System and method for retrieving and analyzing data from a variety of different sources

A flexible, extensible, uniform, and efficient framework for retrieving and analyzing data from a number of different data sources is disclosed. Instructions for retrieving and analyzing data are provided in a configuration file that is defined in a common format irrespective of the different data sources. The configuration file is submitted to a dispatcher, which uses the information therein to dispatch a number of data source collectors. Each such data source collector is unique to a corresponding data source and is able to formulate an efficient method for retrieving the necessary data from its corresponding data source. An analyzer then analyzes the retrieved data according to the instructions in the configuration file.

FIELD OF THE INVENTION

The present invention relates to the field of data retrieval and analysis, and, more specifically, to retrieving and analyzing data from a variety of different data sources with potentially different addressing and access protocols.

BACKGROUND OF THE INVENTION

Complex distributed applications typically store configuration information in a variety of different data sources. For example, Microsoft® Exchange Server from MICROSOFT Corp. of Redmond, Wash. is a messaging platform that accesses configuration data from a number of external sources. A common external source is the Active Directory® also from the above mentioned MICROSOFT Corp. The Active Directory stores Exchange Server configuration information such as definitions of administrative groups, routing groups, configuration settings for protocol virtual servers, and the like. Another common external source is Internet Information Services (IIS), a web server also from the above mentioned MICROSOFT Corp. IIS stores configuration data in its IIS metabase store. Yet another common external source is Windows® Management Instrumentation (WMI), a web based enterprise management (WBEM) application also from the above mentioned MICROSOFT Corp. WMI provides information about the configuration and state of Exchange Servers. In addition to these and other external sources, configuration information for Exchange Server may be stored in the Windows® Registry also from the above mentioned MICROSOFT Corp.

The configuration data within each of these different external sources is typically addressed and accessed in a variety of different ways. For example, the Active Directory is structured as a hierarchy of objects. Such objects may be, for example, mailboxes, distribution lists, servers, configuration objects, and the like. Each object contains attributes in which information about that object is stored. Objects may be container objects, meaning that they contain other objects, or they may be leaf objects, in which case they do not contain other objects. Data for Active Directory objects may be accessed using, for example, Lightweight Directory Access Protocol (LDAP), which is a directory service protocol that runs directly over the TCP/IP stack. WMI objects, on the other hand, may be represented as hierarchical lists of objects that have properties and methods and may also be selected using the WMI query language, which is similar in structure to the SQL query language. Still other various addressing schemes and access protocols may be employed for the IIS metabase and the Registry.

Applications such as Exchange Server may often pull configuration data from these different sources and execute a rule set on the data to determine its validity. A drawback of this process is that, because the data within each of the sources is potentially addressed and accessed differently, a number of different methods may be required to retrieve the data. The formulation and execution of these methods may be a time consuming and tedious process that delays the configuration and/or setup of the application and diverts valuable development time human resources. For example, to pull configuration information from both the Active Directory and the WMI source, it may be necessary to generate both a separate set of LDAP queries and a separate set of WMI queries in accordance with the addressing schemes and access protocols of each of the data sources. Additionally, a number of different rules may need to be employed to analyze each of the retrieved data sets. Accordingly, there is a need in the art for systems and methods for retrieving and analyzing data from a number of different sources.

SUMMARY OF THE INVENTION

The present invention provides a flexible, extensible, uniform, and efficient framework for retrieving and analyzing data from a number of different data sources. Instructions for retrieving and analyzing data are provided in a configuration file, which is defined in a common format irrespective of the different address schemes and access protocols of the different data sources. The configuration file is submitted to a dispatcher, which uses the information therein to dispatch a number of data source collectors. Each such data source collector is unique to a corresponding data source and is able to formulate an efficient method for retrieving the necessary data from its corresponding data source. The retrieved data from the different sources and corresponding rules for analyzing the data are then compiled in a data file that is passed to an analyzer. The analyzer evaluates each of the rules based on the retrieved data and may output the results to a portable analysis file.

DETAILED DESCRIPTION OF ILLUSTRATIVE EMBODIMENTS

A block diagram of an exemplary system for retrieving and analyzing data in accordance with the present invention is shown inFIG. 1. Generally, engine100enables the retrieval and analysis of data from one or more data sources109a-n. Engine100may be used in connection with application117, which may be, for example, Exchange Server. Engine100may, for example, be used to retrieve and analyze configuration data associated with application117. Engine100, however, is not limited to use with configuration data and the retrieval and analysis of any type of data irrespective of its content is contemplated in accordance with the present invention.

