Auto-Suggesting IT Asset Groups Using Clustering Techniques

An information technology (IT) asset management system provides for logically grouping IT assets and performing actions on the logical groups. Cluster analysis techniques are used to analyze the configuration data corresponding to IT assets in the IT asset management system, generating proposed logical groups from the clusters determined by the cluster analysis techniques. A system administrator may be allowed to accept or reject the proposed logical groups.

Continuous Content Sharing Through Intelligent Resolution of Federated Hierarchical Graphs

Systems, methods and computer readable media for media for continuous content sharing between systems through intelligent resolution of federated hierarchical graphs are described. A Multi-Topology Middleman (MTM) is used between the source and target systems to handle the content sharing. The MTM builds on traditional import/export infrastructure; it tracks the import/export of individual objects between systems. When a conflict is found between systems, the MTM learns the conflict resolution and stores the conflict resolution as a rule for the conflicting object, and applies the rule for subsequent import/export process on that object. The MTM also tracks the mapping of objects between the source and target systems and updates the target object in accordance with a change in the source object. The MTM is also capable of undoing the import process. 1. A computer-implemented method of sharing content between computer systems using a Multi-Topology Middleman (MTM) , the method comprising:receiving, at the MTM, a request to share content in a first computer system to a second computer system;exporting, by the MTM, the content from the first computer system;publishing the content to a data fabric;copying metadata of the content to the MTM;previewing conflicts of the content with existing data on the second computer system;returning one or more rules for the content;importing the content from the data fabric to the second computer system; andapplying the one or more rules to the content on the second computer system.2. The computer-implemented method of further comprising detecting a change in content on one of the computer systems.3. The computer-implemented method of claim 1 , wherein the request is initiated by a user.4. The computer-implemented method of wherein the act of previewing comprises attempting to import the content to the second computer system without making any changes based on the metadata.5. The computer-implemented method of claim 1 , wherein the act ...

METHOD AND SYSTEM FOR EXECUTING AND UNDOING DISTRIBUTED SERVER CHANGE OPERATIONS

A method and system for executing and undoing distributed server change operations for a collection of server objects across multiple target servers in a transaction-safe manner is provided. In one embodiment, server change operations for a collection of server objects, such as files and configuration file entries, are specified in a transaction package. The target servers to which the specified change operation are directed are also identified in the transaction package. Parameter values for each of the identified target servers are specified through a parameter file in the transaction package. The transaction package is sent to the identified target servers, which execute the change operations on the target servers in a transaction-safe manner using these parameter values. 1. A method for executing change operations across a plurality of servers in a transaction-safe manner , the method comprising:specifying change operations for a collection of server objects in a transaction package, wherein the objects comprise at least one of files and configuration file entries;identifying two or more target servers for execution of the change operations specified in the transaction package;specifying parameter values specific to the target servers for each of the identified target servers in a parameter file;communicating the transaction package to the identified target servers, the transaction package comprising the parameter file; andexecuting a dry run with a set of tests to see if server object change operations can be carried out by the identified target servers before making any changes.238.-. (canceled)39. The method of claim 1 , wherein communicating the transaction package to the identified target servers comprises transporting the transaction package to respective virtual server agents at the identified target servers.40. The method of claim 39 , wherein communicating the transaction package to the identified target servers comprises transporting the transaction ...

METHOD AND SYSTEM FOR SIMPLIFYING DISTRIBUTED SERVER MANAGEMENT

A method and system for managing a large number of servers and their server components distributed throughout a heterogeneous computing environment is provided. In one embodiment, an authenticated user, such as a IT system administrator, can securely and simultaneously control and configure multiple servers, supporting different operating systems, through a “virtual server.” A virtual server is an abstract model representing a collection of actual target servers. To represent multiple physical servers as one virtual server, abstract system calls that extend execution of operating-system-specific system calls to multiple servers, regardless of their supported operating systems, are used. A virtual server is implemented by a virtual server client and a collection of virtual server agents associated with a collection of actual servers. 1. A method for receiving and executing , on one of a plurality of servers , a system command from a software application program , the method comprising:receiving a system command from a command-line interface of a server management system, the server management system including the command-line interface, a virtual server client, and virtual server agents, each virtual server agent running on a respective server;translating the system command to an abstract system command, the abstract system command being indifferent to operating systems used by the servers running the virtual server agents;receiving, at the virtual server client, the abstract system command; and identifying, by the virtual server client, a target server to receive the abstract system command and a corresponding virtual server agent associated with the target server,', 'transmitting the abstract system command to the corresponding virtual agent for translation of the abstract system command into an operating system-specific system command for execution on the target server,', 'executing the operating system-specific system command under permissions determined as a ...

