Patent Application
20120166317
This disclosure relates generally to the field of information technology (IT) asset management. More particularly, but not by way of limitation, it relates to techniques for automatically generating suggestions for logical groupings of IT assets managed by an enterprise. These IT assets may be managed using one or more IT management systems, including an asset management system, an inventory management system, a configuration management system, and an IT compliance management system.
Asset management systems are an important part of the management of the computer systems of a large enterprise. These systems provide an enterprise with the ability to manage configuration changes, providing better control over the computer software and hardware assets of the enterprise. Example asset management systems include the BMC® BLADELOGIC® Server Automation product from BMC Software, Inc. (BMC and BLADELOGIC are registered trademarks of BMC Software, Inc.)
In a large enterprise, when an asset management product is initially deployed, a large number of assets such as server, desktop, and laptop computers must first be enrolled or registered with the product as managed entities. Depending on the capabilities of the asset management system, the registration of assets may be done manually or may be automated using a discovery tool, such as the BMC Atrium Discovery and Dependency Mapping software, which automatically discovers physical and virtual assets.
The assets managed by such asset management systems are typically grouped into logical groups that may be managed collectively, reducing the complexity and costs of managing those grouped assets. However, creating logical groups of these IT assets remains a manual task. Administrators may create and populate groups with individual IT assets based on some organization-specific criteria. In some asset management systems, administrations may define groups that are automatically populated based on rules involving IT asset attributes. In either case, some administrator is responsible for defining the groups or rules manually. In large enterprises, group definition is a hard task for individual administrators, and is likely to result in false positives (an IT asset incorrectly being assigned to a group) and false negatives (an IT asset incorrectly being omitted from a group). Even where groups are automatically populated, the correctness of those groups remains dependent on discovering and updating the right metadata or configuration data.
In addition, administrators typically create groups using simple criteria of which they are aware, e.g., operating system (OS) type or physical location. Other possible groupings, which may be more useful in some scenarios, may not be created because the administrator is unable to determine the proper criteria for defining the group. For example, the administrator may not be aware of which attributes are key to similarity among assets of a given type or there may not be any simple expression involving IT asset attributes that can be used to define a desired group.
When IT asset management systems managed hundreds of IT assets, these manual groupings, while onerous, may have been feasible. Today, however, where such systems may be managing tens of thousands of IT assets, manual grouping is at best very difficult, and often infeasible with any degree of accuracy.
Thus, IT asset management systems have frequently produced suboptimal groups.
In one embodiment, a method is disclosed. The method comprises registering a plurality of information technology assets of an enterprise in a computerized information technology asset management system; performing cluster analysis on configuration data corresponding to the plurality of information technology assets, generating a plurality of clusters of information technology assets; and adding a cluster of the plurality of clusters of information technology assets as a logical group in the information technology asset management system.
In another embodiment, a computer readable medium is disclosed. The computer readable medium has instructions for a programmable control device stored thereon wherein the instructions cause the programmable control device to perform the method described above.
In yet another embodiment, a networked computer system is disclosed. The networked computer system comprises a plurality of computers communicatively coupled, at least one of the plurality of computers programmed to perform at least a portion of the method of described above wherein the entire method described above is performed collectively by the plurality of computers.
In yet another embodiment, a computerized information technology asset management system is disclosed. The computerized information technology asset management system comprises a database of information technology asset configuration data, entries in which comprise a plurality of attributes of information technology assets; a processor, coupled to the database of information technology assets; a program storage unit, coupled to the processor; and software, stored in the program storage unit, comprising instructions that when executed by the processor cause the processor to perform actions. The actions comprise selecting a plurality of configuration data corresponding to a plurality of information technology assets; performing cluster analysis on the plurality of configuration data, generating a plurality of clusters of information technology assets; and adding a logical group to the information technology management system corresponding to a first cluster of the plurality of clusters of information technology assets.
