Incident resolution

FIELD OF THE INVENTION

0001The present invention relates generally to the field of information technology (IT), and more particularly, to IT support systems.

BACKGROUND OF THE INVENTION

0002The use of IT management systems, especially in enterprise environments, is well known. For example, Hewlett-Packard supplies a suite of IT management systems referred to generally as HP OpenView that provide numerous monitoring, diagnostic and management functions.

0003Where such systems are used it is common for a monitoring system, such as HP OpenView Operations or Network Node Manager, to be used to monitor an object, such as a software application, infrastructure element, etc. If the monitoring system detects a problem with the monitored object the problem is generally signalled in a monitoring system console. The detected problem may also be turned into an incident and sent to a local incident tracking system, such as an internal IT service desk, to enable a human operator to analyse the problem and to take remediative action.

0004Typical internal IT service desks maintain a knowledge and solution base for particular software applications and infrastructure elements used in the IT environment and a solution to the problem may be available therein. However, if the internal knowledge and solution base does not contain any suitable solutions, the human operator typically has to access directly an external IT service desk proving support for the managed object, and to attempt to obtain a solution therefrom.

0005This is a manual process that needs data exchange back and forth between the management software administrator and the external service desk. The situation is further complicated by the fact that individual external service desks may use different systems, have different interfaces and generally may work in dissimilar ways.

0006Accordingly, one aim of the present invention is to overcome, or at least alleviate, at least some of the above-mentioned problems.

SUMMARY OF THE INVENTION

0007According to a first aspect of the present invention, there is provided apparatus for obtaining resolution information related to an incident report related to a monitored object in an IT infrastructure. The apparatus comprises an incident report analyser for identifying an object identified in the report relevant to the incident and for identifying for that object an external resolution resource, an incident dispatcher for dispatching at least a portion of the received incident report to the identified external resolution resource, and an incident manager for receiving resolution information concerning the dispatched incident report from the external resource.

0008According to a second aspect of the present invention, there is provided a method for obtaining resolution information related to an incident report related to a monitored object in an IT infrastructure. The method comprises analysing the incident report to identify an object identified in the report relevant to the incident and for identifying for that object an external resolution resource, dispatching at least a portion of the received incident report to the identified external resolution resource, and receiving resolution information concerning the dispatched incident report from the external resource.

0009According to a third aspect of the present invention, there is provided machine-readable storage storing a program comprising instructions, when executed, for obtaining resolution information related to an incident report related to a monitored object in an IT infrastructure, the instructions being adapted to implement the steps of at least one of analysing the incident report to identify an object identified in the report relevant to the incident and for identifying for that object an external resolution resource, dispatching at least a portion of the received incident report to the identified external resolution resource, and receiving resolution information concerning the dispatched incident report from the external resource.

BRIEF DESCRIPTION OF THE DRAWINGS

Embodiments of the present invention will now be described, by way of non-limiting example only, with reference to the accompanying diagrams, in which:

<figref idref="DRAWINGS">FIG. 1</figref> is a block diagram of an IT support system according to the prior art;

<figref idref="DRAWINGS">FIG. 2</figref> is a block diagram of a system according to an embodiment of the present invention; and

<figref idref="DRAWINGS">FIG. 3</figref> is a flow diagram outlining example processing steps taken by the support system of <figref idref="DRAWINGS">FIG. 2</figref>.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

0014Referring now to <figref idref="DRAWINGS">FIG. 1</figref>, there is shown a block diagram of a system <b>100</b> according to the prior art.

0015The system <b>100</b> comprises one or more monitored objects <b>102</b>. An object may be, for example, a software application, a network element (e.g. router), a database, and the like. The object is monitored by a monitoring system <b>104</b>. The monitoring system <b>104</b> monitors the monitored object to determine the occurrence of an incident associated therewith. An incident may be, for example, when the monitored software application is determined to have a determinable state or status or has some other determinable characteristic or parameter, and may identify, for example, that application has crashed, that the monitored software application has a memory leak, a performance issue, etc. Where the monitored object is a network element, an incident may be, for example, that the monitored object has suffered a hardware failure, is unavailable, etc. Those skilled in the art will appreciate that any type of incident to be monitored for may be defined in the monitoring system for any given monitored object. An example of such a monitoring system in the field of IT system management is the Hewlett-Packard OpenView suite of applications.

0016In addition to the monitoring system <b>104</b>, a self-healing client <b>106</b> is provided. The self-healing client <b>106</b> may be used to monitor the monitoring system and for resolving determined incidents in the monitoring system <b>104</b> itself, in a generally known manner.

0017If the monitoring system <b>104</b> determines that an incident has occurred with a monitored object, the monitoring system <b>104</b> signals the incident in its console. The monitoring system <b>104</b> also generates an incident report containing information relating, for example, to the nature of the incident, and may include managed object identifiers, software component identifiers, error messages, diagnostic data and the like. The incident report, in the form of an incident ticket, is then forwarded to a local incident tracking system <b>110</b>.

0018The local incident tracking system <b>110</b> is arranged to forward the incident report to a support automation module <b>112</b>. The elements <b>102</b>, <b>104</b>, <b>106</b>, <b>110</b> and <b>112</b> are part of a local IT infrastructure <b>114</b> and may, for example, form part of a single enterprise's computer network.

