SYSTEM AND METHOD FOR AUTOMATED SYSTEM MANAGEMENT

A management unit comprising a processor, the management unit is configured to be in communication with at least one management system, the at least one management system configured to be in communication with at least one endpoint machine in an environment of multiple endpoint machines, the processor is configured to: assign for the at least one management system a dynamic group of endpoint machines; execute a relevant adaptor on the management system according to the assigned dynamic group; and apply to the dynamic group of endpoint machines, by the executed adaptor, policy rules relevant to the dynamic group of endpoint machines.

It will be appreciated that for simplicity and clarity of illustration, elements shown in the figures have not necessarily been drawn accurately or to scale. For example, the dimensions of some of the elements may be exaggerated relative to other elements for clarity, or several physical components may be included in one functional block or element. Further, where considered appropriate, reference numerals may be repeated among the figures to indicate corresponding or analogous elements.

DETAILED DESCRIPTION OF EMBODIMENTS OF THE INVENTION

Embodiments of the present invention may provide a system and method for cloud and/or internal system management, which automates change processes in the system. Thus provision and configuration of a new server, as well as monitoring upgrading and updating of the servers in the system may all be automated and preformed continuously.

Once endpoints and/or servers are provisioned and configured, they can move from an internal datacenter to a cloud, between clouds or between roles. This can entail a different management policy for them. The system and method according to embodiments of the present invention may provide the management configuration when the endpoint or server is created, maintain, change or update the management configuration of each endpoint or server and control the management of the endpoint or server through all changes. For example, according to embodiments of the present invention, when an endpoint or server is moved from one cloud to another, from one physical location to another, from one datacenter to another or from one host to another etc., the change may automatically be detected and a different configuration and/or a new management policy may automatically be applied to the endpoint or server.

Embodiments of the present invention may provide a platform for centralized, policy-driven provisioning, configuration and ongoing management of a portion of or an entire management stack of servers and endpoints of a corporation.

Embodiments of the present invention may provide a system and method for management of a system such as, for example, datacenter, private, hybrid or public cloud, in an environment of virtual and physical machines, desktops or servers or mobile devices, by virtualized management agents. Original management agents such as for monitoring, backup, performance, antivirus, compliance, automation, security, configuration, and/or other agents may be virtualized and/or run virtually on machines, for example remote machines, for example machines that may be included in datacenters environment. A system according to embodiments of the present invention may control a virtual infrastructure of virtual agents that may run virtually on machines in the datacenters environment. The execution of the virtual agents may be done based on pre-defined policies. Embodiments of the present invention may provide system management based on virtual agents without the requirement to install and configure agents on each machine. This may save, for example, time and operational overhead costs so as shortening time to market, improve and protect application performance and uptime, reduce risks associated with making changes and ensure and simplify compliance.

Additionally, a system and method according to embodiments of the present invention may monitor, for example continuously, activity of virtual agents. Embodiments of the present invention may enable controlling of consumption of resources across the infrastructure of virtual agents and thus, for example, enable optimization of application performance.

Additionally, a system an method according to embodiments of the present invention may leverage physical agents (non-virtual agents).

In some embodiments of the present invention, tracking and/or management of the entire virtual and/or physical management infrastructure may be performed from one central console.

Although a virtual agent as described herein may function and behave as if it was installed on each machine, the operation or execution of a virtual agent may be decoupled from the underlying operating system. Otherwise described, an agent may be executed on a machine (physical or virtual machine) without being installed on the machine as done in prior art systems and methods.

Virtually executing virtual agents instead of installing agent software on thousands of machines may drastically cut down agent management overhead. For example, agent upgrade processes may include a simple replacing of a file on the endpoint machine and/or may be performed, according to embodiments of the invention, for example, with a mouse click or other command/input by an input device from a user. Other operations, e.g., rebooting, scripting, logging on and off servers, coordinating change management windows, testing for agent conflicts and manual installations when scripting tools fail may all be avoided using embodiments of the invention. In an embodiment, user defined policies may control virtual agents operation or deployment, e.g., in order to proactively optimize application performance and avoid agent storms.