Instructions for retrieving and analyzing data from data sources109a-nare provided in a configuration file101. Configuration file101may be defined in a programming language such as extensible markup language (XML). Configuration file101is defined in a common format irrespective of the potentially different address schemes and accessing protocols of data sources109a-n. Generally, configuration file101defines four sets of primary elements: a set of one or more objects, a set of one or more object processors, a set of one or more settings within each object, and a set of one or more rules. Configuration file101may also define other elements if necessary.

Each object element identifies a collection of data to be retrieved from a data source109. Each object element may represent a particular container within a data source109or any generic collection of data. Each object element may have a set of corresponding object attributes that define the object. One such object attribute may be an object type attribute that identifies a type of data source in which the object is stored. For example, for data that is stored in an LDAP server, the object may be an LDAP type. Other object attributes may, for example, identify a start node from which to begin a search. The object attributes may also define a “scope” of a search, which may be a quantity of levels, nodes, or sub-trees in which to execute a search. The object attributes may also define a “filter”, which identifies a particular search criteria. For example, a filter may be used to limit a search to a class of objects associated with application117.

In addition to a set of object elements, configuration file101includes a set of one or more object processor elements. Each such object processor element corresponds to a particular object type of one or more of the object elements in configuration file101. For example, one or more LDAP type object elements will map to a single LDAP object processor. The object processor element maps its corresponding object type to a method that is capable of processing it. An object processor may be, for example, a string representing a C# class. For each object element, configuration file101also includes a set of one or more setting elements that are nested within the object. The settings represent any generic sub-set of the object and may identify specific properties of the object or specific operations to be performed. Finally, configuration file101includes a set of rule elements. The rule elements are nested within setting elements and identify the analysis to be performed upon the corresponding settings. The rules may, for example, use XPath statements to reference the data retrieved for the corresponding settings.

Configuration file101is submitted to dispatcher103, which reads the configuration file101and performs a number of operations based on the information therein. First, dispatcher103loads each object processor specified in configuration file101. Dispatcher103then proceeds to sequentially process each object specified in configuration file101. To process an object, dispatcher103dispatches one of the data source collectors (DSC's)107a-nthat corresponds to the object's type. For example, for an LDAP object, dispatcher103will dispatch an LDAP DSC. Upon dispatching the DSC107, dispatcher103will forward the object element and its included set of one or more settings and rules to the DSC107.

Each DSC107is unique to a particular data source109and is capable of formulating a method for retrieving data for the object from its corresponding data source109. Such a method will typically involve generating a query that is formatted for the particular corresponding data source109. For example, an LDAP DSC is capable of generating LDAP queries, while a WMI DSC is capable of generating WMI queries. Upon retrieving the data for the object, DSC107may create a set of zero or more instances that match the data. For each instance, DSC107may copy over the settings elements for the original object and retrieve the data for the specified settings. The rule elements are also be copied over and put into each instance but they are not evaluated by DSC107. The DSC107will then pass the retrieved data back to the dispatcher103. The retrieved data may be passed back as an XML fragment.

Upon receiving the retrieved data and the corresponding rules from the DSC107, dispatcher103writes the retrieved data and the corresponding rules to data file111, which may also be an XML file. Dispatcher103then proceeds to recursively process the remaining objects within configuration file101. Once all the objects have been processed, dispatcher103submits the completed data file111to analyzer113. Analyzer113reads data file111and evaluates each rule element based on the retrieved data. Analyzer113may then generate an analysis file115, which includes the retrieved data as well as any issues found based on the rules that were fired. The resulting analysis file115may be also an XML file and may be completely portable.

According to an embodiment of the invention, any of the settings within configuration file101may have an associated substitution attribute. The substitution attribute is a variable that is set to the value of the data retrieved for the corresponding setting. An advantageous feature of the substitution attribute is that any of the other settings or objects within configuration file101may reference the substitution attribute. A substitution is then performed for each other referencing setting or object, meaning that the value of the data retrieved for that referencing setting or object is replaced with the value of the substitution attribute. These substitutions may be performed by dispatcher103just prior to writing the data for the referencing settings or objects to the data file111. Thus, the data within data file111will include the substituted data values rather than the original data values. The substituted value may and typically will be different for each instance of the object.

