Servicenow, Inc.

Yuval Rimar

Haviv Rosh

Tal Kapon

Asaf Garty

Adar Margalit

Netta Hasdai

Yair Leibkowiz

Hail Tal

Sreenevas Subramaniam

Bnayahu Makovsky

Tal Ben Ari

Dov Miron

Vadim Shif

David Joshua Wiener

Chris Nguyen

Olga Shaked

Roy Wallerstein

Rani Tzur

Amir Schnabel

Maayan Wigelman

Robert Bitterfeld

Daniel Badyan

Stephen Scott Tucker

Gregory Grisco

Amit Chandulal Dhuleshia

Qingbin Li

Ofer Gati

Leonid Suslov

Oron Subayi

Joshua Gerbasi

Hardik Modi

Vishal Rao

Benjamin Phan

William Hurt

Neta Hasdai-Rippa

Nisan Bar Zion

Evan Qu

Configuration management persistent storage contains entries representing configuration items and relationships between pairs of the configuration items. Event management persistent storage contains entries representing alert records. Change request persistent storage contains change records respectively referring to changes made to the configuration items. One or more processors may be configured to: extract, from a particular alert, a particular configuration item referred to therein that is associated with a particular problem; determine, by way of the relationships, a set of configuration items within a topological distance of the particular configuration item; identify, by way of the change records, one or more change requests that refer to any of the set of configuration items; and calculate root cause scores for the one or more change requests, wherein the root cause scores respectively represent estimations of impacts that the changes of the one or more change requests had on causing the particular alert.

Context-aware automated root cause analysis in managed networks

Embodiments presented herein provide apparatus and techniques for identifying and classifying processes and associated applications executing in a network. All processes executing in a network may be identified using a discovery process. The processes may be clustered based on associations between the processes. Suggested application entries may then be generated based at least in part on the clusters of processes. A configuration item type and a discovery pattern may be generated for each suggested application entry. A subsequent discovery process may use the configuration item type and discovery patterns to identify associated configuration items in the network.

Discovery process identification and classification

Systems, methods, and media are presented that are used to recompute a service model to match data in a configuration management database. Recomputing includes detecting a change to a configuration item in a configuration management database and marking a recomputing environment indicating a recomputing environment to be recomputed based on the change. Using a recomputation job, a service environment database is queried and a response is received from the service environment indicating at least the recomputing environment. The recomputation job then recomputes the service environment to match a service model to the change in the configuration management database.

Systems and methods for recomputing services

A non-transitory computer readable storage medium may have stored thereon instructions that, when executed by an endpoint device, cause the endpoint device to perform operations including: (i) establishing, by the endpoint device, a first communication channel with an intermediary proxy server; (ii) receiving, from a computational instance and via the intermediary proxy server, a registration payload comprising a list of available proxy servers; (iii) ranking, at the endpoint device, the list of available proxy servers; (iv) selecting, by the endpoint device, a particular proxy server from the list of available proxy servers as ranked; (v) establishing, by the endpoint device, a second communication channel with the particular proxy server; and (vi) communicating, by the endpoint device, with the computational instance via the particular proxy server by utilizing the second communication channel.

Load balancing of discovery agents across proxy servers

Systems and methods may include a managerial server, such as an intermediary measurement, instrumentation, and discovery (MID) server, communicatively coupled to an instance hosted by a cloud service platform. The managerial server is also coupled to an agent. The managerial server is configured to receive a first result from a first check executed by the agent having a first check type and to transmit the first result to the instance using a connection type generic to multiple check types including the first check type. The managerial server is also configured to receive a second result from a second check executed by the agent having a second check type and to transmit the second result using a dedicated pipeline for the second check type.

Systems and methods for an enhanced framework for a distributed computing system

The present approach relates to determining suitable entry points for initiating discovery and mapping of an enterprise service. For example, one or more tables may be utilized that include information regarding connections and/or communication between configuration items (CIs) of the enterprise service. From the tables, a graph may be created with nodes of the graph representing an internet protocol (IP) address and a port associated with the CIs, and edges of the graph representing the connections and/or communication between the CIs. The graph may be traversed according to outbound edges starting from a node with zero or few outbound edges. The nodes that are unreachable, or untraversed, may be flagged as suitable entry point candidates. In some embodiments, the flagged suitable entry point candidates may be reconciled with already known entry points included in the one or more tables.