Reference is now made toFIG. 1, which is a schematic illustration of a system10for automatic system management according to embodiments of the present invention. System10may manage datacenters/servers140and150in an environment15of virtual and physical datacenters/servers140and150. Datacenters/servers140and150may include/be in communication with virtual endpoint machines142and physical endpoint machines152, respectively, that may be managed by virtual agents, for example as describe in detail in U.S. patent application Ser. No. 13/572,740, titled SYSTEM AND METHODS FOR MANAGEMENT VIRTUALIZATION, incorporated herein by reference. A datacenter may be called a datacenter server or datacenter/server interchangeably throughout the present description. As discussed in detail below, embodiments of the present invention may enable execution of virtual agents at endpoint machines by containers such as, for example, package files that include the virtual agents, without a requirement to install the virtual agents in the endpoint machines. System10may include a management unit100, virtualization management servers120, discovery sources121and core servers130. A container may include a plurality of virtual agents, and the plurality of virtual agents may be executed within a single container file, on the endpoint machine.

Management unit100may include a processor110and storage unit/medium115, and may manage/control virtualization management server120and discovery sources121and the virtual environment including infrastructure of virtual agents and/or virtual machines, for example endpoint machines. Management unit100may store images of the virtual agents, policies to control the virtual agents, data about the virtual infrastructure of virtual agents and/or virtual machines, data about the physical machines and infrastructure of environment15and/or any other data that may be required, for example in order to manage the virtual infrastructure of virtual agents. In some embodiments, a virtual agent may be automatically joined to the managed environment upon executing the virtual agent on the endpoint machine and automatically disjoining the virtual agent from the managed environment upon removing the endpoint machine from an installation in environment15.

Management unit and/or Processor110may control, manage and/or be in communication with core servers130and datacenters/servers140and150. Management unit and/or Processor110may control and manage system10. Embodiments of the invention may include an article such as a computer or processor readable non-transitory storage medium, for example storage medium115, such as, for example a memory, a disk drive, or a USB flash memory encoding, including or storing instructions, e.g., computer-executable instructions, which when executed by a processor or controller110, cause the processor or controller110to carry out methods disclosed herein. Processor110may control management unit100and other units and modules of system10to perform the steps and/or functions described herein and to carry out methods disclosed herein.

Management unit100may enable a user to create a library of virtual agents. Management unit100may convert original agent installers, which may be uploaded to management unit100by a user, into virtual agents. The virtual agents may be stored, for example, in a designated storage library in management unit100. As described in more detail below, the virtual agents may be encapsulated in a virtual agent container (may also be called package), which may include in addition to the virtual agent a configuration for execution of the virtual agent at the endpoint machine, for example without installing the virtual agent in the endpoint machine. A virtual agent container file may include and/or wrap one or more virtual agents, for example multiple virtual agents and their configurations.

Virtualization management servers120may include any third-party software for management of virtual machines. Any number of virtualization management servers120may be included in system10and the invention is not limited in this respect.

Discovery source121may include any third party software to provide information about physical, virtual or cloud machines (desktops and servers). Any number of discovery sources121may be included in system10and the invention is not limited in this respect. Discovery sources can be for example, middleware service like Amazon AWS, Microsoft Azure, VMware Hybrid Cloud, Active Directory, CMDB service, proprietary list of machines etc'.

Core servers130may each be in communication with multiple endpoint machines142and152. Core servers130may push the virtual agent container file to relevant endpoint machines, for example upon a command received from a user or the policy engine. Upon such command, management unit100may share container files with core servers130, which may push the container files to relevant endpoint machines. Virtual datacenters140may be, for example cloud data centers. Cloud data centers140may be managed by hypervisors145. Communication between core servers130and virtual endpoint machines142may be facilitated through hypervisor145, for example without the need for direct network connectivity between core servers130and endpoint virtual machines142. Physical endpoint machines and virtual endpoints142may communicate with core servers130by standard network connections. Any number of core servers130and any number of datacenters140and150may be included and the invention is not limited in this respect. Each core server130may support thousands of virtual agents. Each management unit100may support and/or manage a number of core servers130according to the number of virtual agents in the datacenters environment.

