System and methods for event impact analysis

A conventional business enterprise has a number of departments each depending on an information processing infrastructure. Operational anomalies in the information processing infrastructure may have a detrimental effect on one or more of the business processes. A rule engine associates network events with the business processes which the network events impact. The rule engine identifies and processes relations between event-generating manageable entities on the network. The rule engine computes, based on the relations between the various manageable entities, manageable entities having an effect on other manageable entities. Upon occurrence of an event, the rule engine employs the relations to determine which other manageable entities are indirectly affected by the event. The rule engine reports the event and affected manageable entities to identify the business processes which experience resulting operational deficiencies.

BACKGROUND OF THE INVENTION

Conventional managed information environments provide an information processing infrastructure for a particular business workflow. The business workflow has business processes, typically organized as departments, each handling a particular business process. The typical business enterprise, therefore, has a number of departments each depending on the information processing infrastructure for supporting the business process or processes for which the department is responsible.

In such a business enterprise, many business processes depend on the information processing infrastructure for support of routine business activities. Accordingly, consistent ongoing operation, or “uptime” of the information processing infrastructure, is significant. Often, the business processes each depend on the operation of the information processing infrastructure in different ways. Therefore, operational anomalies or deficiencies in the information processing infrastructure may have a detrimental effect on one or more of the business processes. Depending on the reliance of each of the business processes on the information processing infrastructure, a particular operational anomaly may have a different effect on each of the business processes. In other words, failure of a particular entity, such as a server of a disk array host for example, may have a null, minor, or substantial effect on a given business process.

SUMMARY

In a conventional business enterprise, a particular group or external management organization often operates and maintains the information processing infrastructure. The technical nature of the information processing infrastructure generally lends itself better to operational support from proficient operators, rather then intervention with nontechnical users. However, such operators may not be familiar with the business operations which the information processing infrastructure supports. Accordingly, the impact that a technical problem or occurrence in the information processing infrastructure has on the higher level business processes may not be readily apparent.

In a typical conventional managed information environment, such as a storage area network (SAN) operable to coordinate access to mass storage devices by a set of users, the storage area network interconnects a plurality of storage device nodes and associated interconnection nodes. The storage area network therefore includes a variety of nodes, or manageable entities, for providing mass storage retrieval services to users, such as storage devices (e.g. disc drive arrays), connectivity devices (e.g. switches and routers), and conventional host computers for executing software components called agents for monitoring and controlling the nodes in the storage area network. Each of the nodes in the storage area network may have a dependency, and therefore a relation, to another node in the storage area network. Depending on the arrangement of the business processes supported by the SAN, each node may support one or more of the business processes. Events and/or occurrences at a particular node may have an indirect effect on other nodes, and consequently, on the business processes which the node supports.

Further, service impact monitoring (SIM) applications are known which purport to receive a particular failure indication and identify the affected business processes. Such a SIM application receives an event occurrence and a particular object, or manageable entity, experiencing the failure indication. In a storage area network, it would be beneficial to identify the relations between the manageable entities and enumerate indirect effects of events at one manageable entity upon other manageable entities in the storage area network.

In a conventional managed information environment network, therefore, lower level operational anomalies may not be readily attributable to higher level business processes which may experience detrimental operation as a result. The invention as defined by the present claims is based, in part, on the observation that events and/or other detrimental occurrences are often not readily associated with the business processes that the anomaly impacts. In other words, a network occurrence, such as a malfunction or failure, on a particular piece of network hardware will not readily indicate the particular departments in the business enterprise which may experience service irregularities or interruptions as a result. A monitoring application which operates on the network typically generates an event indicative of such an occurrence, and network operators familiar with the monitoring application may therefore respond accordingly. However, business side users, who typically employ the network and components therein as a service, may not understand which business processes are affected by the event.

