# US 12,003,371 B1 · Server configuration anomaly detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,371 B1 - Document ID: US12003371B1 - Status: Granted - Kind: B1 - Application number: 18/080,213 - Filed: 2022-12-13 - Published: 2024-06-13 - Granted: 2024-06-04 - Earliest claimed: 2022-12-13 - Assignees: Sap SE - Applicants: Sap SE - Inventors: Hui Li; Xia Yu - Web page: https://patentgrep.com/patent/US12003371B1 ## CPC - H04L 41/0853: by actively collecting configuration information or by backing up configuration information - H04L 41/0873: Checking configuration conflicts between network elements - H04L 41/0894: Policy-based network configuration management - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Mechanisms are disclosed for applying one or more heuristics to collected server configurations to detect anomalous configurations. A collection system requests configuration data, including one or more configuration values, from a plurality of configuration agents running on a plurality of hosted servers. The one or more configuration values are received from the plurality of configuration agents at the collection system. The one or more configuration values are stored in one or more databases, organized based on one or more server identifiers. The one or more configuration values are accessed, by an analysis system, from the one or more databases. One or more heuristics are applied to the one or more configuration values based on the one or more server identifiers. In response to detecting the presence of one or more anomalous server configurations, a notification of one or more server configuration issues is provided. ## Claims ### Claim 1 One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by a processor, perform a method for applying one or more heuristics to collected server configurations to detect anomalous server configurations, the method comprising: requesting, by a collection system, server configuration data, including one or more server configuration values, from a plurality of configuration agents running on a plurality of hosted servers to detect anomalous server configurations, wherein the plurality of hosted servers is grouped into a plurality of groups, each group of the plurality of groups identified by one or more server identifiers and comprising hosted servers using a same or a related server configuration; receiving, at the collection system, from the plurality of configuration agents the one or more server configuration values of each hosted server in the plurality of hosted servers; storing the one or more server configuration values in one or more databases, organized based on the one or more server identifiers; accessing, by an analysis system, the one or more server configuration values from the one or more databases; applying one or more heuristics to the one or more server configuration values of the hosted servers in each group of the plurality of groups based on the one or more server identifiers; and in response to detecting the presence of one or more anomalous server configurations in the plurality of groups, providing a notification of one or more server configuration issues. ### Claim 2 (depends on 1) The non-transitory computer-readable media of claim 1, wherein the configuration values comprise: operating system configuration values and application configuration values. ### Claim 3 (depends on 1) The non-transitory computer-readable media of claim 1, wherein the one or more server identifiers comprises a server group identifier and a server hardware identifier. ### Claim 4 (depends on 1) The non-transitory computer-readable media of claim 1, wherein the one or more heuristics is based on existence of a standard value for the one or more configuration values. ### Claim 5 (depends on 1) The non-transitory computer-readable media of claim 1, wherein the one or more heuristics is based on existence of a common value for the one or more server configuration values, the common value corresponding to a count of the one or more server configuration values appearing in the server configuration data of the plurality of hosted servers using the same or the related server configuration in each group of the plurality of groups, and wherein the common value is present in at least a configurable threshold number of servers in the plurality of hosted servers. ### Claim 6 (depends on 1) The non-transitory computer-readable media of claim 1, wherein the notification of one or more server configuration issues is provided to an automated configuration remediation system. ### Claim 7 A method for applying one or more heuristics to collected server configurations to detect anomalous server configurations, the method comprising: requesting, by a collection system, server configuration data, including one or more server configuration values, from a plurality of configuration agents running on a plurality of hosted servers to detect anomalous server configurations, wherein the plurality of hosted servers is grouped into a plurality of groups, each group of the plurality of groups identified by one or more server identifiers and comprising hosted servers using a same or a related server configuration; receiving, at the collection system, from the plurality of configuration agents the one or more server configuration values of each hosted server in the plurality of hosted servers; storing the one or more server configuration values in one or more databases, organized based on the one or more server