System and method for alert insight in configuration management databases (CMDBs)

Patent metadata

Field	Value
Publication number	US-11550774-B2
Application number	US-202017084246-A
Country	US
Kind code	B2
Filing date	Oct 29, 2020
Priority date	Apr 2, 2018
Publication date	Jan 10, 2023
Grant date	Jan 10, 2023

Abstract

A method of managing alerts in a client instance associated with a configuration management database (CMDB) platform is disclosed. The method includes: receiving a request identifying a particular CI and a particular alert; identifying related CIs from a plurality of CIs associated with the client instance based on the particular CI and the particular alert; identifying alerts, incidents (INTs), changes (CHGs), and problems (PRBs) of the client instance that are associated with either the particular CI or the related CIs; determining frequency data for the alerts, INTs, CHGs, and PRBs associated with the particular CIs and frequency data for the alerts, INTs, CHGs, and PRBs associated with the related CIs; and sending a response that includes the frequency data for the alerts, INTs, CHGs, and PRBs associated with the particular CIs to be presented alongside the frequency data for the alerts, INTs, CHGs, PRBs associated with the related CIs.

First claim

The invention claimed is:

1. A computing system, comprising:
at least one processor configured to execute stored instructions to perform operations comprising:
receiving a request from a client device identifying a particular configuration item (CI) of a plurality of CIs and a particular alert of a plurality of alerts;
identifying one or more CIs of the plurality of CIs as being related to the particular CI based on the particular CI and the particular alert by:
determining a respective topological relationship score based at least in part on a respective topological relationship between each CI of the plurality of CIs and the particular CI;
determining a respective alert group relationship score based at least in part on an alert group relationship between each CI of the plurality of CIs and the particular alert;
combining the respective topological relationship score and the respective alert group relationship score to generate a respective combined score for each CI of the plurality of CIs; and
identifying the one or more CIs as being related to the particular CI based at least in part on the respective combined score of each CI of the one or more CIs being greater than a threshold value;

identifying one or more issues that are associated with the particular CI, the one or more CIs identified as being related to the particular CI, or a combination thereof;
determining frequency data for the one or more issues associated with the particular CI, the one or more CIs identified as being related to the particular CI, or the combination thereof; and
sending a response to the client device, wherein the response includes the frequency data for the one or more issues associated with the particular CI, the one or more CIs identified as being related to the particular CI, or the combination thereof.

2. The computing system of claim 1 , wherein, to determine the respective alert group relationship score, the at least one processor is configured to execute the stored instructions to perform operations comprising:
determining an alert group associated with the particular alert;
determining alert group CIs of the plurality of CIs that are associated with the alert group; and
assigning each of the alert group CIs a similar respective alert group relationship score based on being associated with the alert group of the particular alert.

3. The computing system of claim 1 , comprising at least one memory configured to store a configuration management database (CMDB), wherein the CMDB comprises a first table configured to store the plurality of CIs and comprises a second table configured to store the plurality of alerts.

4. The computing system of claim 3 , wherein, to determine the respective topological relationship score, the at least one processor is configured to execute the stored instructions to perform operations comprising:
referencing the first table, and wherein determining the respective alert group relationship score comprises referencing the second table.

5. The computing system of claim 1 , wherein, to determine the respective topological relationship score, the at least one processor is configured to execute the stored instructions to perform operations comprising:
determining first level CIs of the plurality of CIs having a first level topological relationship with the particular CI;
determining second level CIs of the plurality of CIs having a second level topological relationship with the particular CI based on the first level CIs;
determining third level CIs of the plurality of CIs having a third level topological relationship with the particular CI based on the second level CIs; and
assigning each CI of the plurality of CIs a respective topological score, wherein topological scores assigned to second level CIs is less than topological scores assigned to first level CIs and topological scores assigned to third level CIs is less than topological scores assigned to second level CIs.

6. The computing system of claim 1 ,
wherein the one or more issues correspond to past incidents, past changes, and/or past problems of the particular CI, the one or more CIs identified as being related to the particular CI, or the combination thereof.

7. The computing system of claim 6 , wherein, to determine the frequency data, the at least one processor is configured to execute the stored instructions to perform operations comprising: counting the past incidents, the past changes, and/or the past problems that occurred within a time window.

8. The computing system of claim 1 , wherein the at least one processor is configured to execute the stored instructions to perform operations comprising:
determining a root cause of the particular alert based at least in part on the frequency data for the one or more issues associated with the particular CI, the one or more CIs identified as being related to the particular CI, or the combination thereof.

9. The computing system of claim 1 , wherein sending the response to the client device comprises providing one or more widgets on a graphical user interface (GUI) to the client device, wherein the one or more widgets are configured to present the frequency data for display.

10. A computer-implemented method, comprising:
receiving a request from a client device identifying a particular configuration item (CI) of a plurality of CIs and a particular alert of a plurality of alerts;
identifying one or more CIs of the plurality of CIs as being related to the particular CI based on the particular CI and the particular alert by:
determining a respective topological relationship score based at least in part on a respective topological relationship between each CI of the plurality of CIs and the particular CI;
determining a respective alert group relationship score based at least in part on an alert group relationship between each CI of the plurality of CIs and the particular alert;
combining the respective topological relationship score and the respective alert group relationship score to generate a respective combined score for each CI of the plurality of CIs; and
identifying the one or more CIs as being related to the particular CI based at least in part on the respective combined score of each CI of the one or more CIs;

identifying one or more issues that are associated with the particular CI, the one or more CIs identified as being related to the particular CI, or a combination thereof;
determining frequency data for the one or more issues associated with the particular CI, the one or more CIs identified as being related to the particular CI, or the combination thereof; and
sending a response to the client device, wherein the response comprises the frequency data for the one or more issues associated with the particular CI, the one or more CIs identified as being related to the particular CI, or the combination thereof.

11. The computer-implemented method of claim 10 , comprising:
determining first level CIs of the plurality of CIs having a first level topological relationship with the particular CI;
determining second level CIs of the plurality of CIs having a second level topological relationship with the particular CI based on the first level CIs;
determining third level CIs of the plurality of CIs having a third level topological relationship with the particular CI based on the second level CIs; and
assigning each CI of the plurality of CIs a respective topological score, wherein topological scores assigned to second level CIs is less than topological scores assigned to first level CIs and topological scores assigned to third level CIs is less than topological scores assigned to second level CIs.

12. The computer-im

Assignees

• Servicenow Inc

Inventors

• Makovsky Bnayahu
• Hasdai Netta
• Gati Ofer

Classifications

• G06F11/3409

  for performance assessment · CPC title

• H04L41/0856

  by backing up or archiving configuration information · CPC title

• G06F11/0775

  Content or structure details of the error report, e.g. specific table structure, specific error fields · CPC title

• G06F11/0748

  in a remote unit communicating with a single-box computer node experiencing an error/fault (remote testing G06F11/2294) · CPC title

• G06F16/252

  between a Database Management System and a front-end application · CPC title