of claim 5, further comprising:

determining a problem associated with the first virtual object based upon the alert correlated with the first virtual object;

determining an impact on the second virtual object based at least in part upon the determined problem and/or a potential solution; and

fixing the problem associated with the first virtual object based at least in part upon the determined impact.

7. A system comprising:

a virtual infrastructure implemented on one or more physical hosts, the virtual infrastructure comprising;

a virtual control center;

at least one virtual machine; and

at least one virtual object;

a component configured to;

monitor the virtual infrastructure for events, the events comprising event occurrences, configuration changes, relationship changes, and conditions that produce an alert;

maintain a record of events that occur within the virtual infrastructure; and

display the record of events along a timeline.

8. The system of claim 7, wherein the component is further configured to:

generate an alert in response to a configuration change;

detect the configuration change and the alert at the same time; and

display the detected configuration change and the detected alert together in an entry on the timeline.

9. The system of claim 7, wherein the system further comprises a display and the timeline is displayed on the display.

10. The system of claim 7, wherein the system further comprises a printer and the timeline is displayed by printing the timeline on a print medium.

11. The system of claim 7, wherein the component is further configured to:

generate an alert;

correlate the alert with a first virtual object of the virtual infrastructure; and

link the first virtual object with a second virtual object of the virtual infrastructure.

12. The system of claim 11, wherein the component is further configured to:

determine a problem associated with the first virtual object based upon the alert correlated with the first virtual object;

determine an impact on the second virtual object based at least in part upon the determined problem and/or a potential solution; and

fix the problem associated with the first virtual object based at least in part upon the determined impact.

13. A method comprising:

generating an alert within a virtual infrastructure;

correlating the alert with a first virtual object of the virtual infrastructure; and

linking the first object with a second virtual object of the virtual infrastructure.

14. The method of claim 13, further comprising:

determining a problem associated with the first virtual object based upon the alert correlated with the first virtual object;

determining an impact on the second virtual object based at least in part upon the determined problem and/or a potential solution; and

fixing the problem associated with the first virtual object based at least in part upon the determined impact.

15. An article of manufacture comprising:

a storage medium; and

a plurality of instructions therein;

wherein the plurality of instructions are adapted to cause one or more processors within a computing environment to perform a plurality of operations comprising;

monitoring a virtual infrastructure for events, the events comprising event occurrences, configuration changes, relationship changes, and conditions that produce an alert;

maintaining a record of events that occur within the virtual infrastructure; and

displaying the record of events along a timeline.

16. The article of manufacture of claim 15, wherein the plurality of operations further comprise:

generating an alert in response to a configuration change;

detecting the configuration change and the alert at the same time;

displaying the detected configuration change and the detected alert together in an entry on the timeline.

17. The article of manufacture of claim 15, wherein said displaying comprises displaying the timeline on a display.

18. The article of manufacture of claim 15, wherein said displaying comprises printing the timeline on a print medium.

19. The article of manufacture of claim 15, wherein the plurality of operations further comprise:

generating an alert;

correlating the alert with a first virtual object of the virtual infrastructure; and

linking the first virtual object with a second virtual object of the virtual infrastructure.

20. The article of manufacture of claim 19, wherein the plurality of operations further comprise:

determining a problem associated with the first virtual object based upon the alert correlated with the first virtual object;

determining an impact on the second virtual object based at least in part upon the determined problem and/or a potential solution; and

fixing the problem associated with the first virtual object based at least in part upon the determined impact.