Systems and methods for determining entry points for mapping a network

The present approach relates to querying a configuration item (CI). The CI may be associated with a monitoring agent. In accordance with this approach, a check request is sent to a management, instrumentation, and discovery (MID) server. The check request may be sent to the monitoring agent. Additionally, a check result may be received from the monitoring agent. The check result may have data associated with the CI and the check request.

Systems and methods for enhanced monitoring of a distributed computing system

An example embodiment may involve performing a discovery process to identify configuration items representing computing devices and applications in a managed network and determining that the configuration items exceed a threshold payload size. The embodiment may then involve generating a graph that represents the configuration items as nodes interconnected by unidirectional edges. The edges may represent respective associations between pairs of configuration items to which they connect, and the respective associations are classified either as weak associations that represent non-dependency relationships between a respective pair of nodes or as strong associations that represent dependency relationships between the respective pair of nodes. The embodiment may involve dividing the graph into overlapping sub-graphs based on the respective associations represented by the edges and, for each sub-graph, separately transmitting the configuration items defined therein to one or more server devices.

Splitting network discovery payloads based on degree of relationships between nodes

A computing system may include a database disposed within a remote network management platform that manages a managed network, and server device(s) associated with the platform and configured to: transmit, to a third-party computing system, a request for general information identifying computing resources of the third-party computing system assigned to the managed network; receive, from the third-party computing system, a response indicating resource names and types of the resources that were identified; based on the response, determine that a first resource is of a first type, and responsively store, in the database, a first representation that has just data fields containing the general information from the response that identifies the first resource; and based on the response, determine that a second resource is of a second type, and responsively store, in the database, a second representation that has data fields arranged to contain specific information about the second resource.

Partial discovery of cloud-based resources

Systems and methods for processing alerts indicative of conditions of nodes of a computing infrastructure are herein disclosed as comprising, in an implementation, generating a node hierarchy comprising nodes associated with a service model, wherein relationships between the nodes are based on impact rules, identifying alerts related to the node hierarchy, wherein the alerts are indicative of impairments affecting at least a portion of the node hierarchy, and performing impact calculation for nodes of the node hierarchy based on the identified alerts. In an implementation, the impact values may be calculated in parallel for nodes indicated for processing. In an implementation, the nodes associated with the service model represent infrastructure or applicative resources and comprise nodes included in the service model and nodes related to, but not included in, the service model.

System and method for processing alerts indicative of conditions of a computing infrastructure

Systems and methods for mapping configuration items to business functions within a corporate infrastructure are disclosed. Discovery processes to automatically create and update service maps may introduce an artificial dependency between configuration items that is not necessary to the business function represented in the service map. These unnecessary dependencies may be considered 'noise' and unnecessarily complicate the service map. Using machine learning techniques and procedures to identify short lived connections embodiments in accordance with this disclosure, dependency connections that may be considered noise may be detected and flagged. Once detected, these connections may be automatically removed from the service map to improve its accuracy and usefulness. Additionally, a user interface is provided that explains the 'reason codes' for identification of noise connections. Reason codes allow a user to understand how the machine learning algorithm traversed a decision tree to identify a connection as noise.

Traffic based discovery noise reduction architecture

An example system includes a database disposed within a remote network management platform that manages a managed network, where one or more worker nodes are configured to execute containerized software applications on behalf of the managed network. The system also includes a computing device configured to request and receive configuration data identifying the applications; access traffic data generated by packet detection modules disposed amongst the one or more worker nodes and configured to (i) monitor network traffic between the applications and (ii) generate and store the traffic data which is indicative of the monitored network traffic; parse the traffic data for one or more patterns indicative of communicative relationships between the applications; based on the one or more patterns being present in the traffic data, generate mappings between the applications that have communicative relationships therebetween; and store, in the database, the configuration data and the mappings.

Discovery and mapping of containerized software applications

Growing community of inventors

Petah Tikva, Israel

Yuval Rimar