identifiers; accessing, by an analysis system, the one or more server configuration values from the one or more databases; applying one or more heuristics to the one or more server configuration values of the hosted servers in each group of the plurality of groups based on the one or more server identifiers; and in response to detecting the presence of one or more anomalous server configurations in the plurality of groups, providing a notification of one or more server configuration issues. ### Claim 8 (depends on 7) The method of claim 7, wherein the one or more server identifiers comprises a server group identifier and a server hardware identifier. ### Claim 9 (depends on 7) The method of claim 7, wherein the one or more heuristics is based on existence of a standard value for the one or more configuration values. ### Claim 10 (depends on 7) The method of claim 7, wherein the one or more heuristics is based on existence of a common value for the one or more server configuration values, the common value corresponding to a count of the one or more server configuration values appearing in the server configuration data of the plurality of hosted servers using the same or related server configuration in each group of the plurality of groups, and wherein the common value is present in at least a configurable threshold number of servers in the plurality of hosted servers. ### Claim 11 (depends on 8) The method of claim 8, wherein the notification of one or more server configuration issues comprises a message-based communication to one or more development engineers. ### Claim 12 (depends on 7) The method of claim 7, wherein the notification of one or more server configuration issues is provided to an automated configuration remediation system. ### Claim 13 A system for applying one or more heuristics to collected server configurations to detect anomalous server configurations, the system comprising: at least one processor; and at least one non-transitory memory storing computer executable instructions that when executed by the at least one processor cause the system to carry out actions comprising: requesting, by a collection system, server configuration data, including one or more server configuration values, from a plurality of configuration agents running on a plurality of hosted servers to detect anomalous server configurations, wherein the plurality of hosted servers is grouped into a plurality of groups, each group of the plurality of groups identified by one or more server identifiers and comprising hosted servers using a same or a related server configuration; receiving, at the collection system, from the plurality of configuration agents the one or more configuration values of each hosted server in the plurality of hosted servers; storing the one or more server configuration values in one or more databases, organized based on the one or more server identifiers; accessing, by an analysis system, the one or more server configuration values from the one or more databases; applying one or more heuristics to the one or more server configuration values of the hosted servers in each group of the plurality of groups based on the one or more server identifiers; and in response to detecting the presence of one or more anomalous server configurations in the plurality of groups, providing a notification of one or more server configuration issues. ### Claim 14 (depends on 13) The system of claim 13, wherein the configuration values comprise: operating system configuration values and application configuration values. ### Claim 15 (depends on 13) The system of claim 13, wherein the one or more server identifiers comprises a server group identifier and a server hardware identifier. ### Claim 16 (depends on 13) The system of claim 13, wherein the one or more heuristics is based on existence of a standard value for the one or more configuration values. ### Claim 17 (depends on 13) The system of claim 13, wherein the one or more heuristics is based on existence of a common value for the one or more server configuration values, the common value corresponding to a count of the one or more server configuration values appearing in the server configuration data of the plurality of hosted servers using the same or the related server configuration in each group of the plurality of groups, and wherein the common value is present in at least a configurable threshold number of servers in the plurality of hosted servers. ### Claim 18 (depends on 13) The system of claim 13, wherein the notification of one or more server configuration issues comprises a message-based communication to one or more development engineers. ### Claim 19 (depends on 1) The non-transitory computer-readable media of claim 1, wherein applying one or more heuristics further comprises, for each group of the plurality of groups: determining if a standard value should be used to detect an anomalous server configuration within the group based on the one or more server identifiers; in response to determining the standard value should not be used, determining if a common value should be used to detect the anomalous server configuration within the group; and in response to determining that none of the standard value and the common value should be used, concluding the anomalous server configuration is detected within the group. ### Claim 20 (depends on 5) The non-transitory computer-readable media of claim 5, wherein the configurable threshold number of servers is a majority of servers in the plurality of hosted servers.