Core servers130may further enable controlling the virtual agents executed at the endpoint machines inside the container, e.g. not installed on the operating system. The execution of the virtual agents at the endpoint machines inside the container may be decoupled from the operating system of the endpoint machine such as, for example, the management, virtual deployment, upgrades, downgrades, troubleshooting and termination of the virtual agents may be performed in the container independently from the operating system. Components of the container may monitor processes performed by a virtual agent, detect failures, health problems, misconfigurations, illegal access, tempering attempts and/or remedy failures in the operation of the virtual agent, for example in real time. Additionally, components of the container may communicate with hypervisor145and/or coordinate operations with operations performed by other virtual agents, for example in other virtual endpoint machine supervised by the same hypervisor145. The coordination may resolve and/or prevent performance bottlenecks. Management actions performed by modules/components of the container may be executed based on policies stored in the container and/or in management unit100, which may be predefined or defined during operation, for example by a user. By decoupling execution of agents from the operating system in the described manners, users may save time and risk of agent deployments, upgrades and troubleshooting.

Environment15of virtual and physical datacenters140and150may belong and/or be controlled by a corporation with certain policies, management system160and/or tools that are being used and security requirements. A virtual or physical endpoint machine142or152may be a virtual or physical server or a virtual or physical desktop or a mobile device, for example having a certain function, or a personal endpoint virtual or physical machine, or any other virtual or physical computer machine, for example belonging and/or controlled by the corporation.

An endpoint machine142and/or152may change its location, role and/or function, and/or may be moved from one server, datacenter server or cloud server to another server, datacenter server or cloud server, and/or its environment or status may otherwise be changed, and/or it may require updates and/or upgrades for tools installed thereon. The status of an endpoint machine, or such changes in status and/or requirements, may be automatically detected by a virtual agent stored in a container installed on an endpoint machine142or152, and/or by periodic requests sent from management unit100to the endpoint machine and vice versa, and/or by gather information from virtualization management120and/or discovery sources121, and/or by detecting network, storage, time and/or state information for example via the core server130. Some or all of endpoint machines142and/or152may have virtual and/or actual software agents installed thereon. However, the present invention is not limited in that respect. In some other embodiments, the automatic detection may be performed by a sensor/plug-in installed on the endpoint machine and/or on the datacenter server or cloud server, which may send data to management unit100, for example via core server130.

For example, management unit100may detect, for example, that an endpoint was added or removed, changed status and/or group, and/or suffered an error. For example, the endpoint machine may be classified by a custom, dynamic definition that may be recognizable by management unit100. The definition may be informative regarding the machine's status such as, for example, role, functioning, location, time, machine metadata, relevance, grouping, and/or any other suitable status parameter. Based on the definition, or when the definition changes, management unit100may detect a status or a change in status of the machine. For example, the endpoint machines in environment15may be classified to multiple dynamic groups, wherein each endpoint machine may belong to at least one of the dynamic groups of machines, classified according to attributes such as, for example, name, IP mask, IP space, hostname, any kind of identification, any kind of address, zone, tag, directory, or any custom attribute assigned to a machine and/or a group of machines by a user or controller. The machine classification to groups may be expressed in the recognizable custom, dynamic definition. The classification attributes, according to which the endpoint machines are classified to the dynamic groups, may be related to and/or indicate the role, functioning, relevance, grouping, and/or any other suitable status parameter of the endpoint machines. According to the classification, management unit100may decide which management system160should be used and/or applied to a specific endpoint machine.

Based on a detected status or change, management unit100may implement and/or enforce rules on how the endpoint machine should be managed, for example according to a corporation policy. For example, management unit100may decide which management system160should be used on the specific endpoint machine, how a management system160applied on the endpoint machine should be configured, and/or may decide to make changes in the endpoint machine, for example by utilization of virtual agents, which may make changes without risking the functioning of the endpoint machine.

