Application backup service level agreement validation

Abstract

A method, apparatus, and computer program for validating backup service level agreement (SLA) of an application program consisting of multiple services. A list of starting points for services discovery is received. A protected assets list is initialized and populated by scanning an item on the list of starting points to detect services used by the application, and scanning to detect and add to the protected assets list assets used by instances of a service detected. The protected assets list is compared with a backup service level agreement of the application to determine a discrepancy. An indication of the discrepancy is outputted to a user.

Description

[0001] APPLICATION BACKUP SERVICE LEVEL AGREEMENT VALIDATION

[0002] BACKGROUND

[0003] Some embodiments described in the present disclosure relate to information technology and, more specifically, but not exclusively, to application backup validation.

[0004] In recent years, there have been growing numbers of application programs (also referred to as “applications” or “apps” in short) running in data centers and using a mixed workload of components, including for example, containers such as the microservices and likewise entities of Kubernetes, virtual machines, cloud entities such as functions and / or the like, and any likewise components, as well as the interaction strategies and mechanisms of the components at hand. Such components use storage systems that may be any combination of block, file, and / or object storage systems, whether shared or dedicated ones. There may be also other assets used, like specialized hardware and / or other equipment.

[0005] As known in the relevant industry, Kubernetes (K8S) is an open-source container orchestration system for automating software deployment, scaling, and management. Originally designed by Google, the project had later been taken over and maintained by the Cloud Native Computing Foundation.

[0006] As also known in the relevant industry, Virtual Machine (VM) is the virtualization or emulation of a computer system. Virtual machines are based on computer architectures and provide the functionality of a physical computer. Their implementations may involve specialized hardware, software, or a combination of the two.

[0007] Many applications nowadays that may be built and / or deployed with the latest technologies, development methodologies, and / or best practices available for delivering an optimal user experience, may be cloud-native. Often these applications may be architected as microservices that communicate with each other through application programming interfaces (APIs), as opposed to tightly coupled monolithic applications. These microservices-based applications typically leverage cloud-native technologies such as containers (e.g., Kubernetes entities etc.) and / or the like.

[0008] Microservice architecture and service-oriented architecture in general may be advantageous in terms of, for example, agility, scalability, portability, reliability, and / or the like. Such applications, where built from multiple microservices rather than as monolithic unit, may thus be scalable, reusable, and easier to use. These applications may often be built in accordance with agile development methodologies and DevOps best practices, with a heavy emphasis on automation throughout the continuous integration and delivery (CI / CD) pipeline, and expected to be able to support the evolutionary and fast-paced nature of the relevant industry and / or business needs.

[0009] SUMMARY

[0010] It is an object of the present disclosure to describe a system and a method for application backup validation.

[0011] The foregoing and other objects are achieved by the features of the independent claims. Further implementation forms are apparent from the dependent claims, the description and the figures.

[0012] According to an aspect of some embodiments of the disclosed subject matter there is provided a service level agreement (SLA) validator for validating backup SLA of an application program consisting of multiple services, comprising: a processing circuitry adapted to execute a code for: receiving a list of starting points for services discovery; initializing and populating a protected assets list by: scanning an item on the list of starting points to detect services used by the application; and scanning to detect and add to the protected assets list assets used by instances of a service detected; comparing the protected assets list with a backup service level agreement of the application to determine a discrepancy; and outputting an indication of the discrepancy to a user.

[0013] According to some embodiments, the processing circuitry is further adapted to execute a code for appending to the list of starting points new items detected during the scanning of the item or the respective instance.

[0014] According to some embodiments, the processing circuitry is further adapted to execute a code for determining and appending to the list of starting points target services communicated by the respective instance.

[0015] According to some embodiments, the processing circuitry is further adapted to execute a code for: determining a type-based backup policy for an asset in the protected assets list; comparing the type-based backup policy with the backup service level agreement to determine an inadequacy or lack thereof; and outputting an indication of the inadequacy or lack thereof to the user.

[0016] According to some embodiments, the processing circuitry is further adapted to execute a code for re-performing the populating according to at least one scheduling scheme selected from the group of: periodically; by-demand; and trigger-based.

[0017] According to some embodiments, an item on the list of starting points is of a type selected from the group of an application name; an application configuration file; an application source code; an application deployment recipe; an application access point; an application special tag.

[0018] According to some embodiments, an item on the protected items list is of a type selected from the group of: a volume; a file system; and a database.

[0019] According to some embodiments, at least one of the scanning to detect services used by the application and the scanning to detect and add assets used by instances of a service detected is performed in a recursive manner.

