Meta-directory control and evaluation of events
View Patent ↗Techniques for meta-directory control and evaluation of events are provided. Disparate events from heterogeneous processing environments are collected as the events are produced by resources within the processing environments. The events are filtered and organized into taxonomies. Next the filtered and organized events are assigned to nodes of a Meta directory, each node defining a relationship between two or more of the resources and policy is applied. Finally, additional policy is evaluated in view of the events and their node assignments with other events, and one or more automated actions are then taken.
1. A method implemented and residing within a non-transitory computer-readable storage medium that is executed by one or more processors of a network to perform the method, comprising:
collecting events from resources processing in heterogeneous environments;
organizing the events into one or more taxonomies;
assigning particular events to nodes defined in a directory, each node representing a relationship between two or more of the resources; and
evaluating the particular events in view of other events for the nodes of the directory.
2. The method of claim 1 further comprising, generating a problem ticket that is sent to a support and maintenance resource based on evaluation of the particular events.
3. The method of claim 1 further comprising, sending a notification for further analysis of the particular events to an administrative resource.
4. The method of claim 1 further comprising, taking one or more mitigation actions based on evaluation of the particular events.
5. The method of claim 1 further comprising, simultaneously presenting in a display the particular events, policy disposition for policy used in evaluating the particular events, and mitigation actions performed as a result of the policy disposition.
6. The method of claim 1 further comprising, automatically updating a policy repository and/or a schema for the events based on evaluation of the particular events.
7. The method of claim 1 , wherein collecting further includes using agents in one or more of the heterogeneous environments to mine log files for the events.
8. The method of claim 7 , wherein using further includes normalizing and then publishing, by the agents, the events on a communication channel.
9. The method of claim 1 , wherein organizing further includes,
normalizing the events into normalized events; and
mapping each normalized event to a specific location defined in a specific one of the taxonomies.
10. The method of claim 1 , wherein assigning further includes accessing a configuration management database to acquire policies that are evaluated to define an assignment for each event to a particular node in the directory.
11. The method of claim 9 , wherein evaluating further includes consulting a configuration management database manager to acquire policy used to evaluate the particular events in view of the other events, where the policy defines threshold values for a density of each node with respect to events housed under that node and a frequency count for a given type of event occurring over a given time interval.
12. A method implemented and residing within a non-transitory computer-readable storage medium that is executed by one or more processors of a network to perform the method, comprising:
monitoring a first communication channel for first events generated by resources processing in heterogeneous environments;
publishing particular ones of the first events as second events to a second communication channel, the second events assigned to nodes of a Meta directory, each node representing a relationship between two or more of the resources;
sending particular ones of the second events as third events to a third communication channel, the third events identified based on each third event's node assignment and an evaluation of a first policy associated with that node assignment; and
processing one or more actions for selective ones of the third events based on a presence of those third events on the third communication channel, node assignments for those third events, and an evaluation of a second policy.
13. The method of claim 12 further comprising, displaying a visual representation of the method processing in an interactive graphical presentation where more or less detail related to the method processing is configurable by a user interacting with the interactive graphical presentation.
14. The method of claim 12 , wherein monitoring further includes using an identity associated with each resource for each first event to organize each first event into a particular taxonomy.
15. The method of claim 12 , wherein monitoring further includes filtering out some events generated by the resources, these filtered events are not injected into or monitored on the first communication channel.
16. The method of claim 12 , wherein publishing further includes accessing configuration management database information to assign each of the second events to a particular node of the Meta directory.
17. The method of claim 12 , wherein processing further includes processing the one or more actions as one or more of: a generation of a problem ticket for support resources, a notification to perform further analysis for administrative resources, and a modification to or addition to a policy repository for the first policy, the second policy, or other policies managed in the policy repository.
18. The method of claim 17 , wherein processing further includes updating a change history in response to the modification or the addition to the policy repository.
19. A multiprocessor-implemented system, comprising:
event managers, each event manager implemented in a non-transitory computer-readable storage medium and to execute on one or more processors of a network;
event organizers, each event organizer implemented in a non-transitory computer-readable storage medium and to execute on one or more processors of the network;
Meta directory managers, each Meta directory manager implemented in a non-transitory computer-readable storage medium and to execute on one or more processors of the network; and
evaluators, each evaluator implemented in a non-transitory computer-readable storage medium and an to execute on one or more processors of the network;
each event manager interacts with one or more event collectors that process in particular processing environments and that communicate first events generated by resources, each event manager further configured to organize the first events into second events assigned to particular taxonomies and to publish the first events to a first communication channel, each event organizer configured to assign the second events detected on the first communication channel as third events to nodes of a Meta directory, each node defining a relationship between two or more of the resources and each event organizer configured to publish the third events on a second communication channel, each Meta directory manager configured to monitor the second communication channel for the third events and evaluate each third event in view of a first policy to selectively publish some of the third events as fourth events on a third communication channel, each evaluator configured to monitor the third communication channel for the fourth events and evaluate a second policy to take one or more automated processing actions in response to the second policy evaluation and the fourth events.
20. The system of claim 19 , wherein each evaluator is further configured to automatically update information in a configuration management database in response to taking the one or more actions.
21. The system of claim 20 , wherein the updated information is used to dynamically configure and alter processing associated with: the event managers, the event organizers, the Meta directory managers, and the evaluators; the updated information creates a dynamic feedback loop for the system.