Secure credential store

A credential store provides for secure storage of credentials. A credential stored in the credential store is encrypted with the public key of a user owning the credential. A first user may provide a credential owned by the first user to a second user. The first user may add credentials owned by the first user to the credential store. An administrator may manage users of the credential store without having the ability to provide credentials to those users.

SECURITY CONTEXT PASSING FOR STATELESS SYSTEM MANAGEMENT

Systems and methods for stateless system management are described. Examples include a method wherein a user sends the management system a request to act upon a managed system. The management system determines whether the user is authorized for the requested action. Upon authorization, the management system looks up an automation principal, which is a security principal native to the managed system. The management system retrieves connecting credentials for the automation principal, and connects to the managed system using the retrieved credentials. Once the managed system is connected, the management system performs the requested action on the managed system, and sends the result back to the user. 1. A method , comprising:displaying an object graph to a user;receiving a request from the user to browse a node in the object graph;obtaining an automation principal for the node; obtaining a credential for the automation principal;connecting to the node using the obtained credential; browsing the node; anddisplaying a result to the user.2. The method of further comprising:receiving a second request from the user to browse a second node in the object graph;obtaining an automation principal for the second node;obtaining a credential for the automation principal for the second node; connecting to the second node using the credential for the second node; browsing the second node; anddisplaying a second result to the user.3. A method for an access control system claim 2 , comprising:selecting, from a database, a managed system;selecting, from the database, a role for accessing the managed system; selecting, from the database, an automation principal for the managed system;creating an association that associates the automation principal with the role and the managed system; andstoring the association in the database.4. The method of further comprising:selecting, from a database, a user; andcreating an association that associates the automation principal with the user, the role ...

Provisioning of containers for virtualized applications

In a general aspect, a computer-implemented method can include receiving a request to provision a plurality of containers of an application across a plurality of data center hosts and iteratively placing the plurality of containers on the plurality of data center hosts. The containers can be selected for placement based on one of a locality constraint and an association with previously-placed containers. Placement of a selected container can be based on, at least, compute requirements of the selected container, network requirements of the selected container, configuration of the plurality of data center hosts, and performance metrics for the plurality of data center hosts.

Dynamic virtual port provisioning

In a general aspect, a computer-implemented method can include provisioning a virtual network on a hypervisor server. The method can also include querying the hypervisor server to determine an allowable range for a number of virtual ports of a first port group of a virtual switch implemented on the hypervisor server, the first port group being associated with the virtual network. The method can further include provisioning at least one virtual machine on the virtual network including assigning a respective virtual port of the first port group to the virtual machine. The method can still further include monitoring usage of the virtual ports of the first port group and, in response to the usage of the virtual ports of the first port group exceeding a threshold, instructing the hypervisor server to provision a second port group on the virtual switch, the second port group being associated with the virtual network.

Vendor portfolio management in support of vendor relationship management analysis, planning and evaluation

Various examples include a system and methods in support of vendor relationship management, analysis, planning and evaluation including dealing with collections of vendors called vendor portfolios. In various examples the system includes a database, vendor portfolio definer, a vendor portfolio populator, and a vendor portfolio analyzer. The database houses vendor data. In various examples the vendor portfolio definer allows vendor portfolios to be created, meta data, including complex documents, to be associated with vendor portfolios, and user access permissions to be assigned to vendor portfolios. In various examples the vendor portfolio populator facilitates user selection of the vendors that will make up the collection of vendors in the vendor portfolio. The vendor portfolio analyzer analyzes a business metric using vendor portfolios. In various examples the vendor portfolio analyzer allows user to perform what-if analysis on vendor portfolios. In various examples the vendor portfolio definer includes a risk management definer, the vendor portfolio populator includes a risk management screener, and the vendor portfolio analyzer includes a risk manager to facilitate managing vendors base on the organizational risk they pose. In various examples the database contains information about obligations owed to and from a vendor and the vendor portfolio analyzer includes an obligation analyzer to analyze the organizational impact of vendor obligations.