[0020] According to another aspect of some embodiments of the disclosed subject matter there is provided method for validating backup SLA of an application program consisting of multiple services, comprising: receiving a list of starting points for services discovery; initializing and populating a protected assets list by: scanning an item on the list of starting points to detect services used by the application; and scanning to detect and add to the protected assets list assets used by instances of a service detected; comparing the protected assets list with a backup service level agreement of the application to determine a discrepancy; and outputting an indication of the discrepancy to a user.

[0021] According to some embodiments, the method further comprising appending to the list of starting points new items detected during the scanning of the item or the respective instance.

[0022] According to some embodiments, the method further comprising determining and appending to the list of starting points target services communicated by the respective instance.

[0023] According to some embodiments, the method further comprising: determining a typebased backup policy for an asset in the protected assets list; comparing the type-based backup policy with the backup service level agreement to determine an inadequacy or lack thereof; and outputting an indication of the inadequacy or lack thereof to the user.

[0024] According to some embodiments, the method further comprising re-performing the populating according to at least one scheduling scheme selected from the group of periodically; by-demand; and trigger-based.

[0025] According to some embodiments, an item on the list of starting points is of a type selected from the group of an application name; an application configuration file; an application source code; an application deployment recipe; an application access point; an application special tag.

[0026] According to some embodiments, an item on the protected items list is of a type selected from the group of: a volume; a file system; and a database.

[0027] According to some embodiments, at least one of the scanning to detect services used by the application and the scanning to detect and add assets used by instances of a service detected is performed in a recursive manner.

[0028] According to yet another aspect of some embodiments of the disclosed subject matter there is provided a computer program for validating backup service level agreement (SLA) of an application program consisting of multiple services, the computer program comprising program instructions which, when executed by at least one processor, cause the at least one processor to: receive a list of starting points for services discovery; initialize and populate a protected assets list by: scan an item on the list of starting points to detect services used by the application; and scan to detect and add to the protected assets list assets used by instances of a service detected; compare the protected assets list with a backup service level agreement of the application to determine a discrepancy; and output an indication of the discrepancy to a user.

[0029] According to some embodiments, the computer program comprising program instructions further cause the at least one processor to append to the list of starting points new items detected during the scanning of the item or the respective instance.

[0030] According to some embodiments, the computer program comprising program instructions further cause the at least one processor to determine and append to the list of starting points target services communicated by the respective instance. According to some embodiments, the computer program comprising program instructions further cause the at least one processor to: determine a type-based backup policy for an asset in the protected assets list; compare the type-based backup policy with the backup service level agreement to determine an inadequacy or lack thereof; and output an indication of the inadequacy or lack thereof to the user.

[0031] According to some embodiments, the computer program comprising program instructions further cause the at least one processor to re-perform the populating according to at least one scheduling scheme selected from the group of periodically; by-demand; and trigger-based.

[0032] According to some embodiments, an item on the list of starting points is of a type selected from the group of an application name; an application configuration file; an application source code; an application deployment recipe; an application access point; an application special tag.

[0033] According to some embodiments, an item on the protected items list is of a type selected from the group of: a volume; a file system; and a database.

[0034] According to some embodiments, at least one of the scanning to detect services used by the application and the scanning to detect and add assets used by instances of a service detected is performed in a recursive manner.

[0035] Other systems, methods, features, and advantages of the present disclosure will be or become apparent to one with skill in the art upon examination of the following drawings and detailed description. It is intended that all such additional systems, methods, features, and advantages be included within this description, be within the scope of the present disclosure, and be protected by the accompanying claims.

[0036] Unless otherwise defined, all technical and / or scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which embodiments. Although methods and materials similar or equivalent to those described herein can be used in the practice or testing of embodiments, exemplary methods and / or materials are described below. In case of conflict, the patent specification, including definitions, will control. In addition, the materials, methods, and examples are illustrative only and are not intended to be necessarily limiting. BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS )

[0037] Some embodiments are herein described, by way of example only, with reference to the accompanying drawings. With specific reference now to the drawings in detail, it is stressed that the particulars shown are by way of example and for purposes of illustrative discussion of embodiments. In this regard, the description taken with the drawings makes apparent to those skilled in the art how embodiments may be practiced.

[0038] In the drawings:

[0039] FIG. l is a schematic illustration of exemplary application deployment and architecture of application backup validation, according to some embodiments;

[0040] FIG. 2 is a block diagram of an exemplary apparatus for application backup validation, according to some embodiments; and

[0041] FIG. 3 is a flowchart schematically representing an optional flow of operations for application backup validation, according to some embodiments.