Additionally, management unit100may continuously monitor environment15, datacenters140and150and endpoints142and152. For example, management unit100may send an inquiry to an endpoint machine, for example to a virtual/software agent or a plug-in applied on the endpoint machine, to validate that the endpoint machine is configured according to the correct policy. In case the configuration of an endpoint machine or of a management system160and/or tool applied to the machine is not a suitable configuration according to the correct policy, for example if the configuration does not match the correct policy, a policy drift is detected. Management unit100may automatically fix a policy drift, by sending a command to the agent/plug-in to change the configuration according to the correct policy. Management unit100may automatically fix a policy drift, by sending a command to the management system160to change the configuration according to the correct policy Similarly, management unit100may monitor health of elements in environment15, such as verification that products and/or tools applied to endpoint machines are healthy and functional, and may verify that core server130and/or datacenters servers140and150run and configured properly and may verify that endpoint machines are healthy and running properly.

In case changes in environment15are detected by management unit100, management unit100may re-match policies to the changed endpoint machines. For example, in case an endpoint machine changed its role/function, the relevant policy may be applied to the endpoint machine, for example instead of a previous policy. Additionally, relevant management systems160and/or tools may be applied to the machine and configured according to a relevant policy, according to the new role/function of the endpoint machine, and/or other tools may be removed or reconfigured according to the relevant policy. For example, the change in role may be detected by identifying a change in the detectable classification definition of the endpoint machine.

In case the policy itself changes, with or without changes in environment15, management unit100may apply the policy change to the relevant endpoint machines and/or relevant management systems and/or back-end tools160applied to the relevant endpoint machines. For example, management unit100may change configurations of endpoint machines and/or applied back-end tools160, and/or may remove and/or apply relevant management systems and/or back-end tools160on the relevant endpoint machines, with the correct configurations according to the new policy. Additionally, for example, based on a new policy, applied agents and/or plug-ins may be removed from endpoint machines and/or replaced with updated agents/plug-ins.

In case an endpoint machine is detected by management unit100to be unhealthy, for example in functioning, management unit100may automatically apply a remediation policy.

Management unit100may apply a relevant configuration for certain management systems160. For example, a certain agent on an endpoint machine may be controlled by a commands and/or requests received from a management systems160, i.e. a certain server controlling this product and/or endpoint machine, such as a datacenter150or cloud server140, or core server130. For example, when a new endpoint is configured, or an old configuration is changed, sometimes the endpoint needs to be registered to a management system160. Management unit100may apply configurations to the management systems160server as well as to the endpoint machine, for example, configuring the back-end server to apply a backup process in certain predetermined periods to a tool applied on the endpoint machine. Generally, management unit100may apply management configurations to the back-end server, such as how to handle certain situations in the endpoint machine. For example, management unit100may apply a management configuration to the management systems160, saying how an agent and/or virtual agent applied to the endpoint machine should be handled in all sorts of situations, for example in case the agent does not work properly or utilizes too many CPU resources.

In some embodiments of the present invention, a certain dynamic group of machines may be managed by a corresponding management system160. A dynamic group of endpoint machines may be identified by a certain policy identifier, which may instruct the corresponding management system to apply a certain policy to the endpoint machines in that group. The management system may include or may be assigned with an adaptor, for example configured by management unit100, which may configure the management system to control and manage this group by assigning to this server the certain policy identifier and may assign the relevant endpoint machines to this management server, based on this policy identifier. In some embodiments, a product/tool applied in an endpoint machine may include a virtual agent which may be applied to the endpoint machine. Such virtual agent may include an “install” configuration. For example, once a virtual agent is applied to/installed on an endpoint machine, it may configure a corresponding management system addresses, ports and/or any other parameter which may enable assigning of the endpoint machine to the relevant management system. Once installed, the virtual agent may report the status, configuration, functioning, actions and/or other parameters of the to the management system. The virtual agent may also apply the policy identifier to the endpoint machine, thus assigning the endpoint machine to the corresponding back-end server.