Method and system for performing distributed server change operations in a transaction-safe manner

A method and system for executing and undoing distributed server change operations for a collection of server objects across multiple target servers in a transaction-safe manner is provided. In one embodiment, server change operations for a collection of server objects, such as files and configuration file entries, are specified in a transaction package. The target servers to which the specified change operation are directed are also identified in the transaction package. Parameter values for each of the identified target servers are specified through a parameter file in the transaction package. The transaction package is sent to the identified target servers, which execute the change operations on the target servers in a transaction-safe manner using these parameter values.

Provisioning of containers for virtualized applications

In a general aspect, a computer-implemented method can include receiving a request to provision a plurality of containers of an application across a plurality of data center hosts and iteratively placing the plurality of containers on the plurality of data center hosts. The containers can be selected for placement based on one of a locality constraint and an association with previously-placed containers. Placement of a selected container can be based on, at least, compute requirements of the selected container, network requirements of the selected container, configuration of the plurality of data center hosts, and performance metrics for the plurality of data center hosts.

Multi-level key management

A key manager provides a way to separate out the management of encryption keys and policies from application domains. The key manager may create cipher objects that may be used by the domains to perform encryption or decryption, without exposing the keys or encryption/decryption algorithms to the domains. A master key managed by the key manager may be used to encrypt and decrypt the domain keys that are stored under the control of the key manager. The key manager supports the rekeying of both the master key and the domain keys based on policy. Multiple versions of domain keys may be supported, allowing domains to access data encrypted with a previous version of a domain key after a rekeying.

Method and system to simplify the management of distributed servers

Un método para configurar una pluralidad de servidores heterogéneos en una red, estando el método caracterizado por: (a) examinar (1000, 1100), en respuesta a una entrada del usuario, objetos de servidor en uno o más de una pluralidad de servidores en una red para examinar la configuración actual de los objetos de servidor en los servidores, donde los objetos de servidor comprenden uno o más equipos de servidor, parámetros de configuración o ambos; (b) crear una plantilla (1010) seleccionando identificadores (1105) de uno o más de los objetos de servidor examinados; (c) crear un modelo de referencia (1030): (d) seleccionando un servidor de referencia (1110) de la pluralidad de servidores; (e) grabar (1020) valores de los objetos de servidor en el servidor de referencia (1110) seleccionado para los objetos de servidor especificados por los identificadores de la plantilla (1010); (f) proporcionar valores para objetos de servidor de base para comparación con otros de la pluralidad de servidores, incluyendo el citado modelo de referencia (1030) valores de línea básica y rangos de cumplimiento para proporcionar una base para la configuración de otros servidores; (g) comparar (1040, 1120) los respectivos parámetros de configuración de un segundo servidor de la pluralidad de servidores con el modelo de referencia (1030); (h) identificar discrepancias entre los objetos de servidor del segundo servidor y los objetos de servidor de la línea básica del modelo de referencia, en el que todas las discrepancias identificadas para el al menos un objeto de servidor básico están fuera de los rangos de cumplimiento; (i) corregir (1050, 1125) las discrepancias identificadas de los objetos de servidor del segundo servidor con respecto al modelo de referencia (1030) generando operaciones de cambio en servidor.

Method and system for simplifying distributed server management

A method and system for managing a large number of servers and their server components distributed throughout a heterogeneous computing environment is provided. In one embodiment, an authenticated user, such as a IT system administrator, can securely and simultaneously control and configure multiple servers, supporting different operating systems, through a “virtual server.” A virtual server is an abstract model representing a collection of actual target servers. To represent multiple physical servers as one virtual server, abstract system calls that extend execution of operating-system-specific system calls to multiple servers, regardless of their supported operating systems, are used. A virtual server is implemented by a virtual server client and a collection of virtual server agents associated with a collection of actual servers.