A flowchart of an exemplary method for retrieving and analyzing data in accordance with the present invention is shown inFIG. 2. At act210, dispatcher103reads configuration file101. As set forth above, configuration file101may be an XML file and may define a set of four primary sets of elements including set a of one or more objects, a set of one or more object processors, a set of one or more settings within each object, and a set of one or more rules for analyzing the data to be retrieved.

At act212, dispatcher103loads the object processors identified in configuration file101. Each object processor corresponds to a particular object type. If multiple object types are included in configuration file101, then multiple object processors may be loaded at act210. If multiple objects of the same object type are included in configuration file101, then only a single object processor may be loaded for those objects.

After loading the object processors, each object in configuration file101is sequentially processed. At act214, dispatcher103selects a first object for processing. At act216, dispatcher103locates and dispatches one of DSC's107a-nthat corresponds to the selected object's type, which may be specified in configuration file101using an object type attribute associated with the corresponding object element. At act218, dispatcher103submits the object element and its included set of one or more settings and rules to the dispatched DSC107.

At act218, the DSC107retrieves the data corresponding to the object from its corresponding data source109. To retrieve the data, DSC107must formulate a retrieval method that is formatted to the particular addressing schemes and access protocols of the data source109. As set forth above, such a method will typically involve generating a query that is formatted for the particular data source109. Upon retrieving the data for the object, at act222, DSC107generates a set of zero or more instances that match the data. At act224, The DSC107will then pass the retrieved data and the corresponding rules back to the dispatcher103. The retrieved data may be passed back as an XML fragment.

Upon receiving the retrieved data and the corresponding rules from the DSC107, at act226, dispatcher103writes the retrieved data and the corresponding rules to data file111, which may also be an XML file. For any settings retrieved that have substitutions specified, dispatcher103may fill in those substitutions at this time. Also, for all other objects and settings that reference the substitution, dispatcher103may at this time replace the attribute values of those referencing objects and settings with the actual value of the substitution.

Dispatcher103then proceeds to recursively process the remaining objects within configuration file101. If, at act228, there are still remaining unprocessed objects in the configuration101, then, at act230, dispatcher103sets one of those remaining objects to be the new selected object for processing and the method returns to act216for processing the new selected object. If, on the other hand, all objects in configuration file101have been processed, then, at act232, the completed data file111is submitted to analyzer113. At act234, analyzer113reads data file111and evaluates each rule element based on the retrieved data, and, at act236, analyzer113generates the resulting analysis file115.

Accordingly, as set forth above with reference to the exemplary systems and methods ofFIGS. 1 and 2, the present invention provides a flexible, extensible, uniform, and efficient framework for retrieving and analyzing data from a number of different data sources. As is apparent from the above, all or portions of the various systems, methods, and aspects of the present invention may be embodied in hardware, software, or a combination of both. When embodied in software, the methods and apparatus of the present invention, or certain aspects or portions thereof, may be embodied in the form of program code (i.e., instructions). This program code may be stored on a computer-readable medium, such as a magnetic, electrical, or optical storage medium, including without limitation a floppy diskette, CD-ROM, CD-RW, DVD-ROM, DVD-RAM, magnetic tape, flash memory, hard disk drive, or any other machine-readable storage medium, wherein, when the program code is loaded into and executed by a machine, such as a computer or server, the machine becomes an apparatus for practicing the invention. A computer on which the program code executes will generally include a processor, a storage medium readable by the processor (including volatile and non-volatile memory and/or storage elements), at least one input device, and at least one output device. The program code may be implemented in a high level procedural or object oriented programming language. Alternatively, the program code can be implemented in an assembly or machine language. In any case, the language may be a compiled or interpreted language.

The present invention may also be embodied in the form of program code that is transmitted over some transmission medium, such as over electrical wiring or cabling, through fiber optics, over a network, including a local area network, a wide area network, the Internet or an intranet, or via any other form of transmission, wherein, when the program code is received and loaded into and executed by a machine, such as a computer, the machine becomes an apparatus for practicing the invention.

When implemented on a general-purpose processor, the program code may combine with the processor to provide a unique apparatus that operates analogously to specific logic circuits.

Moreover, the invention can be implemented in connection with any computer or other client or server device, which can be deployed as part of a computer network, or in a distributed computing environment. In this regard, the present invention pertains to any computer system or environment having any number of memory or storage units, and any number of applications and processes occurring across any number of storage units or volumes, which may be used in connection with the present invention. The present invention may apply to an environment with server computers and client computers deployed in a network environment or distributed computing environment, having remote or local storage. The present invention may also be applied to standalone computing devices, having programming language functionality, interpretation and execution capabilities for generating, receiving and transmitting information in connection with remote or local services.