In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the invention. It will be apparent, however, to one skilled in the art that the invention may be practiced without these specific details. In other instances, structure and devices are shown in block diagram form in order to avoid obscuring the invention. References to numbers without subscripts or suffixes are understood to reference all instance of subscripts and suffixes corresponding to the referenced number. Moreover, the language used in this disclosure has been principally selected for readability and instructional purposes, and may not have been selected to delineate or circumscribe the inventive subject matter, resort to the claims being necessary to determine such inventive subject matter. Reference in the specification to “one embodiment” or to “an embodiment” means that a particular feature, structure, or characteristic described in connection with the embodiments is included in at least one embodiment of the invention, and multiple references to “one embodiment” or “an embodiment” should not be understood as necessarily all referring to the same embodiment.
As used herein, the term database should be understood to include any form of storing data for an intended use and is not limited to relational databases managed by a relational database management system and accessed using a structured query language (SQL) interface, although such relational databases may be used. A database may also be implemented in other ways, including flat files and object-oriented database systems. In addition, the terms table, rows, and columns should not be understood as implying any specific implementation or data structures.
In this system, the display is divided into two panels 110 and 120. Panel 110 provides a tree of IT assets for management by an administrator, with management functionality displayed in panel 120. In this example, tree 111 comprises a collection of servers 112, grouped into three logical groups 113, 114, and 115. Group 115 comprises three servers 116, 117, and 118. An administrator may wish to perform management functions on an individual server (for example, server 116) or in many instances, perform management functions on all of the servers in a group of servers (for example group 115). Servers are used in
Although an IT infrastructure of the size illustrated in
By applying cluster analysis techniques, appropriate logical groups of IT assets may be automatically discovered and suggested to administrators. These cluster analysis techniques may discover groups that are more optimal than would be manually defined by the administrator, based on some combination of configuration attributes, including combinations that may not be suspected by the administrator as useful, or by excluding attributes that analysis determines not to be useful in defining logical groups.
In one embodiment, the IT asset management system may automatically define the logical groups as result of the cluster analysis. In another embodiment, the IT asset management system may suggest logical group definitions to an administrator, allowing the administrator to accept or reject each suggested group definition and creating accepted logical groups in the IT asset management system.
d
p(xi,xj)=(Σk=1n|xi,k−xj,k|p)1/p
where n is the number of dimensions in the data, and p is the order of the distance, typically having a value of 1 (the Manhattan distance) or 2 (the Euclidean distance), although other nonzero values of p may be used, including infinity (the Chebyshev distance).
Other distance metrics may be used, including Mahalanobis distance metrics. The choice of distance metric may affect the shape of the clusters identified in the cluster analysis.
In block 320, the IT assets that are to be grouped are extracted from the IT asset management database and in block 330, their corresponding configuration data are stored in a temporary database in a clustering table as described in more detail below. Then in blocks 350-390, for each cluster discovered by the cluster analysis, a graphical display of the cluster is generated and displayed to the administrator in block 360. If the administrator indicates acceptance of the group in block 370, then in block 380 the logical group is created in the IT asset management system, before moving onto the next cluster in block 390. In one embodiment, as part of creating the logical group, the administrator may assign a human-readable name to the logical group. In other embodiments, the IT asset management system may automatically create a name for the logical group.
In one embodiment, each cluster is presented separately for acceptance or rejection by the administrator. In another embodiment, the GUI of the IT asset management system may present multiple clusters, allowing the administrator to accept or reject each cluster singly or together with other clusters. To assist the administrator in making a good decision regarding acceptance of the proposed logical groups, the IT asset management system may provide additional information related to each proposed group, such as the underlying configuration data elements corresponding to the members of the cluster, to help the administrator have confidence in the proposed logical grouping. In one embodiment, the additional information may be displayed in the GUI by default, without requiring the administrator to request a display of the additional information. In another embodiment, the GUI may display only the graphical representation of the cluster by default, and may display the additional information upon request by the administrator.
In one embodiment, information corresponding to the cluster may also be provided to the administrator, such as information regarding the density of the cluster, the n-dimensional distances between pairs of elements. Other types of information may be provided as desired, including information comparing the cluster currently being considered by the administrator with other clusters that have been accepted by the administrator and created as logical groups in the IT asset management system. The administrator is not required to have any knowledge of the clustering technique used by the IT asset management system, or any detailed knowledge of clustering techniques in general.