Reference is now made toFIG. 2, which is a schematic illustration of management unit100and its main modules and interfaces, according to embodiments of the present invention. Management unit100may include, for example, an Application Programming Interface (API)20, a policy analytics module22, a back-end server automation module24, a policy management module26, a communications channel28and virtualization management connectors29. API20, policy analytics module22, management system automation module24, policy management module26, communications channel28and virtualization management connectors29and/or any other module and/or interface of management unit100may be included, controlled and/or executed by processor110shown and described with reference toFIG. 1. Management unit100may also include and/or interface with console170, by which a user may monitor and manage management unit100and system10. Console170may include a graphical user interface that may communicate with management unit100via API20, by which a user may view, monitor and manage management unit100and system10.

API20may include, for example a Representational State Transfer (REST) API or any other suitable API, which may provide a standard and easily integrated interface between management unit100and other, for example, higher level, automation, orchestration and/or virtualization systems.

Management unit100may act as a central management server for deployment, configuration, auditing and/or performing any other suitable operation for supervision and/or execution of virtual management agents across the datacenters supervised by management unit100. Management unit100may constitute a management center for management of multiple virtualization management servers120, multiple discovery sources121and multiple physical and virtual datacenters. Virtualization management connectors29may include a plug-in mechanism to integrate with virtualization management servers120, which may include, for example, third party virtualization management servers, such as, for example, public and/or private cloud servers, such as, for example, Amazon® web services (AWS), Microsoft® Azure, VMware vCenter®, Microsoft® Hyper-V Management™ Server, Oracle® Virtualization, Citrix® Xen, KVM, Virtual Box, Parallels, Linux Containers, Linux zones, Red Hat® Enterprise Virtualization and/or any other suitable virtualization management servers. Communications with management system160may be performed via communications channel28.

Discovery sources automation25module may plug-in or otherwise connect to one or more discovery sources121. By the plug-in and/or connection, management unit100may read the list of endpoint machines, their current status, power status, location and other metadata. Additionally, by the plug-in and/or connection, management unit100may interact with routing and/or firmware platforms, for example in order to automatically open relevant routing holes and/or paths, so that communication between endpoint machines and back-end servers and/or management systems may be enabled. Therefore, by the plug-in and/or connection, management unit100may read data regarding virtual/cloud server instances and/or register new server instances to management unit100and/or remove decommissioned instances. Additionally, by the plug-in and/or connection, management unit100may read tags defined on instances of the virtual/cloud servers and/or provide the information in the defined tags to a user via console170.

Virtualization management connectors29may plug-in or otherwise connect to a virtualization management server120. By the plug-in and/or connection, management unit100may read the list of endpoint machines, their current status, power status, location and other metadata. Additionally, by the plug-in and/or connection, management unit100may interact with routing and/or firmware platforms of the virtualization management servers120, for example in order to automatically open relevant routing holes and/or paths, so that communication between endpoint machines and back-end servers may be enabled. Therefore, by the plug-in and/or connection, management unit100may read data regarding virtual/cloud server instances and/or register new server instances to management unit100and/or remove decommissioned instances. Additionally, by the plug-in and/or connection, management unit100may read tags defined on instances of the virtual/cloud servers and/or provide the information in the defined tags to a user via console170.

A user may log in to management unit100via a web browser, and then the user may configure and monitor system10by the graphical user interface on console170. Once a user applies settings and configurations to system10, the management unit100may process the settings and configurations and send the relevant commands to management systems160, management systems160may interact, via a hypervisor or directly, with virtual and/or physical endpoint machines to apply the settings and commands. Via console170, a user may apply settings and configurations to specific servers, datacenters or machines, or may apply a policy, e.g. a set of automatic rules for setting and/or configuring a group of servers, datacenters or machines. For example, a user may determine which management systems should be used for each endpoint, how these management systems should be configured and implement that configuration on each management system160. For example, For example, a user may determine which virtual agents should be applied to which servers, datacenters or machines. For example, a user may determine management policies for cases of virtual agent failure of an operating system failure. For example, a user may determine performance requirements such as memory, computing power and/or bandwidth consumption and/or any other suitable performance requirements for virtual agents.

