US 2019/0095263 A1 · ADVANCED COMPUTER SYSTEM DRIFT DETECTION

Abstract

Computer system drift can occur when a computer system or a cluster of computer systems deviates from ideal and/or desired behavior. In a server farm, for example, many different machines may be identically configured to work in conjunction with each other to provide an electronic service (serving web pages, processing electronic payment transactions, etc.). Over time, however, one or more of these systems may drift from previous behavior. Early drift detection can be important, especially in large enterprises, to avoiding costly downtime. Changes in a computer's configuration files, network connections, and/or executable processes can indicate ongoing drift, but collecting this information at scale can be difficult. By using certain hashing and min-Hash techniques, however, drift detection can be streamlined and accomplished for large scale operations. Velocity of drift may also be tracked using a decay function.

Claims20

Dependent claims

A method to facilitate detecting system drift, comprising:

performing a first scan of a plurality of configuration files corresponding to a first computer system, wherein the configuration files include information affecting one or more behaviors of the first computer system;
hashing the plurality of configuration files to produce a corresponding first plurality of configuration hash strings;
performing a min-Hash operation on the first plurality of configuration hash strings to produce a min-Hash signature for the first computer system, wherein the min-Hash signature includes information indicative of a status for individual ones of the plurality of configuration files corresponding to the first computer system;
and
transmitting the min-Hash signature, via a network, to a monitoring system.

2 more elements

A monitoring system, comprising:

a processor;
and
a memory having stored thereon instructions that are executable by the processor to cause the system to perform operations comprising:
receiving, from a first computer system, a first min-Hash signature, wherein the first min-Hash signature includes information indicative of a status for each of a first plurality of configuration files corresponding to the first computer system, and wherein the first min-Hash signature was generated by a min-hash operation performed on a first plurality of configuration hash strings produced from hashing a plurality of configuration files corresponding to the first computer system;
receiving, at a later time from receiving the first min-Hash signature, a second min-Hash signature that includes information indicative of a status for each of a second plurality of configuration files corresponding to the first computer system, wherein the second min-Hash signature was generated by performing the min-Hash operation on a second plurality of configuration hash strings produced from hashing the second plurality of configuration files corresponding to the first computer system;
comparing the first min-Hash signature to the second min-Hash signature;
and
based on results of the comparing, determining a rate of system drift for the first computer system.

5 more elements

Dependencies are inferred from the claim text.

Advanced computer system drift detection

Life of this patent

Advanced computer system drift detection

Life of this patent

Abstract

Claims20