There are numerous techniques for performing cluster analysis, and embodiments may be implemented using any desired clustering techniques, including agglomerative or divisive hierarchical clustering, partitional clustering, density-based clustering, and spectral clustering. Because the number of clusters in the IT asset configuration data is typically not known in advance, clustering techniques that do not depend upon prior knowledge of a desired number of clusters are preferably used.
Some clustering techniques may produce different results depending upon clustering parameters that are specific to the clustering algorithm or that may be related to more than one clustering technique. In one embodiment, an administrator may be able to accept or modify such clustering parameters if desired. Typically, however, administrators may allow the clustering technique to use predefined default clustering parameters, and some embodiments may not allow administrator control over those parameters. One embodiment may allow administrator selection between multiple clustering algorithms.
As indicated above, the configuration data used for the cluster analysis is typically already available in the IT asset management system, having been collected when the IT asset was registered with the IT asset management system. The configuration data may include any attributes deemed useful by the IT asset management system. For servers, for example, the configuration data may include the number of processors, the processor speed, the amount of physical memory, the manufacturer name, the OS (and OS version), the host name, the IP address, etc. These configuration attributes are illustrative and by way of example only, and other configuration data attributes may be used as desired.
In one embodiment, the configuration data to be used for the cluster analysis may be extracted from the IT asset management system database or databases and used to populate a temporary cluster analysis database table, with each row of the table corresponding to one IT asset. This table may be implemented in an existing database or as a separate database specific to the cluster analysis.
The configuration data stored in the table is preferably converted as necessary to a numeric form. This conversion may be performed in various embodiments either prior to storing the data in the table or after the table is populated, as desired or convenient.
The conversion to numeric form may be done in multiple ways, including different types of conversions depending upon the nature of the nonnumeric data being converted to numeric form. For example, a list of manufacturers names may be created, each with an associated numeric value, and the conversion performed as a lookup into this list of manufacturer names and numeric values. In another example, the IP address can be converted from xxx.xxx.xxx.xxx form into a 32-bit unsigned integer using well-known techniques.
In one embodiment, the resulting numeric values may be normalized or scaled into a desired scaling relationship. In another embodiment, the numeric values are unscaled. In one embodiment, numeric values, including values converted from non-numeric data, may be grouped into ranges and the numeric value corresponding to the range used for clustering, instead of the original individual numeric values. For example, instead of using the actual amount of physical memory associated with a server, clustering based on low, medium, and high memory sizes may be more useful. Thus, servers with 1-4 GB of memory may be classed as low, servers with 5-15 GB of memory may be classes medium, and servers with 16 GB or more of memory may be classed as high, using values of 1 (low), 2 (medium), or 3 (high) for clustering instead of using the actual memory size. The memory size ranges described above are illustrative and by way of example only, and different ranges and numbers of ranges may be used. In another example, the IP address data may be grouped by subnets, and the clustering performed on a numeric value corresponding to each subnet, instead of performing clustering on the individual IP addresses. In one embodiment, instead of using predefined groupings or ranges of values, the system may analyze the values for an attribute associated with all of the IT assets to be clustered to derive the ranges and number of ranges to use for that attribute, assigning a numeric value to each derived range.
The numeric data for each IT asset defines a point in an n-dimensional space, where n is the number of configuration data attributes used for clustering. In one embodiment, different types of IT assets may have different numbers of configuration data attributes, thus the dimensionality of the data for different types of IT assets may differ. In one embodiment, the grouping technique may use a subset of the available configuration attributes, selected from the attributes collected at the registration of the IT asset. In another embodiment, all of the collected configuration data may be used. Different types of IT assets may have different selections of attributes, with some types of IT assets using all of the configuration data for grouping purposes, and other types of IT assets using only a selected subset of the configuration data. In one embodiment, an administrator may select the configuration data attributes to use for clustering each type of IT asset.
Performing cluster analysis on the numeric values thus becomes a matter of identifying clusters of points in the n-dimensional space defined by the n configuration data attributes.
Cluster analysis or clustering is the assignment of a set of objects or observations into subsets (known as clusters) so that objects in the same cluster are similar in some sense. Clustering is a common technique for statistical data analysis used in many fields, but has not previously been used in IT asset management systems.
