The present approach relates to event monitoring and management of an instance using a generated service map, allowing monitoring of CIs (e.g., applications) and connections that are currently active in a user's specific instance. A self-monitoring solution is generated for a user (e.g., via an application) that depicts status, configuration, and errors related to the user's instance. In certain implementations, the present techniques involve applying internal knowledge of the working of a user's instance and applications to perform the self-monitoring, and determine when an alert should be generated. Further, the present techniques may involve making a determination to provide a user with a self-help solution in addition or based on the self-monitoring of the user's instance.

BACKGROUND

Computer resources hosted in distributed computing (e.g., cloud-computing) environments may be disparately located with different resources potentially having their own functions, properties, and/or permissions. Such resources may include hardware resources (e.g. computing devices, switches, etc.) and software resources (e.g. database applications). These resources may be used to collect and store data at various times related to a variety of measurable properties, including network, hardware, or database performance properties measured at different times. As networks become more complex, network maintenance and management becomes a more resource intensive task.

SUMMARY

With this in mind, an IT system may include service mapping logic that generates an accurate, service-aware view (e.g., a “service mapping”) of the system infrastructure that is frequently refreshed, keeping the view up to date. The service mapping may be constructed by discovering and mapping relationships between IT components running specific services, such as in a given instance. The service mapping logic may monitor the IT infrastructure for service-affecting changes and update the service mapping in real-time. The service mapping may provide a mix of applications and IT components that support a service provided in an instance and may provide an understanding of how these applications and components are related.

The disclosed techniques enable a user to better maintain and manage a network of components. Specifically, the disclosed techniques enable a user to diagnose issues within their networks so as to allow the user to address errors that arise during operation of a computer system. Service mapped configuration items (CIs) and connections within a network are monitored for their performance. In certain aspects, the performance of a device or application may be measured in terms of Key Performance Indicators (KPIs). From the KPIs or from other monitored states or configuration data, automated routines can make determinations as to the performance of the network, such as performance of an executing job or piece of code. Based on these determinations, one or more automated processes may determine if a self-help solution displayed and implemented at the local level will be provided or if an external resource, such as a call center or field service personnel, will be implemented.

DETAILED DESCRIPTION OF SPECIFIC EMBODIMENTS

Information Technology (IT) is increasingly important in an electronics-driven world in which enterprises and other organizations utilize computers to conduct operations and help run their organizations. However, hardware and software resources used by organizations may take a significant time investment for users to set up, learn to operate, and trouble shoot. Typically, trouble shooting involves browsing frequently asked questions (FAQ), opening incidents online, and contacting support/service agents. This results in reduced efficiency for software resource customers as users spend a substantial amount of time looking for solutions through external resources instead of performing their usual tasks. Development of applications to facilitate support with the customer can greatly reduce downtime.

Servicing Mapping generates comprehensive maps of CIs such as devices, applications, and configuration profiles within a network. A map of CIs within a network facilitates monitoring of the communication between CIs. Monitoring may be performed in some instances by measuring various Key Performance Indicators (KPIs). KPIs are defined performance analytic measurements that may include, but are not limited to, elapsed time of communication between CIs, elapsed run time of jobs, connection time outs, and so forth. If a KPI or other measured operational parameter of a CI is above or below a threshold, an event is triggered. Events may be identified by various characteristics such as source, type, node, resource, event class, and message key. Alert rules may be in place that turn an event into an alert if a characteristic or measured KPI crosses a specified threshold, and thus signify more immediate action needs to be taken by a user to resolve the issue. In the present context, such events, whether rising to the level of alerts or not, are handled by automated routines at a local level (e.g., client site) that automatically provide either a self-help process by which a local user at the site may take action to address the event or contact an external resource (e.g., call center, field agent dispatch, and so forth) to address the event.

