Centralized Configuration and Change Tracking of Computer Platforms

Abstract

To provide techniques for centralizing configuration data and tracking changes of the data.SOLUTION: An embodiment may involve: in response to determining that a software service satisfies a degradation criterion, generating an alert that indicates the software service and a change request specifying that configuration data used by the software service has been changed in a current snapshot of the configuration data; based on the change request, determining a set of configuration changes between the current snapshot and a previous snapshot of the configuration data; and providing a representation of the set of configuration changes indicating one or more parameters that have been changed in the current snapshot and one or more paths in a tree-based arrangement of the configuration data that lead to the one or more parameters that have been changed in the current snapshot.SELECTED DRAWING: Figure 8

Description

Background Art

[0001] Modern computer platforms have become large-scale and complex, supporting hundreds or thousands of software applications simultaneously, and enabling more advanced services through groups of software applications that operate in cooperation with each other. As a result, these computer platforms can have tens of thousands to millions of individually configurable parameters that control the operation of the platform, software applications, and / or services. These parameters are collectively referred to as configuration data.

Summary of the Invention

[0002] In many realistic scenarios, the configuration data can change frequently. For example, in agile software development or rapid software development procedures, these parameters may be updated thousands of times a day across the entire platform. Some specific parameters may change multiple times a day or a week as the software application and / or its usage evolves. Furthermore, the configuration data may be stored in multiple locations within the computer platform or outside the platform, making it difficult and time-consuming to locate or identify specific parameters.

[0003] As a result, it becomes difficult to track and manage changes to the configuration data. Consequently, configuration errors (e.g., one or more parameters having incorrect values) are now thought to be the cause of system downtime, defects, and malfunctions more often than software coding errors.

[0004] Embodiments of this specification overcome the above and other possible limitations of the prior art by providing techniques for centralizing configuration data and tracking changes to this data. Each version of the configuration data may be referred to as a snapshot. Modifications to the configuration data can originate from a change request that specifies the files, database entries, and / or other structures affected by each change. Thereby, a timeline of changes is generated from the snapshots, and differences between the parameters of the snapshots can be determined based on the change requests. Such differences can be presented in a tree-like hierarchy that clearly shows the additions, deletions, and modifications (edits) from one snapshot to another. This is convenient for quickly identifying and sorting out configuration glitches without having to examine thousands of parameters in many places.

[0005] Regarding the representation of these changes, in many existing systems, the representation is done by storing parameters (or changes to parameters) in the rows of a database table. As described above, on a computer platform, there may be thousands of changes per day. Therefore, in identifying changes between snapshots, after writing thousands of such rows to the table, these rows may be read out and the changes presented to the user.

[0006] In such a process, since it takes about 1 millisecond for each line of writing or reading, the latency may increase. Therefore, it may take at least several seconds, and in some cases several minutes, to operate and check a large change table. To avoid such user-side delays, in the embodiments of this specification, a virtual table can be adopted. According to this technology, by using a database interface, it becomes possible to access a part of one or more files stored in the file system of a computer platform. Therefore, instead of a database table, it is possible to write changes to a file and read changes from a file, enabling a speedup of 10 to 100 times. Furthermore, by paginating the output displayed to the user, only a small part of the changes in the file can be displayed at a time. In combination, this method can suppress the use of main memory and significantly improve the response time of the computer platform when presenting this information to the user.

[0007] Accordingly, a first exemplary embodiment may include generating an alert indicating a software service and a change request specifying that the configuration data used by the software service has been changed in the current snapshot of the configuration data in response to a determination that the software service meets a degradation criterion. The first exemplary embodiment may also include determining a set of configuration changes between the current snapshot and a previous snapshot of the configuration data based on the change request. The first exemplary embodiment may also include providing a representation of a set of configuration changes indicating one or more parameters changed in the current snapshot and one or more paths in a tree-based arrangement of configuration data leading to the one or more parameters changed in the current snapshot.

[0008] The second exemplary embodiment is to receive, in a web server application, a query specifying a file, the number of data blocks in the file, and the block size, where the file includes entries representing differences between snapshots of configuration data. Receive and, based on the block size, identify data blocks in the file, store the blocks in non-transitory memory accessible to the web server application, and, in response to the query, transmit, by the web server application, a set of entries in the blocks formatted for display in a list component of a graphical user interface.

[0009] The third exemplary embodiment may include a non-transitory computer-readable medium storing program instructions that, when executed by a computer system, cause the computer system to perform the operations described in the first and / or second exemplary embodiments.

[0010] In a fourth exemplary embodiment, a computer system may include at least one processor, as well as memory and program instructions. The program instructions may be stored in the memory and, when executed by the at least one processor, may cause the computer system to perform the operations described in the first and / or second exemplary embodiments.

[0011] In a fifth exemplary embodiment, a system may include various means for performing each of the operations of the first and / or second exemplary embodiments.

[0012] Those skilled in the art will, while referring to the accompanying drawings as necessary, read the following detailed description to clarify the above and other embodiments, aspects, advantages, and alternatives. Further, since this summary and other descriptions and drawings described herein are only intended to illustrate embodiments by way of example, many variations are possible. For example, with respect to structural elements and process steps, rearrangements, combinations, distributions, removals, or modifications can be made while remaining within the scope of the embodiments such as the claims.

Brief Description of the Drawings

[0013]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6A

Figure 6B

Figure 6C

Figure 7A

Figure 7B

Figure 7C

Figure 7D

Figure 7E

Figure 7F

Figure 8

Figure 9

Figure 10

Figure 11

Figure 12

Figure 13

Best Mode for Carrying Out the Invention

[0014] This specification describes exemplary methods, devices, and systems. In this specification, the words "example" and "exemplary" are understood to be used to mean "serving as an example, instance, or illustration". Any embodiment or feature described herein as "example" or "exemplary" is not necessarily to be construed as preferred or advantageous over other embodiments or features unless otherwise stated. Thus, other embodiments can be utilized and other changes can be made without departing from the scope of the subject matter presented herein.

[0015] Accordingly, the exemplary embodiments described herein are not meant to be limiting. It will be readily understood that the aspects of the present disclosure as described throughout this specification and shown in the drawings can be arranged, substituted, combined, separated, and designed in a wide variety of different configurations. For example, the separation of functions into "client" and "server" components can be implemented in many ways.

[0016] Furthermore, unless otherwise indicated by context, the features shown in each drawing can be used in combination with one another. For this reason, the drawings should generally be regarded as showing aspects of the components of one or more overall embodiments, and it is understood that not all of the features shown are necessary for each embodiment.

[0017] Also, any enumeration of elements, blocks, or steps in this specification or the claims is for purposes of clarity. Thus, such enumeration should not be construed as requiring or implying compliance with a particular arrangement of these elements, blocks, or steps or performance in a particular order.

[0018] I. Introduction Large enterprises are complex entities with many interrelated operations. Among these are those found throughout the enterprise, such as human resources (HR), supply chain, information technology (IT), and finance. However, each enterprise also has its own unique operations that lead to the provision of essential capabilities and / or the building of competitive advantages.

[0019] To support widely implemented operations, enterprises typically use off-the-shelf software applications such as customer relationship management (CRM) and human capital management (HCM) packages. However, custom software applications may also be needed to meet the enterprise's own unique requirements. Large enterprises often have dozens or hundreds of these custom software applications. In contrast, the advantages provided by the embodiments of this specification are considered applicable not only to large enterprises but also to enterprises or other types of organizations of all sizes.

[0020] Many such software applications are developed by individual departments within the enterprise. These range from simple spreadsheets to bespoke software tools and databases. However, the proliferation of custom software applications without coordination with other departments has many drawbacks. This has an adverse impact on the enterprise's ability to operate and grow its business, technological innovation, and response to regulatory requirements. The enterprise may find it difficult to integrate, rationalize, and strengthen its operations due to the lack of a single system to integrate its subsystems and data.

[0021] To efficiently produce custom applications, enterprises will benefit from a remote-hosted application platform that eliminates unnecessary development complexity. The goal of such a platform is to reduce time-consuming repetitive application development tasks so that software engineers and other task individuals can focus on developing highly valuable unique functions.

[0022] To achieve this goal, by introducing the concept of aPaaS (Application Platform as a Service), the enterprise-wide workflow is intelligently automated. The aPaaS system is hosted remotely from the enterprise but can access the enterprise's data, applications, and services through a secure connection. Such an aPaaS system has many advantageous functions and characteristics. These advantages and characteristics are considered to be able to improve the enterprise's operations and workflows with respect to IT, HR, CRM, customer service, application development, and security. In contrast, the embodiments of this specification are not limited to the enterprise's applications or environments and are more widely applicable.

[0023] The aPaaS system can support the development and execution of Model-View-Controller (MVC) applications. MVC applications divide each function into three interconnected parts (model, view, and controller), separating the representation of information from the way information is presented to the user, thereby enabling efficient code reuse and parallel development. These applications can be web-based and provide Create, Read, Update, and Delete (CRUD) functions. This makes it possible to build new applications on a common application infrastructure. In some cases, applications with a structure different from MVC, such as those using unidirectional data flow, may be adopted.

[0024] The aPaaS system can support standardized application components such as a set of standardized widgets for Graphical User Interface (GUI) development. In this way, the applications built using the aPaaS system have a common appearance and atmosphere. Similarly, other software components and modules may also be standardized. In some cases, it is also possible to brand or skin this appearance and atmosphere with the enterprise's custom logo and / or color scheme.

[0025] The aPaaS system may support the function of setting the operation of an application using metadata. By this means, the operation of the application can be quickly adapted to meet specific needs. By such a method, the development time is shortened and the flexibility is increased. Furthermore, the aPaaS system may support a GUI tool that facilitates the creation and management of metadata and suppresses metadata errors.

[0026] Since the aPaaS system may support a clearly defined interface between applications, software developers can avoid unnecessary application - to - application dependencies. For this reason, the aPaaS system can implement a service layer where data such as persistent state information is stored.

[0027] Since the aPaaS system may support a rich set of integration functions, the applications on the system can interact with legacy applications and third - party applications. For example, the aPaaS system may support a custom employee training system integrated with legacy HR, IT, and accounting systems.

[0028] The aPaaS system may support enterprise - level security. Furthermore, since the aPaaS system can be hosted remotely, security procedures should also be utilized when interacting with the enterprise's systems or third - party networks and services hosted outside the enterprise. For example, the aPaaS system may be configured to detect and identify common security threats by sharing data among parties such as enterprises.

[0029] Also, there may be other features, yesterday, and advantages of the aPaaS system. This description is for illustrative purposes and is not intended to be limiting in any way.

[0030] As an example of the aPaaS development process, software developers may be instructed to use an aPaaS system to create a new application. The developer may first define a data model that specifies the types of data used by the application and the relationships between them. The developer then inputs (e.g., uploads) the data model via the GUI of the aPaaS system. The aPaaS system automatically creates all the corresponding database tables, fields, and relationships, which are accessible via an object-oriented service layer.

[0031] In addition, the aPaaS system can build a fully functional application with a client-side interface and server-side CRUD logic. This generated application can function as a basis for further user development. It is convenient for developers as they do not need to spend much time on the basic functions of the application. Furthermore, since the application may be web-based, it is accessible from any internet-enabled client device. As an alternative or addition, access to a local copy of the application may be available, for example, when internet services are not available.

[0032] Also, the aPaaS system can support a rich set of predefined functions that can be added to the application. These functions include support for search, email, templates, workflow design, reports, analytics, social media, scripting, mobile output, and customized GUIs.

[0033] Such an aPaaS system can represent the GUI in various ways. For example, the server device of the aPaaS system may generate the representation of the GUI using a combination of Hypertext Markup Language (HTML) and JAVASCRIPT (registered trademark). JAVASCRIPT (registered trademark) may include client-side executable code, server-side executable code, or both. By the server device sending or providing this representation to the client device, the client device may display it on the screen according to the locally defined appearance and atmosphere. Alternatively, the representation of the GUI may be in other forms, such as an intermediate form (e.g., JAVA (registered trademark) bytecode) that can be used by the client device to directly generate graphic output. There are also other possibilities.

[0034] Furthermore, user interactions with GUI elements such as buttons, menus, tabs, sliders, checkboxes, toggles, etc. may also be referred to as respective "selections", "activations", or "operations". These terms can be used regardless of whether the interaction with the GUI element is by keyboard, pointing device, touch screen, or another mechanism.

[0035] The aPaaS architecture is integrated with the enterprise network and is particularly effective when used for the management of such a network. In the following embodiments, in addition to the exemplary architecture and functional aspects of the aPaaS system, each feature and advantage will be described.

[0036] II. Exemplary Computer Devices and Cloud-Based Computer Environments FIG. 1 is a simplified block diagram illustrating a computer device 100, showing a part of the components included in the computer device and configured to operate according to the embodiments of this specification. The computer device 100 can be a client device (for example, a device actively operated by a user), a server device (for example, a device that provides computing services to a client device), or any other type of computing platform. Some server devices sometimes operate as client devices to execute specific operations, and some client devices incorporate server functions.

[0037] In this example, the computer device 100 includes a processor 102, a memory 104, a network interface 106, and an input / output unit 108, and all of these may be coupled by a system bus 110 or a similar mechanism. In some embodiments, the computer device 100 may include other components and / or peripheral devices (for example, removable storage, printers, etc.).