Computer-readable medium, apparatus, and methods of automatic capability installation

A computer-readable medium includes instructions that, when executed by a processor, cause the processor to receive an installation request from a remote device through a communication channel to update a software component associated with the processor. The processor identifies a capability library component that will be used to perform at least a portion of the installation request and retrieves and uses the capability library component from a local data store to perform the portion of the installation request if the local data store includes the capability library component. The processor requests the capability library component from the remote device if the local data store does not include the capability library component.

Self-evolving computing service template translation

Methods and apparatus for automatically generating translation programs for translating computing services templates to service blueprints are disclosed. An example method includes generating a population of translation logic elements from a plurality of verified computing services template translation programs, where each of the verified programs is configured to correctly translate at least one computing services template of a plurality of known templates to a respective service blueprint. The example method further includes identifying a new computing services template and programmatically augmenting the population of translation logic elements. The example method also includes generating one or more additional translation programs based on the augmented population of translation logic elements and validating each of the one or more additional computing services template translation programs. Based on the validating, each of the one or more additional computing services template translation programs is added to the verified translation programs or is discarded.

Provisioning of containers for virtualized applications

In a general aspect, a computer-implemented method can include receiving a request to provision a plurality of containers of an application across a plurality of data center hosts and iteratively placing the plurality of containers on the plurality of data center hosts. The containers can be selected for placement based on one of a locality constraint and an association with previously-placed containers. Placement of a selected container can be based on, at least, compute requirements of the selected container, network requirements of the selected container, configuration of the plurality of data center hosts, and performance metrics for the plurality of data center hosts.

Method and system for simplifying distributed server management

A method and system fox managing a large number of servers and their server components distributed throughout a heterogeneous computing environment is provided. In one embodiment, an authenticated user, such as an IT system administrator, can securely and simultaneously control and configure multiple servers, supporting different operating systems, through a "virtual server." A virtual server is an abstract model representing a collection of actual target servers. To represent multiple physical servers as one virtual server, abstract system calls that extend execution of operating-system-specific system calls to multiple servers, regardless of their supported operating systems, are used. A virtual server is implemented by a virtual server client and a collection of virtual server agents associated with a collection of actual servers. A method and system for executing and undoing distributed server change operations for a collection of server objects across multiple target servers in a transaction-safe manner is provided.

Enforcing referential integrity for object data documents

A metadata framework helps enforce referential integrity in object data documents. In one general aspect, a method includes generating a first data definition language statement, based on a class defined in a metadata framework, that creates a table in a relational database system to store an object data document. The table may include at least one column that corresponds to an identifying attribute in the object data document, at least one column that corresponds to a relationship attribute in the object data document, and a column that stores the object data document. The method may also include generating a second data definition language statement, based on the referential integrity metadata framework, that creates a foreign key constraint on the at least one column that corresponds to the relationship attribute when the relationship is not polymorphic, and issuing the first data definition language statement and the second data definition language statement.

Systems and Methods for Extensible Distributed Configuration Management

Systems and methods for extensible distributed configuration management of computer resources are described. Examples include a computer system including a processing unit and a storage device that stores a model definition and one or more asset plug-ins (each of the one or more asset plug-ins configured to expose at least one asset object that represents a computer resource). The computer system further includes memory that stores an asset model created based at least in part on the model definition, and a network interface configured to deploy to at least one managed system a compatible asset plug-in (the model definition including at least one conditional reference to the compatible asset plug-in). If a condition specified within the asset model is satisfied the processing unit selects the compatible asset plug-in for deployment, the condition being defined within the model definition and designated as applicable to the at least one conditional reference.

Monitoring network performance of encrypted communications

According to one general aspect, a method of using a first probing device may include monitoring one or more encrypted communications sessions between a first computing device and a second computing device. In some implementations of the method, each encrypted communications session includes transmitting a plurality of encrypted data objects between the first and second computing devices. The method may include deriving, by the first probing device, timing information regarding an encrypted communications session. The method may also include transmitting, from the first probing device to a second probing device, the derived timing information.