Distributed computing facilitates sharing of computer resources and services by exchange between computing devices and systems. These resources and services include, but are not limited to, the exchange of information, cache storage, and disk storage for files. Distributed computing takes advantage of network connectivity, allowing clients to leverage their collective power to benefit the entire enterprise. In this regard, a variety of devices may have applications, objects or resources that may implicate processing performed in connection with the present invention.

FIG. 3provides a schematic diagram of an exemplary networked or distributed computing environment. The distributed computing environment comprises computing objects10a,10b, etc. and computing objects or devices110a,110b,110c, etc. These objects may comprise programs, methods, data stores, programmable logic, etc. The objects may comprise portions of the same or different devices such as PDAs, televisions, MP3 players, personal computers, etc. Each object can communicate with another object by way of the communications network14. This network may itself comprise other computing objects and computing devices, and may itself represent multiple interconnected networks. In accordance with an aspect of the invention, each object10a,10b, etc. or110a,110b,110c, etc. may contain an application that might make use of an API, or other object, software, firmware and/or hardware, to request use of the processes used to implement the present invention.

It can also be appreciated that an object, such as110c, may be hosted on another computing device10a,10b, etc. or110a,110b, etc. Thus, although the physical environment depicted may show the connected devices as computers, such illustration is merely exemplary and the physical environment may alternatively be depicted or described comprising various digital devices such as PDAs, televisions, MP3 players, etc., software objects such as interfaces, COM objects and the like.

There are a variety of systems, components, and network configurations that support distributed computing environments. For example, computing systems may be connected together by wired or wireless systems, by local networks or widely distributed networks. Currently, many of the networks are coupled to the Internet, which provides the infrastructure for widely distributed computing and encompasses many different networks. Any of the infrastructures may be used for exemplary communications made incident to the present invention.

The Internet commonly refers to the collection of networks and gateways that utilize the TCP/IP suite of protocols, which are well-known in the art of computer networking. TCP/IP is an acronym for “Transmission Control Protocol/Internet Protocol.” The Internet can be described as a system of geographically distributed remote computer networks interconnected by computers executing networking protocols that allow users to interact and share information over the network(s). Because of such wide-spread information sharing, remote networks such as the Internet have thus far generally evolved into an open system for which developers can design software applications for performing specialized operations or services, essentially without restriction.

Thus, the network infrastructure enables a host of network topologies such as client/server, peer-to-peer, or hybrid architectures. The “client” is a member of a class or group that uses the services of another class or group to which it is not related. Thus, in computing, a client is a process, i.e., roughly a set of instructions or tasks, that requests a service provided by another program. The client process utilizes the requested service without having to “know” any working details about the other program or the service itself. In a client/server architecture, particularly a networked system, a client is usually a computer that accesses shared network resources provided by another computer, e.g., a server. In the example ofFIG. 3, computers110a,110b, etc. can be thought of as clients and computer10a,10b, etc. can be thought of as servers, although any computer could be considered a client, a server, or both, depending on the circumstances. Any of these computing devices may be processing data in a manner that implicates the invention.

A server is typically a remote computer system accessible over a remote or local network, such as the Internet. The client process may be active in a first computer system, and the server process may be active in a second computer system, communicating with one another over a communications medium, thus providing distributed functionality and allowing multiple clients to take advantage of the information-gathering capabilities of the server. Any software objects utilized pursuant to the invention may be distributed across multiple computing devices.

Client(s) and server(s) may communicate with one another utilizing the functionality provided by a protocol layer. For example, Hypertext Transfer Protocol (HTTP) is a common protocol that is used in conjunction with the World Wide Web (WWW), or “the Web.” Typically, a computer network address such as an Internet Protocol (IP) address or other reference such as a Universal Resource Locator (URL) can be used to identify the server or client computers to each other. The network address can be referred to as a URL address. Communication can be provided over any available communications medium.

Thus,FIG. 3illustrates an exemplary networked or distributed environment, with a server in communication with client computers via a network/bus, in which the present invention may be employed. The network/bus14may be a LAN, WAN, intranet, the Internet, or some other network medium, with a number of client or remote computing devices110a,110b,110c,110d,110e, etc., such as a portable computer, handheld computer, thin client, networked appliance, or other device, such as a VCR, TV, oven, light, heater and the like in accordance with the present invention.