[0038] The processor 102 may be one or more of any type of computer processing element, such as a central processing unit (CPU), a coprocessor (for example, a math, graphics, or encryption coprocessor), a digital signal processor (DSP), a network processor, and / or in the form of an integrated circuit or a controller that executes processor operations. Optionally, the processor 102 may be one or more single-core processors. In other cases, the processor 102 may be one or more multi-core processors with multiple independent processing units. Also, the processor 102 may include, in addition to register memory for temporarily storing instructions and related data to be executed, cache memory for temporarily storing recently used instructions and data.

[0039] Memory 104 may be any form of computer-usable memory, including, but not limited to, random access memory (RAM), read-only memory (ROM), and non-volatile memory (e.g., flash memory, hard disk drive, semiconductor drive, compact disk (CD), digital video disk (DVD), and / or tape storage). Thus, memory 104 represents both main memory units and long-term storage. Other types of memory include biological memory.

[0040] Memory 104 may store program instructions and / or data on which the program instructions may operate. As an example, memory 104 may store these program instructions on a non-transitory computer-readable medium so that, when executed by processor 102, any of the methods, processes, or operations disclosed in this specification or the accompanying drawings can be performed.

[0041] As shown in FIG. 1, memory 104 may include firmware 104A, kernel 104B, and / or application 104C. Firmware 104A may be program code used to start or initiate some or all of computer device 100. Kernel 104B may be an operating system that includes modules for memory management, processor scheduling and management, input / output, and communication. Also, kernel 104B may include device drivers that enable communication between the operating system and the hardware modules of computer device 100 (e.g., memory units, network interfaces, ports, and buses). Application 104C may be one or more user-space software programs such as a web browser or an email client, as well as any software libraries used by these programs. Also, memory 104 may store data used by the above and other programs and applications.

[0042] The network interface 106 may be in the form of one or more wired interfaces such as Ethernet (e.g., Fast Ethernet, Gigabit Ethernet). Also, the network interface 106 may support communication via one or more non-Ethernet media such as coaxial cables or power lines, or wide area media such as Synchronous Optical Networking (SONET) or Digital Subscriber Line (DSL) technologies. Further, the network interface 106 may be in the form of one or more wireless interfaces such as IEEE 802.11 (Wifi), BLUETOOTH (registered trademark), Global Positioning System (GPS), or wide area wireless interfaces. However, other forms of physical layer interfaces and other types of standards or proprietary communication protocols may be used via the network interface 106. Additionally, the network interface 106 may include multiple physical interfaces. For example, some embodiments of the computer device 100 may include Ethernet, BLUETOOTH (registered trademark), and Wifi interfaces.

[0043] The input / output unit 108 can facilitate the interaction between the user and the computer device 100 and peripheral devices. The input / output unit 108 may include one or more types of input devices (keyboard, mouse, touch screen, etc.). Similarly, the input / output unit 108 may include one or more types of output devices (screen, monitor, printer, and / or one or more Light Emitting Diodes (LEDs), etc.). As an addition or alternative, the computer device 100 can communicate with other devices, for example, by using a Universal Serial Bus (USB) or a High-Definition Multimedia Interface (HDMI) port interface.

[0044] In some embodiments, the deployment of one or more computer devices, such as computer device 100, may support the aPaaS architecture. The exact physical location, connectivity, and configuration of these computer devices may be unknown and / or unimportant to the client device. Thus, the computer devices may sometimes be referred to as "cloud-based" devices that can be housed at various remote data center locations.

[0045] FIG. 2 shows a cloud-based server cluster 200 according to an exemplary embodiment. In FIG. 2, the operation of a computer device (e.g., computer device 100) may be distributed among server devices 202, data storage 204, and router 206, all of which may be connected by a local cluster network 208. The number of server devices 202, data storage 204, and routers 206 in server cluster 200 may be determined by the computing tasks and / or applications assigned to server cluster 200.

[0046] For example, server device 202 may be configured to execute various computing tasks of computer device 100. Thus, computing tasks may be distributable to one or more server devices 202. To the extent that these computing tasks can be executed in parallel, such task distribution can reduce the total time until these tasks are completed and results are returned. For simplicity, both server cluster 200 and individual server devices 202 may sometimes be referred to as "server devices". This nomenclature is to be understood as an implication that one or more different server devices, data storage devices, and cluster routers may be involved in the operation of the server device.

[0047] The data storage 204 may be a data storage array including a drive array controller configured to manage read and write access to a plurality of groups of hard disk drives and / or semiconductor drives. Also, the drive array controller may be configured to manage backups or redundant copies of data stored in the data storage 204, either alone or in conjunction with the server device 202, for protection against drive failures or other types of failures in which one or more server devices 202 become unable to access units of the data storage 204. Other types of memory other than drives may be used.

[0048] The router 206 may include network equipment configured to provide internal and external communications to the server cluster 200. For example, the router 206 may include one or more packet switching and / or routing devices (including switches and / or gateways) configured to provide (i) network communication between the server device 202 and the data storage 204 via the local cluster network 208, and / or (ii) network communication between the server cluster 200 and other devices via the communication link 210 to the network 212.

[0049] Also, the configuration of the router 206 may be based at least in part on the data communication requirements of the server device 202 and the data storage 204, the latency and throughput of the local cluster network 208, the latency, throughput, and cost of the communication link 210, and / or other factors that may contribute to the cost, speed, fault tolerance, resilience, efficiency, and / or other design goals of the system architecture.

[0050] As an example, data storage 204 may include any form of database such as a Structured Query Language (SQL) database. In such a database, various types of data structures can store information, including but not limited to tables, arrays, lists, trees, and tuples. Further, any database in data storage 204 may be monolithic or distributed across multiple physical devices.

[0051] Server device 202 may be configured to transmit data to and / or receive data from data storage 204. This transmission and reading may each be in the form of an SQL query or other type of database query and the output of such a query. Similarly, text, images, video, and / or audio may additionally be included. Further, server device 202 may be configured to compile received data as a representation of a web page or web application. Such a representation may be in the form of a markup language such as HTML, Extensible Markup Language (XML), or any other standardized or proprietary format. Further, server device 202 may be capable of executing various types of computerized scripting languages, including but not limited to Perl, Python, PHP Hypertext Preprocessor (PHP), Active Server Pages (ASP), JAVASCRIPT (registered trademark), etc. Computer program code written in these languages may, in addition to providing web pages to client devices, facilitate interaction with web pages of client devices. Alternatively or additionally, JAVA (registered trademark) may be used to facilitate the generation of web pages and / or provide web application functionality.

[0052] III. Exemplary Remote Network Management Architecture Figure 3 shows a remote network management architecture according to an exemplary embodiment. This architecture includes three main components: a managed network 300, a remote network management platform 320, and a public cloud network 340, all of which are connected by the Internet 350.

[0053] A. Managed Network The managed network 300 may be an enterprise network used by entities for data storage, among other computing and communication tasks. For this reason, the managed network 300 may include client devices 302, server devices 304, routers 306, virtual machines 308, firewalls 310, and / or proxy servers 312. The client devices 302 may be implemented by computer devices 100, the server devices 304 may be implemented by computer devices 100 or server clusters 200, and the routers 306 may be any type of router, switch, or gateway.

[0054] The virtual machines 308 may be implemented by one or more of the computer devices 100 and server clusters 200. Generally, a virtual machine is an emulation of a computer system that mimics the functions of a physical computer (e.g., processors, memory, and communication resources). One physical computer system, such as the server cluster 200, can support up to thousands of individual virtual machines. In some embodiments, the virtual machines 308 may be managed by a centralized server device or application that facilitates the allocation of physical computing resources to individual virtual machines, as well as performance and error reporting. Enterprises often efficiently allocate computing resources as needed by adopting virtual machines. Providers of virtualized computer systems include VMWARE (registered trademark) and MICROSOFT (registered trademark).

[0055] The firewall 310 may be one or more dedicated routers or server devices that protect the managed network 300 from unauthorized access attempts to internal devices, applications, and services while permitting legitimate communication originating from the managed network 300. Additionally, the firewall 310 may provide intrusion detection, web filtering, virus scanning, application layer gateway, and other applications or services. In some embodiments not shown in FIG. 3, the managed network 300 may comprise one or more virtual private network (VPN) gateways for communicating with a remote network management platform 320 (see below).

[0056] Also, the managed network 300 may comprise one or more proxy servers 312. One embodiment of the proxy server 312 may be a server application that facilitates the communication and transfer of data among the managed network 300, the remote network management platform 320, and the public cloud network 340. In particular, the proxy server 312 may be able to establish and maintain a secure communication session with one or more computing instances of the remote network management platform 320. Such a session may enable the remote network management platform 320 to detect and manage the architecture and configuration aspects of the managed network 300 and its components.

[0057] In some cases, with the assistance of the proxy server 312, the remote network management platform 320 may also be able to detect and manage the aspects of the public cloud network 340 used by the managed network 300. Although not shown in FIG. 3, this detection and management may be facilitated by placing one or more proxy servers 312 in any of the public cloud networks 340.

[0058] Firewalls such as firewall 310 typically do not originate sessions such as those described above behind the firewall (i.e., devices on the managed network 300), and reject all incoming communication sessions via the Internet 350 unless the firewall is explicitly configured to support the session. By placing proxy server 312 behind firewall 310 (e.g., placing it within the managed network 300 and protecting it with firewall 310), proxy server 312 can initiate these communication sessions through firewall 310. This may eliminate the need for firewall 310 to be specially configured to support incoming sessions from remote network management platform 320, thus avoiding potential security risks to the managed network 300.

[0059] In some cases, the managed network 300 may consist of a small number of devices and a small number of networks. In other deployments, the managed network 300 may include hundreds of networks and hundreds of thousands of devices in multiple physical locations. Therefore, the architecture shown in FIG. 3 can scale up or down by orders of magnitude.

[0060] Furthermore, depending on the size, architecture, and connectivity of the managed network 300, the number of proxy servers 312 deployed internally can be varied. For example, each proxy server 312 may be responsible for communicating with the remote network management platform 320 for a portion of the managed network 300. As an alternative or addition to this, load balancing, redundancy, and / or improved availability may be achieved by assigning multiple sets of two or more proxy servers to such portions of the managed network 300.

[0061] B. Remote Network Management Platform The remote network management platform 320 is a hosted environment that provides aPaaS services to users, particularly operators of the managed network 300. These services may be in the form of a web-based portal using, for example, the aforementioned web-based technologies. Thus, users can securely access the remote network management platform 320 from, for example, the client device 302 or potentially a client device outside the managed network 300. The web-based portal enables users to design, test, and deploy applications, generate reports, review analytics, and perform other tasks. Also, the remote network management platform 320 may be referred to as a multi-application platform.

[0062] As shown in FIG. 3, the remote network management platform 320 includes four computing instances 322, 324, 326, and 328. These computing instances may each represent one or more nodes and / or one or more database nodes running a dedicated copy of the aPaaS software. On physical server equipment and / or virtual machines, flexible placement of servers and databases is possible and may be changed based on the needs of the enterprise. In combination, these nodes can provide a set of web portals, services, and applications (e.g., a fully functional aPaaS system) available to a particular enterprise. In some cases, a single enterprise may use multiple computing instances.

[0063] For example, the managed network 300 may be an enterprise customer of the remote network management platform 320, and may also use the computing instances 322, 324, and 326. The reason for providing multiple computing instances to a single customer is that the customer may desire independent development, testing, and deployment of its applications and services. For this reason, the computing instance 322 may be dedicated to application development related to the managed network 300, the computing instance 324 may be dedicated to testing these applications, and the computing instance 326 may be dedicated to the live operation of the tested applications and services. Also, the computing instances may be referred to as hosted instances, remote instances, customer instances, or some other designation. Any application deployed on a computing instance may be considered a scoped application in that access to the database within the computing instance may be restricted to specific internal elements (e.g., one or more specific database tables or specific rows within one or more database tables).

[0064] For simplicity, in the disclosure of this specification, the configuration of the application node, database node, aPaaS software executed thereon, and the underlying hardware is referred to as a "computing instance". Note that a user may colloquially refer to the graphical user interface provided as above as an "instance". However, unless otherwise defined in this specification, a "computing instance" is a computer system disposed within the remote network management platform 320.

[0065] The multi-instance architecture of the remote network management platform 320 offers several advantages as compared to the conventional multi-tenant architecture. In a multi-tenant architecture, data from different customers (e.g., enterprises) is mixed in a single database. Although the data of these customers is separated from each other, this separation is enforced by software operating on a single database. As a result, a security breach in this system affects all the data of the customers, posing an additional risk especially for entities subject to government, medical, and / or financial regulations. Furthermore, any database operation that affects one customer may potentially affect all the customers sharing that database. Thus, in case of a halt due to hardware or software errors, this halt affects all such customers. Similarly, when the database is upgraded to meet the needs of one customer, all customers become unavailable during the upgrade process. Such maintenance timeframes tend to be long due to the size of the shared database.

[0066] In contrast, the multi-instance architecture provides each customer with its own database in a dedicated computing instance. This prevents the mixing of customer data and enables independent management of each instance. For example, even if an instance of a certain customer halts due to an error or upgrade, other computing instances are not affected. Since the database contains only the data of one customer, the maintenance downtime is limited. Furthermore, the simpler design of the multi-instance architecture allows redundant copies of each customer database and instance to be geographically diversely deployed. This promotes high availability and enables the live version of the customer instance to be movable during fault detection or maintenance execution.

