WO2005008433A2

WO2005008433A2 - System and method for creating and using self describing events in automation

Info

Publication number: WO2005008433A2
Application number: PCT/US2004/022589
Authority: WO
Inventors: Rohit Ghai; Edward Grinvald
Original assignee: Computer Associates Think, Inc.
Priority date: 2003-07-11
Filing date: 2004-07-12
Publication date: 2005-01-27
Also published as: EP1711885A2; US20050120330A1; EP1711885A4; US7483902B2; WO2005008433A3

Abstract

Methods, systems, apparatus and computer-readable media are disclosed for creating and using self describing events in automation. A first exemplary method is disclosed that includes querying (205) a plurality of managed components, receiving (210) a response, and processing (215) each response to select event types as triggers for steps in an automated workflow using attributes of events as arguments to workflow steps. This method further discloses the monitoring (220), detection, and processing (225) of events defined in the workflow. Processing of an event includes creating a machine readable data payload containing event information including the event type, event attributes, and a grammar to which the event conforms. Using the provided grammar, components in the automated workflow can interpret the data payload and perform the actions defined in the automated workflow. Other methods, apparatus, systems and computer readable media are disclosed for presenting event information.

Description

SYSTEM AND METHOD FOR CREATING AND USING SELF DESCRIBING EVENTS IN AUTOMATION

Cross Reference to Related Applications [0001] This application claims priority to and incorporates by reference the entirety of U.S. provisional application entitled "System and Method for Using Self-Describing Events," Serial No. 60/487,038, filed July 11, 2003.

Technical Field [0002] The present application generally relates to computer system infrastructure management. The present application more specifically relates to systems and methods to facilitate automation of computer system event and work-flow monitoring.

Background [0003] Events are ubiquitous in the world of Mrastructure Management, described herein as including Enterprise Management, Security Management and Storage Management. Events typically have several attributes such as timestamp, severity, source, and action. One of the main attributes of an event is the Message attribute. As an example, a message could be the following: "El 005 Backup Job (JoblD = 5643) failed due on server." Textual messages are amenable to human consumption, allowing a human operator, for instance to visually inspect, sort, and filter events. However, events are also consumed by automation engines, referred to herein as "machine consumption." Machine consumption may include parsing the information inside the message attribute. As an example, in order to trigger an automated workflow process in response to a "backup job failed" event, the JoblD parameter is extracted from the textual message. This extraction or parsing has the draw back of being subject to changes in the formatting of the message due to regular software updates or due to other circumstances. Each time the human readable text message format for the event is changed through updates to the system, the parsing routine must also be changed to allow the data to be extracted. [0004] Simple Network Management Protocol ("SNMP") traps can be used to relay a condition or an event. However, it is problematic to determine if a network or storage component is capable of producing an event via SNMP, and if so, the categories and types of events produced. This limitation, combined with a lack of machine-readable event data, makes it difficult to employ SNMP in storage management automation. Products such as Unicenter, developed by Computer Associates ("CA"), the assignee of the present application, provide capabilities to receive events from remote agents. However, in many instances the event management component has no way of establishing the possible events that can be received, making it difficult to create automated management workflows and practices. [0005] Therefore, there is a need for a system and method to generate and use events suitable for machine consumption to facilitate automated workflow management.