[0042] DETAILED DESCRIPTION

[0043] Some embodiments described in the present disclosure relate to information technology and, more specifically, but not exclusively, to application backup validation.

[0044] In information technology, a backup, or data backup is a term relating to a copy of computer data taken and stored elsewhere so that it may be used to restore the original after a data loss event. Backups as obtained by backing up operation(s) can be used to recover data after its loss from data deletion or corruption, and / or to recover data from an earlier time.

[0045] A backup system contains at least one copy of all data considered worth saving. The data storage requirements can be large. Data is selected, extracted, and manipulated for storage. There are limitations and human factors involved in any backup scheme.

[0046] The backing up of service-oriented architecture (SOA) applications, and microservicebased applications, in particular, on many occasions and / or real-world scenarios may become challenging and cumbersome task posing significant technical difficulties and practical limitations that pre-existing technologies fall short of accommodating. To vit, one significant drawback of such pre-existing tools and / or techniques is rooted in that these are mainly based on defining detailed instructions in advance for well-known applications, referred to in the field as “recipes”. These predefined backup schemes thus do not provide for an efficient and automatic approach for service-based applications and / or for cases where applications change dynamically during runtime.

[0047] For example, in some real -world scenarios involving service-based applications, the particulars of a service at hand such as its implementation, resources used thereby, and / or the like may be encapsulated or otherwise obfuscated, as well as being subject to occasional changes throughout the lifespan of that service, as functionalities may be added, removed, and / or modified.

[0048] The situation may be even further exacerbated for service-based and microservice-based applications that may consist of mixed workload and / or change dynamically over time. As a result, a user such as, for example, an administrator, an operator, an information technology officer, and / or the like, may be required take an enormous number of actions to make sure that all assets used by an application in question are properly backed up. Since service-based applications, and microservice applications in particular, may consist of many services, it may be very complicated if not even almost infeasible to maintain a proper backup plan manually.

[0049] The disclosed subject matter provides for an improvement in the field of application data backup over pre-existing approaches, by which ensuring that all assets and / or data of an application are backed up properly can be achieved, and moreover, it is so done in an automated manner, efficiently and effectively.

[0050] In the context of the present disclosure, the terms “protected assets”, “assets”, “application data”, and / or the like, may be used interchangeably and may refer to, for example, data volumes, file systems, databases, and / or any likewise resources that may be backed up by a backup scheme and / or system, such as discussed herein.

[0051] As used herein, the term Service Level Agreement (SLA) relates to a commitment between a service provider and a customer. Particular aspects of the service, such as for example, quality, availability, responsibilities of the parties and / or the like, may be agreed between the service provider and the service user, and specified in the Service Level Agreement terms and conditions. As used herein, the term application discovery relates to a process through which applications installed and used throughout an enterprise may be identified and collected, e.g., in a list and / or likewise data structure. This process may thus enable the gathering, monitoring and management of an entire application portfolio used within an IT environment and / or on individual computers and / or networks, such as business / productivity applications, database applications, client / server applications, and / or the like.

[0052] One technical approach is to employ an application discovery-like methodology, where for a given starting point, any and all relevant assets and / or data used by an application are searched for and collected together, e.g., in a respective list and / or likewise data structure.

[0053] For a starting point at hand, the respective application in question is scanned and a search for any and all services used by that application is performed. For each service thus detected, a scan is performed in search of any and all assets used by that service instance(s) used by the respective application scanned.

[0054] The collection of assets thus discovered and recorded (i.e., a compiled “protected assets” list), and a pre-existing SLA for application backup, are compared with one another to determine whether a gap of unprotected assets exits, in which case, an indication of the gap is outputted to a user. The current SLA may be defined inside a respective secondary storage system (Backup System) associated with the application. Additionally or alternatively, the SLA may be provided on other acceptable manner for comparison, for example, retrieved from a default storage location, received as input, and / or the like.

[0055] In some embodiments, a starting point may be an item and / or a combination of items from the following list:

[0056] An application configuration file;

[0057] An application source code;

[0058] An application deployment recipe;

[0059] An application access point, such as for example, a uniform resource locator (URL), an internet protocol (IP) address and / or an IP port, a process identifier (ID), and / or the like;

[0060] An application special tag and / or the like. In some embodiments, one or more starting points may be provided as input, retrieved from a default location specified, and / or the like. An initial list of starting points for exploration may be incrementally grown and / or otherwise dynamically updated throughout the scanning and discovery process as newly detected items considered to be fit as additional starting points, such as items and / or items combinations of the type(s) as listed herein, may be encountered and appended to the current list of starting points accordingly.

