System and method for handling events involving computing systems and networks using fabric monitoring system

Patent metadata

Field	Value
Publication number	US-10652103-B2
Application number	US-201615134277-A
Country	US
Kind code	B2
Filing date	Apr 20, 2016
Priority date	Apr 24, 2015
Publication date	May 12, 2020
Grant date	May 12, 2020

Abstract

A method includes receiving, at a fabric monitoring system, information identifying occurrences of events in an enterprise system having multiple computing or networking systems. The events occur on or involve computing or networking devices in the computing or networking systems, and the events are identified using rules accessible by the fabric monitoring system. The method also includes processing, using the fabric monitoring system, the information in real-time to identify the occurrences of the events and to assign the events to multiple situations. The events are assigned to the situations using one or more processing models accessible by the fabric monitoring system. The method further includes outputting information identifying the situations.

First claim

What is claimed is:

1. A method comprising:
receiving, at multiple stripes, information identifying occurrences of first events in an enterprise system comprising multiple computing or networking systems, the first events occurring on or involving computing or networking devices in the computing or networking systems, the stripes comprising different instances of a fabric monitoring system that includes a plurality of computing nodes interconnected by a plurality of communication links;
processing, using the multiple stripes, the information in real-time to identify the occurrences of the first events and to assign the first events to multiple situations, the first events identified using rules accessible by the stripes, the first events assigned to the situations using one or more processing models accessible by the stripes;
transmitting second events between the stripes to support cross-stripe correlations of the first events or the situations, the second events comprising synthetic events; and
outputting information identifying the situations.

2. The method of claim 1 , wherein:
a number of the computing nodes operating in each instance of the fabric monitoring system is scalable; and
a number of the stripes in the multiple stripes is scalable.

3. The method of claim 1 , further comprising:
storing information associated with the first events and the situations, including information about the first events and the situations and information about how the situations are resolved, to provide an audit trail for the first events and the situations.

4. The method of claim 1 , further comprising:
obtaining the rules from one or more policies, at least a portion of the one or more policies defined by at least one user using a monitoring definition language.

5. The method of claim 1 , wherein the one or more processing models define how to categorize the first events and identify the situations, the one or more processing models including:
at least one user-defined model defined by at least one user; and
at least one analytical model defining one or more analytical functions that operate using the information identifying the occurrences of the first events.

6. The method of claim 1 , further comprising:
responsive to identification of the situations, creating the synthetic events, wherein each stripe of the multiple stripes operates independently.

7. The method of claim 1 , wherein different ones of the multiple stripes process different first events that are associated with at least one of:
different assets in the computing or networking systems;
different locations in which the computing or networking systems are deployed;
different deployments of hardware, software, or firmware in the computing or networking systems;
different business units using the computing or networking systems; and
different types of business being transacted using the computing or networking systems.

8. The method of claim 1 , wherein the first events comprise at least one of:
current states of the computing or networking devices in the computing or networking systems;
changes in the current states of the computing or networking devices in the computing or networking systems;
anomalies in the computing or networking devices in the computing or networking systems; and
occurrences of defined conditions within the computing or networking systems.

9. The method of claim 1 , wherein outputting the information identifying the situations comprises:
providing information identifying at least one of the situations to an automated agent that automatically resolves the at least one situation.

10. The method of claim 1 , wherein outputting the information identifying the situations comprises:
providing information identifying at least one of the situations to a ticketing agent that generates at least one notification for personnel, the at least one notification identifying the at least one situation.

11. A system comprising:
multiple stripes, the stripes comprising different instances of a fabric monitoring system that includes multiple computing nodes and multiple communication links coupling the computing nodes, at least one of the computing nodes comprising one or more processors, the stripes configured to:
receive information identifying occurrences of first events in an enterprise system comprising multiple computing or networking systems, the first events occurring on or involving computing or networking devices in the computing or networking systems;
process the information in real-time to identify the occurrences of the first events and to assign the first events to multiple situations, the first events identified using rules accessible by the stripes, the first events assigned to the situations using one or more processing models accessible by the stripes;
generate and transmit second events to one another in order to support cross-stripe correlations of the first events or the situations, the second events comprising synthetic events; and
output information identifying the situations.

12. The system of claim 11 , wherein:
a number of the computing nodes operating in each instance of the fabric monitoring system is scalable; and
a number of the stripes in the multiple stripes is scalable.

13. The system of claim 11 , wherein the stripes are further configured to store information associated with the first events and the situations, including information about the first events and the situations and information about how the situations are resolved, to provide an audit trail for the first events and the situations.

14. The system of claim 11 , further comprising:
a repository configured to store one or more policies comprising the rules, at least a portion of the one or more policies defined by at least one user using a monitoring definition language.

15. The system of claim 11 , wherein the one or more processing models define how to categorize the first events and identify the situations, the one or more processing models including:
at least one user-defined model defined by at least one user; and
at least one analytical model defining one or more analytical functions that operate using the information identifying the occurrences of the first events.

16. The system of claim 11 , wherein the stripes are further configured to:
responsive to identification of the situations, create the synthetic events, wherein each stripe of the multiple stripes operates independently.

17. The system of claim 11 , wherein each stripe is configured to generate at least some of the synthetic events upon identification of situations by that stripe.

18. The system of claim 11 , wherein different ones of the multiple stripes are configured to process different first events that are associated with at least one of:
different assets in the computing or networking systems;
different locations in which the computing or networking systems are deployed;
different deployments of hardware, software, or firmware in the computing or networking systems;
different business units using the computing or networking systems; and
different types of business being transacted using the computing or networking systems.

19. The system of claim 11 , wherein the first events comprise at least one of:
current states of the computing or networking devices in the computing or networking systems;
changes in the current states of the computing or networking devices in the computing or networking systems;
anomalies in the computing or networking devic

Assignees

• Goldman Sachs & Co
• Goldman Sachs & Co Llc

Inventors

• Anderson Robert
• Berman Ilia
• Billis Keith
• Joshi Amol

Classifications

• H04L41/5074

  Handling of user complaints or trouble tickets · CPC title

• H04L41/145 Primary

  involving simulating, designing, planning or modelling of a network · CPC title

• G06Q10/06

  Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling · CPC title

• G06Q10/0633

  Workflow analysis · CPC title

• H04L41/0893

  Assignment of logical groups to network elements · CPC title