Summary [0006] The following presents a simplified summary of methods, apparatus, systems, and computer readable media associated with using self describing events in automation in accordance with the present application. This summary is not an extensive overview and is not intended to identify key or critical elements of the methods, apparatus, systems, and/or media or to delineate the scope of the methods, apparatus, systems, and media. It conceptually identifies the methods, apparatus, systems, and media in a simplified form as a prelude to the more detailed description that is presented later. [0007] In accordance with one aspect of the present application, an exemplary embodiment of a method is disclosed for creating and using self-describing events in automated workflow management. This exemplary method includes querying a plurality of managed components. The method also includes receiving a response from each of the managed components. Included in the response is a list of producible event types, attributes of each event type, and a grammar to which each event type conforms. Pursuant to this embodiment, each response is processed. Processing of the response can include selecting event types to be used as triggers for steps in an automated workflow. Attributes of events can be selected as arguments to workflow steps. One way that this processing can occur is to present the data type information to a user and allow this user to manually select which event types will trigger steps in the automated workflow and which event attributes will be passed as arguments to the workflow steps. [0008] With the workflow defined, the above described method continues by monitoring the plurality of managed components for events defined in the workflow. When an event is detected it is processed. Processing of an event includes creating a machine readable data payload containing event information including the event type, event attributes, and a grammar to which the event conforms. Using the provided grammar, components in the automated workflow can interpret the data payload and perform the actions defined in the automated workflow. [0009] In accordance with a second aspect of the present application, an exemplary apparatus is disclosed for creating and using self-describing events in automated workflow management. This exemplary apparatus comprises a processor with memory. This memory stores a program to control operation of the processor. The processor is operative with the program in memory to query a plurality of managed components. The processor is also operative with the program in memory to receive a response from each of the managed components including a list of producible event types, attributes of each event type, and a grammar to which each event type conforms. Said processor with program in memory can process each response to define desired event types as triggers for steps in an automated workflow using desired attributes of each event type as arguments to workflow steps. One way that this processing can occur is to present the data type information to a user and allow this user to manually select which event types will trigger steps in the automated workflow and which event attributes will be passed as arguments to the workflow steps. [0010] The processor with program in memory can monitor the plurality of managed components and detect events of the event types defined in the automated workflow. When an event is detected it can be processed by the processor in memory. Processing of an event includes creating a machine readable data payload containing event information including the event type, event attributes, and a grammar to which the event conforms. Using the provided grammar, components in the automated workflow can interpret the data payload and perform the actions defined in the automated workflow. [0011] In accordance with a third aspect of the present application, an exemplary system is disclosed for presenting event type information. This system comprises a web browser client. The system also includes a graphical viewer in communication with the web browser client. The graphical viewer is operative to display event type information including producible event types of managed components, attributes of each event type, and a grammar to which each event type conforms. Pursuant to the this aspect of the current application, a server application is provided. The sever application is in communication with the web browser client and with an event database and an event application. The server application is operative to receive a request for event type information, query the event application and access the event database to respond to a request for event type information. A remote data server is in communication with the graphical viewer. The remote data server is further in communication with at least one platform-specific event database. The remote data server is operative to receive a request for platform-specific event type viewing data and is operative to query the platform-specific event database and respond to the request for platform-specific event viewing data. [0012] In accordance with a fourth aspect of the present application, an exemplary computer-readable storage medium is disclosed. The medium is encoded with processing instructions for creating and using self-describing events. These steps include querying a plurality of managed components. The steps stored on the computer-readable medium also includes receiving a response from each of the managed components queried. Included in the response is a list of producible event types, attributes of each event type, and a grammar to which each event type conforms. Pursuant to this embodiment, each response is processed. Processing of the response can include selecting event types to be used as triggers for steps in an automated workflow. Attributes of events can be selected as arguments to workflow steps. One way that this processing can occur is to present the data type information to a user and allow this user to manually select which event types will trigger steps in the automated workflow and which event attributes will be passed as arguments to the workflow steps. [0013] With the workflow defined, the above described steps stored on the computer- readable medium continue by monitoring the plurality of managed components for events defined in the workflow. When an event is detected it is processed. Processing of an event includes creating a machine readable data payload containing event information including the event type, event attributes, and a grammar to which the event conforms. Using the provided grammar, components in the automated workflow can interpret the data payload and perform the actions defined in the automated workflow. [0014] Certain illustrative aspects of the methods, apparatus, systems and computer- readable media are described herein in connection with the following description and the annexed drawings. These aspects are indicative, however, of but a few of the various ways in which the principles of the methods, apparatus, systems, and media may be employed and thus the examples are intended to include such aspects and equivalents. Other advantages and novel features may become apparent from the following detailed description when considered in conjunction with the drawings.

Brief Description of the Drawings [0015] For a more complete understanding of the present methods and systems, reference is now made to the following description taken in conjunction with the accompanying drawings in which like reference numbers indicate like features and wherein: [0016] Figure 1 is a system topology illustrating a diverse collection of managed components connected by a shared network;

- A - [0017] Figure 2 is a block diagram illustrating an example process for creating and using self describing events in automation; and [0018] Figure 3 is a block diagram illustrating an example system for executing the methodology of Figure 2.

