System management software enables centralized and automated management of a numerous distributed computing resources including servers, desktops computers, laptop computers, mobile phones, and tablets. System management can comprise managing hardware and software inventory, software distribution, and security including anti-virus and anti-malware, among other things. System management software is designed to be highly scalable to enable use over any number of computers (e.g., hundred computers, hundreds of thousands of computers . . . ). Accordingly, a client-server infrastructure is employed, where system management software resides on a central server, as well number of management point servers in a scaled out architecture, and all managed computers, or other processor-based devices, are clients. In this scenario, each client can report to a server on some configurable interval (e.g., every hour, couple of hours . . . ) to ask whether the client is required to perform some task such as install a software update, deploy software, or report what software is currently installed. In other words, a pull-based communication is employed.
The following presents a simplified summary in order to provide a basic understanding of some aspects of the disclosed subject matter. This summary is not an extensive overview. It is not intended to identify key/critical elements or to delineate the scope of the claimed subject matter. Its sole purpose is to present some concepts in a simplified form as a prelude to the more detailed description that is presented later.
Briefly described, the subject disclosure pertains to a fast channel for system management. A dedicated and persistent communication channel is established between a client and a server in a system management, and more particularly client management, context that enables push-based communication. The server can communicate information regarding time-sensitive tasks over the persistent communication channel. In accordance with one aspect, the client, in response to notification that a task should be executed, utilizes a separate pull-based communication channel to request and acquire the task as is conventionally done. In accordance with another aspect, a task can be communicated directly over the persistent communication channel. A variety of functionality can be employed with respect to push-based communication over the persistent channel including collection of presence information, selective targeting, throttling, and waking up a client in sleep mode, among other things.
To the accomplishment of the foregoing and related ends, certain illustrative aspects of the claimed subject matter are described herein in connection with the following description and the annexed drawings. These aspects are indicative of various ways in which the subject matter may be practiced, all of which are intended to be within the scope of the claimed subject matter. Other advantages and novel features may become apparent from the following detailed description when considered in conjunction with the drawings.
Conventionally, pull-based communication is employed in the system management space for client management (as opposed to server management where network connectivity is present and the number of servers is relatively small). Managed clients contact a server executing system management software (e.g., management point server) periodically to check whether they need to execute a management task. In large-scale environments, such as those including tens of thousands of clients, for example, when an administrator initiates a task, it can take several minutes, or even an hour, for each client to receive a task, execute the task, and report back to the server. Accordingly, administrators cannot push task execution in or near real time. This is problematic, because some tasks are mission-critical and time-sensitive (e.g., anti-virus, anti-malware). In addition, some managed clients, such as servers in data centers or clients that do not have virtual private network direct access and are not configured to be managed remotely over the Internet, have limited time reserved for management tasks. As a result, if tasks are not pushed to those clients at a specific time, the opportunity to do so may be missed.
Details below are generally directed toward a fast channel for system management. A dedicated and persistent communication channel can be established between managed clients and a server executing system management software. This channel can then be utilized to push messages to clients regarding time-sensitive tasks such as initiating execution of anti-malware and/or anti-virus software. Upon receipt of a message, a client computer can perform some action based thereon. In one instance, the client computer can immediately contact the server using the conventional pull-based channel and acquire one or more tasks for execution rather than waiting a predetermined time, such as an hour or more, prior to contacting the server. As another example, if the message includes a task, the client computer can execute that task. A variety of other functionality can be employed with respect push-based communication including collection of connection information, selective targeting, throttling, and waking up a client in sleep mode, among other things.
Various aspects of the subject disclosure are now described in more detail with reference to the annexed drawings, wherein like numerals refer to like or corresponding elements throughout. It should be understood, however, that the drawings and detailed description relating thereto are not intended to limit the claimed subject matter to the particular form disclosed. Rather, the intention is to cover all modifications, equivalents, and alternatives falling within the spirit and scope of the claimed subject matter.
Referring initially to
The server management component 110 and the client management component 120 can communicate in two distinct manners. First, and in accordance with conventional technology, communication can be pull based. In this scenario, the client management component 120 can connect to the sever manager by way of a communication channel, and ask whether there are any tasks that should be performed. If there are no tasks to be performed, the connection is terminated. If there are tasks to be performed, the tasks are acquired, if necessary, prior to disconnecting. Optionally, results of task execution can subsequently be communicated. Second, communication can be push based. Here, a connection/communication channel can be established and maintained between the server management component 110 and the client management component 120. Furthermore, this communication channel can be dedicated to a particular type of communication such as time-sensitive management/administrative tasks. Accordingly, a fast communication channel is provided to enable real time or near real time communication regarding time-sensitive tasks between the server management component 110 and the client management component 120.