[0061] In some embodiments, scanning of an application to detect services used thereby and / or scanning to detect assets used by instances of a service detected as one being used by the application, may be performed in a recursive manner. Additionally or alternatively, common techniques such as Breadth First Search (BFS), Depth First Search (DFS), and / or the like may be used.

[0062] In some embodiments, it may be determined that a service instance detected for an application scanned communicates with one or more other services. The target service(s) communicated by the service instance may be appended to the list of starting points and the scanning and assets discovery process may continue and progress accordingly to scan such newly discovered starting point(s) in a same and / or similar manner as described herein.

[0063] In some embodiments, for a detected asset such as obtained using an application scanning procedure as described herein, a recommended backup policy may be determined and set according to a type thereof.

[0064] For example, a database asset may be set with frequent backup interval, or even continuous backup if such may exist or be available, on the one hand, whereas a configuration file, a source code, and / or a likewise asset, may be set with infrequent backup interval, on the other hand, seeing that assets of this sort may generally not be subject to changes frequently.

[0065] Optionally, a type-based backup policy determined for an asset as recommended one may be compared with a backup policy specified in a pre-existing SLA for application backup to determine whether the SLA backup policy is adequate or not, and accordingly an indication of an inadequacy found may be outputted to a user. Additionally or alternatively, a user output confirming adequacy of the SLA backup policy for the asset may be provided where applicable.

[0066] In some embodiments, an application scanning procedure as described herein, by which respective services and assets used by the application may be searched for and a list of protected assets may be compiled accordingly, may be repeated, for example, every once in a while and / or based on predetermined trigger, to detect dynamic changes that may have occurred in the meantime, such as for example, new service added, old service deleted, scaling up / down of service instances, new data assets, and / or the like.

[0067] Before explaining at least one embodiment in detail, it is to be understood that embodiments are not necessarily limited in its application to the details of construction and the arrangement of the components and / or methods set forth in the following description and / or illustrated in the drawings and / or the Examples. Implementations described herein are capable of other embodiments or of being practiced or carried out in various ways.

[0068] Embodiments may be a system, a method, and / or a computer program product. The computer program product may include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out aspects of the embodiments.

[0069] The computer readable storage medium can be a tangible device that can retain and store instructions for use by an instruction execution device. The computer readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of the computer readable storage medium includes the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, and any suitable combination of the foregoing. A computer readable storage medium, as used herein, is not to be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber-optic cable), or electrical signals transmitted through a wire.

[0070] Computer readable program instructions described herein can be downloaded to respective computing / processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and / or a wireless network. The network may comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and / or edge servers. A network adapter card or network interface in each computing / processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing / processing device.

[0071] Computer readable program instructions for carrying out operations of embodiments may be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, C++ or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The computer readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGA), or programmable logic arrays (PLA) may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of embodiments.

[0072] Aspects of embodiments are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer readable program instructions.

[0073] These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks. These computer readable program instructions may also be stored in a computer readable storage medium that can direct a computer, a programmable data processing apparatus, and / or other devices to function in a particular manner, such that the computer readable storage medium having instructions stored therein comprises an article of manufacture including instructions which implement aspects of the function / act specified in the flowchart and / or block diagram block or blocks.

[0074] The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process, such that the instructions which execute on the computer, other programmable apparatus, or other device implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0075] The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions, which comprises one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and / or flowchart illustration, and combinations of blocks in the block diagrams and / or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts or carry out combinations of special purpose hardware and computer instructions.

[0076] Reference is now made to FIG. 1 which is a schematic illustration of exemplary application deployment and architecture of application backup validation, according to some embodiments.

[0077] As shown in FIG. 1, an exemplary service-based application may consist of a plurality of services, such as exemplary service #1, service #2, service #3, and / or the like, as illustrated. The plurality of services may be deployed on a plurality of host machines, such as exemplary host #1, host #2, host #3, and / or the like. Optionally, the application may use other and / or additional services, such as exemplary no-SQL database service which may be deployed as a cloud service.