Detailed Description [0019] Example methods and systems are now described with reference to the drawings, where like reference numerals are used to refer to like elements throughout, hi the following description, for purposes of explanation, numerous specific details are set forth in order to facilitate thoroughly understanding the methods and systems. It may be evident, however, that the methods and systems can be practiced without these specific details, hi other instances, well-known structures and devices are shown in block diagram form in order to simplify the description. [0020] Referring to Figure 1, there is illustrated a topology of a system 100 including a diverse collection of managed components connected by a shared network. The system 100 includes a user workstation 102, data 104 and a hub 106 which connect these components to various other system resources via shared network 108. The example system resources illustrated in Figure 1 include a raid drive 110, servers 112, 114, and 128, network controller 116, VAX 118, Micro VAX 120, network processor 122, IBM AS/400 124 and tower box 126. [0021] In accordance with the present application, workstation 102 includes control logic for creating and/or using self-describing events. In addition, certain managed components, such as raid drive 110, for example, may include control logic for creating self- describing events. [0022] Referring now to Figure 2, there is illustrated an example methodology for creating and using self-describing events in an automated work flow application. The methodology may be employed, for example, by workstation 102 working in cooperation with other components of system 100. At block 205, one or more managed components are queried to determine the status of each managed component. A work flow automation application running, for example, on workstation 102 receives responses from the managed components at block 210. Each response includes event type data. [0023] At block 215, each of the responses are processed to define an automated work flow, h the automated work flow, events are used as triggers, and event attributes are used as arguments. Each of the managed components is monitored through periodic polling or other techniques known to those of ordinary skill in the art. Any occurrence of an event that has been defined in the work flow to trigger an action is detected, as shown by block 220. At block 225, each detected event is processed by control logic associated with the associated managed component, and the control logic directs the creation of a machine readable data payload. The control logic may be resident in a memory of the managed component or in a application responsible for monitoring the managed component. [0024] At block 230, the work flow automation application interprets the attributes of each event which are stored in the data payload, and the actions defined in the work flow. [0025] Referring now to Figure 3, there is illustrated an example system 300 for executing methodology 200. As illustrated, a user 305 employs an event subscription module 310 to define a work flow automation. The work flow automation definition is stored in data store 320. Each work flow definition of data store 320 includes an identification of an event type triggering a work flow action, and an identification of an action to be taken upon the triggering event. The event types of the work flow automation definitions are selected from a store of event definitions 315. [0026] The store of event definitions 315 may be populated by a component discovery module 325. Component discovery module 325 queries each component which may be managed, components 330, 335 and 340 in the present example, to receive event type definitions. Upon receiving a query from component discovery module 325, each component responds with a list of producible event types, a list of attributes for each event type, and a grammar or syntax of a data payload to which each event type conforms. The component discovery module 325 processes each component response to define the event type definitions 315 which may be used as triggers for steps in an automated workflow using desired attributes of each event type as arguments to workflow steps. In one embodiment, the data payload is defined as being in XML form with an associated XML Schema and/or DTD attached to the event. The XML Schema and/or DTD may be obtained by querying the managed component that produced the event. [0027] Event monitor module 345 monitors the components 330, 335 and 340 to detect whether any event defined as a trigger in the work flow definition data store 320 has occurred. Upon detecting a triggering event, event momtor 345 processes the detected event to create a machine readable data payload containing event information including the event type, event attributes, and a grammar to which the event conforms. Event monitor module 345 then provides the triggering event, including the machine readable data payload, to event processor module 350 for processing. [0028] Event processor module 350 processes the data payload in the manner defined by the automated work flow definition of data store 320 according to the provided grammar of the event type to interpret the attributes of the event. Event processing module 320 determines an appropriate action processor module 355 to perform the action based on the automated work flow definition of data store 320 and directs action processor module 355 to perform the action defined by the work flow definition. [0029] What has been described above includes several examples. It is, of course, not possible to describe every conceivable combination of components or methodologies for purposes of describing the systems, apparatus, methods, and computer readable media associated with creating and using self-describing events in automation within an enterprise. However, one of ordinary skill in the art may recognize that further combinations and permutations are possible. Accordingly, this application is intended to embrace such alterations, modifications, and variations that fall within the scope of the appended claims. Furthermore, to the extent that the term "includes" is employed in the detailed description or the claims, such term is intended to be inclusive in a manner similar to the term "comprising" as that term is interpreted when employed as a transitional word in a claim.