Configurations of the invention substantially overcome the above described shortcomings with respect to the association of network events with the enterprise business processes, or operations, which the network events impact. In the configurations described below, a rule engine identifies and processes relations between manageable entities on the network. A business side user defines the types of manageable entities for which event impact analysis is desired. The rule engine computes, based on the relations between the various manageable entities, which of the other manageable entities have an effect on the manageable entities under observation. Upon occurrence of an event, the rule engine employs the relations to determine which other manageable entities are indirectly affected by the event. The rule engine enumerates the affected manageable entities, and reports the event and affected manageable entities to an impact manager, such as a SIM application, which correlates the event to the business processes which may experience operational deficiencies as a result.

In further detail, the method for identifying the impact of event occurrences in a managed information such as a storage area network includes identifying a configuration of managed entities of interest in the storage area network, and determining relations between the managed entities of interest and other managed entities in the storage area network, in which the relations are indicative of an event at a managed entity having an affect on another managed entity. The rule manager then registers for notification of events affecting, based on the determined relations, the identified manageable entities. At a subsequent time, the registered server, on behalf of the rule engine, receives an indication of an event affecting a registered manageable entity, and determines, via the determined relations, other manageable entities affected by the received event.

The rule engine determines the other affected manageable entities by traversing the relations between managed entities from the manageable entity directly affected by the event, and identifying, from the traversing, manageable entities of interest affected by the received event. The rule manager then stores the relations between the manageable entities, maintaining the relations to be mapped in response to corresponding events.

Upon occurrence of an event, the rule engine determines the affected manageable entities by traversing a mapping of events and affected manageable entities, and matching the received event to the mapping of events and affected manageable entities. The rule engine determines the relations by parsing the manageable entities to identify manageable entities including manageable entities effected directly or indirectly by an event at another managed entity. The rule engine then traverses the relations using the manageable entity corresponding to the matching event to determine affected manageable entities.

The server, on behalf of the rule engine, registers for notification of events affecting manageable entities of interest by identifying types of events affecting a particular manageable entity. The server also registers for other manageable entities of interest relative to the particular manageable entity, and which may be indirectly impacted, based on the determined relations. In the exemplary configuration, the server invokes an event notification mechanism operable within the storage area network. Alternate notification services may be employed.

In particular configurations, the rule engine determines the affected managed entities by invoking a relation service operable to identify other managed entities effected by a particular managed entity according to the relations. Alternatively, determining affected managed entities includes traversing a cache of effected managed entities and selectively invoking the relation service if no match is found in the cache.

The impacted manageable entities are indicative of a set of business processes, or business operations, dependent on particular manageable entities, and the rule engine integrates, via an adaptor, with a Service Impact Monitor (SIM) application, operable to receive an indication of the identified manageable entity of interest and the accompanying triggering event. The service impact monitor is therefore operable to apply the manageable entity of interest to determine affected business processes.

The invention as disclosed above is described as implemented on a computer having a processor, memory, and interface operable for performing the steps and methods for monitoring and processing timer events in an information services network system as disclosed herein. Other embodiments of the invention include a computerized device such as a computer system, central processing unit, microprocessor, controller, electronic circuit, application-specific integrated circuit, or other hardware device configured to process all of the method operations disclosed herein as embodiments of the invention. In such embodiments, the computerized device includes an interface (e.g., for receiving data or more segments of code of a program), a memory (e.g., any type of computer readable medium), a processor and an interconnection mechanism connecting the interface, the processor and the memory. In such embodiments, the memory system is encoded with an application having components that when performed on the processor, produces a process or processes that causes the computerized device to perform any and/or all of the method embodiments, steps and operations explained herein as embodiments of the invention to allow execution of instructions in a computer program such as a Java, HTML, XML, C, or C++ application. In other words, a computer, processor or other electronic device that is programmed to operate embodiments of the invention as explained herein is itself considered an embodiment of the invention.

DETAILED DESCRIPTION

The invention as defined by the present claims is based, in part, on the observation that events and/or other detrimental occurrences are often not readily associated with the business processes which are affected. In other words, a network occurrence, such as a malfunction or failure, on a particular piece of network hardware will not readily indicate the particular departments in the business enterprise which may experience service anomalies or interruptions as a result. A monitoring application which operates on the network typically generates an event indicative of such an occurrence, and network operators familiar with the monitoring application may therefore respond accordingly. However, business side users, who typically employ the network and components therein as a service, may not be informed or understand which business processes are affected by the event.

