Lower-tier application deployment for higher-tier system data monitoring

Patent metadata

Field	Value
Publication number	US-2019097902-A1
Application number	US-201815884637-A
Country	US
Kind code	A1
Filing date	Jan 31, 2018
Priority date	Sep 25, 2017
Publication date	Mar 28, 2019
Grant date	—

Abstract

One or more lower-tier system monitoring components are installed and operated prior to installing a higher-tier system monitoring component. A lower-tier system may be an individual server, network device, or local area network. A higher-tier system may include an enterprise or organization wide network or service that includes at least a part of the lower-tier system. Once the higher-tier system monitoring component is installed, the higher-tier and lower-tier system monitoring components use an interface to operate with one another to form a single larger instance of an organization wide monitoring system. The combination of the higher-tier system monitoring component and the one or more lower-tier system operating components performs monitoring aspects of the overall information technology environment based at least in part on machine data produced and made searchable to provide monitoring results.

First claim

What is claimed:

1 . A method comprising:
installing and operating one or more lower-tier system monitoring components; and installing a higher-tier system monitoring component after said installing and operating the one or more lower-tier system monitoring components, the higher-tier system monitoring component having an interface to operate with the one or more lower-tier system monitoring components.

2 . The method of claim 1 further comprising:
monitoring the one or more entities of the information technology system with the one or more lower-tier system monitoring components; and
producing entity-level metrics based on the monitoring of the one or more entities with the one or more lower-tier system monitoring components.

3 . The method of claim 1 further comprising:
monitoring the one or more entities of the information technology system with the one or more lower-tier system monitoring components;
producing entity-level metrics based on the monitoring of the one or more entities with the one or more lower-tier system monitoring components;
interfacing the higher-tier system monitoring component with the one or more lower-tier system monitoring components through the interface; and
interoperating the higher-tier system monitoring component with the one or more lower-tier system monitoring components via the interface to access the entity-level metrics that are produced based on the monitoring of the one or more entities with the one or more lower-tier system monitoring components.

4 . The method of claim 1 wherein the higher-tier system monitoring component and the one or more lower-tier system monitoring components each perform monitoring aspects of an information technology environment that is based at least in part on machine data produced and made searchable to provide monitoring results.

5 . The method of claim 1 further comprising installing the higher-tier system monitoring component and the one or more lower-tier system monitoring components of a shared search head.

6 . The method of claim 1 wherein the higher-tier system monitoring component and the one or more lower-tier system monitoring components share an indexer.

7 . The method of claim 1 wherein the higher-tier system monitoring component and the one or more lower-tier system monitoring components share an indexer, and further comprising:
publishing data to the interface with the one or more lower-tier system monitoring components; and
based at least in part on the published data, accessing the shared indexer with the higher-tier system monitoring component to retrieve machine data associated with the lower-tier system monitoring component.

8 . The method of claim 1 wherein the interface comprises a message bus.

9 . The method of claim 1 wherein the interface comprises an independent message bus.

10 . The method of claim 1 wherein the interface comprises a message bus and wherein the higher-tier system monitoring component comprises the message bus.

11 . The method of claim 1 wherein the interface comprises a message bus and further comprising subscribing to rest endpoints of the message bus with the higher-tier system monitoring component.

12 . The method of claim 1 wherein the interface comprises a message bus and further comprising:
subscribing to rest endpoints of the message bus with the higher-tier system monitoring component; and
publishing data to the rest endpoints of the message bus with the one or more lower-tier system monitoring components.

13 . The method of claim 1 wherein the interface comprises a message bus and further comprising:
performing authentication and authorization steps in order to subscribe and publish data to the message bus;
subscribing to rest endpoints of the message bus with the higher-tier system monitoring component; and
publishing data to the rest endpoints of the message bus with the one or more lower-tier system monitoring components.

14 . The method of claim 1 wherein the interface comprises a message bus and further comprising:
subscribing to rest endpoints of the message bus with the higher-tier system monitoring component; and
publishing data to the rest endpoints of the message bus with the one or more lower-tier system monitoring components, wherein the data comprises one or more of configuration data and alert data.

15 . The method of claim 1 wherein the interface comprises a message bus and further comprising:
subscribing to rest endpoints of the message bus with the higher-tier system monitoring component; and
publishing data to the rest endpoints of the message bus with the one or more lower-tier system monitoring components, wherein the data comprises one or more of configuration data, alert data, and machine data.

16 . The method of claim 1 wherein the interface comprises a message bus and further comprising:
subscribing to rest endpoints of the message bus with the higher-tier system monitoring component;
publishing data to the rest endpoints of the message bus with the one or more lower-tier system monitoring components; and
operating the higher-tier system monitoring component to monitor a higher-tier system based at least in part on the published data from the one or more lower-tier system monitoring components.

17 . The method of claim 1 wherein the interface comprises a message bus and the one or more lower-tier system monitoring components push data associated with entities of a lower-tier system to the message bus and the higher-tier system monitoring component pulls the data from the message bus to provide system-level metrics that are based at least in part on the pushed data from the one or more lower-tier system monitoring components.

18 . The method of claim 1 wherein the interface comprises a message bus and the message bus detects whether published data set is duplicative of a previously published data set and stops the higher-tier system monitoring component from receiving a duplicate data set.

19 . The method of claim 1 wherein the interface comprises a message bus and the message bus filters the published data and the higher-tier system monitoring component receives the filtered data.

20 . The method of claim 1 wherein the interface comprises a message bus and the message bus sets a stream rate to control a rate at which the higher-tier system monitoring component receives the published data.

21 . A system comprising:
a data store including computer-executable instructions; and one or more processors configured to execute the computer-executable instructions, wherein execution of the computer-executable instructions causes the system to:
install and operate one or more lower-tier system monitoring components; and
install a higher-tier system monitoring component subsequent to installing and operating the one or more lower-tier system monitoring components, the higher-tier system monitoring component having an interface to operate with the one or more lower-tier system monitoring components.

22 . The system of claim 21 wherein the interface comprises a message bus.

23 . The system of claim 21 wherein the interface comprises a message bus and execution of the computer-executable instructions further causes the system to subscribe to rest endpoints of the message bus with the higher-tier system monitoring component.

24 . The system of claim 21 wherein the interface comprises a message bus, and ex

Assignees

• Splunk Inc

Inventors

• Hardin Alan Vincent
• Wu Kan
• Ramani Arun
• Tankersley Nicholas Matthew
• Fletcher Tristan
• Bhide Alok

Classifications

• G06F17/30864

  Physics · mapped topic

• G06F8/61

  Installation · CPC title

• H04L43/04 Primary

  Processing captured monitoring data, e.g. for logfile generation · CPC title

• H04L43/14

  using software, i.e. software packages (network security related monitoring H04L63/1408) · CPC title

• H04L43/20 Primary

  the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV · CPC title