[0067] In some embodiments, the remote network management platform 320 may include one or more central instances that are controlled by the entity operating this platform. Similar to the compute instances, the central instances may include some applications and database nodes deployed on several physical server devices or virtual machines. Such central instances may, in addition to the compute instances, function as a repository for a specific configuration of data that may be shared by at least a portion of the compute instances. For example, definitions of common security threats that may occur on the compute instances, software packages that are commonly detected on the compute instances, and / or an application store for applications deployable to the compute instances may be present in the central instances. The compute instances may communicate with the central instances via a clearly defined interface to obtain this data.

[0068] To efficiently support multiple compute instances, the remote network management platform 320 may run these multiple instances on a single hardware platform. For example, an aPaaS system, when running on a server cluster such as server cluster 200, may operate virtual machines that allocate various amounts of compute, storage, and communication resources to the instances. However, full virtualization of the server cluster 200 is not required, and other mechanisms may be used to separate the instances. In some examples, each instance may have a dedicated account and one or more dedicated databases on the server cluster 200. Alternatively, a compute instance such as compute instance 322 may span multiple physical devices.

[0069] In some cases, a single server cluster of the remote network management platform 320 may support multiple independent enterprises. Further, as described later, the remote network management platform 320 may include multiple server clusters deployed in geographically diverse data centers to facilitate load balancing, redundancy, and / or high availability.

[0070] C. Public Cloud Network The public cloud network 340 may be remote server equipment (e.g., multiple server clusters such as the server cluster 200) that can be used for outsourced computing, data storage, communication, and service hosting operations. These servers may be virtualized (i.e., they may be virtual machines). Examples of the public cloud network 340 include AMAZON WEB SERVICES (registered trademark) and MICROSOFT (registered trademark) AZURE (registered trademark). Similar to the remote network management platform 320, multiple server clusters supporting the public cloud network 340 may be deployed in geographically diverse locations for the purpose of load balancing, redundancy, and / or high availability.

[0071] The managed network 300 may use one or more public cloud networks 340 to deploy applications and services to its clients and customers. For example, if the managed network 300 provides an online music streaming service, the public cloud network 340 may store music files and provide web interface and streaming functions. In this way, the enterprises of the managed network 300 do not need to build and maintain their own servers for these operations.

[0072] The remote network management platform 320 may include modules that expose internal virtual machines and managed services to the managed network 300 through integration with the public cloud network 340. These modules may enable users to request virtual resources, detect allocated resources, and provide flexible reporting to the public cloud network 340. To establish this functionality, users of the managed network 300 may first create an account in the public cloud network 340 and may request a set of related resources. Subsequently, the user may enter the account information into an appropriate module of the remote network management platform 320. These modules may then automatically detect the account's manageable resources and may provide reports related to usage, performance, and billing.

[0073] D. Communication Support and Other Operations The Internet 350 may represent a part of the global Internet. However, the Internet 350 may alternatively represent different types of networks, such as a private wide area or local area packet-switched network.

[0074] FIG. 4 further shows the communication environment between the managed network 300 and the computing instance 322, and introduces additional features and alternative embodiments. In FIG. 4, all or part of the computing instance 322 is replicated in both data centers 400A and 400B. These data centers may be geographically separated from each other and may perhaps be in different cities or different countries. Each data center includes, in addition to the managed network 300, support facilities that facilitate communication with remote users.

[0075] In data center 400A, network traffic to external devices flows through VPN gateway 402A or firewall 404A. The VPN gateway 402A may be peered with the VPN gateway 412 of the managed network 300 by a security protocol such as Internet Protocol Security (IPSEC) or Transport Layer Security (TLS). The firewall 404A may be configured to permit access from legitimate users such as user 414 and remote user 416, and to deny access from unauthorized users. By the firewall 404A, these users can access the compute instance 322 and optionally other compute instances. The load balancer 406A may be used to distribute traffic among one or more physical or virtual server devices hosting the compute instance 322. The load balancer 406A can simplify user access by hiding the internal configuration of the data center 400A (e.g., the compute instance 322) from the client device. For example, if the compute instance 322 includes a plurality of physical or virtual computer devices sharing access to a plurality of databases, the load balancer 406A may distribute network traffic and processing tasks among these computer devices and databases such that no one computer device or database is significantly busier than the others. In some embodiments, the compute instance 322 may include the VPN gateway 402A, the firewall 404A, and the load balancer 406A.

[0076] Data center 400B may include its own version of the components of data center 400A. Thus, VPN gateway 402B, firewall 404B, and load balancer 406B may each perform the same or similar operations as VPN gateway 402A, firewall 404A, and load balancer 406A, respectively. Additionally, the compute instance 322 may exist simultaneously in data centers 400A and 400B through real-time or near real-time database replication and / or other operations.

[0077] Data centers 400A and 400B, as shown in FIG. 4, may promote redundancy and high availability. In the configuration of FIG. 4, data center 400A is active and data center 400B is passive. Thus, data center 400A serves all traffic to the managed network 300, while the version of the compute instance 322 in data center 400B is updated near real-time. Other configurations, such as a configuration where both data centers are active, may be supported.

[0078] If data center 400A experiences some failure or becomes unavailable to users, data center 400B can take over as the active data center. For example, a domain name system (DNS) server that associates the domain name of the compute instance 322 with one or more Internet protocol (IP) addresses of data center 400A may re-associate the domain name with one or more IP addresses of data center 400B. After this re-association is complete (which may be considered to be within 1 second or less than a few seconds), users can access the compute instance 322 by data center 400B.

[0079] Also, FIG. 4 shows a possible configuration of the managed network 300. As described above, the proxy server 312 and the user 414 can access the computing instance 322 through the firewall 310. Also, the proxy server 312 can access the configuration item 410. In FIG. 4, the configuration item 410 can represent any or all of the client device 302, the server device 304, the router 306, and the virtual machine 308, any of these components, any application or service running thereon, as well as the relationships between the devices, components, applications, and services. For this reason, the term "configuration item" may be an abbreviation representing any physical or virtual device, any application or service that can be remotely detected or managed by the computing instance 322, or a part or all of the relationships between the detected devices, applications, and services. The configuration item can be represented in the configuration management database (CMDB) of the computing instance 322.

[0080] Upon storage or transmission, the configuration item may be a list of attributes characterizing the hardware or software represented by the configuration item. These attributes may include the manufacturer, vendor, location, owner, unique identifier, description, network address, operating status, serial number, last update time, etc. The class of the configuration item can determine a subset of the attributes present for the configuration item (for example, software and hardware configuration items may have different attribute lists).

[0081] As described above, the VPN gateway 412 can provide a dedicated VPN to the VPN gateway 402A. Such a VPN can be useful when there is a large amount of traffic between the managed network 300 and the compute instance 322, or when the security policy suggests or requires the use of a VPN between these sites. In some embodiments, any device of the managed network 300 and / or the compute instance 322 that communicates directly via the VPN is assigned a public IP address. Other devices of the managed network 300 and / or the compute instance 322 can be assigned private IP addresses (e.g., IP addresses selected from the ranges 10.0.0.0 to 10.255.255.255 or 192.168.0.0 to 192.168.255.255, each abbreviated as the subnets 10.0.0.0 / 8 and 192.168.0.0 / 16). In various alternatives, a device of the managed network 300, such as the proxy server 312, may communicate directly with one or more data centers using a secure protocol (e.g., TLS).

[0082] IV. Exemplary Detection The remote network management platform 320 may first determine the devices, their configurations, components, and operating states, as well as the applications and services provided by the devices, that exist in the managed network 300 in order to manage the devices, applications, and services of the managed network 300. The remote network management platform 320 may also determine the relationships between the detected devices, their respective components, applications, and services. The representation of each device, component, application, and service may be referred to as a setting item. The process of determining the setting items and relationships within the managed network 300 is referred to as detection, which can be facilitated at least in part by the proxy server 312. The representation of the setting items and relationships is stored in the CMDB.

[0083] In this section, the detection performed on the managed network 300 is described, but the same or similar detection procedures may also be used on the public cloud network 340. For this reason, in some environments, "detection" may represent the detection of configuration items and relationships on the managed network and / or one or more public cloud networks.

[0084] For the embodiments of this specification, "application" may represent one or more processes, threads, programs, client software modules, server software modules, or any other software executed on a device or group of devices. "Service" may represent a high-level function provided by one or more applications executed on one or more devices that act in cooperation with each other. For example, a web service may include multiple web application server threads that execute on one device and access information from a database application executed on another device.

[0085] FIG. 5 is a logical depiction of how configuration items and relationships can be detected and how information related to them can be stored. For simplicity, the remote network management platform 320, the public cloud network 340, and the Internet 350 are not shown.

[0086] In FIG. 5, the arrangement and / or operation of the CMDB 500, the task list 502, and the identification / mediation engine (IRE) 514 are performed within the compute instance 322. The task list 502 represents the connection point between the compute instance 322 and the proxy server 312. The task list 502 may also be referred to as a queue, or more specifically, an external communication channel (ECC) queue. The task list 502 may represent not only the queue itself but also any related processing such as the addition, deletion, and / or manipulation of queue information.

[0087] When detection is performed, the computing instance 322 may store the detection tasks (jobs) to be executed by the proxy server 312 in the task list 502 until the proxy server 312 requests these tasks in one or more batches. Placing the tasks in the task list 502 may trigger or initiate the proxy server 312 to start each detection operation. For example, the proxy server 312 may poll the task list 502 periodically or as needed, or notify the proxy server 312 of the detection commands in the task list 502 in some other way. As an alternative or addition to this, the detection may be triggered manually or automatically based on a trigger event (for example, the detection may be automatically started once a day or at a specific time).

[0088] Nevertheless, the computing instance 322 may transmit these detection commands to the proxy server 312 upon request. For example, the proxy server 312 may repeatedly query the task list 502, obtain the next task therein, and execute this task until the task list 502 becomes empty or another stop condition is achieved. In response to receiving the detection command, the proxy server 312 may query various devices, components, applications, and / or services in the managed network 300 (represented as devices 504, 506, 508, 510, and 512 in FIG. 5 for simplicity). These devices, components, applications, and / or services may provide responses to the proxy server 312 regarding their respective configurations, operations, and / or states. In contrast, the proxy server 312 may then provide this detection information to the task list 502 (that is, the task list 502 may have a transmission queue for holding detection commands until requested by the proxy server 312 and a reception queue for holding detection information until read).

[0089] IRE514 may be a software module that extracts detection information from the task list 502 and organizes this detection information as configuration items (e.g., representing devices, components, applications, and / or services detected on the managed network 300) and the relationships between them. Then, IRE514 may provide these configuration items and relationships to the CMDB 500 for storage. The operation of IRE514 will be described in more detail below.

[0090] Thus, the configuration items stored in the CMDB 500 represent the environment of the managed network 300. As an example, these configuration items may represent a set of physical and / or virtual devices (e.g., client devices, server devices, routers, or virtual machines), applications running on these (e.g., web servers, email servers, databases, or storage arrays), and services that include multiple individual configuration items. The relationships may be pair definitions of the arrangement or dependency relationships between the configuration items.

[0091] So that the detection as described above can be performed, authentication information of the device to be detected may be set in the proxy server 312, the CMDB 500, and / or one or more authentication information stores. The authentication information may include any type of information required to access the device. These may include pairs of user ID / password, certificates, etc. In some embodiments, this authentication information may be stored in an encrypted field of the CMDB 500. The proxy server 312 may include a decryption key for this authentication information so that logging on to or accessing the device to be detected using the authentication information becomes possible.

[0092] There are two general types of detection: horizontal and vertical (top-down). Each will be discussed below.

[0093] A. Horizontal Detection Horizontal detection is used to scan the managed network 300, search for devices, components, and / or applications, and then input the configuration items representing these devices, components, and / or applications into the CMDB 500. Also, in horizontal detection, relationships between configuration items are generated. For example, a "runs on" relationship between a configuration item representing a software application and a configuration item representing the server device on which it runs is possible. Usually, horizontal detection does not recognize services and does not generate relationships between configuration items based on the services in operation.

[0094] There are two versions of horizontal detection. One relies on probes and sensors, while the other also employs patterns. The probes and sensors may be scripts (e.g., written in JAVASCRIPT (registered trademark)) that collect and process detection information on a device and then update the CMDB 500 accordingly. More specifically, the probes search or investigate devices on the managed network 300, and the sensors analyze the detection information returned from the probes.

[0095] The pattern is also a script that collects and processes data on one or more devices to update the CMDB. The pattern is written in a specific detection programming language and is used to perform detailed detection procedures on specific devices, components, and / or applications where reliable detection (or any detection at all) is often not possible with more general probes and sensors. In particular, the pattern can specify a series of operations that define the detection method for a specific arrangement of devices, components, and / or applications, the authentication information to use, and the CMDB table to input the configuration items as a result of this verification.

[0096] Any version can go through four logical stages: scanning, classification, identification, and search. Also, any version may require the specification of one or more ranges of IP addresses on the managed network 300 where detection is to be performed. Each stage may include communication between devices on the managed network 300 and the proxy server 312, as well as between the proxy server 312 and the task list 502. In some stages, some or preliminary configuration items may be stored in the CMDB 500, which can be updated in later stages.