Configurations of the invention substantially overcome the above described shortcomings with respect to the association of network events with the enterprise business processes, or operations, which the network events impact. In the configurations described below, a rule engine identifies and processes relations between manageable entities on the network. A business side user defines the types of manageable entities for which event impact is desired. The rule engine computes, based on the relations between the various manageable entities, which of the other manageable entities have an effect on the manageable entities under observation. Upon occurrence of an event, the rule engine employs the relations to determine which other manageable entities are indirectly affected by the event. The rule engine enumerates the affected manageable entities, and reports the event and affected manageable entities to an impact manager which correlates the event to the business processes which may experience operational deficiencies as a result.

FIG. 1is a context diagram of an exemplary managed information environment including a storage area network, suitable for use with the event impact analysis and reporting mechanism. Referring toFIG. 1, a storage area network100interconnects a plurality of manageable entities112, including interconnectivity elements such as switches112-1, servers112-2, and hosts112-3. A server120connects to the SAN110for monitoring and controlling the manageable entities112in the SAN110. A user console122is operable by a user or operator for manipulating the manageable entities112. The manageable entities112are operable to generate events114, typically in the form of alerts which indicate occurrences relevant to the operation of the SAN110. The manageable entities112may have relations116associating each manageable entity112with one or more other manageable entities112, as will be discussed further below. A manageable entity database (DB)130stores information about the manageable entities112, events114and relations116concerning the manageable entities112.

A Service Impact Monitor (SIM)140is accessible via an Information Technology (IT)/Business Process interface142for receiving and analyzing the impact of events occurring at affected entities144, as computed by the server120via a rule engine124, discussed further below with respect toFIG. 3. The SIM manager140correlates the affected entities144with business enterprise processes150, and is accessible via an impact (SIM) operator146. Exemplary business enterprise processes150include purchasing150-1, payroll150-2, sales150-3and shipping150-4, and may include others depending on the particular business enterprise.

FIG. 2is a top-level flowchart of event impact analysis as described herein. Referring toFIG. 2, the method for identifying the direct and indirect impact of event occurrences involves identifying a configuration of managed entities of interest in the storage area network, as depicted at step200. The configuration is stored in a non volatile entry such as a configuration file132(FIG. 3) in the manageable entity DB130. The configuration file132specifies the entities, events, and indirection of occurrences for which SIM manager140reporting is desired. The type of manageable entities112depends on the granularity of the monitoring, and is usually at a high level such as a host or server, however may be at lower levels of granularity as well. Such manageable entities112are the manageable entities of interest, for which the rule engine computes relations to other manageable entities112, discussed further below. In the exemplary configuration, the manageable entities112include hosts such as storage arrays, servers, connectivity elements such as switches, ports, and media connecters such as fiber adapters. Other manageable entities112or objects are likewise monitorable, such as agents, hubs, routers and various interfaces such as Ethernet adapters, frame engines, etc.

The configuration file132also specifies the events to be monitored. In a large system, such as the exemplary SAN environment100illustrated, many events corresponding to various types of occurrences are defined. In order to avoid inundation of event traffic, recipients of events typically limit, or filter, scrutiny to a set of predetermined events. Accordingly, the configuration files132specifies types of events which the rule engine124receives and analyzes. Further, the configuration file specifies whether direct or indirect impact of the events is sought. Typically, a user elects indirect impact, in order to ascertain the attenuated impact, or effect, of a particular occurrence. If direct impact only is requested, then the rule engine performs analysis only of the objects directly affected by an event.

The rule engine124determines relations136between the managed entities112of interest and other managed entities112in the storage area network100, as disclosed at step201. The relations136are indicative of an event at a managed entity112of interest having an effect, or impact, on another managed entity112. Therefore, the configuration file132specifies the manageable entities112of interest, for which direct occurrences (i.e. occurrences triggering an event) are observable, and the relations136indicate other manageable entities112which are indirectly affected via the relation. Generally, the relation136derives from a direct connectivity between the manageable entities112, such as a fiber adapter failing and compromising a port and server112-2which it supports. The determined relations136are then stored in a non-volatile area such as the ME database130.