Once the cluster analysis has identified clusters in the configuration data, the clusters may be rendered in a form that lets the administrator approve and accept the proposed logical groupings. In one embodiment, the groupings may be presented in a non-graphical report format. In another embodiment, the groupings may be rendered in a graphical user interface (GUI) that displays clusters graphically.
In one embodiment, the GUI may display a proposed logical grouping of IT assets as a graph, displaying the n-dimensional distance measure between points in the graph. In another embodiment, the GUI may display the configuration data attributes for the items in the cluster in a tabular or other convenient form. Other embodiments for displaying the cluster may be used, including combinations of the embodiments described above. Any additional information may be displayed that may assist the administrator in deciding whether the logical grouping suggested by the cluster analysis is appropriate.
In addition to displaying the proposed logical groupings in a GUI, one embodiment may allow the administrator to accept or reject the proposed logical groupings. Upon acceptance by the administrator, the system may automatically create a logical group of IT assets in the IT asset management system and pre-populate the group with the members of the cluster as accepted by the administrator. If the group suggested by the cluster analysis is rejected by the administrator, the group is not added to the IT asset management system. In one embodiment, in addition to creating logical groups as suggested by the cluster analysis, the administrator may be given an opportunity to define additional groups not suggested by the cluster analysis, using additional domain knowledge possessed by the administrator.
Some of the configuration data attributes may be useful for defining logical groups and some attributes may contribute little to the clustering. In such a situation, the dimensionality of the configuration data may be reduced by omitting those attributes that contribute little to the clustering. However, neither the system nor the administrator may have prior knowledge of which configuration data attributes materially contribute to the clustering.
In one embodiment, the IT asset management system initially performs the clustering with all of the configuration data attributes. The system then may attempt to reduce the dimensionality of the data by iteratively performing the cluster analysis, each time omitting one or more of the configuration data attributes. Statistical analysis of the resulting clusters may then be performed and compared to a statistical analysis of the previous iteration. If the resulting clusters are statistically better than those produced previously, then that attribute may be dropped from the analysis, because it did not materially contribute to the similarity of the members of the clusters. In one embodiment, the system automatically decides which attribute or attributes to remove from the next iteration. In another embodiment, the administrator may be allowed to choose which attribute or attributes to remove from the next iteration.
Any statistical measurement known to the art may be used to evaluate the clustering results, including cluster cohesiveness and semantic cohesiveness measures. By comparing the results of the clustering using these statistical measures, after several iterations the IT asset management system may be able to eliminate the attributes that do not contribute materially to the clustering.
In another embodiment, factor analysis techniques known to the clustering arts may be used to discover the factors or latent variables that result in joint variability of the configuration attributes. Latent variables are not configuration attributes entered into the IT asset management system, but are inferred through mathematical models from those attributes. In some cases, latent variables correspond to configuration attributes that have physical reality, but which may not be captured for practical or other reasons. Alternately, the latent variables may correspond to abstractions, like categories, that do not have physical reality. Latent variables generally represent a shared variance, or the degree in which a variance in one variable correlates to a variance in another variable. For example, in computer servers, units with more processors may also tend to have more physical memory, thus a latent variable may effectively combine those two variables and could be used for clustering instead of the two separate attributes, reducing the dimensionality of the clustering.
By using factor analysis techniques known to the art to reduce the dimensionality of the cluster analysis, the administrator may be presented with discovered groupings that are grouped better, and the system may increase the confidence level of the administrator, making verification that the system has proposed appropriate logical groups easier for the administrator.
Referring now to
System unit 610 may be programmed to perform methods in accordance with this disclosure (an example of which is in
It is to be understood that the above description is intended to be illustrative, and not restrictive. For example, the above-described embodiments may be used in combination with each other. Many other embodiments will be apparent to those of skill in the art upon reviewing the above description. The scope of the invention therefore should be determined with reference to the appended claims, along with the full scope of equivalents to which such claims are entitled. In the appended claims, the terms “including” and “in which” are used as the plain-English equivalents of the respective terms “comprising” and “wherein.”