[0097] In the scanning stage, the proxy server 312 may determine the general type of device and its operating system by probing each IP address within the specified range of IP addresses for open Transmission Control Protocol (TCP) and / or User Datagram Protocol (UDP) ports. The presence of such open ports on an IP address indicates that a specific application is running on the device to which the IP address is assigned, thereby enabling the identification of the operating system used by the device. For example, if TCP port 135 is open, this device is likely running the WINDOWS® operating system. Similarly, if TCP port 22 is open, this device is likely running a UNIX® operating system such as LINUX®. If UDP port 161 is open, this device may be separately identifiable through the Simple Network Management Protocol (SNMP). There are other possibilities as well.

[0098] During the classification stage, the proxy server 312 may further probe each detection device to determine the type of its operating system. The probes used for a particular device are based on the information collected about that device during the scan stage. For example, if a device with TCP port 22 open is found, a set of UNIX®-specific probes may be used. Similarly, if a device with TCP port 135 open is found, a set of WINDOWS®-specific probes may be used. In either case, an appropriate set of tasks may be placed in the task list 502 and the proxy server 312 may be made to execute these. By these tasks, the proxy server 312 becomes able to log on to or access information from a particular device. For example, when TCP port 22 is open, the proxy server 312 may be instructed to initiate a secure shell (SSH) connection to the particular device and obtain information about a particular type of the operating system on the device from a particular location in the file system. Based on this information, the operating system may be determined. As an example, a UNIX® device with TCP port 22 open may be classified as AIX®, HPUX, LINUX®, MACOS®, or SOLARIS®. This classification information may be stored in the CMDB 500 as one or more configuration items.

[0099] In the identification stage, the proxy server 312 may determine the specific details regarding the classified device. The probes used in this stage may be based on the information collected regarding a specific device in the classification stage. For example, if a device is classified as LINUX (registered trademark), a set of LINUX (registered trademark)-specific probes may be used. Similarly, if a device is classified as WINDOWS (registered trademark) 10, a set of WINDOWS (registered trademark) 10-specific probes may be used. Similar to the classification stage, an appropriate set of tasks may be placed in the task list 502 and the proxy server 312 may be made to execute them. By these tasks, the proxy server 312 can make the information such as basic input / output system (BIOS) information, serial number, network interface information, media access control addresses assigned to these network interfaces, IP addresses used by the specific device, etc. of a specific device readable. This identification information may be stored in the CMDB 500 as one or more configuration items along with any relevant relationships between them. At this time, by passing the identification information through the IRE 514, it may be possible to avoid the generation of duplicate configuration items for the purpose of ambiguity resolution and / or determine the table of the CMDB 500 in which the detection information should be written.

[0100] In the discovery stage, the proxy server 312 may determine additional details regarding the operating state of the classified device. The probes used in this stage may be based on the information collected regarding a specific device in the classification stage and / or the identification stage. Also in this case, an appropriate set of tasks may be placed in the task list 502 and the proxy server 312 may be made to execute them. By these tasks, the proxy server 312 can make additional information such as processor information, memory information, list of running processes (software applications), etc. of a specific device readable. Here again, the detection information may be stored in the CMDB 500 as one or more configuration items and relationships.

[0101] When performing horizontal detection on specific devices such as switches and routers, SNMP may be used. As an alternative or addition to the determination of the execution process or a list of other application-related information, in detection, the router may be made to determine the operating states (for example, active, inactive, queue length, number of dropped packets, etc.) of known additional subnets and the router's network interfaces. The IP addresses of the additional subnets may serve as candidates for other detection procedures. For this reason, horizontal detection may proceed iteratively or recursively.

[0102] Patterns are used only in the identification and exploration phases. In pattern-based detection, the scanning and classification phases act as they do when probes and sensors are used. After completion of the classification phase, a pattern probe is designated as the probe to be used for identification. Thereafter, the pattern probe and the pattern it designates are activated.

[0103] Patterns support many functions that are not available or difficult to implement in detection using probes and sensors by the detection programming language. For example, by using pattern-based detection, in addition to the detection of devices, components, and / or applications in a public cloud network, it becomes much easier to implement the tracking of configuration files. Furthermore, these patterns can be customized by the user more easily than probes and sensors. Also, since patterns are focused on specific devices, components, and / or applications, they can be executed faster than the more general methods used by probes and sensors.

[0104] Once the horizontal detection is completed, in the CMDB500, the setting item representations of each detection device, component, and / or application become available. For example, after detection, in addition to the operating system versions, hardware configurations, and network configuration details of client devices, server devices, and routers in the managed network 300, the applications running on them may be stored as setting items. By presenting these collected information to the user in various ways, the user may be able to confirm the hardware configuration and operating status of the device.

[0105] Furthermore, the CMDB500 may include entries regarding the relationships between setting items. More specifically, assume that a server device includes many hardware components (e.g., processors, memories, network interfaces, storage, and file systems), and multiple software applications are installed or executed on them. The relationships between components and the server device (e.g., the "inclusion" relationship) and between software applications and the server device (e.g., the "execution" relationship) may be represented as such in the CMDB500.

[0106] More generally, the relationships between software setting items installed or executed in hardware setting items may be in various forms such as hosting, execution, or dependency. For this reason, a database application installed on a server device may have a "hosting" relationship with the server device, indicating that the database application is hosted on the server device. In some embodiments, a server device may have a "usage" interrelationship with a database application, indicating that the server device is used by the database application. These relationships may be automatically found using the above-described detection procedures, but it is also possible to set the relationships manually.

[0107] In this way, the remote network management platform 320 can detect and list the hardware and software deployed and provided on the managed network 300.

[0108] B. Vertical Detection Vertical detection is a technique used for exploring and mapping configuration items that are part of an overall service such as a web service. For example, in vertical detection, a web service can be mapped by showing the relationships between a web server application, a LINUX (registered trademark) server device, and a database storing data for the web service. Usually, horizontal detection is first performed to find the configuration items and their basic relationships, and then vertical detection is performed to establish the relationships between the configuration items that make up the service.

[0109] By using patterns, specific types of services can be detected. This is because these patterns can be programmed to search for specific arrangements of hardware and software that conform to descriptions of how the service is deployed. As an alternative or addition to this, it is also possible to facilitate vertical detection by using traffic analysis (for example, investigating network traffic between devices). In some cases, it is also possible to manually set the parameters of the service to assist with vertical detection.

[0110] Generally, vertical detection attempts to find specific types of relationships between devices, components, and / or applications. Some of these relationships can be inferred from configuration files. For example, the configuration file of a web server application may represent the IP address and port number of the database it depends on. The vertical detection pattern can be programmed to search for such references and infer relationships therefrom. It is also possible to infer relationships from traffic between devices. For example, if there is a large amount of web traffic (e.g., TCP port 80 or 8080) flowing between a load balancer and the device hosting the web server, it is considered that the load balancer and the web server have some relationship.

[0111] The relationships found by vertical detection may be in various forms. As an example, an email service may include email server software configuration items and database application software configuration items, each installed on different hardware device configuration items. While the email service may have a "dependency" relationship with these software configuration items both on the one hand, the software configuration items have a "usage" interrelationship with the email service. Since such services may not be fully determinable by horizontal detection procedures, instead, they may rely on vertical detection and possibly some degree of manual configuration.

[0112] C. Advantages of Detection The detection information can be beneficial for the operation of the managed network regardless of the acquisition method. In particular, IT personnel can quickly determine the location where a specific software application is deployed and the configuration items that make up the service. As a result, the root cause of service outages or degradation can be quickly identified. For example, if the response times of two different services are slow, it can be determined that the root cause is, among other possible actions, a high processor utilization rate of the database application used by both services by querying the CMDB. Therefore, IT personnel can address the database application without wasting time considering the soundness and performance of other configuration items that make up the service.

[0113] In another example, assume that a database application is running on server equipment and that this database application is used not only for the employee training service but also for the salary calculation service. Therefore, if the server equipment stops operating for maintenance, the employee training service and the salary calculation service will clearly be affected. Similarly, the dependencies and relationships between configuration items can be considered to represent the services affected when a specific hardware device fails.

[0114] Generally, configuration items and / or the relationships between configuration items can be displayed on a web-based interface and represented as a hierarchy. Through this interface, modifications to the configuration items and / or relationships as described above in the CMDB can be achieved.

[0115] Furthermore, users of the managed network 300 can develop a workflow that enables the execution of specific coordinated actions across multiple detected devices. For example, through an IT workflow, users may be able to change the common administrator password of all detected LINUX (registered trademark) devices in a single operation.

[0116] V. CMDB Identification Rules and Mediation CMDBs such as CMDB500 provide a repository of configuration items and relationships. When properly defined, they can play an important role in higher-level applications deployed within a computing instance or in higher-level applications that include the higher-level application. These applications can be related to an enterprise's IT service management, business management, asset management, configuration management, compliance, etc.

[0117] For example, an IT service management application may use the information in the CMDB to determine applications and services that may be affected by a malfunctioning, down, or highly loaded component (e.g., server equipment). Similarly, an asset management application may use the information in the CMDB to determine the hardware and / or software components used to support a particular enterprise application. As a result of the importance of the CMDB, the information stored therein is desirably accurate, consistent, and up-to-date.

[0118] Input to the CMDB can be done in various ways. As described above, in the discovery process, information including configuration items and relationships may be automatically stored in the CMDB. However, all or part of the input to the CMDB can also be done manually, through configuration files, and from third-party data sources. Given that multiple data sources can update the CMDB at any time, one data source may overwrite an entry from another data source. Also, two data sources may each generate slightly different entries for the same configuration item, resulting in the CMDB containing duplicate data. If any of these occur, the integrity and usefulness of the CMDB may be degraded.

[0119] To mitigate this situation, these data sources may not directly write the configuration items to the CMDB. Instead, they may be written to the identification and mediation application programming interface (API) of the IRE514. Subsequently, the IRE514 may use a set of configurable identification rules to uniquely identify the configuration items and determine whether and how to write them to the CMDB.

[0120] Generally, the identification rules specify a set of configuration item attributes that can be used for this unique identification. Also, the identification rules may have priorities, and higher-priority rules may be considered before lower-priority rules. Also, the rules may be considered independent in that they identify configuration items independently of other configuration items. Alternatively, the rules may be considered dependent in that they first use metadata rules to identify dependent configuration items.

[0121] The metadata rules describe other configuration items included in a specific configuration item or the host on which a specific configuration item is deployed. For example, a network directory service configuration item may include a domain controller configuration item, while a web server application configuration item may be hosted on a server device configuration item.

[0122] The goal of each identification rule is to be able to clearly distinguish a configuration item from all other configuration items and to use a combination of attributes that are not expected to change during the lifetime of the configuration item. Exemplary attributes that can be considered for a server device include serial number, location, operating system, operating system version, memory capacity, etc. If the rule specifies an attribute that does not uniquely identify the configuration item, multiple components may be represented as the same configuration item in the CMDB. Also, if the rule specifies an attribute that changes for a specific configuration item, duplicate configuration items may be generated.

[0123] Thus, when a data source provides information regarding a configuration item to IRE514, IRE514 may attempt to match this information against one or more rules. If a match is found, the configuration item is written to the CMDB or updated if it already exists in the CMDB. If no match is found, the configuration item may be held for further analysis.

[0124] A configuration item mediation procedure may be used so that only authorized data sources are permitted to overwrite CMDB configuration item data. This mediation may also be rule-based. For example, mediation rules may be specified such that a particular data source has the authority for a particular configuration item type and a set of attributes. And IRE514 may only permit writing to a particular configuration item by this authorized data source, preventing writes by unauthorized data sources. In this way, legitimate data sources become the sole source of truth for information regarding particular configuration items. In some cases, writing to a configuration item may be permitted if an unauthorized data source has generated the configuration item or if the attribute being written is empty.

[0125] Also, there may be cases where multiple data sources have authority over the same configuration item or its attributes. For clarity, these data sources may be assigned a priority to be considered when writing to the configuration item. For example, a data source with second priority may be able to write to an attribute of a configuration item until a data source with first priority writes to that attribute. Subsequently, further writes to the attribute by the data source with second priority may be blocked.

[0126] In some cases, IRE514 may be able to automatically detect or otherwise detect duplicate configuration items. These configuration items may be set to be deleted for manual deduplication or flagged.

[0127] VI. Determination of Changes to Configuration Data As described above, a remote network management platform (such as remote network management platform 320, etc.) can support a huge number of software applications and services. Each of these may have its own configuration data, but by default, it may also exist in one or more files or database entries within or outside the platform.

[0128] The configuration data can be composed of multiple sets of parameters, and the parameters may be key-value pairs, one or more values, files, or any other type of content. For the purpose of the discussion in this specification, it is assumed that the parameters are in the form of key-value pairs, but other parameter forms may be adopted. An example of a key-value pair is "IP address: 10.0.177.15", where the key is the text "IP address" and the value is the IP address "10.0.177.15". Key-value pairs can be stored in various types of structured or unstructured text files, database tables, etc.