Policy manager26may be configured by the user with the relevant management policies. Policy manager26compiles the management policies and may apply corresponding tasks to the relevant management systems160, which may apply the tasks on the relevant endpoint machines. Management unit100may be automated by developing and integrating software into management unit100. In some embodiments, a user may fully or partially automate management unit100, for example by a software development kit (SDK) that may be included in management unit100. Policies applied by a user and/or by policy manager26may include, for example, management system configuration, networking configuration, security configuration, deployment policies for deployment of virtual agents and/or non-virtual agents, performance protection policies and proactive management policies.

Policy manager26manages the list of rules that together are consider the policies. In some embodiments, a built rule includes three basic sections: matching section, action section, and metadata section. The matching section of a rule built by policy manager26may include indication of to which endpoint machines the rule applies. The indication may be performed by the dynamic groups described herein, e.g. the matching section may indicate the dynamic group or groups to which the rule is applicable. The action section may describe the actions that should be taken when and where the rule applies. For example, the actions may include deployment of a management package, the package describing, for example, the configuration and/or implementation of a management system being used for managing, securing and/or configuring an endpoint machine. Additionally or alternatively, for example, the actions may include recommendation to deploy such or another management package. Additionally or alternatively, the action may include settings and configuration of the endpoint operating system, services, daemons, processes, registry and file system. The metadata section may include metadata about the applicable rule. Such metadata may include a serial number of a rule, identification of a creator of the rule, time of creation of the rule, rule's source, and comments about the rule, rule group attribution, and/or any other suitable metadata about the rule.

Policy manager26and policy analytics22may be configured to learn and build policy rules independently, on the fly, according actual configuration, existing configuration of management system, type of agents installed, management systems applied, endpoint machines and/or tools and/or products installed on endpoint machines. Policy analytics22includes a data collection component that collects that data and build suggested rules based on that actual or existing configuration. The policy analytics may configure rules in the policy manager26. The policy analytics may also export the suggested rules to the console170to get further confirmation or instructions from the user.

Policy manager26may execute and/or control execution of the created rules. In some embodiments, policy manager26may indicate an order for execution of the rules. In some embodiments, the rules may be executed by policy manager26or policy manager26may control execution of the rules by serial order, for example according to the serial number of the rule indicated in the metadata, for example one rule after the other, by order of the serial numbers. When a rule is found to be applicable for a certain dynamic group of end-points, the action section of a rule may be executed, for example by applying a management package as described herein or by sending and/or displaying a message that a certain management package should be applied to a certain endpoint machine or a group of endpoint machines. The metadata information included in the metadata section may be stored, for example once a rule is executed, in policy analytics module22.

Additionally, policy manager26may include a policy verification mechanism that may verify that the policy and/or rules execution works properly, may detect conflicts in the policy and/or may alert against such conflicts that may occur. In some embodiments of the present invention, for example, when two or more rules contradict each other, execution of all or some of the contradicting rules may be skipped. For example, a contradiction may occur when two different rules have management packages deployable on the same product/tool, for example because two different back-end configurations are applied on the same tool, for example by two versions of the same agent applied on the endpoint machine.

Back-end server automation module24may be an open adaptor based platform for configuration, control and monitoring of any software, tool and/or product installed on an endpoint machine. Server automation module24may, for example, automatically configure management systems applied to an endpoint machine. Particularly, some events in a lifecycle of an endpoint machine may require such automatic configuration, as described in detail herein. Server automation module24may execute adaptors on the management systems, the adaptors include the management packages and configuration rules gathered from the policy manager. Each adaptor may be executed on the respective management system or remotely by the server automation module24. The adaptors may include the knowledge how to monitor and configure a management system. By the adaptors, server automation module24may provide automatic handling of logging issues, debugging and errors. The adaptors may be custom made, for example for a particular software, product or tool installed on an endpoint machine.