These two communication mechanisms are complementary rather than mutually exclusive. Together real time or near real time functionality/responsiveness is provided for high priority (e.g., emergency) action (e.g., something an administrator does or an automated process) while maintaining scalability of the system. Conventional pull-based communication is designed to scale but does not support real time or near real time action. By contrast, push-based communication over or a dedicated persistent channel enables prompt action but does not scale well as a primary means of communication. Combined, however, a responsive and scalable system is provided.
In accordance with one embodiment, the push-based connection/channel can be utilized to notify the client management component 120 that at least one task is to be executed. The pull-based connection/channel can subsequently be employed to acquire more information including the task, for instance. Stated differently, rather than waiting an hour or more, for example to contact the server management component 110 as part of a periodic check, receipt of a signal on the push-based channel prompts substantially immediate connection by way of the pull-based channel. As a result, the push-based channel is not burdened with transmitting more data than necessary to prompt pull-based communication. In accordance with another embodiment, the push-based channel can include and/or identify one or more task for execution, thus eliminating the need to acquire such information utilizing the pull-based channel. For example, server management component 110 can send a message that instructs the client management component 120 to initiate a malware and/or virus scan. As another example, the client management component 120 can be provided with a script to execute (e.g., ad hoc administrator script outside normal workflow).
In theory, anything and everything can be transmitted by way of the push-based channel. However, if the push-based channel is not utilized judiciously, there is a point where the channel ceases to be fast from an operational perspective. Furthermore, the use of a persistent channel for all communications does not scale well, which is one reason why push-based communication has not heretofore been employed with respect to large-scale system management. Various mechanisms can be utilized to control push-based communication as will be described later herein.
In addition to establishing connections/communication channels, the pull component 210 and push component 220 can facilitate acquisition, as well as transmission of various types of data or information. For example, management tasks can be acquired and provided to task processor component 230, which is configured to execute tasks. In one embodiment, the pull component 210 can acquire information regarding a typical (e.g., non-time-sensitive) management tasks. Tasks acquired or identified with respect to a pull-based communication can be provided to the task processor component 230 for execution. The push component 220 can received messages regarding time-sensitive tasks. Subsequently, the pull component 210 can be prompted to acquire one or more time-sensitive tasks and provided them to the task processor component 230 for processing. Alternatively, the push component can acquire a task directly and provide the task to the task processor component 230 for execution. Furthermore, it should be appreciated that the pull component 210 and the push component 220 can be configured to communicate feedback associated with task execution including data or a signal that task execution succeeded or failed, among other things.
The presence component 330 is configured to acquire information regarding the online presence of client computers. The presence component 330 can identify which clients are online and which clients are offline based on connection status with a server. Presence information is useful in determining when to trigger, or schedule, a task. In furtherance thereof, the presence component 330 can also be configured render or display presence information to aid an administrator in deciding when to trigger a task. By way of example, if it is desirous to distribute software to a bunch of client machines, an administrator can estimate the installation success rate. For instance, if half the client computers are offline and half are online, chances are the success rate will be around fifty-percent. A decision can be made concerning when to trigger a task based on the presence information.
Turning attention briefly to
Returning to
Where supported by a client, the wakeup component 350 is configured to wake up a client from a sleep or suspended mode. In this manner, if a client is targeted but is in sleep mode, the computing device can be woken up automatically prior to messaging the client computer, for example regarding a time-sensitive task. Similarly, where supported, the wakeup component 350 can be configured to power on a device that is in a power off mode.
The throttle component 360 is configured to control the speed at which tasks are sent to clients with respect to the persistent communication channel. In one instance, a basic static throttle of sending “X” tasks per minute can be utilized. Alternatively, more advanced throttling techniques can take a variety of factors into account such as server load, client load, or network conditions, among other things. For instance, rather than asking all client computers to contact a server at once regarding a task, thereby potentially overloading the server with requests, messages informing the client to contact the server can be staggered over time or client computers can be instructed to delay contacting the server for one minute, for example. As another example, consider clients embodied as virtual machines. In this case, there can be ten clients on the same physical host. If a malware scan, or other disk intensive task, is initiated on the ten clients at the same time, resources of the physical host will be significantly and negatively impacted. Accordingly, if such a situation can be identified, throttling can be employed to reduce the effect on the physical host, for example by initiating execution sequentially.
Although the persistent communication channel for push-based communication is described herein with respect to a direct connection, it is not limited thereto. By way of example, and not limitation, a relay server can be employed so that both a client computer and server can establish a feed that allows the client computer and server to communicate by way of the relay server.
The aforementioned systems, architectures, environments, and the like have been described with respect to interaction between several components. It should be appreciated that such systems and components can include those components or sub-components specified therein, some of the specified components or sub-components, and/or additional components. Sub-components could also be implemented as components communicatively coupled to other components rather than included within parent components. Further yet, one or more components and/or sub-components may be combined into a single component to provide aggregate functionality. The components may also interact with one or more other components not specifically described herein for the sake of brevity, but known by those of skill in the art.