The rule engine132then registers for notification of events affecting the identified manageable entities112, as per the determined relations136, depicted at step202. The server120has an event notification mechanism, not specifically shown, which is common in information processing systems of a nontrivial size. The event notification mechanism informs a designated object, such as the server120, of a significant occurrence in the system. Such notification takes the form of an event, which the event notification system transmits to registered entries depending on the event. Accordingly, the rule engine124registers for each event affecting a manageable entity112of interest. Such events include events directly affecting the manageable entity112of interest, and also event which indirectly affect the manageable entity112of interest via the relations136.

At a successive time, as a result of registration, the server120receives an indication of an event affecting a registered manageable entity112, as shown at step203. Accordingly, the server invokes the rule engine124to traverse the relations136and determining, by mapping the determined relations, other manageable entities112affected by the received event. The rule engine124therefore identifies the manageable entities112affected by the occurrence triggering the event. Typically, such indirectly affected manageable entities112are upstream entities dependent on the event-producing manageable entity for generating throughput, such as a host112-3receiving a data stream via a fiber adaptor. The rule engine124employs the relations to determine and map the indirect effect of such events, by traversing the relations136, as will now be described further.

FIG. 3is a block diagram of the server120in the exemplary managed information environment100operable according to the system of the present invention. Referring toFIG. 3, the exemplary environment100is a storage area network environment and the exemplary server120is an ECC (EMC Control Center) server, marketed commercially by EMC corporation of Hopkinton, Mass.), in communication with the SAN110. The ECC server includes the rule engine124and an adaptor160. The adaptor160provides an application specific interface to the SIM manager140and is operable to provide the IT/Business process interface142. The adaptor160further includes a cache162and a network services module164for identifying relations as will now be discussed in greater detail. The manageable entity DB130includes the configuration file132, an event mapping134, and a set of relations136. Briefly, the configuration file identifies the manageable entities112(objects) of interest, the types of events114to be reported, and whether direct and/or indirect events114are sought. The event mapping134identifies events114which affect a particular manageable entity112, and the relations136identify which manageable entities112have an effect on other manageable entities112.

In the exemplary configuration, configuration file132, event mapping134, and relations136are non-volatile files operable to be fetched into memory for processing. In various configurations, these files132,134and136may take other forms of volatile and non-volatile storage, such as flat files, indexed files, volatile memory tree structures, or other data structures, such a cache described further below.

FIGS. 4-6are a flowchart of the event impact analysis as inFIG. 2in greater detail. Referring toFIGS. 3-6, the SIM manager140or other manner of correlating the relevant business operations identifies the configuration by determining, based on a set of business processes15, business operations dependent on particular manageable entities, as depicted at step300. Typically, the impact operator146of the SIM manager140identifies the business processes150(practices) concerned and the corresponding manageable entities112which are employed by, and therefore potentially impact, the business practices. For example, a disk array host supporting a payroll application, or a server handling sales, indicate a correlation of business processes150to manageable entities112.

The configuration file132designates the determined manageable entities as manageable entities of interest by enumerating the manageable entities112, the types of events, and the direct/indirect nature of events sought in the configuration file132, as shown at step301. Note that a particular type of an event may correspond to, or indicate interest in, a number of individual events for which feedback is desired. In other words, the configuration file132lists manageable entities112which the SIM manager140perceives as affecting, or impacting, one or more business processes150. In this manner, the SIM manager140identifies a configuration of managed entities112of interest in the storage area network110.

Having the manageable entities112of interest codified in the configuration file132, the ECC server120integrates, via an adaptor160, an indication of the identified manageable entity112of interest and the triggering event114with a service impact monitor (SIM) operable to apply the manageable entity112of interest to determine affected business processes150, as depicted at step302. The adaptor160is a software interface entity which operates as an Application Programming Interface (API) to the SIM manager140from the ECC server120. Therefore, the adaptor160allows the ECC120server to communicate the events and corresponding manageable entities112to the SIM manager140for identification of the business processes150impacted by the event. As indicated above, as the SIM manager140may take the form of various software entities and/or applications, the SIM manager140receives impact analysis information indicative of affected entities144via the adaptor.