[0129] A. Arrangement of Configuration Data Figure 6A shows an example of the method and location of storage in addition to the types of configuration data. Application / service settings 600 may include configuration data for a specific software application and / or service. These may be one or more usernames and passwords, encryption settings, application programming interface (API) keys, or connections to a database. Middleware settings 602 may include configuration data for features incorporated into a remote network management platform that can be employed by a software application and / or service. These may be one or more of database settings, message queue settings, content delivery network (CDN) settings, and / or heap size. Cloud-based resource settings 604 may include configuration data regarding one or more public cloud network services used by a software application and / or service. These may be one or more of storage settings, scaling rules (e.g., processing, storage, and network capacity, etc.), the geographical region where cloud-based resources are deployed, and / or hostnames associated with these resources. Infrastructure settings 606 may include configuration data targeting the operation of computer devices within a remote network management platform. These may be one or more of server device settings, network settings, firewall settings, etc. For example, these settings may include IP address assignment, domain name assignment, workgroup assignment, etc.

[0130] All of this configuration data may be distributed and stored in different ways across a remote network management platform, one or more public cloud networks, and / or other locations. For example, some of this configuration data may be stored in a file 608 that can include unstructured text, structured text, or other types of files (e.g.,.properties,.conf, XML, JavaScript Object Notation (JSON), comma-separated values (CSV), and / or Yet Another Markup Language (YAML) files). As an alternative or in addition, some of this configuration data (parameters and / or files) may be stored in a repository 610 that can include a database (e.g., a particular database table), a network folder, a source code management system, and / or an artifact storage.

[0131] In some cases, the configuration data may be stored in a hierarchical tree-like structure. For example, JSON and XML files have a hierarchical structure that directly resembles a tree. In these types of files, an object can be either an element (e.g., a key-value pair like a leaf of the tree) or a container for other objects (e.g., a block of elements like the root node or an intermediate node of the tree).

[0132] As a specific example, an airline reservation website can include a custom ticket reservation application, a user relationship management component, a payment gateway service, a user interface, a series of web servers that provide content to the user interface, an authentication microservice, a database server, a load balancer, an internal network routing policy, etc., and many nodes of application and service configuration data. All of these need to be properly configured for seamless integration and operation as an airline reservation application service. For this reason, the configuration data of software services can span thousands of nodes that store tens of thousands of configuration key-value pairs in a tree-like hierarchy. For such software services, a simplified exemplary set of JSON configurations is shown in FIG. 6B.

[0133] The challenges in maintaining such configuration data are not only that the data is complex (tens of thousands to millions of parameters), but also that the frequency of changes is high. For example, a remote network management platform can support hundreds or thousands of software applications and services, some of which may be under continuous development processes such as various types of agile programming models. For this reason, new versions of these applications may be deployed to the production environment every few days or several times a day.

[0134] The team of software engineers who develop and test these applications may change the configuration data of the applications. In addition to the configuration data of other applications, they may also change the configuration data of middleware and / or infrastructure. Therefore, for fixing software defects or deploying multiple functions, a team of software engineers may change the configuration data that affects the software applications of some or all of the other teams. Such changes can cause at least some of these other software applications to behave differently or experience various failures.

[0135] Furthermore, the set data for each group can be arranged in files 608 and / or repositories 610 arranged throughout many locations. For this reason, access restrictions on the set data are weakened, making it difficult, if not impossible, to coordinate changes. As a result, changes become uncontrollable, tracking becomes impossible, and auditing cannot be easily performed.

[0136] As a result, the main root cause of software application and service outages is currently set data errors. In some estimates, these errors are far more common and have a greater impact than coding errors in software applications. In some notable configuration-related outages, entire websites have gone offline or become unusable for hours to days. Due to the aforementioned limitations, troubleshooting these outages is difficult. Narrowing down the configuration changes that could be the cause of the outage is like looking for a needle in a haystack across multiple files and repositories.

[0137] Therefore, improvements in the management, presentation, display, and operation methods of set data that reduce the likelihood of outages and enable quick resolution are beneficial.

[0138] Embodiments of this specification provide such an improvement. As shown in FIG. 6C, these embodiments may include integrating configuration data into a centralized configuration data model 612 that can be stored in a single location. This facilitates centralized visualization of the configuration data (thereby eliminating the need for software engineers and operations engineers to spend an inordinate amount of time just looking for relevant files or repositories). Also, this promotes rule-based access control, where multiple sets of access control lists (ACLs) or other mechanisms define what changes a particular user can make to specific parameters at what times. This further promotes continuous verification where an automated process scans the configuration data to identify potential errors, misconfigurations, or inconsistent groups of parameters. Such verification may be based on rules that define valid and / or invalid parameters or combinations of parameters, or may be based on more complex logic.

[0139] Also, one or more such ACLs may be used to control the visibility of nodes, keys, or values on a per-user or per-user-group basis. As a result, some users may be unable to view certain branches of the tree or observe certain masked values (such as passwords), while still being able to keep track of whether masked values have been added, edited, deleted, or remain unchanged.

[0140] As described above, a snapshot represents a version of the configuration data. Optionally, a snapshot may represent the entire configuration data, but in other cases, may only represent a subset of the configuration data (e.g., the subset of configuration data used by one or more specific software applications).

[0141] As an example, assume that a specific software application includes parameters of configuration data that determine a search engine to be employed for a user's search request. It is considered desirable to support multiple search engines and for the software application to be able to use or switch between any of them.

[0142] In a possible embodiment, the parameters may be updated to include a new search engine. For example, the parameters specifying the Google search engine may include key-value pairs such as "googleSearch: disabled", "googleSearchURL: www.google.com", and "googleRefIdNumber: grefID123113".

[0143] First, a change request may be made to request the addition of a new search engine. This change request may originate from a user or the application, and may also be added to a database of change requests stored by a remote network management platform. Based on this change request, a software developer may add new parameters to the configuration file of the software application. Next, a new version of the software application is built, and its configuration file incorporates, in addition to these parameters, any changes to the code of the software application that facilitate the use of the new search engine. Then, this package (e.g., the new version of the application and its configuration data) may be subject to automated test procedures. Such tests may ensure that the configuration file is syntactically correct and properly formatted.

[0144] Assuming that these tests are passed, the configuration file may be uploaded to the centralized configuration data model 612. A snapshot of the configuration file is constructed, and this snapshot is the current version of the configuration file. The snapshot is made available (published) via the web interface of the centralized configuration data model 612 after passing through the verification process.

[0145] After the snapshot becomes available, the change control process is executed to review and approve or reject change requests (and related snapshots). The change control process may include manual or automated reviews by software developers. For example, the results of the verification process may be reviewed to ensure verification success. If a change request is approved, deployment to the package's environment (e.g., for use in a production environment by an end user of a remote network management platform, in a test environment by a software tester, or in a development environment by a software developer) becomes possible.

[0146] B. Exemplary Graphical User Interface For further illustration, FIG. 7A shows a list 700 of available snapshots of configuration data organized by environment, where "prod" indicates production, "test" indicates testing, and "dev" indicates development. This list may be obtained via the web interface of a remote network management platform, such as the web interface of the centralized configuration data model 612.

[0147] Here, assume that snapshot prod-v8.dpl 702 is a new snapshot with parameters added to specify the Google search engine. In particular, the web interface specifies whether each snapshot has been made public, the deployable environment, whether it has been verified, and the timestamps of its generation and the most recent verification. As shown, prod-v8.dpl 702 is the latest production snapshot.

[0148] As a continuation of this scenario, assume that the package associated with snapshot prod-v8.dpl 702 is deployed in a production environment. This environment may be configured to generate alerts if various types of problems or potential problems are detected. For example, the environment may be set to generate an alert if no searches have been performed over the past 15 minutes (assuming that such an event is expected to be very rare given that thousands of users are expected to be using the search service).

[0149] As a result, the remote network management platform may generate an alert. This alert may be sent to one or more system reliability engineers tasked with maintaining the correct operation of the platform and its applications and services. As an example, Figure 7B shows the web interface 710 of the alert management application of the remote network management platform. Alert 0010223 is shown, including the identified problem 712 ("No searches processed in the last 15 minutes"), the affected setting item 714 ("Search engine service - production"), and the possible root cause 716 (associated with change request CHG0030040). Here, assume that change request CHG0030040 is (i) for changing the configuration file to include the Google search engine and (ii) was associated with the affected setting item 714.

[0150] In many realistic scenarios, there may be multiple change requests listed under possible root causes 716. Furthermore, from the content of these change requests, the parameters of the changed configuration data may not be clear. Therefore, in the root cause analysis process, after a system reliability engineer manually reviews each change request, in collaboration with software developers, it may be necessary to first identify relevant configuration snapshots, identify the changes between these snapshots, and determine whether these changes led to an obvious service outage. In all situations except the simplest cases, this process is complex and may take several hours to several days.

[0151] Embodiments of this specification overcome the above-mentioned drawbacks resulting from the relevance between change requests and snapshots. In particular, due to change request CHG0030040, snapshot prod-v8.dpl 702 is deployed. Therefore, the new configuration parameters introduced in snapshot prod-v8.dpl 702 can be quickly and easily identified.

[0152] In this regard, FIG. 7C shows a user interface 720 that shows a plurality of snapshots, each with a snapshot deployment timeline 722 that can be selected. FIG. 7C shows that a reference snapshot 724 (representing the latest previous deployment snapshot) and a target snapshot 726 (representing the current deployment snapshot prod-v8.dpl 702) are selected. Generally, the time range shown in timeline 722 can be expanded or contracted, and any one or two of the snapshots on it can be selected. Furthermore, the web interface may be configured to automatically display a final plurality of deployment snapshots (e.g., two, three, five, or ten snapshots).

[0153] FIG. 7D shows the difference between two selected snapshots (e.g., reference snapshot 724 and target snapshot 726). In this figure, user interface 730 may be part of user interface 720 (e.g., reached from user interface 720 by scrolling down) or a separate user interface.

[0154] Nevertheless, pane 732 shows a tree-based layout of the changes between these snapshots, with each node being selectable. By selecting such a node, pane 734 can display any changes between the two snapshots within or under the node. For example, in pane 732, the node "Prod" is selected. Therefore, pane 734 shows all the changes under that node. These changes are labeled with the path leading to the node where the change exists through the tree. For example, the path shown as " / Prod / release-1.0 / searchService-V1.0 / javaConfig / json / settings" indicates that there are three changes between the two snapshots and that these changes appear in the settings node (i.e., the settings file edited to add the Google search engine).

[0155] Pane 734 shows, in table form, for each changed parameter, the associated action 736 (e.g., add, edit, delete, unchanged), the key (name) 738 of the parameter, the value from the reference snapshot 740, and the value from the target snapshot 742. If neither the reference snapshot nor the target snapshot contains the parameter, the associated entry may be blank. For example, in FIG. 7D, since three parameters have been added to the target snapshot, they are not shown in the reference snapshot.

[0156] As shown in the illustration, the pain 734 uses a list component of the graphical user interface to display rows of operations, parameter keys (names), and parameter values. On the other hand, other types of user interface components may be used for displaying such information.

[0157] From this user interface, system reliability engineers or software developers can easily identify the parameters that have changed between related snapshots. This significantly reduces the amount of searching required by such individuals to explore the root cause of the stoppage. It is not particularly difficult to find the difference in the content of two files. The difficult part of root cause analysis is identifying the two files to be compared. In the embodiments of this specification, such a process requires only seconds to minutes, rather than hours to days, to execute.

[0158] Regarding this point, the value of the additional parameter "googleSearch" is "disabled" in FIG. 7D. This indicates that the Google search engine is not enabled in the production environment and explains the reason for the generated alert. Software developers can allow the use of the Google search engine by creating and deploying a new snapshot in which the value of the parameter "googleSearch" is "enabled".

[0159] For example, FIG. 7E shows a user interface 750, which is a variation of the user interface 730. However, the user interface 750 includes multiple parameter changes to multiple nodes in a tree-based arrangement. Further, these changes include addition, deletion, and editing of both parameters and nodes. Also, the user interfaces 730 and 750 may support the function of displaying parameters that have not been changed. This may be useful when parameter changes are expected but not made for some reason. Further, these user interfaces may support searching and sorting of display parameters.

[0160] FIG. 7F shows a user interface 760 as an alternative view of the changes applied to the parameters, as an optional alternative. Instead of the conventional view of the differences between files shown in two adjacent text boxes, here each parameter name (key) is shown (if necessary) along with its previous value and the new value. Thus, for example, FIG. 7F shows that the key "com.glide.csp.self_script_src_svg" has the value "true" in the reference snapshot and the value "false" in the target snapshot. Conversely, since only one value is shown for the key "com.glide.decision.table.max_inputs", it has not changed between these snapshots. Also, parameters that have been added, deleted, and edited may be emphasized in various ways (e.g., special font, color, or related characters or icons) to draw the user's attention.

[0161] This view may be superior to the conventional adjacent text boxes because most of the changes here are in the values rather than the keys. Thus, the user may find it difficult to identify changes in adjacent text boxes, while it is easy in this layout.

[0162] C. Exemplary Operations FIG. 8 is a flowchart showing an exemplary embodiment. The process shown in FIG. 8 may be executed by a computer device such as computer device 100 and / or a cluster of computer devices such as server cluster 200. However, this process can also be executed by other types of devices or device subsystems. For example, this process can also be executed by a remote network management platform or a computing instance of a portable computer such as a laptop or tablet device.