Claims

What is claimed is:

1. A method for creating and using self-describing events in automated workflow management comprising: querying a plurality of managed components; receiving a response from each of the managed components including a list of producible event types, attributes of each event type, and a grammar to which each event type conforms; processing each response to define desired event types as triggers for steps in an automated workflow using desired attributes of each event type as arguments to workflow steps; monitoring the plurality of managed components and detecting events of the event types defined in the automated workflow; processing each detected event to create a machine readable data payload containing event information including the event type, event attributes, and a grammar to which the event conforms; and processing the data payload in the manner defined by the automated workflow by using the provided grammar of the event type to interpret the attributes of the event.

2. The method of claim 1, wherein the response is processed by presenting each managed component's producible event types to a user selecting desired event types for definition as triggers to the automated workflow, said user selecting desired attributes of each event type as arguments to steps in the automated workflow.

3. The method of claim 1 , wherein the data payload is in XML form with an associated XML Schema attached to the event.

4. The method of claim 1, wherein the data payload is in XML form with an associated DTD attached to the event.

5. The method of claim 1, wherein the data payload is in XML form and an associated XML Schema is obtained by querying the managed component that produced the event.

6. The method of claim 1, wherein the data payload is in XML form and an associated DTD is obtained by querying the managed component that produced the event.

7. An apparatus for creating and using self-describing events in automated workflow management comprising: a processor; a memory connected to the processor storing a program to control operation of the processor; the processor operative with said program in memory to: query a plurality of managed components; receive a response from each of the managed components including a list of producible event types, attributes of each event type, and a grammar to which each event type conforms; process each response to define desired event types as triggers for steps in an automated workflow using desired attributes of each event type as arguments to workflow steps; monitor the plurality of managed components and detect events of the event types defined in the automated workflow; process each detected event to create a machine readable data payload containing event information including the event type, event attributes, and a grammar to which the event conforms; and process the data payload in the manner defined by the automated workflow by using the provided grammar of the event type to interpret the attributes of the event.

8. The apparatus of claim 7, wherein the processor is operative with said program in memory to present event information to a user including producible event types of managed components, attributes of each event type, and a grammar to which each event type conforms; receive user responses for selection of desired event types for definition as triggers to the automated workflow; further receive user responses for selection of desired attributes of each event type as arguments to steps in the automated workflow; and process the user responses to create the automated workflow.

9. The apparatus of claim 7, wherein the data payload is in XML form with an associated XML Schema attached to the event.

10. The apparatus of claim 7, wherein the data payload is in XML form with an associated DTD attached to the event.

11. The apparatus of claim 7, wherein the data payload is in XML form and an associated XML Schema is obtained by querying the managed component that produced the event.

12. The apparatus of claim 7, wherein the data payload is in XML form and an associated DTD is obtained by querying the managed component that produced the event.

13. A system for presenting event type information comprising: a web browser client; a graphical viewer in communication with the web browser client, the graphical viewer operative to display event type information including producible event types of managed components, attributes of each event type, and a grammar to which each event type conforms; a server application in communication with the web browser client, the server application in communication with an event database and an event application, the server application operative to receive a request for event type information, query the event application and access the event database to respond to a request for event type information; and a remote data server in communication with the graphical viewer, the remote data server further in communication with at least one platform-specific event database, the remote data server operative to receive a request for platform-specific event type viewing data, the remote data server further operative to query the platform-specific event database and respond to the request for platform-specific event viewing data.

14. A computer-readable storage medium encoded with processing instructions for creating and using self describing events in automation, the processing instructions for directing a computer to perform the steps of: querying a plurality of managed components; receiving a response from each of the managed components including a list of producible event types, attributes of each event type, and a grammar to which each event type conforms; processing each response to define desired event types as triggers for steps in an automated workflow using desired attributes of each event type as arguments to workflow steps; monitoring the plurality of managed components and detecting events of the event types defined in the automated workflow; processing each detected event to create a machine readable data payload containing event information including the event type, event attributes, and a grammar to which the event conforms; and processing the data payload in the manner defined by the automated workflow by using the provided grammar of the event type to interpret the attributes of the event.