Management System automation module24may communicate with the adaptors executed on each of the back-end servers. The adaptors may have several functions that may enable server automation module24automation of the back-end server. For example, an adaptor may execute connection of server automation module24to the management system to which the adaptor is related. The connection may be triggered by the management system automation module24. For example, an adaptor may execute registration of an endpoint machine to a management system for example according to the policy identifier and/or by a virtual agent as described above. For example, an adaptor may execute assigning of a relevant configuration and/or policy to an endpoint machine, according to the rules decided by policy manager26as described in detail herein. For example, an adaptor may execute a query whether a current configuration of an endpoint machine is correct and/or functions properly. For example, an adaptor may execute deregistration of an endpoint machine from the back-end server, for example in case the endpoint machine does not belong to a relevant dynamic group anymore.

Management system automation module24may continuously query and/or receive indications, for example, via the adaptors, about whether an endpoint is configured properly and/or according to the correct policy rules decided and/or built by policy manager26. For example, for a certain management system, automation module24, by the adaptor, may queue all the endpoint machines assigned to this server, and execute a query on each of the queued endpoint machine, according to the queue, whether a current configuration of the endpoint machine is correct and/or functions properly.

Policy analytics module22may aggregate the events of rules execution and/or may generate statistics and/or conclusions about the functioning of policy manager26, possible problems and/or trends in the rules and/or any other possible statistics and/or conclusions about policy manager26and the executed rules.

Policy analytics module22may store data about servers, datacenters and/or endpoint machines, data about virtual agent container, associations between servers, datacenters and/or endpoint machines and virtual agent container and management policies data. In addition, policy analytics module22may store events and logs generated by endpoint machines. Policy analytics module22may include a relational database to relate data about endpoint machines with data about virtual agents. Data about endpoint machines may include name, Internet Protocol (IP) address, operating system in use, and/or any additional suitable data. Policy analytics module22may also collect and/or store events and logs from endpoint machines, process the events and logs and generate reports, for example upon a user's request or periodically. The generated reports may be in a fully searchable format.

For example, policy analytics module22may generate rules based on the collected data.

For example, policy analytics module22may generate audit reports, reports about endpoint machines, excessive resource consumption events, virtual agent predicted performance and/or any other report based on data collected and/or stored in policy analytics module22. Audit reports generated by policy analytics module22may include logs of changes in the managed environment, including the time and user identification. Reports about endpoint machines may present endpoint machines in the managed environment that are managed or not managed by management unit100. In some embodiments, any endpoint machine in the environment may be automatically controlled and/or manageable by management unit100. In some embodiments, an endpoint machine in the managed environment may be unmanageable by management unit100because of a problem, error or failure that may be solved by a troubleshooting policy or by a user through console170. Reports about endpoint machine may enable a user to identify such problems and solve them. Reports about excessive resource consumption events may constitute an events log and/or present, for example, events that triggered excessive resource consumption by virtual agents. The report may also present data about initiated proactive actions for moderating these events, for example by management unit100. Reports about virtual agent predicted performance may predict resource consumption by virtual agents before pushing virtual agents to endpoint machines. For example, management unit100may detect that a particular virtual agent will consume a lot of memory. As a result, management unit100and/or the user may compute that a certain number and/or percentage of machines may experience memory shortage.

In some embodiments of the present invention, management unit100may include a virtual agent management module23for distribution and management of virtual agents. Virtual agent management module23may deploy a virtual agent to an endpoint machine, replace an old virtual agent with a new virtual agent, change configuration of a virtual agent or remove a virtual agent, for example, when a management package includes a certain virtual agent that have to be implemented on the endpoint machine. Additionally, virtual agent management module23may monitor the health of the virtual agents, for example by execution of periodic health monitor scripts, command lines and/or any other suitable manner of health validation. For example, health validation may be executed periodically, for example in each container of a virtual agent. Health validation may include validation of connectivity to the relevant back-end server, validation of normal resource consumption, validation of general health and/or functionality, validation of configuration according to the correct policy rules, and/or any other suitable validation of proper status and/or functioning.