[0078] In some embodiments, an exemplary SLA validator such as illustrated on FIG. 1 may perform scanning of the application in accordance with the disclosed subject matter. The SLA validator may generate accordingly a list of protected assets, including items such as the following:

[0079] 1. Block volume on host #1 used by service #1

[0080] 2. SQL DB on host #1 used by service #1

[0081] 3. File System on host #2 used by service #2

[0082] 4. File System on host #3 used by service #3

[0083] 5. No-SQL Database service on the cloud used by service #3

[0084] In some embodiments, once the list of protected assets is generated, the SLA validator may compare the list against a pre-existing backup SLA defined for the application, such as may be stored in a backup and / or secondary storage system as illustrated on FIG. 1. If the list of protected assets as generated by the SLA validator and the list of assets in the pre-existing backup SLA are not identical, an alert may be issued, and the gap may be reported to a user.

[0085] Reference is now made to FIG. 2 which is a block diagram of an exemplary apparatus for application backup validation, according to some embodiments. An exemplary apparatus 200 may be used for performing one or more of the acts for application backup validation such as described with reference to FIGS. 1 and / or 3 herein.

[0086] The apparatus 200 may comprise and / or be implemented as, for example, a computer, a server, a computing node, a cluster of computing nodes and / or the like, which may include an Input / Output (I / O) interface 210 for connecting to one or more external devices, systems, services and / or the like, one or more processor(s) 212 for executing a process such as the optional flow of operations 300 as illustrated in FIG. 3, a storage 214 for storing data and / or code (program store), and / or the like.

[0087] The I / O interface 210 may include one or more wired and / or wireless network interfaces for connecting to a network 202 comprising one or more wired and / or wireless networks, for example, a Local Area Network (LAN), a Wide Area Network (WAN), a Metropolitan Area Network (MAN), a cellular network, the internet and / or the like. Using the network interface(s) the optimization system 200 may communicate, optionally via the network 202, with one or more (optionally remote, e.g., networked) application resources 206, which may optionally comprise and / or be implemented as, for example, a server, a computing node, a storage server, a networked database, a cloud service and / or the like. Through the network 202 and / or otherwise, the apparatus 200 may optionally further communicate with one or more client terminals 204, for example, a computer, a server, a laptop, a mobile device and / or the like used by one or more users, for example, an operator, a researcher, an analyst, a system administrator, an information technology (IT) expert, and / or the like. Optionally one or more of the client terminals 204 and / or application resources 206 may reside at and / or be coupled to the apparatus 200 locally.

[0088] The I / O interface 210 may further include one or more wired and / or wireless I / O interfaces, ports, interconnections and / or the like for connecting to one or more external devices, for example, a Universal Serial Bus (USB) interface, a serial interface, a Radio Frequency (RF) interface, a Bluetooth interface and / or the like. Through the I / O interface 210, the apparatus 200 may communicate with one or more external devices (not shown) attached to the I / O interface(s), for example, an attachable mass storage device, an external media device and / or the like.

[0089] In some embodiments. The apparatus 200 may comprise, and / or communicate with, via the network 202 for example, a backup and / or secondary storage such as 208, which may store backup(s) of an application, such as the exemplary service-based application illustrated in FIG. 1 herein.

[0090] The apparatus 200, communicating with one or more of the external devices, client terminals 204, and / or application resources 206, may therefore receive, fetch, collect and / or otherwise obtain data and information required for application backup validation. Such data and information may include, for example: an application configuration file, an application source code, an application deployment recipe, an application access point, an application special tag, and / or any likewise items and / or combinations of items; an input of initial list of starting points for an application scan, such as the aforementioned item(s); a pre-existing backup SLA for backing up an application; and / or the like. Optionally the apparatus 200 may communicate with one or more of the external devices and / or client terminals 204 to output data and information to a user pertaining to application backup validation, such as for example, generated protected assets lists, backup policy recommendations, gaps in assets and / or policies between current backup SLA and assets detected and / or policies set therefor, and / or the like.

[0091] The processor(s) 212, homogenous or heterogeneous, may include one or more processing nodes arranged for parallel processing, as clusters and / or as one or more multi core processor(s). The storage 214 may include one or more tangible, non-transitory persistent storage devices, for example, a hard drive, a Flash array and / or the like. The storage 214 may also include one or more volatile devices, for example, a Random Access Memory (RAM) component, a cache and / or the like. The storage 214 may further comprise one or more local and / or remote network storage resources, for example, a storage server, a Network Attached Storage (NAS), a network drive, a cloud storage service and / or the like accessible via the I / O interface 210.

