Predictive monitoring and problem identification in an information technology (it) infrastructure

Abstract

An information technology (IT) infrastructure may be monitored, and the data thus collected may be used to infer problems and predict future conditions. In one embodiment, the present invention may include receiving a plurality of component metrics, each component metric related to a corresponding component of an (IT) infrastructure of an enterprise, each component being associated with one or more gross-level rules, and generating an indicator set by comparing each received component metric to relevant historical values of the component metric. In one embodiment, the present invention may also include determining that a gross-level rule is out of compliance, comparing the indicator set to one or more historical indicator sets to determine whether the indicator set resembles any of the one or more historical indicator sets, and performing an appropriate action based on the result of the comparison.

1 . A method comprising: 
 (A) aggregating data collected from a plurality of monitors deployed throughout an information technology (IT) infrastructure to form collective monitor patterns by 
 (1) receiving a plurality of component metrics, each component metric corresponding to a component of a plurality of components of the IT infrastructure and being associated with one or more gross-level rules of a plurality of gross-level rules indicative of expected or desired functioning of the IT infrastructure, and  
 (2) generating an indicator set representative of a current state of the IT infrastructure based on the received component metrics and relevant historical values of component metrics corresponding to the plurality of components; and  
   (B) predicting a future condition within the IT infrastructure, the predicted future condition representing (i) inference of a future irregularity or problem within the IT infrastructure or (ii) inference of a future out-of-compliance condition with respect to a gross-level rule of the plurality of gross-level rules, which has occurred in the past and based on the collective monitor patterns has a statistical likelihood of reoccurring relatively soon by    (1) comparing the indicator set to one or more historical indicator sets representative of past states of the IT infrastructure, and    (2) determining whether the indicator set has sufficient resemblance to a historical indicator set of the one or more historical indicator sets that is associated with a previously observed irregularity or problem within the IT infrastructure or a previously observed out-of-compliance condition of the gross-level rule.    
   
   
       2 . The method of  claim 1 , further comprising: 
 receiving information confirming whether the predicted future condition was in fact imminent; and    based on the received information, adjusting a plurality of weights used for comparing the indicator set to the one or more historical indicator sets, each weight being associated with one component indicator of the indicator set.    
   
   
       3 . The method of  claim 1 , further comprising causing information regarding the predicted future condition to be communicated to a technician having responsibility for maintaining the IT infrastructure.  
   
   
       4 . The method of  claim 1 , further comprising programmatically taking corrective action to remedy the predicted future condition.  
   
   
       5 . The method of  claim 2 , wherein said adjusting a plurality of weights comprises increasing the statistical significance of one or more component indicators of the historical indicator set responsive to receiving confirmation regarding correctness of the predicted future condition.  
   
   
       6 . The method of  claim 2 , wherein said adjusting a plurality of weights comprises decreasing the statistical significance of one or more component indicators of the historical indicator set responsive to receiving confirmation regarding incorrectness of the predicted future condition.  
   
   
       7 . A method comprising: 
 maintaining a database of a plurality of historical fingerprints, each of the plurality of historical fingerprints corresponding to a previous observation of an out-of-compliance condition of a gross-level rule of a plurality of gross-level rules, each of the plurality of gross-level rules representing an expected or desired functioning of an information technology (IT) infrastructure, each of the plurality of historical finger prints associated with an indication of one or more problems that existed in the IT infrastructure when the historical fingerprint was generated and that were believed to have been responsible for or contributed to the corresponding out-of-compliance condition of the gross-level rule;    generating a current fingerprint representative of a current state of the IT infrastructure by gathering data from a plurality of component monitors regarding a plurality of components of the IT infrastructure and processing the gathered data with reference to relevant historical values the plurality of components, each of the plurality of components being associated with a particular gross-level rule of the plurality of gross-level rules; and    inferring a future out-of-compliance condition with respect to the particular gross-level rule by comparing the current fingerprint to the plurality of historical fingerprints and identifying a historical fingerprint of the plurality of historical fingerprints that sufficiently resembles the current fingerprint by performing a weighted comparison of a plurality of component indicators of the current fingerprint and a plurality of component indicators of one or more of the plurality of historical fingerprints.    
   
   
       8 . The method of  claim 7 , further comprising: 
 receiving information confirming whether the inferred future out-of-compliance condition was in fact imminent; and    based on the received information, adjusting a plurality of weights used for comparing the identified historical fingerprint to current fingerprints, each weight being associated with one component indicator of the plurality of component indicators of the identified historical fingerprint.    
   
   
       9 . The method of  claim 7 , further comprising causing information regarding the inferred future out-of-compliance condition to be communicated to a technician having responsibility for maintaining the IT infrastructure.  
   
   
       10 . The method of  claim 7 , further comprising programmatically taking corrective action to remedy the inferred future out-of-compliance condition.  
   
   
       11 . The method of  claim 8 , wherein said adjusting a plurality of weights comprises increasing the statistical significance of one or more component indicators of the identified historical fingerprint responsive to receiving confirmation regarding correctness of the inferred future out-of-compliance condition.  
   
   
       12 . The method of  claim 8 , wherein said adjusting a plurality of weights comprises decreasing the statistical significance of one or more component indicators of the identified historical fingerprint responsive to receiving confirmation regarding incorrectness of the inferred future out-of-compliance condition.