With the preceding in mind,FIG. 1is a block diagram of a system100that utilizes distributed computing and that may be used in conjunction with the approaches discussed herein for providing customer service. As illustrated, one or more clients102communicate with a platform (e.g., a cloud service)104over a communication channel106. Each client102may include any suitable computing system, such as a mobile phone, a tablet computer, a laptop computer, a notebook computer, a desktop computer, or any other suitable computing device or combination of computing devices. Each client102may include client application programs running on the computing devices.

The platform (e.g., a cloud service)104may include any suitable number of computing devices (e.g., computers) in one or more locations that are connected together using one or more networks. For instance, the platform104may include various computers acting as servers in datacenters at one or more geographic locations where the computers are connected together using network and/or Internet connections. The communication channel106may include any suitable communication mechanism for electronic communication between each client102and the platform104. The communication channel106may incorporate local area networks (LANs), wide area networks (WANs), virtual private networks (VPNs), cellular networks (e.g., long term evolution networks), and/or other network types for transferring data between the client102and the platform104. For example, the communication channel106may include an Internet connection when the client102is not on a local network common with the platform104. Additionally or alternatively, the communication channel106may include network connection sections when the client and the platform104are on different networks or entirely using network connections when the client102and the platform104share a common network. Although only four clients102are shown connected to the platform104in the depicted example, it should be noted that platform104may connect to any number of clients (e.g., tens, hundreds, or thousands of clients).

Through the platform104, the client102may connect to various devices with various functionality, such as gateways, routers, load balancers, databases, application servers running application programs on one or more nodes, or other devices that may be accessed via the platform104. For example, the client102may connect to an application server107and/or a database (DB)108via the platform104. The application server107may include any computing system, such as a desktop computer, laptop computer, server computer, and/or any other computing device capable of providing functionality from an application program to the client102. The application server107may include one or more application nodes running application programs whose functionality is provided to the client via the platform104.

The DB108may include a configuration management database (CMDB) that includes a series of tables containing information about assets and services controlled by a client102and the configurations of these assets and services. The assets and services may include records of computers, other devices on a network (or group of networks), software contracts and/or licenses, enterprise services; hardware resources, such as server computing devices, client computing devices, processors, memory, storage devices, networking devices, or power supplies; software resources, such as instructions executable by the hardware resources including application software or firmware; virtual resources, such as virtual machines or virtual storage devices; and/or storage constructs such as data files, data directories, or storage models.

Additional to or in place of the DB108, the platform104may include one or more other database servers. The database servers are configured to store, manage, or otherwise provide data for delivering services to the client102over the communication channel106. The database server includes one or more databases (e.g., DB108) that are accessible by the application server107, the client102, and/or other devices external to the databases. In some embodiments, more than a single database server may be utilized. Furthermore, in some embodiments, the platform104may have access to one or more databases external to the platform104entirely.

Access to the platform104is enabled by a server126via a communication channel128. The server126may include an application program (e.g., Java application) that runs as a service (e.g., Windows service or UNIX daemon) that facilitates communication and movement of data between the platform104and external applications, data sources, and/or services. The server126may be implemented using a computing device (e.g., server or computer) on the network112that communicates with the platform104.

The application servers107may store content accessible by one or more users via one of the clients. For example, the application server107may store one or more pages (e.g., Community pages, knowledge management pages, customer service management pages, and so forth) with which one or more of the users may interact (e.g., view, post, etc.) with other users and/or customer service agents. As a result, users may use the pages to resolve issues that arise through installation, expansion, maintenance, and regular use of the network, either on their own, or with the help of a customer service agent.