In a network environment in which the communications network/bus14is the Internet, for example, the servers10a,10b, etc. can be servers with which the clients110a,110b,110c,110d,110e, etc. communicate via any of a number of known protocols such as HTTP. Servers10a,10b, etc. may also serve as clients110a,110b,110c,110d,110e, etc., as may be characteristic of a distributed computing environment.

Communications may be wired or wireless, where appropriate. Client devices110a,110b,110c,110d,110e, etc. may or may not communicate via communications network/bus14, and may have independent communications associated therewith. For example, in the case of a TV or VCR, there may or may not be a networked aspect to the control thereof. Each client computer110a,110b,110c,110d,110e, etc. and server computer10a,10b, etc. may be equipped with various application program modules or objects135and with connections or access to various types of storage elements or objects, across which files or data streams may be stored or to which portion(s) of files or data streams may be downloaded, transmitted or migrated. Any computer10a,10b,110a,110b, etc. may be responsible for the maintenance and updating of a database, memory, or other storage element20for storing data processed according to the invention. Thus, the present invention can be utilized in a computer network environment having client computers110a,10b, etc. that can access and interact with a computer network/bus14and server computers10a,10b, etc. that may interact with client computers110a,110b, etc. and other like devices, and databases20.

FIG. 4and the following discussion are intended to provide a brief general description of a suitable computing device in connection with which the invention may be implemented. For example, any of the client and server computers or devices illustrated inFIG. 3may take this form. It should be understood, however, that handheld, portable and other computing devices and computing objects of all kinds are contemplated for use in connection with the present invention, i.e., anywhere from which data may be generated, processed, received and/or transmitted in a computing environment. While a general purpose computer is described below, this is but one example, and the present invention may be implemented with a thin client having network/bus interoperability and interaction. Thus, the present invention may be implemented in an environment of networked hosted services in which very little or minimal client resources are implicated, e.g., a networked environment in which the client device serves merely as an interface to the network/bus, such as an object placed in an appliance. In essence, anywhere that data may be stored or from which data may be retrieved or transmitted to another computer is a desirable, or suitable, environment for operation of the object persistence methods of the invention.

Although not required, the invention can be implemented via an operating system, for use by a developer of services for a device or object, and/or included within application or server software that operates in accordance with the invention. Software may be described in the general context of computer-executable instructions, such as program modules, being executed by one or more computers, such as client workstations, servers or other devices. Generally, program modules include routines, programs, objects, components, data structures and the like that perform particular tasks or implement particular abstract data types. Typically, the functionality of the program modules may be combined or distributed as desired in various embodiments. Moreover, the invention may be practiced with other computer system configurations and protocols. Other well known computing systems, environments, and/or configurations that may be suitable for use with the invention include, but are not limited to, personal computers (PCs), automated teller machines, server computers, hand-held or laptop devices, multi-processor systems, microprocessor-based systems, programmable consumer electronics, network PCs, appliances, lights, environmental control elements, minicomputers, mainframe computers and the like.

FIG. 4thus illustrates an example of a suitable computing system environment400in which the invention may be implemented, although as made clear above, the computing system environment400is only one example of a suitable computing environment and is not intended to suggest any limitation as to the scope of use or functionality of the invention. Neither should the computing environment400be interpreted as having any dependency or requirement relating to any one or combination of components illustrated in the exemplary operating environment400.

The drives and their associated computer storage media discussed above and illustrated inFIG. 4provide storage of computer readable instructions, data structures, program modules and other data for the computer110. InFIG. 4, for example, hard disk drive141is illustrated as storing operating system144, application programs145, other program modules146and program data147. Note that these components can either be the same as or different from operating system134, application programs135, other program modules136and program data137. Operating system144, application programs145, other program modules146and program data147are given different numbers here to illustrate that, at a minimum, they are different copies. A user may enter commands and information into the computer110through input devices such as a keyboard162and pointing device161, such as a mouse, trackball or touch pad. Other input devices (not shown) may include a microphone, joystick, game pad, satellite dish, scanner, or the like. These and other input devices are often connected to the processing unit120through a user input interface160that is coupled to the system bus121, but may be connected by other interface and bus structures, such as a parallel port, game port or a universal serial bus (USB). A graphics interface182may also be connected to the system bus121. One or more graphics processing units (GPUs)184may communicate with graphics interface182. A monitor191or other type of display device is also connected to the system bus121via an interface, such as a video interface190, which may in turn communicate with video memory186. In addition to monitor191, computers may also include other peripheral output devices such as speakers197and printer196, which may be connected through an output peripheral interface195.

CONCLUSION