Managed hosting server auditing and change tracking

• US 7,065,767 B2
• Filed: 06/29/2001
• Issued: 06/20/2006
• Est. Priority Date: 06/29/2001
• Status: Expired due to Fees

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Kambhammettu, Venkatesh, Faris, Ryan C., Theisen, John J.
• Primary Examiner(s): An, Meng-Al T.
• Assistant Examiner(s): Truong, LeChi
• Application Number:
  US09/895,716
• Publication Number:
  US 20030005109A1
• Time in Patent Office: 1,817 Days
• Field of Search: 709/224, 719/224, 719/310, 714/100
• US Class Current: 719/310
• CPC Class Codes: G06F 11/302 where the computing system component is a software system
• CPC Class Codes: G06F 11/3051 Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs verification or detection of system hardware configuration G06F11/2247
• CPC Class Codes: G06F 11/328 Computer systems status display G06F11/327 takes precedence

Abstract

A method and apparatus are described for auditing and tracking changes in a managed hosting server. Embodiments of the present invention track changes made to systems in a server farm or data center. More specifically, embodiments of the present invention track changes to the operating system, file system, registry, application software files, and other important files and maintain the changes in a database. This database of changes can then be queried to identify the root cause of problems and aid in systems and applications management in the data center.

Claims

1. A computer implemented method for tracking changes to a customer system in a managed hosting environment, the method comprising:

detecting predetermined audit intervals to perform periodic audits;

performing the periodic audits of the customer system in accordance with the predetermined audit intervals, the performing of the periodic audits includes executing an agent program that is resident on the customer system and that collects audit data to be transferred to an application server connected with the customer system via a network; and

transferring the audit data to the application server, the application server to perform a comparison of the audit data with previous audit data to detect changes to the customer system; and

correlating the audit data and a set of rules with previous failures and previous security attacks to develop change patterns, wherein the change patterns are used to predict one or more of the following;

future failures and future security attacks.

2. The method of claim 1, wherein the performing of the periodic audits comprises storing the changes on a database server connected with the application server via the network.

3. The method of claim 2, wherein the audit data comprises operating system files, file system, registry, and application software files of the customer system.

4. The method of claim 2, wherein the changes are compressed and encrypted prior to being stored.

5. The method of claim 2, further comprising:

reading the set of rules from the database server;

applying the set of rules to the change data to determine whether any of the set of rules has been violated; and

responsive to a violation of any of the set of rules, taking an action associated with a rule violated.

6. The method of claim 5, wherein the rules are stored on the database server.

7. The method of claim 1, further comprising:

checking out the customer system from the application server to allow the application server to make the changes to software of the customer system;

suspending the periodic audits;

taking a first snapshot of the customer system;

checking in the customer system when the changes to the software of the customer system have been completed;

taking a second snapshot of the customer system;

generating change data on the application server by comparing the first snapshot and the second snapshot;

storing the change data on the database server; and

resuming the periodic audits.

8. The method of claim 7, wherein the first and second snapshots comprise operating system files, file system, registry, and application software files of the customer system.

9. The method of claim 7, wherein the change data is compressed and encrypted prior to being stored.

10. A system, comprising:

a customer system available to a customer in a managed hosting server, the customer system having an agent program to detect predetermined audit intervals to perform periodic audits, to perform the periodic audits, and to collect audit data to be transferred to an application server;

the application server connected with the customer system via a network to perform a comparison of the audit data with previous audit data to detect changes to the customer system;

a database server connected with the application server via the network to store changes detected by the application server, wherein the database server includes a rules engine, the rules engine to correlate the audit data and a set of rules with previous failures and previous security attacks to develop change patterns, wherein the change patterns are used to predict one or more of the following;

future failures and future security attacks;

a report server connected with the database server via the network to generate reports based on the changes stored on the database server; and

a command center connected with the application server and the report server via the network to retrieve reports from the report server.

11. The system of claim 10, wherein customer system is further to execute the agent program, and to collect snapshot data responsive to a request from the application server.

12. The system of claim 10, wherein the application sever is further to:

store the changes on the database server.