The rule engine then determines the relations136between the managed entities112of interest and other managed entities112in the storage area network110, in which the relations are indicative of an event at a managed entity having an affect on another managed entity, as depicted at step303. Typically, an event at one manageable entity112may have an indirect effect on one or more other manageable entities112. The relations132indicate this effect in an iterative “cause and effect” manner adapted to a hierarchical set of dependencies as is typical in a storage area network110. The rule engine124examines interconnections and other dependencies between the manageable entities112, and determines when a deficiency or failure of one manageable entity112has an effect on another manageable entity112.

The rule engine124, in determining the relations136, further parses the manageable entities112in the SAN110to identify managed entities112effected directly or indirectly by an event at another managed entity112, as shown at step304. Therefore, the resulting relations136are traversable to determine other manageable entities112which may be compromised or disabled by a failure of a predicate manageable entity112.

The rule engine124then stores the relations136between the manageable entities, in the manageable entity database130, as depicted at step305. The relations136are operable to be mapped in response to corresponding registered events114. In conjunction with storing the relations, the configuration file134is employed to define the events mapping134, which is an enumeration of the events to the manageable entities of interest which the specific events directly effect, or impact, as will be discussed further below upon occurrence of an event.

The server120, on behalf of the rule engine124, registers for notification of events affecting, based on the relations, the identified manageable entities112, as depicted at step306. The registration provides notification of events114stored in the event mapping134which are indicative of event occurrences directly affecting manageable entities112of interest. Therefore, registration for notification of events affecting manageable entities of interest includes identifying types of events affecting a particular manageable entity and other manageable entities of interest relative to the particular manageable entity based on the determined relations, as depicted at step307. Upon registration, the ECC server is designated to receive events occurring in the SAN which are deemed to affect manageable entities112of interest. The manageable entities112of interest are those designated by the configuration file132to be business process150sensitive, and those manageable entities which may have an indirect effect via dependencies on the manageable entities112of interest. The events mapping file134lists events114corresponding to the registrations, along with the manageable entity112experiencing (i.e. directly affected) by the event. The relations136provide the complementary indication of the manageable entities which are indirectly affected by the event, and may indicate a sequence or chain of dependencies from the direct impact manageable entity to multiple indirectly impacted manageable entities112.

Following initialization and storage of the events mapping134and the relations136based on the configuration file132, the server120receives events on behalf of the rule engine. Accordingly, at step308, the server120receives an indication of an event affecting a registered manageable entity112, and determines, via the relations136, other manageable entities112indirectly affected by the received event114. Determination of the affected manageable entities112includes traversing a mapping of events134and affected manageable entities112, as depicted at step311, and matching the received event114to the mapping of events and affected manageable entities112, thereby providing one or more manageable entities112affected by the event114, as shown at step312. Note that multiple manageable entities112may be listed in the events mapping134as directly affected by a particular event, and the manageable entities112affected subsequently increases after mapping the impact into the relations136. The rule engine then employs the directly affected manageable entity112to traverse the relations136using the manageable entity corresponding to the matching event to determine affected manageable entities, as depicted at step312.

Accordingly, determining the other manageable entities112further includes traversing the relations between managed entities from the manageable entity112from the event mapping134directly affected by the event114, as depicted at step313. In the particular exemplary implementation shown, the rule manager124employs the adapter160to retrieve the relations136. Depending upon performance and resources available, the adaptor employs one or more of a high speed cache of recently accessed relations, a main memory or disk fetch, and a net service mechanism. In the exemplary configuration shown, determination of the effected managed entities112further includes first traversing the cache162of effected managed entities112and selectively invoking the relation service164if no match is found in the cache162, as depicted at step314.