[0163] The embodiment of FIG. 8 can be simplified by removing any one or more of the features shown therein. Further, these embodiments may be combined with any of the other features or the features, aspects, and / or embodiments described herein.

[0164] Block 800 may include generating an alert indicating the software service and a change request specifying that the configuration data used by the software service has been changed in the current snapshot of the configuration data in response to a determination that the software service meets a degradation criterion.

[0165] Block 802 may include determining a set of configuration changes between the current snapshot and the previous snapshot of the configuration data based on the change request.

[0166] Block 804 may include providing a representation of a set of configuration changes indicating one or more parameters changed in the current snapshot and one or more paths in the tree-based arrangement of the configuration data leading to the one or more parameters changed in the current snapshot.

[0167] In some embodiments, determining a set of configuration changes between a current snapshot and a previous snapshot of configuration data is in response to receiving a selection of the current snapshot and the previous snapshot.

[0168] In some embodiments, a software service is supported by one or more software applications, and one or more parameters changed in the current snapshot of configuration data are used by one or more software applications.

[0169] In some embodiments, determining that a software service meets a degradation criterion includes detecting one or more of a stop affecting the software service, a performance degradation of the software service, or a use of a processor or memory that exceeds a threshold.

[0170] In some embodiments, an alert is stored in an alert database and is one of a plurality of alerts associated with a detected technical problem affecting one or more of a plurality of software services.

[0171] Some embodiments may further include providing, by a graphical user interface, a representation of a software service and an alert specifying a change request to a client device.

[0172] In some embodiments, determining a set of configuration changes includes providing to a client device an adjustable timeline of a plurality of snapshots including the current snapshot and the previous snapshot of configuration data, receiving from the client device another selection of the current snapshot and the previous snapshot, and determining, as one or more parameters, what has changed between the previous snapshot and the current snapshot.

[0173] In some embodiments, each of one or more parameters changed in the current snapshot of the configuration data is represented as a key-value pair that includes a key uniquely identifying each parameter and the value of each parameter.

[0174] In some embodiments, each of one or more parameters changed in the current snapshot of the configuration data is marked as a new addition to the configuration data, a deletion from the configuration data, or an edit within the configuration data.

[0175] In some embodiments, the representation of a set of configuration changes also shows additional parameters that have not been changed in the current snapshot of the configuration data.

[0176] In some embodiments, the current snapshot of the configuration data is deployed in a production environment, and the previous snapshot is the snapshot of the configuration data that was most recently deployed in the production environment prior to the deployment of the current snapshot.

[0177] VII. USE OF A PAGINATED VIRTUAL TABLE TO DISPLAY CHANGES IN CONFIGURATION DATA Using the centralized configuration data model 612, changes to the configuration data are tracked and stored in a similar manner to source control management systems such as Git, Subversion (SVN), Concurrent Versions System (CVS), and Team Foundation Server (TFS). For example, the centralized configuration data model 612 tracks the ability to reconstruct the changes, the users involved in each change, and the state of the configuration data before and after such changes. However, the embodiments herein include managing and presenting such changes in a new way specialized for configuration data.

[0178] Changes are tracked for debugging, tracing, and auditing purposes. The version of the configuration data can be imported from a file, but also from changes made as part of the change request process. These changes to the configuration data can be in the form of a set of changes that involve one or more software services and / or the configuration tree of deployable modules that can be used by such services.

[0179] The changes involved are incorporated into the centralized configuration data model 612. The centralized configuration data model 612 may be stored in a relational database such that each element of the configuration data is represented as a row of a database table representing a node of the tree-like structure of the configuration data. The node references the set of changes corresponding to that node (i.e., the set of changes that caused the generation of that node) and can be reached (addressed) by the unique path of nodes from the root to this node. In particular, a new release of the configuration data can reference a specific set of source control changes that can be used to determine a valid snapshot of the configuration data for that release.

[0180] The involvement of these sets of changes is an addition to the configuration data. Therefore, they are non-destructive, and the entries that have been added, edited, or deleted become new instances of the nodes, replacing the nodes of the past versions of the tree-like structure. However, since this does not change the past versions of the nodes, the history is preserved. For example, a node that has been deleted from the configuration data by a set of changes still exists and can be observed as a deleted node. From these nodes of the tree-like structure (deleted nodes and non-deleted nodes), snapshots of the configuration data at various points in time can be generated. By releasing these snapshots, the current snapshot can be applied to the configuration items of the software service.

[0181] Furthermore, a snapshot of the configuration data at a certain point in time or for a specific change involvement can be reconstructed for auditing and / or scrutiny purposes. To reconstruct a snapshot at a specific point in time and determine the nodes of the valid configuration data tree structure of the snapshot, identify the change involvement of the tree structure and determine the valid version of the nodes of the tree at that time.

[0182] As described above, changes to the configuration data may lead to degradation or outage of the software service. Alerts such as abnormally high processor utilization and / or abnormally slow response time may be generated by the monitoring software on the platform. This alert can identify the configuration items affected by the monitoring target, the related software service, and / or other components related to the configuration item. Since the configuration data of the snapshot includes the configuration items identified by the alert, the current configuration snapshot can be inferred from the alert. From the current snapshot, the history of configuration changes and the valid snapshots of only the configuration changes involved and deployed can be reconstructed as the timeline of the configuration snapshot used to identify the configuration changes that caused the degradation of the software service.

[0183] Visualizing the difference between two versions of code is a function of the source control system and is performed at the text-based, line-based, or character-based level. In contrast, the difference between two versions of configuration data, say A and B, involves identifying the differences in nodes between the tree structures of the two snapshots, say A and B. And these changes can be classified as added (the node path exists in B but not in A), deleted (the node path exists in A but not in B), edited (the node path exists in both A and B, but has different values in B), or unchanged (the same node path and value exist in both A and B).

[0184] This is different from normal source control code comparison due to the background of the tree-like structure. The nodes of the configuration data tree-like structure may span multiple lines of text, and not all lines of the text representing the node may have text-based differences. In fact, even if some lines of the text of two snapshots are the same, they may still belong to a modified node. In source control systems such as Git, only line-based and text-based comparisons are used to identify differences, and lines of added and deleted text may be highlighted. Furthermore, in a source control system, even if a line is part of a modified node, the line may be considered unchanged. In the visual differences of a source control system, the lines of added and deleted text between two versions of a code file are shown, and the unchanged lines are omitted.

[0185] The differences between snapshots of configuration data depend on the context regarding the nodes of the configuration data. For example, even if a parent node has not been changed, its child nodes may have been changed. As a result, the parent node will have an edit difference category.

[0186] Even when the difference category is unchanged, there is more information than in a source control system. For example, if the difference category of a node is unchanged, it means that none of its child nodes have been changed. Therefore, in a tree-like structure, additional insights are provided to identify the changes in the configuration data that caused the alert based on the context regarding the location of the nodes in the tree and the difference categories of the sibling, child, and ancestor nodes of the node. If an attempt is made to apply text-line comparison of source control code, this context is lost, and it is even possible that the line changes are due to the wrong node.

[0187] Differential comparison can be executed by the configuration data management software application and can be calculated between two snapshots of the configuration data of the configuration items related to the alert. These snapshots may include tens of thousands of nodes in two tree-like hierarchies. The difference is an integrated tree structure that includes all nodes of both snapshots. If nodes exist in both snapshots determined by the path, they are considered the same node in the integrated tree. In such a node, the differential comparison of each key-value pair is also executed, and as a result, for the said node, one of the above four states (addition, deletion, editing, unchanged) is determined.

[0188] A. Storage of Differential Comparison Differential comparison can be executed by loading two or more snapshots into the main memory and then determining the difference between the nodes of these snapshots. However, the results are temporary and are usually specific only to one user (the user who requests the differential comparison) and the access permission of that user (each user can only see a part of the accessible tree). These results may not even be related to the duration of the entire user session. This is because the user can change the selection of snapshots for comparison.

[0189] Also, the results may involve tens of thousands of nodes. For this reason, storing these results in a database table is prohibited because the reading and writing of the database become relatively slow and the calculation cost becomes extremely high. Displaying these results to the user interface with high responsiveness (for example, in less than 1 to 2 seconds) is impossible considering the amount of data. Furthermore, due to the transient nature of differential comparison, it is also a waste to adopt permanent storage in the database table. These tens of thousands of results are meaningless and need to be deleted from the database when the user finishes viewing because they are no longer needed.

[0190] Therefore, storing a large amount of short-term results in a database table will result in a decline in performance and efficiency. This is even more complicated in a high-availability database configuration where all database operations are replicated to a secondary database. Inserting and deleting such a large amount of data in a short period of time may cause the replication to be backed up, and ultimately the stability of the replication process may be impaired. In some cases, the stability of the computing instance may be impaired because most or all of the software applications running on the platform depend on being able to access the database and use the replication procedure. For example, if a software application is blocked by a large-scale and continuous database insertion or deletion operation, other operations necessary to maintain the smooth and healthy execution of the computing instance will be affected, which may cause a service degradation of the entire instance.

[0191] Therefore, although the storage of differential comparisons is transient, make it persistent so that users can read the same results again and apply filtering, searching, and / or sorting in a desirable way to isolate and identify the changes considered to be the root cause of the alert. Database tables facilitate filtering, searching, and sorting, but as mentioned above, the use of database tables is operationally prohibited.

[0192] To overcome the above and possibly other limitations, the integrated differential snapshot can be serially converted into a file in the file system of the computing instance. File system I / O is usually several times faster than storing a large data set in a database table. Furthermore, normal text compression of a text file of several megabytes can reduce the size by 70-80%. Such compression and storage (for example, storing on a semiconductor drive) may take about 10 milliseconds in total, but deletion is almost instantaneous.

[0193] Differential comparison is performed by pairing the nodes of the snapshots using paths, so the integration results of the file format are grouped by tree paths, and the entries contain keys and values (including the values from both snapshots, as well as an indicator of any of the four types of differences indicated by the nodes). To further reduce the file size, nodes with edited differences can contain two values, one from each snapshot, per key-value pair, while deleted, added, and unchanged nodes contain only a single value per key-value pair.

[0194] An example of this is shown in the partial differential comparison file 900 of FIG. 9. Each leaf node of file 900 represents a key-value pair and is annotated with a comment (text after " / / ") indicating the type of change, if any. Leaf nodes 902 and 904 contain two values to represent edits. Considering from left to right, the first value is the one before the edit, and the second value is the one after the edit. All other leaf nodes have only one value to represent an added, deleted, or unchanged scenario.

[0195] Nevertheless, the resulting file is stored in the file system and associated with a unique difference identifier (difference ID). This allows the file to be read and opened by the difference identifier.

[0196] B. Display to the User Interface of Differential Comparison To investigate the cause of software service degradation, the user may find it advantageous to observe a snapshot of the configuration data (current snapshot) deployed at the time of alert generation. With the support of the differential comparison operation described above, the user can compare this snapshot with a snapshot of the configuration data (preceding snapshot) deployed at a past time when no degradation occurred in the software service.

[0197] To observe the differences between nodes in the current snapshot and the previous snapshot, a graphical user interface may be generated to display these differences. Also, information from different comparison files may be presented to the graphical user interface in a table format having columns and rows. The columns can indicate one or more of the node path, the type of change indicated by the node from the previous snapshot to the current snapshot, the key of the node's key-value pair, the previous value of the node's key-value pair (if applicable), and the new value of the node's key-value pair (if applicable). Further, the graphical user interface in table format may support filtering, searching, paging, and sorting of its rows based on the content of its columns.

[0198] Figure 7D shows a possible embodiment of such a graphical user interface in table format. Pane 734 displays the root paths of three nodes ( / Prod / release-1.0 / searchService-V1.0 / javaConfig.json / settings) (this path can also be inferred from the tree structure of the configuration data displayed in pane 732). For each node, the table format includes columns for action 736 (type of change), name 738 (key of the node's key-value pair), baseline snapshot value 740 (previous value of the node's key-value pair), and target snapshot value 742 (new value of the node's key-value pair). As described above, in pane 734, a list component is used to display this information.

[0199] Tabular graphical user interfaces with rows and columns are familiar to users, and a familiar graphical user interface with familiar navigation and data presentation improves the efficiency of users tasked with identifying the root cause of alerts. For example, if a request timeout in an infrastructure setting item that is part of a software service is detailed in an alert, the user can first examine the change in the setting data and the node and its child nodes by inspecting a subtree of the setting data that includes the software service and filtering the results. The user can examine the differential comparison results by performing this analysis more quickly and easily with a familiar tabular graphical user interface with familiar options.

[0200] C. Virtual Table Normally, data stored in a database table is input into a tabular graphical user interface. However, for the reasons described above, it is not desirable to place differential comparison data in the database. Therefore, to serve a tabular graphical user interface in an efficient way that avoids the latency associated with storing differential comparison data in the database, the use of a virtual table configuration enables the display and response of files stored in the file system as if the information in the files were in a database table.

[0201] Conventionally, a list component of a graphical user interface for displaying entries of a database table can make API calls to a back-end web service of a web server. In these API calls, it is possible to specify a table name, columns of the table for which display is requested, a sort order, a limit on the number of entries to be returned, a page number, and optionally a filter based on values displayed in one or more columns. In the back-end web service, another software layer such as an object-relational mapper (ORM) can be called to generate a database query (e.g., SQL) for the database table. And this query can be sent through a database driver of the web server.