FIG. 2is a schematic of an embodiment of a multi-instance architecture150that may be utilized by the distributed computing system100ofFIG. 1. As shown, one or more clients102are connected to a customer network152, which may or may not be protected by a firewall154. The one or more clients102may access first and second virtual machines158,160via the Internet156. In the illustrated embodiment, the first virtual machine158is a primary virtual machine158and the second virtual machine160is a secondary virtual machine. The primary and secondary virtual machines158,160are disposed in different data centers. Other embodiments may include more than two virtual machines (e.g., multiple secondary virtual machines). As shown, each of the virtual machines158,160includes at least one load balancer162, multiple application nodes164, and a DB108. In the illustrated embodiment, the database108of the primary virtual machine158is read-write and the database108of the secondary virtual machine160is read-only. The databases108are replicated via MySQL binlog replication for near real-time replication between the primary database108and the secondary database108. As shown, the application nodes164of the primary virtual machine158may access the primary database108, while the applications nodes164of the secondary virtual machine160may access both the primary database108and the secondary database.

Each customer may have its own dedicated virtual machines158,160and database processes. Further, full and incremental backups may be scheduled as the customer wishes (e.g., daily, weekly, bi-weekly, monthly, etc.). The multi-instance architecture150results in full instance redundancy for all production instances with near real time replication and no comingling of data between customers.

FIG. 3generally illustrates a block diagram of an embodiment of an internal configuration of a computing device200. With respect toFIGS. 1-3, the computing device200may be an embodiment of the client102, the application server107, a database server (e.g., DB108), other servers in the platform104(e.g., server hosting the communication channel128), and/or a device running the server126. These devices may include a computing system that includes multiple computing devices and/or a single computing device, such as a mobile phone, a tablet computer, a laptop computer, a notebook computer, a desktop computer, a server computer, and/or other suitable computing devices.

As illustrated, the computing device200may include various hardware components. For example, the device includes one or more processors202, one or more busses204, memory206, input structures208, a power source210, a network interface212, a user interface214, and/or other computer components useful in performing the functions described herein.

The one or more processors202may include a processor capable of performing instructions stored in the memory206. For example, the one or more processors may include microprocessors, system on a chips (SoCs), or any other circuitry capable of performing functions by executing instructions, such as instructions stored in the memory206. Additionally or alternatively, the one or more processors202may include application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), and/or other devices that may perform the functions discussed herein without calling instructions from the memory206. Moreover, the functions of the one or more processors202may be distributed across multiple processors in a single physical device or in multiple processors in more than one physical device. The one or more processors202may also include specialized processors, such as a graphics processing unit (GPU).

The one or more busses204includes suitable electrical channels to provide data and/or power between the various components of the computing device. For example, the one or more busses204may include a power bus from the power source210to the various components of the computing device. Additionally, in some embodiments, the one or more busses204may include a dedicated bus among the one or more processors202and/or the memory206.

The memory206may include any tangible, non-transitory, and computer-readable storage media. For example, the memory206may include volatile memory, non-volatile memory, or any combination thereof. For instance, the memory206may include read-only memory (ROM), randomly accessible memory (RAM), disk drives, solid state drives, external flash memory, or any combination thereof. Although shown as a single block inFIG. 2, the memory206can be implemented using multiple physical units in one or more physical locations. The one or more processor202accesses data in the memory206via the one or more busses204.

The input structures208provide structures to input data and/or commands to the one or more processor202. For example, the input structures208include a positional input device, such as a mouse, touchpad, touchscreen, and/or the like. The input structures208may also include a manual input, such as a keyboard and the like. These input structures208may be used to input data and/or commands to the one or more processors202via the one or more busses204. The input structures208may also monitor operating conditions (e.g., temperatures) of various components of the computing device200, such as the one or more processors202.

The power source210can be any suitable source for power of the various components of the computing device200. For example, the power source210may include line power and/or a battery source to provide power to the various components of the computing device200via the one or more busses204.

The network interface212is also coupled to the processor202via the one or more busses204. The network interface212includes one or more transceivers capable of communicating with other devices over one or more networks (e.g., the communication channel106). The network interface may provide a wired and/or wireless network interface. Moreover, the computing device200may communicate with other devices via the network interface212using one or more network protocol.

A user interface214may include a display that is configured to display images transferred to it from the one or more processors202. In addition to and/or alternative to the display, the user interface214may include other devices for interfacing with a user. For example, the user interface214may include lights (e.g., LEDs), speakers, haptic feedback, and the like.