[0092] The processor(s) 212 may execute one or more software modules such as, for example, a process, a script, an application, an agent, a utility, a tool, an Operating System (OS) and / or the like each comprising a plurality of program instructions stored in a non-transitory medium (program store) such as the storage 214 and executed by one or more processors such as the processor(s) 212. The processor(s) 212 may further include, utilize and / or otherwise facilitate one or more hardware modules (elements), for example, a circuit, a component, an integrated circuit (IC), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA), a Digital Signals Processor (DSP), a Graphic Processing Units (GPU), an Artificial Intelligence (Al) accelerator and / or the like.

[0093] The processor(s) 212 may therefore execute one or more functional modules utilized by one or more software modules, one or more of the hardware modules and / or a combination thereof. For example, the processor(s) 212 may execute a backup SLA validator functional module 220 for scanning an application and detecting assets used thereby, determining an optimal and / or otherwise recommended application backup plan, validating completeness and / or soundness of a backup SLA (e.g., in terms of coverage of detected assets, sufficient frequency of backup cycles according to asset type, and / or the like), and / or performing any likewise application backup validation functions, in accordance with some embodiments.

[0094] Optionally, the apparatus 200, specifically the backup SLA validator 220 may be utilized by one or more cloud computing services, platforms and / or infrastructures such as, for example, Infrastructure as a Service (laaS), Platform as a Service (PaaS), Software as a Service (SaaS) and / or the like provided by one or more vendors, for example, Google Cloud, Microsoft Azure, Amazon Web Service (AWS) and Elastic Compute Cloud (EC2) and / or the like.

[0095] One or more of the client terminals 204 may execute one or more applications, services and / or tools for communicating with the apparatus 200 and more specifically with the backup SLA validator 220 to enable one or more of the users to interact with the backup SLA validator 220. For example, one or more client terminals 204 may execute a web browser for communicating with the backup SLA validator 220 and presenting a User Interface (UI), specifically a Graphical UI (GUI) which may be used by the respective users to interact with the backup SLA validator 220. In another example, one or more client terminals 204 may execute a local agent which communicates with the backup SLA validator 220 and presents a GUI which may be used by the respective users to interact with the backup SLA validator 220.

[0096] The backup SLA validator 220 may be adapted to receive as input and / or otherwise obtain from default storage, such as for example application resources 206 and / or the like, an initial list of starting points for an application scan. The backup SLA validator 220 may be adapted to initialize and populate an empty list of protected assets, by performing a scanning process at an unprocessed item of the starting points list, optionally in a recursive manner. The backup SLA validator 220 may be adapted to perform, for a starting point initially provided and / or newly detected during scanning of an application, a search for detecting any and all services used by the application. The backup SLA validator 220 may be adapted to perform, for any and all such services detected, a search for detecting any and all assets used by any and all service instances used by the application respective of a service detected, and add the assets detected into the list of protected assets. The backup SLA validator 220 may be adapted to append to the list of starting points any and all newly detected starting points, other target services that a service instance used by the application communicates therewith, and / or the like.

[0097] The backup SLA validator 220 may be adapted to, upon completion of scan and generation of the protected assets list populated fully, perform a comparison between a current backup SLA, such as stored on backup storage 208, and the protected assets list generated, to determine whether and / or with regard to which assets a discrepancy exists. The backup SLA validator 220 may be adapted to set a recommended backup policy for an asset on the protected assets list generated, and optionally perform a comparison between the current backup SLA and the backup policy set for the asset to determine inadequacy of the current backup SLA or lack thereof. The backup SLA validator 220 may be adapted to output an indication of result(s) of any and all comparisons performed to a user.

[0098] The backup SLA validator 220 may be adapted to reperform the scan and generation of a protected assets lists, on-demand, periodically, and / or in response to a trigger event and / or condition, to detect any and all dynamic changes from previous scan. The backup SLA validator 220 may be adapted to repeat the comparison of assets in the protected assets list generated and in a respective list of a backup SLA effective at the time, and / or of a recommended backup policy set for an asset in the protected assets list generated and a respective backup policy specified in the backup SLA, and output indication of the comparison result(s) to a user.

[0099] Reference is now made to FIG. 3 is a flowchart schematically representing an optional flow of operations (i.e., a process) 300 for application backup validation, according to some embodiments. The exemplary process 300 may be implemented by SLA validator such as illustrated in FIG. 1 and / or exemplary apparatus 200 such as illustrated in FIG. 2.