[0202] This database driver may be another software layer that handles low-level communication between the web server and the database server. Thus, after generating a connection to the database server, providing the query in a format recognized by the database server, and receiving the results provided by the database server on the network, these results can be returned to the ORM layer. Then, the web server formats the results according to the list component of the graphical user interface and displays them in the list component. These layers act integrally through software interfaces that enable interoperability between each layer with standards, defined communication protocols, and other layers implementing the same interfaces, protocols, and standards.

[0203] ORM can support multiple types of databases by adopting two or more database drivers. For example, there may be a database driver for the MySQL database and another database driver for the Postgres database. Each database driver can use a specific communication protocol and query format adjusted for that type of database. On the other hand, in the graphical user interface module of the web server, it does not recognize the way the web service obtains the results, in the web service, it does not recognize the way the ORM layer obtains the results, and in the ORM, it does not recognize the way the database driver obtains the results. What is important for each of these modules is that they can communicate and interoperate with other modules according to the defined interfaces.

[0204] When data is stored in a table that is not a conventional database table, there is no database that handles the queries related to that table. On the other hand, the web service can still accept queries from the list component of the graphical user interface, call the ORM, and return the results to the web service. Instead of providing the query to the database driver, the ORM may recognize that the table name being queried is not a database table and instead call an alternative layer of software that implements the driver in a virtual table in non-volatile memory such as RAM.

[0205] Such a configuration is shown in FIG. 10. The client device graphical user interface 1002 communicates with the web server 1004. When the client device is provided with a list component indicating the input of data from the database 1006 (for example, a MySQL database) or the virtual table 1008, it may make an inquiry corresponding to the web server 1004. In particular, the client device and the web server 1004 may be separate and different computer devices that communicate via a network such as the Internet. Further, the database 1006 may be a separate and different computer device that communicates with the web server 1004 via a network. The virtual table 1008 may be stored in the RAM of the web server 1004 or the RAM of yet another separate and different computer device. There are other possibilities. As described above, the client device graphical user interface 1002 and, in some cases, part of the web server 1004 may not recognize that they are ultimately querying a virtual table instead of an actual database table.

[0206] Steps 1010 to 1024 show how queries and their corresponding responses to the data from database 1006 flow through the modules of web server 1004. In step 1010, client device graphical user interface 1002 may send a database query to backend web service 1004A. In step 1012, backend web service 1004A may identify this query as being related to the database and provide it to ORM 1004B. In step 1014, ORM 1004B may identify this query as being related to database 1006 and provide it to database driver 1004C. In step 1016, database driver 1004C may convert the query into a format compatible with database 1006 and then send it to database 1006. In step 1018, database 1006 may send a response to the query to database driver 1004C. In step 1020, database driver 1004C may convert the response into a format compatible with ORM 1004B and then provide it to ORM 1004B. In step 1022, ORM 1004B may provide the response to backend web service 1004A. In step 1024, backend web service 1004A may provide the response to client device graphical user interface 1002. Thereafter, although not shown in FIG. 10, client device graphical user interface 1002 may use this response to input to a list component.

[0207] Steps 1026 to 1040 show how queries and their corresponding responses for data from the virtual table 1008 flow through the modules of the web server 1004. In step 1026, the client device graphical user interface 1002 may send a virtual table query to the backend web service 1004A. In step 1028, the backend web service 1004A may identify this query as related to the virtual table and provide it to the ORM 1004B. In step 1030, the ORM 1004B may identify this query as related to the virtual table 1008 and provide it to the virtual database driver 1004D. In step 1032, the virtual database driver 1004D may convert the query into a format that conforms to the virtual table 1008 and then send it to the virtual table 1008. In step 1034, the virtual table 1008 may send a response to the query to the virtual database driver 1004D. In step 1036, the virtual database driver 1004D may convert the response into a format that conforms to the ORM 1004B and then provide it to the ORM 1004B. In step 1038, the ORM 1004B may provide the response to the backend web service 1004A. In step 1040, the backend web service 1004A may provide the response to the client device graphical user interface 1002. Thereafter, although not shown in FIG. 10, the client device graphical user interface 1002 may use this response to input to the list component.

[0208] D. Block-based Reading and User Interface Pagination As described above, the virtual table 1008 may be stored in the RAM. The capacity of the RAM is usually several orders of magnitude smaller than that of persistent storage such as a hard drive or a semiconductor drive. Also, the RAM can be shared by other virtual tables, applications, processes, and operating systems running on a computer system such as the web server 1004. Therefore, for a database, it is possible to maintain it in persistent storage and grow it into billions of entries, but for a virtual table in shared volatile memory, the amount of accessible memory is quite small and it can only handle a limited number of entries (e.g., 1000 entries). Further, an entry limit (e.g., 1000) can be enforced by the virtual table driver. Here, the entries of the virtual table correspond to nodes of the configuration data (e.g., nodes in the differential comparison of two snapshots), and can be displayed in the rows of the list component.

[0209] Given that the differential comparison of two snapshots of the configuration data may have several times (e.g., tens of thousands) the number of entries that can be reasonably stored in the RAM, it is desirable to fetch a "block" of entries from the virtual table 1008 at a time and store these entries in the RAM for at least a portion of the time they are being displayed to the user. For example, assume the entry limit is 1000 and the differential comparison stored in the file system contains 10,000 entries. In this case, there are 10 blocks each containing 1000 entries. Thus, entries 0 - 999 form the first block (block 0), entries 1000 - 1999 form the second block (block 1), and so on. In various embodiments, a block number and / or another set of identifiers may be used to identify the desired block.

[0210] To make it easier to display these entries in the client graphical user interface, a custom block reading mechanism may be used. For this purpose, a new column is added to the virtual table. The rows function not simply as data read from the virtual table, but as additional parameters to the software layer that generates virtual table entries. These additional rows in the virtual table may include a difference ID, a block number, the number of entries per block, and possibly other information. The software layer may be configured to add filter conditions based on these additional rows. Such filter conditions may not be used to filter the data returned by the virtual table, but instead may function as part of a query against the virtual table.

[0211] Here, the difference ID represents a difference comparison between two snapshots stored in one or more files in persistent storage. For example, there may be a one-to-one mapping between the difference ID and a file, or a single difference ID may represent a large-scale difference comparison spanning multiple files. In the latter case, a B-tree (binary tree) index exists in the header of the first file or in a separate file and is used to determine the correct file to serve the request. In other words, the B-tree will function as an index to identify files and / or block regions within files, and the resulting blocks may contain some entries from each of two or more files. Another possibility is that there are multiple redundant files associated with the same difference ID in persistent storage, each arranged with a different internal structure or having a specific data scanning procedure such as pre-grouping, pre-filtering, or pre-sorting of the results. This allows for more rapid provision of certain types of requests (e.g., specific grouping, filtering, or sorting of results).

[0212] With these filter conditions, the queries provided by the ORM can identify a specific difference ID, a specific block number within the difference ID, and a specific block size of the blocks within the difference ID. With this information, the virtual database driver can locate a specific difference ID in the persistent storage, iterate through the difference ID based on the specific block size until the start of the specific block is found, and then return an appropriate number of entries. As an example, if the block size is 1000 entries and the query indicates that the second block is requested, the virtual database driver can return entries 1000 - 1999 of the specified difference ID. In particular, the blocks read are not always continuously loaded from the same area of the file on the file system. This is because different requests for blocks can also include additional filter and / or sort conditions that modify how the blocks are identified for that request.

[0213] This scenario is shown in Figure 11. Assume that MYFILE1100 exists in a local or remote file system accessible by the virtual database driver 1004D. In step 1102, the virtual database driver 1004D receives a query specifying the differential ID of "MYFILE", block number 1, and block size 1000. The query is derived from, for example, ORM1004B. In some cases, the block size may not be included in the query. This may be because there may be a fixed setting for the virtual database driver 1004D. In step 1104, the virtual database driver 1004D locates MYFILE in the file system (local or remote) and uses the block number and block size to identify and read entries 1000 - 1999 that make up block 1 (the second block) of MYFILE. If filtering and / or sorting is applied to one or more "columns" of the entries (e.g., node path, operation, name, previous value, current value), the data in the file is filtered and / or sorted accordingly prior to the identification of the entries. In step 1106, the virtual database driver 1004D receives these entries. In step 1108, the virtual database driver 1004D provides these entries in response to the query.

[0214] In these embodiments, the list component, backend web service, and ORM interfaces do not vary significantly from queries to conventional database tables. Maintaining these interfaces without significant changes promotes backward compatibility while reducing the risk of introducing defects.

[0215] Furthermore, for the convenience of the user and system performance, user interface components (such as list components) usually do not have an unlimited number of entries displayed at one time. For example, through pagination of entries by a list component, the graphical user interface of the client device may be configured to display only a small fixed number (such as 10, 25, 50, 100, etc.) at a time. Therefore, when the block size is 1000, the list component may be configured to display any one of 10 pages, each consisting of 100 entries.

[0216] In various embodiments, pagination interacts with the loaded block when there are more entries than can be loaded into a block. If such additional entries exist in the differential ID, up to 1000 entries (example) of the block may be reloaded / replaced to process the next graphical user interface request to paginate pages after the first 10 pages out of 100 pages. In practice, for each stateful transaction (where multiple requests from one or more users do not mix simultaneously), and / or as required by the graphical user interface request, the block can be reloaded into the virtual table memory. Even if each block is limited to 1000 entries, the pagination control can independently recognize the existence of more entries such as 10,000, etc., and does not limit the page options of the graphical user interface to only the first 10 pages out of 100 pages. Therefore, when the 11th page is selected, a different block is reloaded into the virtual table memory. Also, the virtual table driver may be configured to understand that the graphical user interface is displaying only 100 entries in the list (request block size) at that time, and instead of continuously filling the memory up to the memory limit of 1000 entries, it may be configured to load only the 100 entries required for the transaction of the graphical user interface.

[0217] With custom pagination control, in some embodiments, it is possible to avoid reading the total count of entries through the normal channel of the backend web service 1004A / ORM 1004B / virtual database driver 1004D. Instead, in custom pagination control, it may be possible to generate the total count of entries of the current list filter, calculate the number of pages, and query another web service (e.g., the pagination backend service) that can track the current page being viewed by the user.

[0218] The pagination service may be configured to receive as input the delta ID, the various filters and filter values currently active in the list component, and / or the list page size currently being used in the list component. These inputs are updated whenever any of them change in the graphical user interface, and another pagination service is called. In contrast, in pagination control, the currently selected page is provided to the list component for the query to the backend of the list, and reset to page 1 when the input changes. The pagination service can determine the file from the delta ID and apply the filter. Thereafter, instead of loading the entries into the virtual table memory, the pagination service may obtain the total count of the filtered entries by calling an iteration count. Thereafter, the pagination service divides the total count of entries by the input of the list page size and rounds up, and returns the total count (with any filter applied) and this rounded-up number of pages.

[0219] An example is shown in FIG. 12. The client graphical user interface 1200 displays the differential comparison information in a list component. This information is read by the virtual database drivers 1004D of the list backend service 1004A-1, the ORM 1004B, and the web server 1004. As shown in the figure, the virtual database driver 1004D reads blocks of related differential IDs (files) from the file system 1202 into the main memory. Also, there is a parallel channel through which the list component communicates with the pagination backend service 1004A-2. In the pagination backend service 1004A-2, the number of pages and / or the current page number are determined from the blocks currently in the main memory and / or the blocks of differential IDs (files) stored in the file system 1202, and are displayed or highlighted in the client graphical user interface 1200.

[0220] E. Exemplary Operations FIG. 13 is a flowchart showing an exemplary embodiment. The process shown in FIG. 13 may be adapted to be executed by a computer device such as the computer device 100 and / or a cluster of computer devices such as the server cluster 200. However, this process can also be executed by other types of devices or device subsystems. For example, this process can also be executed by a remote network management platform or a computing instance of a portable computer such as a laptop or tablet device.

[0221] The embodiment of FIG. 13 can be simplified by removing any one or more of the features shown therein. Further, these embodiments may be adapted to be combined with any of the other features or the features, aspects, and / or embodiments described herein.

[0222] Block 1300 is to receive, in a web server application, a query specifying a file, the number of data blocks in the file, and the block size, where the file may include entries representing differences between snapshots of configuration data. Receive This may be included.

[0223] Block 1302 may include identifying data blocks in the file based on the block size.

[0224] Block 1304 may include storing the blocks in non-volatile memory accessible by the web server application.

[0225] Block 1306 may include, in response to the query, sending, by the web server application, a set of entries in the block formatted for display in a list component of the graphical user interface.

[0226] In some embodiments, the file is one of one or more files that include entries.

[0227] In some embodiments, identifying data blocks in the file includes iterating through the file until the blocks are located based on the block size.

[0228] In some embodiments, the query also specifies a filter to be applied to the entries. These embodiments may further include applying the filter to the entries before iterating through the file. In practice, although the filter is applied, it may be evaluated lazily as part of an iteration loop. This is to avoid the need to always iterate through the entire file to filter it to the end, for example, if the block limit is reached for the first time during iteration before the entire file is filtered. In this process, it is also possible to read an entry, test the entry's filter, hold or discard the entry, and then iterate to the next entry. At this granularity, although the filter is applied before each iteration step, not all filtering is completed before the iteration begins. This is in contrast to sorting, where all sorting must be completed before the iteration begins, or where iteration is performed on unsorted entries.

