Servicenow, Inc.

Dov Miron

Bnayahu Makovsky

Vadim Dukhovny

Yuval Rimar

Ofer Gati

Yair Leibkowiz

Rani Tzur

Maayan Wigelman

Marina Osherov

Noam Biran

Tal Kapon

Vadim Shif

Shlomi Sividia

Mohammad Iktelat

Jesus Castro

Configuration management persistent storage contains entries representing configuration items and relationships between pairs of the configuration items. Event management persistent storage contains entries representing alert records. Change request persistent storage contains change records respectively referring to changes made to the configuration items. One or more processors may be configured to: extract, from a particular alert, a particular configuration item referred to therein that is associated with a particular problem; determine, by way of the relationships, a set of configuration items within a topological distance of the particular configuration item; identify, by way of the change records, one or more change requests that refer to any of the set of configuration items; and calculate root cause scores for the one or more change requests, wherein the root cause scores respectively represent estimations of impacts that the changes of the one or more change requests had on causing the particular alert.

Context-aware automated root cause analysis in managed networks

An alert management system for a configuration management database (CMDB) platform includes a client instance configured to: apply a first filter of an alert rule to CMDB alerts to select a first alert based on context of the first alert and apply a second filter of the alert rule to the CMDB alerts to select a second alert based on context of the second alert, wherein the context of the first and second alerts includes details regarding the first and second alerts and associated configuration items (CIs). The client instance is also configured to: evaluate at least one condition of the alert rule using the context of the first and/or second alert; and in response to evaluating the at least one condition of the alert rule to be true, performing at least one action of the alert rule using the context of the first and/or second alert.

Alert management system and method of using alert context-based alert rules

A new alert associated with a computer information technology issue to be remediated is received. Matching previous alerts similar to the new alert are determined. One or more successful remediation actions of the matching previous alerts are identified. The one or more successful remediation actions are evaluated. A performance of a selected one of the one or more successful remediation actions is initiated.

Computer information technology alert remediation selection based on alert similarity

An embodiment may involve a computational instance disposed within a remote network management platform. The computational instance may contain queues and facilitate the execution of applications. Communication between the computational instance and a managed network may involve: (i) selecting, by a particular application, a particular output queue; (ii) writing, by the particular application, a unit of work generated by the particular application to the particular output queue; (iii) providing, by particular output queue, the unit of work to a particular proxy server application; (iv) retrieving, by a particular input queue, a result from the particular proxy server application, where the result represents an outcome of the particular proxy server application carrying out the unit of work, and where the particular input queue is associated with the particular output queue; and (v) retrieving, by the particular application, the result from the particular input queue.

Distributed queueing in a remote network management architecture

A system includes a non-transitory memory and one or more hardware processors. The hardware processors are configured to read instructions from the non-transitory memory to perform operations including generating a service mapping illustrating a plurality of discovered configuration items connected to a network and one or more connections between the plurality of discovered configuration items, wherein at least one of the plurality of discovered configuration items comprises a virtual platform server, receiving input data from the generated service mapping associated with the virtual platform server, wherein the input data indicates one or more manual configuration item additions, validating the input data of the one or more manual configuration item additions, update the service mapping to include the one or more manual configuration item additions, generating a specified number of tasks to be performed by the service mapping, and determining an amount of time for the updated service mapping to respond to the set number of tasks.

Systems and methods for service mapping

An embodiment may involve proxy server applications within a managed network, and a computational instance disposed within a remote network management platform. The computational instance may contain queues and facilitate the execution of applications. Communication between the computational instance and managed network may involve: (i) selecting, by a particular application, a particular output queue; (ii) writing, by the particular application, a unit of work generated by the particular application to the particular output queue; (iii) retrieving, by a particular proxy server application, the unit of work; (iv) carrying out, by the particular proxy server application, the unit of work; (v) writing, by the particular proxy server application, a result to a particular input queue, where the result represents an outcome of carrying out the unit of work; and (vi) retrieving, by the particular application, the result from the particular input queue.

The present approach relates to the use of a unique key for event messages related to the same event and by employing a publication/subscription framework so that like-keyed event messages are only processed by a subscribing server. The message key may be a numeric value (e.g., from 0-99) calculated or generated based on designated event fields so that similar message keys will have the same message key number. The message key may be used to populate an event bucket field and may also be used as the topic of an event message, allowing a subscribing server to subscribe to this message key and receive and process the related event messages in order of arrival. In this manner, there is no distribution of the event messages having the same message key between parallel processing servers.

Growing community of inventors

Petach Tikva, Israel

Dov Miron