The present disclosure is directed towards monitoring the performance of an instance using a generated service map, allowing monitoring of CIs (e.g., applications) and connections that are currently active in a user's specific instance. A self-monitoring solution is generated for a user (e.g., via an application) that depicts status, configuration, and errors related to the user's instance. A user may add monitors and modeling to any existing or custom application components and processes. Additionally, the present techniques involve applying internal knowledge of the working of a user's instance and applications to perform the self-monitoring, and determine when an alert should be generated. Further, the present techniques involve making a determination to provide a user with a self-help solution in addition or based on the self-monitoring of the user's instance.

As discussed herein, a user may use a computing device200to access various components of a customer service architecture in order to resolve issues within that architecture. In conventional approaches, a user might submit a request for service based on an error code, contact a service representative, or search online for solutions to an issue. In certain instances it might be preferable for a user to resolve an issue themselves.FIG. 4is a diagram of aspects of an event management250model in accordance with an embodiment of the present approach. By way of example, the depicted event management model may be implemented as part of a configuration management database (CMDB) as an event management service250provided as a manual service and as a CMDB class derived from a given application and having properties such as a connectors252, event processing254, and alert processing256. In addition, the event management model may include a table (shown below with respect toFIG. 5) related to scripts to be executed as part of an event monitoring for a given job, application, or piece of executable code. For example, a script table as discussed herein may have fields corresponding to a job or script name, description of the script, the script code itself, and an active/not active field. Other relied upon tables (shown inFIG. 5) may relate to monitoring a configuration and/or a state of the job or code execution environment. Thus, a configuration and state monitor table may be provided as one or as separate tables having fields such as monitored parameter name, description, active/not active, first threshold (e.g., event threshold), second threshold (e.g., alert threshold), frequency, last run, last value, last status, additional information, to be reported, and so forth).

A typical event management system receives event indications through any protocol for sending events, including, but not limited to, MID servers, REST, connectors using APIs, SNMP trap, email, etc.). As these events occur, certain embodiments might involve a MID server sending the events to an external support center (e.g., a data center or remote monitoring site). Event management generates events, applies rules (i.e., determining how an event becomes an alert), and prioritizes events or alerts for remediation. In the depicted model, event management250may include monitoring event connectors252and generating events or alerts as appropriate based on the monitored parameters and appropriate event generation scripts. In certain embodiments, monitoring event connectors252may involve monitoring the current status (success/error) of an event connector252, monitoring a delay associated with the event connector252, or monitoring an elapsed time (e.g., last run time), and determining whether each monitored action is above or below a threshold.

FIG. 5is a flow chart of an event generation system300in accordance with certain embodiments. In general, a job302is executed on a computer system, either as part of a routine or automated process or in response to a user input. In certain embodiments, a job302might be running an application, initializing a connection with a CI, transmitting data to a CI, or retrieving data from a CI. For every job, there is one or more associated script304. Each script304, when executed, is configured to determine an event output based on a monitored configuration and state of a CI or other network or system parameter. Scripts304for each job302are stored in a script table306or list which is stored on the CMDB and a corresponding script or scripts304is retrieved from the script list306upon initializing or running a job302.

In response to the job302being run, the list of scripts306is accessed and the appropriate script or scripts is retrieved and run. In certain embodiments, the scripts304may be run according to a specified frequency or based on a last run time. The executed script304may receive or retrieve as inputs one or more sets of monitored data308from one or more CIs referenced by the script304, such as monitored data308conveying observations related to network or device configurations, operating parameters, operational states, and so forth). Based on these inputs and the code of the script304, a script output is generated that is provided to an alert/event generator310which, based on the script output, can generate an event or alert (such as if the script output indicates a monitored parameter exceed an event threshold or an alert threshold). By way of example, the executed script304accesses monitored data to determine configuration and state information for one or more components or devices implicated in the execution of the job302. For example, the executed script might monitor status (e.g., success/error) of the job302, the elapsed time of a job run, delay of any events, number of actual jobs versus configuration possibly depending on the number of nodes in the instance, or verify that the number of jobs meet certain configurations. If the script output based on any of the configuration or state information indicates a value monitored by the script204exceeds a threshold, an event or alert is generated310, depending on the degree of deviation of the monitored value from expected norms.