Furthermore, various portions of the disclosed systems above and methods below can include or employ of artificial intelligence, machine learning, or knowledge or rule-based components, sub-components, processes, means, methodologies, or mechanisms (e.g., support vector machines, neural networks, expert systems, Bayesian belief networks, fuzzy logic, data fusion engines, classifiers . . . ). Such components, inter alia, can automate certain mechanisms or processes performed thereby to make portions of the systems and methods more adaptive as well as efficient and intelligent. By way of example, and not limitation, the throttle component 360 can utilize such mechanism to infer an optimal sending speed with respect to various clients in light of various factors, context, and/or history, among other things.
In view of the exemplary systems described supra, methodologies that may be implemented in accordance with the disclosed subject matter will be better appreciated with reference to the flow charts of
Referring to
Turning attention to
The word “exemplary” or various forms thereof are used herein to mean serving as an example, instance, or illustration. Any aspect or design described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other aspects or designs. Furthermore, examples are provided solely for purposes of clarity and understanding and are not meant to limit or restrict the claimed subject matter or relevant portions of this disclosure in any manner. It is to be appreciated a myriad of additional or alternate examples of varying scope could have been presented, but have been omitted for purposes of brevity.
As used herein, the terms “component,” and “system,” as well as various forms thereof (e.g., components, systems, sub-systems . . . ) are intended to refer to a computer-related entity, either hardware, a combination of hardware and software, software, or software in execution. For example, a component may be, but is not limited to being, a process running on a processor, a processor, an object, an instance, an executable, a thread of execution, a program, and/or a computer. By way of illustration, both an application running on a computer and the computer can be a component. One or more components may reside within a process and/or thread of execution and a component may be localized on one computer and/or distributed between two or more computers.
The conjunction “or” as used this description and appended claims in is intended to mean an inclusive “or” rather than an exclusive “or,” unless otherwise specified or clear from context. In other words, “‘X’ or ‘Y’” is intended to mean any inclusive permutations of “X” and “Y.” For example, if “‘A’ employs ‘X,’” “‘A employs ‘Y,’” or “‘A’ employs both ‘X’ and ‘Y,’” then “‘A’ employs ‘X’ or ‘Y’” is satisfied under any of the foregoing instances.
As used herein, the term “inference” or “infer” refers generally to the process of reasoning about or inferring states of the system, environment, and/or user from a set of observations as captured via events and/or data. Inference can be employed to identify a specific context or action, or can generate a probability distribution over states, for example. The inference can be probabilistic—that is, the computation of a probability distribution over states of interest based on a consideration of data and events. Inference can also refer to techniques employed for composing higher-level events from a set of events and/or data. Such inference results in the construction of new events or actions from a set of observed events and/or stored event data, whether or not the events are correlated in close temporal proximity, and whether the events and data come from one or several event and data sources. Various classification schemes and/or systems (e.g., support vector machines, neural networks, expert systems, Bayesian belief networks, fuzzy logic, data fusion engines . . . ) can be employed in connection with performing automatic and/or inferred action in connection with the claimed subject matter.
Furthermore, to the extent that the terms “includes,” “contains,” “has,” “having” or variations in form thereof are used in either the detailed description or the claims, such terms are intended to be inclusive in a manner similar to the term “comprising” as “comprising” is interpreted when employed as a transitional word in a claim.
In order to provide a context for the claimed subject matter,
While the above disclosed system and methods can be described in the general context of computer-executable instructions of a program that runs on one or more computers, those skilled in the art will recognize that aspects can also be implemented in combination with other program modules or the like. Generally, program modules include routines, programs, components, data structures, among other things that perform particular tasks and/or implement particular abstract data types. Moreover, those skilled in the art will appreciate that the above systems and methods can be practiced with various computer system configurations, including single-processor, multi-processor or multi-core processor computer systems, mini-computing devices, mainframe computers, as well as personal computers, hand-held computing devices (e.g., personal digital assistant (PDA), phone, watch . . . ), microprocessor-based or programmable consumer or industrial electronics, and the like. Aspects can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. However, some, if not all aspects of the claimed subject matter can be practiced on stand-alone computers. In a distributed computing environment, program modules may be located in one or both of local and remote memory storage devices.
With reference to
The processor(s) 1020 can be implemented with a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general-purpose processor may be a microprocessor, but in the alternative, the processor may be any processor, controller, microcontroller, or state machine. The processor(s) 1020 may also be implemented as a combination of computing devices, for example a combination of a DSP and a microprocessor, a plurality of microprocessors, multi-core processors, one or more microprocessors in conjunction with a DSP core, or any other such configuration.