As discussed above, system10and the virtual agents may be monitored and managed through console170, including a dashboard and/or a graphical user interface. Console170may display data about managed endpoint machines, virtual agents that are running on the endpoint machines and proactive management policies, which are applied to each machine. Console170may enable a user to create and embed in management unit100management and performance policies for the virtual agents. In some embodiments of the present invention, viewing, controlling, managing and/or any other kind of accessing into a virtual agent may be performed, for example, exclusively, by a user identified as an owner and/or any kind of administrator of the virtual agent.

Management unit100may detect all the machines across the data centers140and150in environment15. Management unit100may collect and store in policy analytics module22real-time information about statuses of endpoint machines, operating system used on each machine, virtual agents running on each machine, versions of virtual agents, and any other suitable data required for managing system10and the virtual agents.

In order to deploy virtual agents to endpoint machines, a user can select a virtual agent and push it to substantially any number of selected endpoint machines by commands via console170. The virtual agent may then be executed on the selected machines as described herein and deliver all the functionality of the original agent, without actually being installed on the endpoint machine and without incurring excessive costs and waste of time associated with mass agent deployments on each machine separately. Additionally, via console170, a user may schedule in advance specific time slots for virtual agents to be pushed to their endpoint machine automatically.

Additionally, via console170, user can define the setup of rules compromising a policy. Each rule may include the three key objects: match, which means to which endpoint it should be applied to, action which describes what should be done as part of this rule and the metadata for that rule.

For virtual datacenters140, pushing of virtual agents by management systems160to endpoint machines may be performed whether the virtual endpoint machine is powered on or powered off. In case the virtual endpoint machine is powered off during the pushing of the virtual agent, the virtual agent is already included and may be executed in the endpoint machine once the machine is powered on. Additionally, in case virtual endpoint machine is power off, virtual agent management module23can access the storage directly to alter the file system and apply the virtual agent even when the endpoint machine is powered off.

In order to upgrade a version of a virtual agent a user may upload the selected version of the original agent installer files to management unit100, which, as described above, may convert the original agent installer files to a virtual agent and may distribute the virtual file to core managers130. Then, core manager130may push the virtual agent to all the relevant endpoint machines. The pushing may be done upon a command form a user via console170. Reverting back to a previous version may be done in a similar manner.

Console170may display virtual agents applied to endpoint machines and non-virtual agents installed on the same endpoint machines. When a virtual agent is applied to an endpoint machine, the installed agent may be deactivated. The virtual agent container may copy configurations from the installed agent to the container and/or the virtual agent may be executed with configurations of the installed agents. The non-virtual installed agent may not be removed from the machine and may be reactivated if desired. This side by side architecture of virtual and non-virtual agents may allow users to implement the use of system10gradually and with minimal risk.

Reference is now made toFIG. 3, which is a schematic flowchart illustrating a method for automated system management according to embodiments of the present invention. As indicated in block610, the method may include assigning for at least one management system a dynamic group of endpoint machines, for example according to embodiments of the present invention as described in detail herein. As indicated in block620, the method may include executing a relevant adaptor on said management system according to the assigned dynamic group, for example according to embodiments of the present invention as described in detail herein. As indicated in block630, the method may include applying to said dynamic group of endpoint machines, by said executed adaptor, policy rules relevant to said dynamic group of endpoint machines, wherein said adaptor is executed by a processor, for example according to embodiments of the present invention as described in detail herein.

It should be understood that the systems described above may provide multiple ones of any or each of those components and these components may be provided on either a standalone machine or, in some embodiments, on multiple machines in a distributed system. The systems and methods described above may be implemented as a method, apparatus or article of manufacture using programming and/or engineering techniques to produce software, firmware, hardware, or any combination thereof. In addition, the systems and methods described above may be provided as one or more computer-readable programs embodied on or in one or more articles of manufacture. For example, some embodiments may be provided in a computer program product that may include a non-transitory machine-readable medium, stored thereon instructions, which may be used to program a computer, or other programmable devices, to perform methods as disclosed herein. Embodiments of the invention may include an article such as a computer or processor readable non-transitory storage medium, such as for example a memory, a disk drive, or a USB flash memory encoding, including or storing instructions, e.g., computer-executable instructions, which when executed by a processor or controller, cause the processor or controller to carry out methods disclosed herein.