System and method for alert insight in configuration management databases (CMDBs)

Patent metadata

Field	Value
Publication number	US-10824616-B2
Application number	US-201815943490-A
Country	US
Kind code	B2
Filing date	Apr 2, 2018
Priority date	Apr 2, 2018
Publication date	Nov 3, 2020
Grant date	Nov 3, 2020

Abstract

A method of managing alerts in a client instance associated with a configuration management database (CMDB) platform is disclosed. The method includes: receiving a request identifying a particular CI and a particular alert; identifying related CIs from a plurality of CIs associated with the client instance based on the particular CI and the particular alert; identifying alerts, incidents (INTs), changes (CHGs), and problems (PRBs) of the client instance that are associated with either the particular CI or the related CIs; determining frequency data for the alerts, INTs, CHGs, and PRBs associated with the particular CIs and frequency data for the alerts, INTs, CHGs, and PRBs associated with the related CIs; and sending a response that includes the frequency data for the alerts, INTs, CHGs, and PRBs associated with the particular CIs to be presented alongside the frequency data for the alerts, INTs, CHGs, PRBs associated with the related CIs.

First claim

The invention claimed is:

1. A computing system including a configuration management database (CMDB) platform, comprising:
a client instance including a configuration items (CI) table configured to store a plurality of CIs, an alerts table, an incidents (INTs) table, a changes (CHGs) table, a problems (PRBs) table, and wherein the client instance is configured to:
receive a request identifying a particular CI and a particular alert;
identify related CIs from the plurality of CIs based on the particular CI and the particular alert, wherein, identifying the related CIs comprises:
determining a respective topological relationship score based on a respective topological relationship between each of the plurality of CIs and the particular CI;
determining a respective alert group relationship score based on an alert group relationship between each of the plurality of CIs and the particular alert;
combining the respective topological relationship score and the respective alert group relationship score to generate a respective combined score for each of the plurality of CIs; and
identifying the related CIs from the plurality of CIs, wherein the respective combined score of each of the related CIs is greater than a predetermined threshold value;

identify alerts from the alerts table, INTs from the INTs table, CHGs from the CHGs table, and PRBs from the PRBs table that are associated with either the particular CI or the related CIs;
determine frequency data for the alerts, INTs, CHGs, and PRBs associated with the particular CIs and frequency data for the alerts, INTs, CHGs, and PRBs associated with the related CIs; and
send a response that includes the frequency data for the alerts, INTs, CHGs, and PRBs associated with the particular CIs to be presented alongside the frequency data for the alerts, INTs, CHGs, and PRBs associated with the related CIs.

2. The computing system of claim 1 , wherein, to determine the respective topological relationship score, the client instance is configured to:
determine first level CIs of the plurality of CIs having a first level topological relationship with the particular CI;
assign each of the first level CIs a relatively high respective topological relationship score based on the first level topological relationship with the particular CI;
determine second level CIs of the plurality of CIs having a second level topological relationship with the particular CI based on the first level CIs;
assign each of the second level CIs a relatively median respective topological score based on the second level topological relationship with the particular CI;
determine third level CIs of the plurality of CIs having a third level topological relationship with the particular CI based on the second level CIs; and
assign each of the third level CIs a relatively low respective topological score based on the third level topological relationship with the particular CI.

3. The computing system of claim 1 , wherein, to determine the respective alert group relationship score, the client instance is configured to:
determine an alert group associated with the particular alert;
determine alert group CIs of the plurality of CIs that are associated with the alert group; and
assign each of the alert group CIs a similar respective alert group relationship score based on being associated with the alert group of the particular alert.

4. The computing system of claim 1 , wherein the computing device comprises a client device communicatively coupled to the client instance via a network, wherein the client device is configured to:
provide the request identifying the particular CI and the particular alert to the client instance;
receive the response that includes the frequency data for the alerts, INTs, CHGs, and PRBs associated with the particular CIs and the frequency data for the alerts, INTs, CHGs, and PRBs associated with the related CIs; and
present a plurality of widgets on a user interface associated with the client device that includes the frequency data for the alerts, INTs, CHGs, and PRBs associated with the particular CIs presented alongside the frequency data for the alerts, INTs, CHGs, and PRBs associated with the related CIs.

5. The computing system of claim 4 , wherein the plurality of widgets includes an alert widget that indicates a first number of alerts associated with the particular alert and the particular CI, and that indicates a second number of alerts associated with the particular alert and the related CIs.

6. The computing system of claim 4 , wherein the plurality of widgets includes an INT widget that indicates a first number of INTs associated with the particular alert and the particular CI, and that indicates a second number of INTs associated with the particular alert and the related CIs.

7. The computing system of claim 4 , wherein the plurality of widgets includes a CHG widget that indicates a first number of CHGs associated with the particular CI, and that indicates a second number of CHGs associated with the related CIs.

8. The computing system of claim 4 , wherein the plurality of widgets includes a PRB widget that indicates a first number of PRBs associated with the particular CI, and that indicates a second number of PRBs associated with the related CIs.

9. The computing system of claim 1 , wherein the alert group relationship comprises a relationship between an alert group associated with the particular alert and an alert group associated with at least one of the plurality of CIs.

10. A method of providing alert insight in a client instance associated with a configuration management database (CMDB) platform, comprising:
receiving, via a processor, a request identifying a particular configuration item (CI) and a particular alert;
identifying, via the processor, related CIs from a plurality of CIs associated with the client instance based on the particular CI and the particular alert, wherein identifying related CIs comprises:
determining a respective topological relationship score based on a respective topological relationship between each of the plurality of CIs and the particular CI;
determining a respective alert group relationship score based on an alert group relationship between each of the plurality of CIs and the particular alert;
combining the respective topological relationship score and the respective alert group relationship score to generate a respective combined score for each of the plurality of CIs; and
identifying the related CIs from the plurality of CIs, wherein the respective combined score of each of the related CIs is greater than a predetermined threshold value;

identifying alerts, incidents (INTs), changes (CHGs), and problems (PRBs) of the client instance that are associated with either the particular CI or the related CIs;
determining, via the processor, frequency data for the alerts, INTs, CHGs, and PRBs associated with the particular CIs and frequency data for the alerts, INTs, CHGs, and PRBs associated with the related CIs; and
sending, via the processor, a response that includes the frequency data for the alerts, INTs, CHGs, and PRBs associated with the particular CIs to be presented alongside the frequency data for the alerts, INTs, CHGs, PRBs associated with the related CIs.

11. The method of claim 10 , wherein determining frequency data for the alerts, INTs, CHGs, and PRBs associated with the particular CIs comprises respectively counting the alerts, INTs, CHGs, and PRBs associated with the particular CI within respective time windows.

12. The method of claim 11 , wherein determining frequency data for the alerts, INTs, CHGs, and PRBs associated with the related CIs comprises respec

Assignees

• Servicenow Inc

Inventors

• Makovsky Bnayahu
• Hasdai Netta
• Gati Ofer

Classifications

• H04L41/065 Primary

  involving logical or physical relationship, e.g. grouping and hierarchies · CPC title

• H04L41/0856

  by backing up or archiving configuration information · CPC title

• H04L41/069

  using logs of notifications; Post-processing of notifications · CPC title

• G06F11/0709

  in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems · CPC title

• G06F11/327

  Alarm or error message display · CPC title