System and method for generating and using fingerprints for integrity management
A system and method is provided for capturing and using problem fingerprints in an Information Technology (IT) infrastructure for integrity management. A fingerprint of the transaction topology in an IT infrastructure is automatically captured at various time intervals prior to the occurrence of an event leading to a problem, such as a failure, hard threshold violation, defined transaction violation or user-provided occurrence. The fingerprint provides an indication of the activity and operation of the IT infrastructure immediately preceding the problem event. The captured fingerprint is then used to monitor real-time data in the IT infrastructure operation and activity to look for activity that matches a captured fingerprint to provide an indication of a pending problems before the problems occur. When it is determined that there is sufficient probability a problem event will occur based upon real-time data matching a previously generated problem fingerprint, an alert is generated to provide sufficient notification prior to the occurrence of problem event.
1. A method of capturing a fingerprint of a problem in an information technology (IT) infrastructure, comprising:
using a computer to:
identifying a problem in the IT infrastructure;
collecting information related to the problem;
analyzing the collected information against a fingerprint creation criteria comprising a first set of rules to determine if the collected information meets a threshold number of rules for fingerprint capture;
assign probability weights to a set of events that characterize a behavior of the IT infrastructure prior to the occurrence of the problem to form a second set of rules when the fingerprint creation criteria have been satisfied; and
capture a fingerprint by create creating a fingerprint comprising the second set of rules if a fingerprint does not exist or updating an existing fingerprint using the second set of rules.
2. The method of claim 1 , wherein identification of the problem comprises identify at least one of a failure, a hard threshold violation, and under-identified problem.
3. The method of claim 1 , wherein the dynamic thresholding process is used to identify the problem, the dynamic thresholding determination involving a determination of a transaction slowdown on the IT infrastructure.
4. The method of claim 1 , wherein the information collecting step comprises:
identifying a problem device in the IT infrastructure; determining a group of devices in the IT infrastructure that includes the problem device; determining a number of time cuts in which to obtain information and a time interval for the time cuts;
identifying all transactions within the group of devices that involve the problem device; and for a given time cut, obtaining a set of all events for the identified transactions.
5. The method of claim 4 , wherein the analysis of the collected information to determine if the fingerprint creation criteria have been satisfied comprises:
collecting a the first set of rules describing the probability of a symptom indicating a fingerprint for a given time cut; and
determining if the number of rules in the collected first set of rules meets a certain number defined to be sufficient to satisfy the fingerprint creation criteria.
6. A computer storage medium having program instructions stored thereon executable by a processing unit for capturing a fingerprint of a problem in information technology (IT) infrastructure by performing the steps of:
identifying a problem in the IT infrastructure;
collecting information related to the problem;
analyzing the collected information against a fingerprint creation criteria comprising a first set of rules to determine if the collected information meets a threshold number of rules for fingerprint capture;
assigning probability weights to a set of events that characterize a behavior of the IT infrastructure prior to the occurrence of the problem to form a second set of rules when the fingerprint creation criteria have been satisfied; and
capturing a fingerprint by creating a fingerprint comprising the second set of rules if a fingerprint does not exist or updating an existing fingerprint using the second set of rules.
7. The computer storage medium of claim 6 , further comprising program instructions stored thereon for identifying the problem by identifying at least one of a failure, a hard threshold violation, and a user-identified problem.
8. The computer storage medium of claim 6 , wherein the dynamic thresholding process is used to identify the problem, the dynamic thresholding determination involving a determination of a transaction slowdown on the IT infrastructure.
9. The computer storage medium of claim 6 , further comprising program instructions stored thereon for collecting the problem-related information by:
identifying a problem device in the IT infrastructure;
determining a group of devices in the IT infrastructure that includes the problem device;
determining a number of time cuts in which to obtain information and a time interval for the time cuts;
identifying all transactions within the group of devices that involve the problem device; and for a given time cut, obtaining a set of all events for the identified transactions.
10. The computer storage medium of claim 9 , further comprising program instructions stored thereon for analyzing the collected information to determine if the fingerprint creation criteria have been satisfied by:
collecting a the first set of rules describing the probability of a symptom indicating a fingerprint for a given time cut; and
determining if the number of rules in the collected first set of rules meets a certain number defined to be sufficient to satisfy the fingerprint creation criteria.
11. A device comprising:
a fingerprint generator in an information technology (IT) infrastructure, wherein the fingerprint generator is adapted to:
identify a problem in the IT infrastructure;
collect information related to the problem;
analyze the collected information against a fingerprint creation criteria comprising a first set of rules to determine if the collected information meets a threshold number of rules for fingerprint creature;
assign probability weights to set of events that characterize a behavior of the IT infrastructure prior to the occurrence of the problem to form a second set of rules when the fingerprint creation criteria are satisfied; and
capture a fingerprint by create creating a fingerprint comprising the second set rules if a fingerprint does not exist or updating an existing fingerprint using the second set of rules.
12. The device of claim 11 , wherein the problem is identified by at least one of a failure, a hard threshold violation, and a user-identified problem.
13. The device of claim 11 , wherein a dynamic thresholding process is used to identify the problem, the dynamic threshold determination involving a determination of a transaction slowdown on the IT infrastructure.
14. The device of claim 11 , wherein the device is further adapted to collect information by:
identifying a problem device in the IT infrastructure;
determining a group of devices in the IT infrastructure that includes the problem device;
determining a number of time cuts in which to obtain information and a time interval for the time cuts;
identifying al transactions within the group of devices that involve the problem device; and for a given time cut, obtaining a set of all events for the identified transactions.
15. The device of claim 14 , wherein the fingerprint creation criteria are satisfied by;
collecting a the first set of rules describing the probability of a symptom indicating a fingerprint for a given time cut; and
determining if the number of rules in the collected first set of rules meets a certain number defined to be sufficient to satisfy the fingerprint creation criteria.
16. A device comprising:
using a computer to identify a problem in the IT infrastructure;
collect information related to the problem;
analyze the collected information to determine if fingerprint creation criteria, the fingerprint creation criteria comprising a first set of rules, to determine if the collected information meets a threshold number of rules for fingerprint capture have been satisfied;
assign probability weights to set of events that characterize a behavior of the IT infrastructure to form a second set of rules when the fingerprint creation criteria are satisfied; and
capture a fingerprint by create creating a fingerprint comprising the second set of rules or updating an existing fingerprint using the second set of rules,
wherein the second set of rules reflects a state of a transaction the IT infrastructure at a time cut prior to the occurrence of the problem.
17. The method of claim 16 , further comprising identifying the problem by identifying at least one of a failure, a hard threshold violation, and a user-identified problem.
18. The method of claim 16 , wherein a dynamic thresholding process is used to identify the problem, the dynamic thresholding determination involving a determination of a transaction slowdown on the IT infrastructure.
19. The method of claim 16 , wherein the problem-related information collecting step comprises:
identifying a problem device in the IT infrastructure where the problem is originating;
determining a group of devices in the IT infrastructure that includes the problem device;
determining a number of time cuts in which to obtain information and a time interval for the time cuts;
identifying all transactions within the group of devices that involve the problem device; and for a given time cut, obtaining a set of all events for the identified transactions.
20. The method of claim 16 , wherein the analysis of the collected information to determine if the fingerprint creation criteria have been satisfied comprises:
collecting a the first set of rules describing the probability of a symptom indicating a fingerprint for a given time cut; and
determining if the number of rules in the collected first set of rules meets a certain number defined to be sufficient to satisfy the fingerprint creation criteria.