Supervisión de rendimiento de red de comunicaciones encriptadas

Un sistema que tiene un dispositivo de servidor (106, 206) que proporciona una aplicación (180) como un servicio a través de una red a un dispositivo informático de cliente (102), comprendiendo el sistema: un primer dispositivo de sondeo (108, 208) configurado para: supervisar una sesión de comunicación de red en una red de lado de servidor (195); generar primera información de temporización (123, 298) con respecto a la sesión de comunicación de red en la red de lado de servidor (195); un segundo dispositivo de sondeo (108b, 268) configurado para: supervisar una sesión de comunicación de red en una red de lado de cliente (196); generar segunda información de temporización (123b, 297) con respecto a la sesión de comunicación de red en la red de lado de cliente (196); enviar la información de temporización (123b, 297) al primer dispositivo de sondeo (108, 208), en el que el primer dispositivo de sondeo (108, 208) se configura para generar métricas de rendimiento de extremo a extremo basándose en la primera y segunda información de temporización.

Monitoring network performance of encrypted communications

According to one general aspect, a method of using a first probing device may include monitoring one or more encrypted communications sessions between a first computing device and a second computing device. In some implementations of the method, each encrypted communications session includes transmitting a plurality of encrypted data objects between the first and second computing devices. The method may include deriving, by the first probing device, timing information regarding an encrypted communications session. The method may also include transmitting, from the first probing device to a second probing device, the derived timing information.

Monitoring network performance of encrypted communications

Hybrid-cloud infrastructures

Methods and apparatus for implementing hybrid-cloud computing networks are disclosed. An example computer-implemented method includes receiving, at a computing device, a request to provision a user application. The method further includes identifying an application blueprint corresponding with the request and identifying at least one computing resource corresponding with the request. The method still further includes identifying a network blueprint that includes the at least one computing resource, provisioning a computing network in accordance with the identified network blueprint and provisioning the at least one computing resource in the provisioned computing network. The method also includes, installing the user application in the provisioned at least one computing resource in accordance with the application blueprint.

Enforcing referential integrity for object data documents

A metadata framework helps enforce referential integrity in object data documents. In one general aspect, a method includes generating a first data definition language statement, based on a class defined in a metadata framework, that creates a table in a relational database system to store an object data document. The table may include at least one column that corresponds to an identifying attribute in the object data document, at least one column that corresponds to a relationship attribute in the object data document, and a column that stores the object data document. The method may also include generating a second data definition language statement, based on the referential integrity metadata framework, that creates a foreign key constraint on the at least one column that corresponds to the relationship attribute when the relationship is not polymorphic, and issuing the first data definition language statement and the second data definition language statement.

Topology aware smart merge

Systems, methods, and computer readable media for managing the configuration of topologically related network devices are described. In general, devices that are “topologically related” are devices that are functionally coupled in some way (e.g., network switches sharing a common trunk line or network routers providing common router services in accordance with an established priority scheme). Specifically, techniques are disclosed for verifying or changing the configuration of a first network device based on the configuration of a second, topologically related, network device. Configuration policies (or rules) are described that are used to “bridge” the configuration of one device with that of another device.

Security context passing for stateless system management

Systems and methods for stateless system management are described. Examples include a method wherein a user sends the management system a request to act upon a managed system. The management system determines whether the user is authorized for the requested action. Upon authorization, the management system looks up an automation principal, which is a security principal native to the managed system. The management system retrieves connecting credentials for the automation principal, and connects to the managed system using the retrieved credentials. Once the managed system is connected, the management system performs the requested action on the managed system, and sends the result back to the user.

System and method for installing, updating and uninstalling applications

One method includes mapping a set of environment independent attributes and tokenizing a set of environment dependent attributes in a user selected format. Optionally, the tokens may be replaced with values for the environment dependent attributes. The mapped attributes and the values for the environment dependent attributes may then be used to configure an environment(s). In one embodiment, the configuration is a transaction in a J2EE environment and the format is XML. Additionally, the transaction may tolerate the presence/absence of attributes which are to be installed/deleted. Moreover, the method may support uninstalling applications, change logging, version skipping, and generating prospective change and state reports. The mapping may be from an operational or development server. Likewise, the configuration can occur to an operational or development server. The sets of attributes may be identified by, for example, using predefined rules.