[0100] At 302 one or more starting points for an application scan may be received. At 306 an empty list of protected assets may be initialized. At 310 items of the starting points list as initially received at 302 and / or incrementally grown by newly detected starting points throughout the application scan may be processed, optionally in a recursive manner. At 314 an item on the starting points list may be scanned to detect any and all services used by the application scanned. At 318 for a service detected at 314, scanning for any and all assets used by service instances used by the application respective of that service, may be performed, and assets thus detected may be added to the protected assets list as initialized at 306. Optionally, at 322 a recommended backup policy may be determined for an item of the protected assets list, according to a type thereof and / or likewise criteria. At 326 any and all new starting points detected during scanning as performed at 314 and / or 318 may be appended to the list of starting points, as well as any services communicated by service instances used by the application. At 330 a comparison of the list of protected assets populated at 310 through 326, as performed repeatedly and / or recursively till completion, and a current backup SLA, may be made to determine if and what discrepancy arises therebetween. Additionally or alternatively, at 334 a comparison of the recommended backup policy determined for items of the protected assets list and the current backup SLA may be performed to determined inadequacy of the current backup SLA or lack thereof. At 338 an indication of the comparison result(s) as obtained at 330 and / or 334 may be outputted to a user. Optionally the process 300 may be repeated at one or more scheduled times, per user demand, and / or upon a triggering event and / or condition specified, so as to allow detection of any and all dynamic changes that may have occurred in between.

[0101] It is appreciated that one or more of the acts described herein, particularly, but not exclusively with reference to FIGS. 1-3 herein may be executed by a computer program for unauthorized database access detection, the computer program comprising program instructions for executing the aforementioned one or more acts which may be executed by at least one processor. Each of these programs may be provided on a non-transitory storage medium.

[0102] The descriptions of the various embodiments have been presented for purposes of illustration, but are not intended to be exhaustive or limited to the embodiments disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terminology used herein was chosen to best explain the principles of the embodiments, the practical application or technical improvement over technologies found in the marketplace, or to enable others of ordinary skill in the art to understand the embodiments disclosed herein.

[0103] It is expected that during the life of a patent maturing from this application many relevant service-based application architectures, volumes, file systems, databases, application configurations, application program code, secondary and / or backup storage systems, and backup service level agreements (SLAs) will be developed and the scope of those terms as used herein is intended to include all such new technologies a priori.

[0104] As used herein the term “about” refers to ± 10 %.

[0105] The terms "comprises", "comprising", "includes", "including", “having” and their conjugates mean "including but not limited to". This term encompasses the terms "consisting of' and "consisting essentially of'. The phrase "consisting essentially of means that the composition or method may include additional ingredients and / or steps, but only if the additional ingredients and / or steps do not materially alter the basic and novel characteristics of the claimed composition or method.

[0106] As used herein, the singular form "a", "an" and "the" include plural references unless the context clearly dictates otherwise. For example, the term "a compound" or "at least one compound" may include a plurality of compounds, including mixtures thereof.

[0107] The word “exemplary” is used herein to mean “serving as an example, instance or illustration”. Any embodiment described as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments and / or to exclude the incorporation of features from other embodiments.

[0108] The word “optionally” is used herein to mean “is provided in some embodiments and not provided in other embodiments”. Any particular embodiment may include a plurality of “optional” features unless such features conflict.

[0109] Throughout this application, various embodiments may be presented in a range format. It should be understood that the description in range format is merely for convenience and brevity and should not be construed as an inflexible limitation on the scope of embodiments. Accordingly, the description of a range should be considered to have specifically disclosed all the possible subranges as well as individual numerical values within that range. For example, description of a range such as from 1 to 6 should be considered to have specifically disclosed subranges such as from 1 to 3, from 1 to 4, from 1 to 5, from 2 to 4, from 2 to 6, from 3 to 6 etc., as well as individual numbers within that range, for example, 1, 2, 3, 4, 5, and 6. This applies regardless of the breadth of the range.

[0110] Whenever a numerical range is indicated herein, it is meant to include any cited numeral (fractional or integral) within the indicated range. The phrases “ranging / ranges between” a first indicate number and a second indicate number and “ranging / ranges from” a first indicate number “to” a second indicate number are used herein interchangeably and are meant to include the first and second indicated numbers and all the fractional and integral numerals therebetween.

[0111] It is appreciated that certain features of embodiments, which are, for clarity, described in the context of separate embodiments, may also be provided in combination in a single embodiment. Conversely, various features of embodiments, which are, for brevity, described in the context of a single embodiment, may also be provided separately or in any suitable subcombination or as suitable in any other described embodiment. Certain features described in the context of various embodiments are not to be considered essential features of those embodiments, unless the embodiment is inoperative without those elements.