[0229] In some embodiments, the query also specifies a sort operation to be applied to the entries. These embodiments may further include applying the sort operation to the entries before iterating through the file.

[0230] In some embodiments, a set of entries includes one or more entries. In some cases, it is also possible to return an empty set if all entries that could be considered by the filter are excluded, or if the snapshot is an empty tree and a comparison generates an empty file.

[0231] In some embodiments, the file is specified by a unique identifier associated with the difference between two specific snapshots of the configuration data.

[0232] In some embodiments, the list component displays a set of entries in a table format with pagination buttons that load and display multiple other sets of entries within a block.

[0233] These embodiments may further include, in a web server application, receiving another query to load another set of entries into a list component; determining that the another set of entries includes entries within another block of a file; identifying another block within the file based on a block size; storing the another block in non-transitory memory; and transmitting, in response to the another query, by the web server application, entries within the another block formatted for display in the list component.

[0234] In some embodiments, storing the another block in non-transitory memory includes replacing the block with another block.

[0235] In some embodiments, each entry is associated with a configurable setting within configuration data and includes one or both of a previous value of the setting from a previous snapshot and a current value of the setting from a current snapshot among a path, an operation, a name, and a snapshot.

[0236] In some embodiments, transmitting a set of entries within a block formatted for display in the list component includes, for each entry, entering each path, each operation, each name, and one or both of the previous value and the current value into a row of the list component.

[0237] In some embodiments, a particular one of the entries includes a particular operation indicating that a configurable setting has been added, with the previous value being null and the current value not being null.

[0238] In some embodiments, a particular one of the entries includes a particular operation indicating that a configurable setting has been deleted, with the previous value not being null and the current value being null.

[0239] In some embodiments, a particular one of the entries includes a particular action indicating that a configurable setting has been edited, where the previous value is not null and the current value is also not null.

[0240] In some embodiments, the file is used instead of storing the entries in a database structure.

[0241] In some embodiments, the non-transitory memory is volatile main memory.

[0242] In some embodiments, the block size ranges from 100 to 5000 entries.

[0243] VIII. Conclusion The present disclosure is not limited in terms of the specific embodiments described in the present application, which are intended to illustrate various aspects. As will be apparent to those skilled in the art, many improvements and modifications are possible without departing from its scope. From the above description, in addition to what is described herein, functionally equivalent methods and apparatuses within the scope of the present disclosure will be apparent to those skilled in the art. Such improvements and modifications will also be included in the appended claims.

[0244] In the above detailed description, various features and operations of the disclosed system, apparatus, and method have been described with reference to the accompanying drawings. The exemplary embodiments described herein and in the drawings are not meant to be limiting in any way. Other embodiments can be utilized and other changes can be made without departing from the scope of the subject matter presented herein. It will be readily understood that the aspects of the present disclosure as described throughout this specification and shown in the drawings can be arranged, substituted, combined, separated, and designed in a wide variety of different configurations.

[0245] For any and all of the message flow diagrams, scenarios, and flowcharts in the figures, each step, block, and / or communication can represent the processing and / or transmission of information according to the exemplary embodiments discussed herein. The scope of these exemplary embodiments includes alternative embodiments. In these alternative embodiments, for example, the operations described as steps, blocks, transmissions, communications, requests, responses, and / or messages can be executed out of the illustrated or described order according to the functions involved (including substantially simultaneously or in reverse order). Further, in any of the message flow diagrams, scenarios, and flowcharts discussed herein, it is possible to increase or decrease the number of blocks and / or operations used, and it is possible to combine some or all of these message flow diagrams, scenarios, and flowcharts with each other.

[0246] A step or block representing the processing of information can correspond to a circuit configured to perform a specific logical function of the method or technology described herein. As an alternative or addition to this, a step or block representing the processing of information can correspond to a module, segment, or portion of program code (including related data). The program code can include one or more instructions executable by a processor to perform specific logical operations or actions in the above method or technology. The program code and / or related data can be stored in any type of computer-readable medium, such as a storage device including RAM, a disk drive, a semiconductor drive, or another storage medium.

[0247] In addition, computer-readable media may include non-transitory computer-readable media such as register memory and processor caches that store data for a short period of time. Non-transitory computer-readable media may further include non-transitory computer-readable media that store program code and / or data for a long period of time. Therefore, non-transitory computer-readable media may include secondary or persistent long-term storage such as ROM, optical or magnetic disks, semiconductor drives, or compact disc read-only memory (CD-ROM). Also, as non-transitory computer-readable media, any other volatile or non-volatile memory system is possible. Non-transitory computer-readable media can be considered, for example, as computer-readable storage media or tangible storage devices.

[0248] Furthermore, one or more steps or blocks representing information transmission may correspond to information transmission between software and / or hardware modules in the same physical device. However, as other information transmissions, information transmissions between software modules and / or hardware modules in different physical devices are also possible.

[0249] The specific arrangements shown in the drawings should not be construed as being in any way limiting. It is to be understood that in other embodiments, it is possible to increase or decrease the number of each element shown in a given drawing. Furthermore, it is possible to combine or omit some of the illustrated elements. Furthermore, it is possible for an exemplary embodiment to include elements not shown in the drawings.

[0250] Although various aspects and embodiments are disclosed herein, other aspects and embodiments will be apparent to those skilled in the art. The various aspects and embodiments disclosed herein are for illustrative purposes only and are not intended to be limiting in any way, and the true scope is indicated by the following claims.

Description of Reference Numerals

[0251] 101 Computer device 102 Processor 104 Memory 104A Firmware 104B Kernel 104C Application 106 Network Interface 108 Input / Output Unit 110 System Bus 200 Server Cluster 202 Server Equipment 204 Data Storage 206 Router 208 Local Cluster Network 210 Communication Link 212 Network 300 Managed Network 302 Client Equipment 304 Server Equipment 306 Router 308 Virtual Machine 310 Firewall 312 Proxy Server 320 Remote Network Management Platform 322 Computing Instance 324 Computing Instance 326 Computing Instance 328 Computing Instance 340 Public Cloud Network 350 Internet 400A Data Center 400B Data Center 402A VPN Gateway 402B VPN Gateway 404A Firewall 404B Firewall 406A Load Balancer 406B Load Balancer 410 Setting Item 412 VPN Gateway 414 User 416 Remote User 500 CMDB 502 Task List 504 Equipment 506 Equipment 508 Equipment 510 Equipment 512 Equipment 514 IRE 600 Application / Service Settings 602 Middleware Settings 604 Cloud-Based Resource Settings 606 Infrastructure Settings 608 File 610 Repository 612 Centralized Configuration Data Model 700 List 702 Snapshot 710 Web Interface 712 Identified Problem 714 Configuration Item 716 Root Cause 720 User Interface 722 Snapshot Deployment Timeline 724 Baseline Snapshot 726 Target Snapshot 730 User Interface 732 Pain 734 Pain 736 Operation 738 Name 740 Baseline Snapshot Value 742 Target Snapshot Value 750 User Interface 760 User Interface 900 Partial Difference Comparison File 902 Leaf Node 904 Leaf Node 1002 Client Device Graphical User Interface 1004 Web Server 1004A Back-End Web Service 1004A-1 List Backend Service 1004A-2 Pagination Backend Service 1004B ORM 1004C Database Driver 1004D Virtual Database Driver 1006 Database 1008 Virtual Table 1010 Database Query 1012 Database Query 1014 Database Query 1016 Database Query 1018 Database Response 1020 Database Response 1022 Database Response 1024 Database Response 1026 Virtual Table Query 1028 Virtual Table Query 1030 Virtual Table Query 1032 Virtual Table Query 1034 Virtual Table Response 1036 Virtual Table Response 1038 Virtual Table Response 1040 Virtual Table Response 1100 MYFILE 1200 Client Graphical User Interface 1202 File System

Claims

1. In response to a determination that a software service meets a degradation criterion, generating an alert indicating the software service and a change request specifying that the configuration data used by the software service has been changed in a current snapshot of the configuration data; Based on the change request, determining a set of configuration changes between the current snapshot and a previous snapshot of the configuration data; Providing a representation of the set of configuration changes indicating one or more parameters changed in the current snapshot and one or more paths in a tree-based arrangement of the configuration data leading to the one or more parameters changed in the current snapshot; A method comprising the above.

2. The method according to claim 1, wherein determining the set of configuration changes between the current snapshot and the previous snapshot of the configuration data is in response to receiving a selection of the current snapshot and the previous snapshot.

3. The method according to claim 1, wherein the software service is supported by one or more software applications, and the one or more parameters changed in the current snapshot of the configuration data are used by the one or more software applications.

4. The method according to claim 1, wherein the determination that the software service meets the degradation criterion includes detecting one or more of a stop affecting the software service, a performance degradation of the software service, or utilization of a processor or memory exceeding a threshold.

5. The method according to claim 1, wherein the alert is stored in an alert database and is one of a plurality of alerts associated with a detected technical problem affecting one or more of a plurality of software services.

6. The method according to claim 1, further comprising providing, by a graphical user interface, a representation of the alert specifying the software service and the change request to a client device.

7. Determining the set of configuration changes comprises providing to the client device an adjustable timeline of a plurality of snapshots including the current snapshot and the preceding snapshot of the configuration data; receiving from the client device another selection of the current snapshot and the preceding snapshot; determining, as the one or more parameters, what has changed between the preceding snapshot and the current snapshot; The method according to claim 6, comprising.

8. The method according to claim 1, wherein each of the one or more parameters changed in the current snapshot of the configuration data is represented as a key-value pair including a key that uniquely identifies each parameter and the value of each parameter.

9. The method according to claim 1, wherein each of the one or more parameters changed in the current snapshot of the configuration data is marked as a new addition to the configuration data, a deletion from the configuration data, or an edit within the configuration data.

10. The method according to claim 1, wherein the representation of the set of configuration changes also indicates additional parameters that have not changed in the current snapshot of the configuration data.

11. The method according to claim 1, wherein the current snapshot of the configuration data is deployed in a production environment, and the preceding snapshot is the snapshot of the configuration data that was most recently deployed in the production environment prior to the deployment of the current snapshot.

12. when executed by one or more processors of a computer system, in response to a determination that a software service meets a degradation criterion, generating an alert indicating the software service and a change request specifying that the configuration data used by the software service has changed in the current snapshot of the configuration data; determining, based on the change request, a set of configuration changes between the current snapshot and the preceding snapshot of the configuration data; providing a representation of the set of configuration changes indicating one or more parameters changed in the current snapshot and one or more paths in the tree - based arrangement of the configuration data leading to the one or more parameters changed in the current snapshot; A non - transitory computer - readable medium storing program instructions that cause the computer system to perform operations including the above. **Claim 13** The non - transitory computer - readable medium according to claim 12, wherein determining the set of configuration changes between the current snapshot and the previous snapshot of the configuration data is in response to receiving a selection of the current snapshot and the previous snapshot. **Claim 14** The non - transitory computer - readable medium according to claim 12, wherein the software service is supported by one or more software applications, and the one or more parameters changed in the current snapshot of the configuration data are used by the one or more software applications. **Claim 15** The non - transitory computer - readable medium according to claim 12, wherein determining that the software service meets the degradation criterion includes detecting one or more of a stop affecting the software service, a performance degradation of the software service, or utilization of a processor or memory exceeding a threshold. **Claim 16** The non - transitory computer - readable medium according to claim 12, wherein the alert is stored in an alert database and is one of a plurality of alerts associated with a detected technical problem affecting one or more of a plurality of software services. **Claim 17** The operations further include providing, by a graphical user interface, a representation of the alert specifying the software service and the change request to a client device, determining the set of configuration changes includes providing to the client device an adjustable timeline of a plurality of snapshots including the current snapshot and the previous snapshot of the configuration data; receiving from the client device another selection of the current snapshot and the previous snapshot; determining, as the one or more parameters, what has changed between the previous snapshot and the current snapshot; The non-transitory computer-readable medium according to claim 12, comprising: **Claim 18** The non-transitory computer-readable medium according to claim 12, wherein each of the one or more parameters changed in the current snapshot of the configuration data is represented as a key-value pair including a key that uniquely identifies each parameter and a value of each parameter. **Claim 19** The non-transitory computer-readable medium according to claim 12, wherein each of the one or more parameters changed in the current snapshot of the configuration data is marked as a new addition to the configuration data, a deletion from the configuration data, or an edit within the configuration data. **Claim 20** A computer system, comprising: one or more processors; a memory; When stored in the memory and executed by the one or more processors, generating an alert indicating the software service and a change request specifying that the configuration data used by the software service has changed in the current snapshot of the configuration data in response to a determination that the software service meets a degradation criterion; determining a set of configuration changes between the current snapshot and a previous snapshot of the configuration data based on the change request; providing a representation of the set of configuration changes indicating one or more parameters changed in the current snapshot and one or more paths in a tree-based arrangement of the configuration data leading to the one or more parameters changed in the current snapshot; program instructions that cause the computer system to perform operations including: A computer system comprising the same.

Images