The rule engine determines if a match was found in the cache162, as depicted at step315, and if so, control passes to step319. If no match was found in the cache162, the rule engine traverses main memory of the server120for a match, as shown at step316. A check is performed, at step317, and if a match was found, control passes to step319. If no match is found in the server120main memory, the rule engine invokes a network relation service164operable to identify other managed entities effected by a particular managed entity according to the relations, as depicted at step318.

The rule engine may employ one or more of the cache162, server120main memory, and network service for identifying the relations. Further, the relations136may be predetermined for storage in server120memory, or may be determined dynamically via invocation of the network relations service164. Available server120resources and performance constraints drive the relation136traversal implementation. The outcome of step313and corresponding substeps is an aggregation of impacted manageable entities112from the traversal.

Accordingly, determining the affected managed entities further includes identifying, from the traversing, manageable entities112of interest affected by the received event114, as depicted at step319. The identified manageable entities144are then available to the SIM manager140for display to an operator146so as to ascertain the full impact of a particular event, now described with reference to a specific example inFIG. 8.

FIG. 7is an example of configuring and processing an event occurrence according to the event impact analysis mechanism as described herein. Referring toFIGS. 8 and 3, an exemplary configuration101is shown, including a server X, switch Y, port Z, and fiber adapter A, all supporting an exemplary host112-4. The configuration includes a plurality of manageable entity types118, including hosts118-1, servers118-2, switches118-3, ports118-4, and fiber adapters118-5, arranged in a hierarchical dependency, partially illustrated for space convenience. The actual “fan out” of an operational managed information network is likely to be substantial. The event mapping134, such as a file or other storage medium, includes the mappings134-1. . .134-3. The relations136include exemplary relations136-1. . .136-5, as will now be discussed in further detail.

In the exemplary configuration101shown, the configuration file132specifies, inter alia, an interest in servers112-2for events of type E1. As indicated above, in the exemplary configuration, the rule engine124computes the event mappings134and the relations136from the interconnectivity of the manageable entities (objects)112in the configuration101and the entities112of interest from the configuration file132. The rule engine124determines that an event of type E1may directly affect fiber adapter A, and accordingly, the corresponding event mapping134includes an entry134-1corresponding to fiber adapter as affected by event E1. Further, the interconnectivity of the configuration101indicates a relation136-1from fiber adapter A to port Z, another relation136-2from port Z to switch Y, and a relation136-3from switch Y to server X, as shown in the relations136.

The rule engine132, in the exemplary configuration, computes the event mappings134and relations136, from the configuration file132and the configuration101interconnections upon startup. The server120registers for notification of events of interest based on the mappings134and relation136. Therefore, the rule engine124may map the registered events114to affected manageable entities112upon occurrence. Alternate configurations may compute relations dynamically and/or employ alternate event notification and mapping mechanisms.

The relations and events, in the particular exemplary arrangement, take the form of a service model structure, operable to be codified as a data structure and instantiated as an object according to an implementation language such as C++, XML, Java, and others as is known to those of skill in the art. The indication of affected entities144sent from the server120to the SIM manager140takes the form of the service model. The service model as described herein is further operable to store the event mapping134and the relations136, in whole or in portions corresponding to particular manageable entities, for processing in the rule engine124. Further the service model data and/or portions thereof are operable for storage in the ME database for storing the event mapping134and the relations136data, as described above.

In particular, in an exemplary object oriented implementation platform such as C++, the service model is a class, and includes one or more enumerations of the relations136, in the form of objects, properties, and relations, and enumerations of the event mapping134, including a definition and affected objects corresponding to the event. Alternate implementations may employ other object and data structures.

The event impact analysis and reporting mechanism disclosed herein may encompass a variety of alternate deployment environments. In a particular configuration, as indicated above, the exemplary SAN management application discussed may be the EMC Control Center (ECC) application, marketed commercially by EMC corporation of Hopkinton, Mass., assignee of the present application.

While the system and method for event impact analysis and reporting has been particularly shown and described with references to embodiments thereof, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the scope of the invention encompassed by the appended claims. Accordingly, the present invention is not intended to be limited except by the following claims.