As part of the event/alert generation at block310, a determination is made whether to send an alert to an external help site (e.g., call center, field agent), such as by sending an external alert312to a remote site, or whether to send the alert and provide a self-help solution318to a user320.

In the depicted example, an external alert312results in informing an external service314(e.g., external data center, service center, or monitoring instance) of the event or alert generated in block310. In addition to an alert, configuration and status data316(e.g., a detailed report of the configuration and state of the job and/or other useful network or device information) is sent to the other external service314to provide a more detailed explanation of the issue or source of the alert to the external service314.

As noted above, a determination may instead be made at the event/alert generator310to provide a self-help solution318. If such a self-help solution318is determined to be appropriate, a user may be provided with instructions or an executable routine that allow the user to address the event or alert without implicating an external help site. In such self-help contexts, the user can address the event or alert promptly, rather than wait for a solution to be provided from the external service314. In certain embodiments, records of event and alerts and the appropriate self-help solution318might be stored in a database accessible by the alert generation system300. A self-help solution318might be any combination of the following: an immediate solution to the event that triggered an alert (e.g., an update, providing a missing file, initializing a reset), a direction to a FAQ page, refreshing memory, or an indication of the source, severity, location, or time of event. A self-help solution318might be provided to the user (e.g., automatically triggering a workflow, or opening an incident, etc.)

In certain embodiments, a user may receive a self-help solution through a graphical user interface that displays a service map for an instance and all associated events and alerts between aspects of the instance. The service map may show dependencies between the components to enable a user to prioritize alerts and events. A graphical user interface that displays a service map and all associated events and alerts associated with an instance may serve as an analysis tool to help a user determine the root cause of events/alerts, and how to respond.

FIG. 6is a flow diagram, in accordance with an embodiment of the present disclosure illustrated inFIG. 5, but includes an additional path for monitoring errors in code. For example, code352may contain errors when executed and/or may otherwise be poorly optimized. Such errors or poor optimization may manifest in the monitored configuration and state data as memory misallocation errors, extended run times, hanging threads, and so forth. In certain embodiments, it might be advantageous to monitor code352for such sub-optimization indications. Events that arise from the code352are processed354and based on KPIs, may be deemed an event or alert if the KPI exceeds a respective threshold. In such instances, as in the preceding example, logic within the system automatically determines whether an external help request is provided or self-help is provided (e.g., a software patch or update, a firmware or BIOS update, and so forth).

FIG. 7is an illustration of a self-help application400for a user in accordance with an embodiment of the present disclosure. The self-help application400displays a model of components being monitored, interconnections between these components, and events/alerts associated with particular components that are specific to the user's instance. Further, the self-help application400display illustrates the impact of events and allows root cause to be determined, such as by visual analysis. Even further, the self-help application400provides the ability of the user to add monitors and modeling to any existing or custom application components and processes. The self-help application400shows an event map402of a configuration item404and an interactive window406. The event map402results from a job run on a configuration item404and the event map402displays the configuration items connection to MID servers408as well as the associated event management410to enable a user to find and track sources of errors or issues.

As discussed inFIG. 4, the event manager monitors at least alert processing412, event sources414, and event processing416. Each icon (i.e., box) monitored by event management410is related to event management410by connection arrows418. Thus, a hierarchy of relationships between monitored components is present. Beside each icon of the event map402, there is an arrow420that allows a user to collapse and expand portions of the event map402. This enables a user to organize and improve the clarity of the information displayed on the event map. For example, a user may only want to monitor event source414. Therefore, the user could select all arrows420associated with MID servers408, event processing416, and alert processing412to efficiently determine the errors within event sources414.

