Automated diagnosis for computer networks
View Patent ↗Systems for providing automated diagnosis of problems for an electronic network include a central diagnosis engine configured to include modules that rank identified policy/configuration changes into potential causes, verify the ranked potential causes and determine whether any of the ranked potential causes is a likely cause or contributor to the problem. An estimator module is configured to calculate distances associated with the ranked potential causes such that a list of potential causes of the problem can be presented in order of likelihood. Other systems and methods are also provided.
1. A method for providing automated diagnosis of problems for a computer network, comprising:
receiving input regarding a problem with the computer network;
identifying configuration changes made to components of the computer network that are associated with parameters of the problem;
associating each of the identified configuration changes with a rank based on a likelihood that each of the identified configuration changes caused the problem, the rank determined based on a proximity of each of the configuration changes to the problem, a difference in time between an occurrence of each of the configuration changes and an occurrence of the problem, and a security sensitivity associated with the components of the computer network; and
verifying that the ranked configuration changes are related to the problem.
2. The method of claim 1 , further comprising:
formulating a list of the configuration changes based on or ordered in terms of the rank associated with each of the verified configuration changes; and
presenting the list to a user.
3. The method of claim 1 , further comprising:
determining a distance between each of the configuration changes and the problem;
comparing the determined distance associated with each of the verified configuration changes with a configurable distance threshold; and
discarding any of the verified configuration changes associated with the determined distance that violates the configurable distance threshold.
4. The method of claim 1 , further comprising:
recording the configuration changes made to the computer network at a first level of detail; and
in response to receiving the input regarding the problem, recording the configuration changes associated with the problem at a second level of detail, wherein the second level of detail is greater than the first level of detail.
5. The method of claim 1 , further comprising accumulating and filtering the received input associated with the problem until all of the input is received.
6. The method of claim 1 , further comprising searching a database having user records, vulnerability and reliability data to verify the ranked configuration changes.
7. The method of claim 1 , wherein the parameters of the problem include at least one of a component of the computer network experiencing the problem, a component of the computer network affected by the problem, and a time at which the problem was first noted.
8. The method of claim 1 , wherein verifying that the ranked configuration changes are related to the problem includes cycling through a database structure configured as hierarchical database pages, each of the database pages having a page index, data section and selector section, wherein the data section includes reliability information associated with the components of the computer network associated with the problem to verify that the ranked configuration changes are related to the problem, and wherein the selector section includes links to other related database pages of the database structure for cycling through the database structure.
9. A computer-readable medium executable on a computer having a program for providing automated diagnosis of problems for a computer network, comprising:
logic configured to receive input regarding a problem with the computer network;
logic configured to identify configuration changes made to components of the computer network that are associated with parameters of the problem;
logic configured to associate each of the identified configuration changes with a rank based on a likelihood that each of the identified configuration changes caused the problem, the rank determined based on a proximity of each of the configuration changes to the problem, a difference in time between an occurrence of each of the configuration changes and an occurrence of the problem, and a security sensitivity associated with the components of the computer network; and
logic configured to verify that the ranked configuration changes are related to the problem.
10. The computer-readable medium of claim 9 , further comprising:
logic configured to formulate a list of the configuration changes based on the rank associated with each of the verified configuration changes; and
logic configured to present the list to a user.
11. The computer-readable medium of claim 9 , further comprising:
logic configured to record the configuration changes made to the computer network at a first level of detail; and
logic configured to record the configuration changes associated with the problem at a second level of detail in response to receiving the input regarding the problem, wherein the second level of detail is greater than the first level of detail.
12. The computer-readable medium of claim 9 , further comprising logic configured to accumulate and filter the received input associated with the problem until all of the input is received.
13. The computer-readable medium of claim 9 , further comprising logic configured to search a database having user records, vulnerability and reliability data to verify the ranked configuration changes.
14. The computer-readable medium of claim 9 , wherein the parameters of the problem include at least one of a component of the computer network experiencing the problem, a component of the computer network affected by the problem, and a time at which the problem was first noted.
15. A system for providing automated diagnosis of problems for a computer network, comprising:
means operative to receive input regarding a problem with the computer network;
means operative to identify configuration changes made to components of the computer network that are associated with parameters of the problem;
means operative to associate each of the identified configuration changes with a rank based on a likelihood that each of the identified configuration changes caused the problem, the rank determined based on a proximity of each of the configuration changes to the problem, a difference in time between an occurrence of each of the configuration changes and an occurrence of the problem, and a security sensitivity associated with the components of the computer network; and
means operative to verify that the ranked configuration changes are related to the problem.
16. The system of claim 15 , further comprising means operative to receive policy or profile input from a user's processing device or policy-management systems and to convert the policy or profile input into usable data.
17. The system of claim 15 , wherein the means operative to verify that the ranked configuration changes are related to the problem include:
a database populated with descriptive system information; and
a database structure configured as hierarchical database pages, each database page having a page index, data section and selector section, wherein the data section is further configured to include reliability or vulnerability information associated with the components of the computer network associated with the problem to verify that the ranked configuration changes are related to the problem, and wherein the selector section is further configured to include links to other related database pages of the database structure.
18. The system of claim 17 , further comprising means operative to enable provisioning and access to the database and the database structure.
19. The system of claim 17 , wherein the database comprises an element descriptive database (EDD).
20. The system of claim 17 , wherein the database structure comprises a hierarchical vulnerability database (HVD) structure.
21. The system of claim 15 , further comprising means operative to accumulate and filter the received input regarding the problem with the computer network until all of the input is received.
22. The system of claim 15 , wherein the parameters of the problem include at least one of a component of the computer network experiencing the problem, a component of the computer network affected by the problem, and a time at which the problem was first noted.
23. The system of claim 15 , further comprising:
means operative to formulate a list of the configuration changes based on the rank associated with each of the verified configuration changes; and
means operative to present the list to a user.
24. The system of claim 15 , further comprising:
means operative to record the configuration changes made to the computer network at a first level of detail; and
means operative to record the configuration changes associated with the problem at a second level of detail in response to receiving the input regarding the problem, wherein the second level of detail is greater than the first level of detail.