The computer 1010 can include or otherwise interact with a variety of computer-readable media to facilitate control of the computer 1010 to implement one or more aspects of the claimed subject matter. The computer-readable media can be any available media that can be accessed by the computer 1010 and includes volatile and nonvolatile media, and removable and non-removable media. By way of example, computer-readable media may comprise computer storage media and communication media.
Computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer-readable instructions, data structures, program modules, or other data. Computer storage media includes memory devices (e.g., random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM) . . . ), magnetic storage devices (e.g., hard disk, floppy disk, cassettes, tape . . . ), optical disks (e.g., compact disk (CD), digital versatile disk (DVD) . . . ), and solid state devices (e.g., solid state drive (SSD), flash memory drive (e.g., card, stick, key drive . . . ) . . . ), or any other like medium which can be used to store the desired information and which can be accessed by the computer 1010. Further, computer storage media excludes signals.
Communication media typically embodies computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media. The term “modulated data signal” means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared and other wireless media. Combinations of any of the above should also be included within the scope of computer-readable media.
Memory 1030 and mass storage 1050 are examples of computer-readable storage media. Depending on the exact configuration and type of computing device, memory 1030 may be volatile (e.g., RAM), non-volatile (e.g., ROM, flash memory . . . ) or some combination of the two. By way of example, the basic input/output system (BIOS), including basic routines to transfer information between elements within the computer 1010, such as during start-up, can be stored in nonvolatile memory, while volatile memory can act as external cache memory to facilitate processing by the processor(s) 1020, among other things.
Mass storage 1050 includes removable/non-removable, volatile/non-volatile computer storage media for storage of large amounts of data relative to the memory 1030. For example, mass storage 1050 includes, but is not limited to, one or more devices such as a magnetic or optical disk drive, floppy disk drive, flash memory, solid-state drive, or memory stick.
Memory 1030 and mass storage 1050 can include, or have stored therein, operating system 1060, one or more applications 1062, one or more program modules 1064, and data 1066. The operating system 1060 acts to control and allocate resources of the computer 1010. Applications 1062 include one or both of system and application software and can exploit management of resources by the operating system 1060 through program modules 1064 and data 1066 stored in memory 1030 and/or mass storage 1050 to perform one or more actions. Accordingly, applications 1062 can turn a general-purpose computer 1010 into a specialized machine in accordance with the logic provided thereby.
All or portions of the claimed subject matter can be implemented using standard programming and/or engineering techniques to produce software, firmware, hardware, or any combination thereof to control a computer to realize the disclosed functionality. By way of example and not limitation, the system management system 100, or portions thereof, can be, or form part, of an application 1062, and include one or more modules 1064 and data 1066 stored in memory and/or mass storage 1050 whose functionality can be realized when executed by one or more processor(s) 1020.
In accordance with one particular embodiment, the processor(s) 1020 can correspond to a system on a chip (SOC) or like architecture including, or in other words integrating, both hardware and software on a single integrated circuit substrate. Here, the processor(s) 1020 can include one or more processors as well as memory at least similar to processor(s) 1020 and memory 1030, among other things. Conventional processors include a minimal amount of hardware and software and rely extensively on external hardware and software. By contrast, an SOC implementation of processor is more powerful, as it embeds hardware and software therein that enable particular functionality with minimal or no reliance on external hardware and software. For example, the system management system 100 and/or associated functionality can be embedded within hardware in a SOC architecture.
The computer 1010 also includes one or more interface components 1070 that are communicatively coupled to the system bus 1040 and facilitate interaction with the computer 1010. By way of example, the interface component 1070 can be a port (e.g., serial, parallel, PCMCIA, USB, FireWire . . . ) or an interface card (e.g., sound, video . . . ) or the like. In one example implementation, the interface component 1070 can be embodied as a user input/output interface to enable a user to enter commands and information into the computer 1010 through one or more input devices (e.g., pointing device such as a mouse, trackball, stylus, touch pad, keyboard, microphone, joystick, game pad, satellite dish, scanner, camera, other computer . . . ).
In another example implementation, the interface component 1070 can be embodied as an output peripheral interface to supply output to displays (e.g., CRT, LCD, plasma . . . ), speakers, printers, and/or other computers, among other things. Still further yet, the interface component 1070 can be embodied as a network interface to enable communication with other computing devices (not shown), such as over a wired or wireless communications link.
What has been described above includes examples of aspects of the claimed subject matter. It is, of course, not possible to describe every conceivable combination of components or methodologies for purposes of describing the claimed subject matter, but one of ordinary skill in the art may recognize that many further combinations and permutations of the disclosed subject matter are possible. Accordingly, the disclosed subject matter is intended to embrace all such alterations, modifications, and variations that fall within the spirit and scope of the appended claims.