The interactive window406gives a user more information about an alert. In this illustrated embodiment, the interactive window includes a first row of tabs422and a second row of tabs424. In this illustrated embodiment, the first row of tabs422includes selectable tabs426and an alert severity count428. The selectable tabs426including alerts430, impact432, and root cause CI434that control what is being displayed in the content window. For example, if the user wants to see all alerts associated with the event map402, they would select alerts430. The alert severity count428displays the number of each alert that has a rank of a certain severity. This embodiment shows four categories of alert severity436and an associated number438that indicates how many errors are of a particular alert severity436. In certain embodiments, there may be fewer or more categories of alert severity.

A second row of tabs424includes a number tab440, a group tab442, a severity tab444, a priority tab446, a source tab448, a description tab450, a node tab452, a configuration item tab454, a maintenance tab456, a task tab458, an acknowledged tab460, and an updated tab462. The first row of tabs422control what is displayed in a window464below the tabs. Selecting the any of the tabs440,442,444,446,448,450,452,454,456,458,460, or462causes the window to display the associated information under each tab (e.g., in chronological order, order of importance/relevance, etc.) to the user. For example, if the severity tab444is selected, all alerts can be reorganized increasing or decreasing order of severity. The number tab440displays the alert code. A group tab442might display an organizational group of the alert or the configuration item. The severity tab444displays the ranking of severity of an alert. The priority tab446displays an associated numerical value that corresponds to how readily an alert or event should be addressed. The source tab448shows the origin of the error within the event mapping. The description tab450gives a user information pertaining to the type or source of the error. The node tab452shows the location of the source of the error. The configuration item tab454shows the ID of the configuration item that is associated with the error. The maintenance tab456displays if there has been an attempt or success at maintenance on the alert. The task tab458displays a suggestion or instructions of how a user might fix the error. The acknowledged tab460displays whether or not an alert has been received by the user (e.g., selected, responded to a prompt). The updated tab462gives an indication of when the alert was sent to the user via the interactive window. It should be noted that certain embodiments may not require all of the tabs listed above, and in some embodiments more or less tabs related to an alert might be provided.

An example of how a user might use the event map is as follows. After a user executes a job, and the steps listed forFIG. 4orFIG. 5have finished, or are running simultaneously to provide updates of new alerts, the event map402is updated and displayed for a user. As illustrated, there is an alert indicator466on the even management410icon. Selecting the arrow420associated with the event management410icon displays three additional monitored items: alert processing412, event sources414, and event processing416. As illustrated, the alert indicator466is signifying an alert within the event sources icon414. Selecting the arrow420associated with event sources414displays two CIs468and470. In this illustration, configuration item470(i.e., ‘Zabbix_10.196 . . . ’) is the source of the alert that resulted in the alert indicator466.

FIG. 8is a table architecture500for monitoring connector instances. As shown, the table architecture contains an active tab502, a connector definition tab504, an event collection schedule tab506, an event collection last run time tab508, a last event collection signature tab510, and a last event collection status tab512. The active tab displays whether or not a connector defined in the connector definition tab is active. The event collection schedule tab shows the interval at which the events relating to the connector are taken. The event collection last run time displays a time and date of the last event collection for each connector listed under the connection definition tab. The last even collection signature displays a signature as an output from the last run time. The success of the last run event collection is displayed under the last event collection status.

FIG. 9is a table architecture550for monitoring events. As shown, the table architecture contains a time of event tab552, a source tab554, a description tab556, a node tab558, a type tab560, a resource tab562, a message key tab564, a state tab566, and a severity tab568. A user can click on any of the tabs and reorder the display based the information contained under each tab. For example, a user clicking the severity tab568could address events that are deemed more severe (e.g. denoted with labels ‘major’ or critical’) than the ‘minor’ errors.