13. The system of claim 12, wherein the application server compresses and encrypts the changes before storing the changes on the database server.

14. The system of claim 10, wherein the application server is further to:

check out the customer system to allow the application server to make the changes to software of the customer system;

suspend the periodic audits;

take a first snapshot of the customer system;

check in the customer system when the changes to the software of the customer system have been completed;

take a second snapshot of the customer system;

generate change data by comparing the first snapshot and the second snapshot;

store the change data on the database server; and

resume the periodic audits.

15. A machine-readable medium having stored thereon data representing sets of instructions which, when executed by a machine, cause the machine to:

detect predetermined audit intervals to perform periodic audits;

perform the periodic audits of a customer system in accordance with the predetermined audit intervals, the performing of the periodic audits includes executing an agent program that is resident on the customer system and that collects audit data to be transferred to an application server connected with the customer system via a network;

transfer the audit data to the application server, the application server to perform a comparison of the audit data with previous audit data to detect changes to the customer system; and

correlating the audit data and a set of rules with previous failures and previous security attacks to develop change patterns, wherein the change patterns are used to predict one or more of the following;

future failures and future security attacks.

16. The machine-readable medium of claim 15, wherein the performing of the periodic audits comprises storing the changes on a database server connected with the application server via the network.

17. The machine-readable medium of claim 16, wherein the audit data comprises operating system files, file system, registry, and application software files of the customer system.

18. The machine-readable medium of claim 16, wherein the changes are compressed and encrypted prior to being stored.

19. The machine-readable medium of claim 16, wherein the sets of instructions which, when executed by the machine, further cause the machine to:

read the set of rules from the database server;

apply the set of rules to the change data to determine whether any of the set of rules has been violated; and

responsive to a violation of any of the set of rules, take an action associated with a rule violated.

20. The machine-readable medium of claim 19, wherein the rules are stored on the database server.

21. The machine-readable medium of claim 15, wherein the sets of instructions which, when executed by the machine, further cause the machine to:

check out the customer system from the application server to allow the application server to make the changes to the software of the customer system;

suspend the periodic audits;

take a first snapshot of the customer system;

check in the customer system when the changes to the software of the customer system have been completed;

take a second snapshot of the customer system;

generate change data on the application server by comparing the first snapshot and the second snapshot;

store the change data on the database server; and

resume the periodic audits.

22. The machine-readable medium of claim 21, wherein the first and second snapshots comprise operating system files, file system, registry, and application software files of the customer system.

23. The machine-readable medium of claim 21, wherein the change data is compressed and encrypted prior to being stored.

24. An apparatus, comprising:

a customer system available to a customer in a managed hosting server, the customer system having an agent program to detect predetermined audit intervals to perform periodic audits, to perform the periodic audits, and to collect audit data to be transferred to an application server;

the application server connected with the customer system via a network to perform a comparison of the audit data with previous audit data to detect changes to the customer system; and

a rules engine coupled to the application server, the rules engine to correlate the audit data and a set of rules with previous failures and previous security attacks to develop change patterns, wherein the change patterns are used to predict one or more of the following;

future failures and future security attacks.

25. The apparatus of claim 24, further comprising:

a database server connected with the application server via the network to store changes detected by the application server;

a report server connected with the database server via the network to generate reports based on the changes stored on the database server; and

a command center connected with the application server and the report server via the network to retrieve reports from the report server.

26. The apparatus of claim 24, wherein the customer system is further to execute the agent program, and to collect snapshot data responsive to a request from the application server.

27. The apparatus of claim 24, wherein the application sever is further to store the changes on the database server.

28. The apparatus of claim 27, wherein the application server compresses and encrypts the changes before storing the changes on the database server.

29. The system of claim 24, wherein the application server is further to:

check out the customer system to allow the application server to make the changes to software of the customer system;

suspend the periodic audits;

take a first snapshot of the customer system;

check in the customer system when the changes to the software of the customer system have been completed;

take a second snapshot of the customer system;

generate change data by comparing the first snapshot and the second snapshot;

store the change data on the database server; and

resume the periodic audits.