[0112] Although embodiments have been described in conjunction with specific embodiments thereof, it is evident that many alternatives, modifications and variations will be apparent to those skilled in the art. Accordingly, it is intended to embrace all such alternatives, modifications and variations that fall within the spirit and broad scope of the appended claims. It is the intent of the applicant(s) that all publications, patents and patent applications referred to in this specification are to be incorporated in their entirety by reference into the specification, as if each individual publication, patent or patent application was specifically and individually noted when referenced that it is to be incorporated herein by reference. In addition, citation or identification of any reference in this application shall not be construed as an admission that such reference is available as prior art to the present disclosure. To the extent that section headings are used, they should not be construed as necessarily limiting. In addition, any priority document(s) of this application is / are hereby incorporated herein by reference in its / their entirety.

Claims

CLAIMS1. A service level agreement, SLA, validator for validating backup SLA of an application program consisting of multiple services, comprising: a processing circuitry adapted to execute a code for: receiving a list of starting points for services discovery; initializing and populating a protected assets list by: scanning an item on the list of starting points to detect services used by the application; and scanning to detect and add to the protected assets list assets used by instances of a service detected; comparing the protected assets list with a backup service level agreement of the application to determine a discrepancy; and outputting an indication of the discrepancy to a user.

2. The SLA validator of claim 1, wherein the processing circuitry is further adapted to execute a code for appending to the list of starting points new items detected during the scanning of the item or the respective instance.

3. The SLA validator of claim 1, wherein the processing circuitry is further adapted to execute a code for determining and appending to the list of starting points target services communicated by the respective instance.

4. The SLA validator of claim 1, wherein the processing circuitry is further adapted to execute a code for: determining a type-based backup policy for an asset in the protected assets list; comparing the type-based backup policy with the backup service level agreement to determine an inadequacy or lack thereof; and outputting an indication of the inadequacy or lack thereof to the user.

5. The SLA validator of claim 1, wherein the processing circuitry is further adapted to execute a code for re-performing the populating according to at least one scheduling scheme selected from the group of: periodically; by-demand; and trigger-based.

6. The SLA validator of claim 1, wherein an item on the list of starting points is of a type selected from the group of an application name; an application configuration file; an application source code; an application deployment recipe; an application access point; an application special tag.

7. The SLA validator of claim 1, wherein an item on the protected items list is of a type selected from the group of: a volume; a file system; and a database.

8. The SLA validator of claim 1, wherein at least one of the scanning to detect services used by the application and the scanning to detect and add assets used by instances of a service detected is performed in a recursive manner.

9. A method for validating backup service level agreement, SLA, of an application program consisting of multiple services, comprising: receiving a list of starting points for services discovery; initializing and populating a protected assets list by: scanning an item on the list of starting points to detect services used by the application; and scanning to detect and add to the protected assets list assets used by instances of a service detected; comparing the protected assets list with a backup service level agreement of the application to determine a discrepancy; and outputting an indication of the discrepancy to a user.

10. The method of claim 9, further comprising appending to the list of starting points new items detected during the scanning of the item or the respective instance.

11. The method of claim 9, further comprising determining and appending to the list of starting points target services communicated by the respective instance.

12. The method of claim 9, further comprising: determining a type-based backup policy for an asset in the protected assets list; comparing the type-based backup policy with the backup service level agreement to determine an inadequacy or lack thereof; and outputting an indication of the inadequacy or lack thereof to the user.

13. The method of claim 9, further comprising re-performing the populating according to at least one scheduling scheme selected from the group of periodically; by-demand; and trigger-based.

14. The method of claim 9, wherein an item on the list of starting points is of a type selected from the group of: an application name; an application configuration file; an application source code; an application deployment recipe; an application access point; an application special tag.

15. The method of claim 9, wherein an item on the protected items list is of a type selected from the group of: a volume; a file system; and a database.

16. The method of claim 9, wherein at least one of the scanning to detect services used by the application and the scanning to detect and add assets used by instances of a service detected is performed in a recursive manner.

17. A computer program for validating backup service level agreement, SLA, of an application program consisting of multiple services, the computer program comprising program instructions which, when executed by at least one processor, cause the at least one processor to: receive a list of starting points for services discovery; initialize and populate a protected assets list by: scan an item on the list of starting points to detect services used by the application; and scan to detect and add to the protected assets list assets used by instances of a service detected; compare the protected assets list with a backup service level agreement of the application to determine a discrepancy; and output an indication of the discrepancy to a user.

Images