0019The support automation module <b>112</b> attempts to automatically resolve the determined incident and, as is generally known, may access local support resources within the local IT infrastructure <b>114</b>, such as a solution and knowledge base database <b>113</b> or other suitable resolution resource.

0020If the support automation system <b>112</b> is able to automatically determine a solution to the incident the support automation system <b>112</b> can apply the determined solution to the monitored object or other part of the local IT infrastructure <b>114</b>. However, if the support automation module <b>112</b> is unable to provide a solution or information relating to a solution a human operator is alerted and the human operator is then charged with trying to resolve the incident in any appropriate manner.

0021Referring now to <figref idref="DRAWINGS">FIG. 2</figref> there is shown an external support automation system <b>200</b> according to an embodiment of the present invention. Further reference is made to <figref idref="DRAWINGS">FIG. 3</figref>, which is a block diagram showing example processing steps that may be taken by the external support automation system <b>200</b>.

0022In the present embodiment the support automation module <b>112</b> of <figref idref="DRAWINGS">FIG. 1</figref> is modified so as to forward incidents to the external support automation system <b>200</b>. The incidents that the may be forwarded may be, for example, incidents that the support automation module <b>112</b> was unable to resolve using the resources of the local IT infrastructure <b>114</b>. The support automation module <b>112</b> may additionally alert a human operator of an incident, in parallel with sending the incident to the external support automation system <b>200</b>.

0023The external support system <b>200</b>, as described in greater detail below, is responsible for resolving incidents through use of external resources, such as external vendor's helpdesks and online services <b>210</b>, <b>212</b>, <b>214</b>.

0024The external support system <b>200</b> receives (step <b>302</b>) incident reports at an incident report analyser <b>202</b>. The incident report analyser <b>202</b> analyses (step <b>304</b>) the incident reports received from the support automation module <b>112</b>. The analysis determines (step <b>306</b>) the identity (step <b>306</b>) of which object or objects or components caused the incident report to be generated. For example, an incident report may detail that a problem was caused by a third party web browser used by the monitored object <b>102</b>. The incident report may further detail that the problem with the web browser was caused by a plug-in web browser module supplied by a further third party.

0025Having determined the identity of the third party object or objects at the root of the incident, the vendor of the third party object is determined (step <b>306</b>) and the incident report analyser <b>202</b> informs an external support system manager <b>206</b>. The external support system manager <b>206</b> is configured with details of the third party resources <b>210</b>, <b>212</b> and <b>214</b>. Examples of third party resources include knowledge and solution databases, automated diagnosis services, case logging to the third party service desks and the like. The configuration details of the third party resource may be obtained in any suitable manner such as, for example, through manual configuration, through discovery of available third party resources, registration of the third party resources with the external support system <b>200</b>.

0026If the external support system manager <b>206</b> has details of a suitable resource for the identified vendor the incident report analyser <b>202</b> sends a message to an incident manager <b>204</b>. The incident manager <b>204</b> is responsible for managing the status of the incident with respect to both the local incident tracking system <b>110</b> and any of the external resources <b>210</b>, <b>212</b> or <b>214</b>.

0027For example, if the incident was additionally alerted, by the local incident tracking system <b>110</b>, to a human operator as well as to the support automation module <b>112</b>, if the human operator manages to obtain a satisfactory resolution of the incident prior to a resolution being obtained by external support system <b>200</b>, the incident manager <b>204</b> is informed. The incident manager <b>204</b> then closes the incident with any external resources <b>210</b>, <b>212</b>, <b>214</b>, previously informed of the incident.

0028Conversely, if an external resource <b>210</b>, <b>212</b> or <b>214</b> is able to satisfactorily resolve the incident, this information is passed back to the support automation module <b>112</b> and the incident is closed on the external support system <b>200</b>. The incident closure information is also fed back to the local incident tracking system <b>110</b>, via the support automation module <b>112</b>, so that the incident status may be closed or updated accordingly. The incident manager <b>204</b> is able to completely manage the status of the incident report, including escalation, updates, opening and closing, etc.

0029The incident report analyser <b>202</b> then forwards the incident report to an incident dispatcher <b>208</b>.

0030The incident dispatcher <b>208</b> obtains details of the determined third party resource or resources to which the incident report should be sent. Where the incident report details multiple third party objects the incident report may be sent in its entirety, or the incident report may be pre-processed to remove any details deemed not relevant to any particular third party resource.

0031The external support system manager <b>206</b> may be configured with information relating to the format in which incident reports should be sent to any particular external resource. If the format of the received incident report is in a different format to that required by the determined third party resource then appropriate formatting of the incident report is performed. The required formatting information may be obtained, for example, through pre-configuration, through negotiation, through use of an XML based description language, and the like.

0032In an alternative embodiment all of the third party resources are arranged to use a standard incident report format, in which case no formatting is be required by the incident dispatcher <b>208</b>.

0033The incident dispatcher <b>208</b> may additionally add or remove information from the incident report depending on particular circumstances. For example, the incident dispatcher may ‘anonymise’ the incident report by removing or modifying any information that may be used to determine the origin of the incident report.

0034The incident dispatcher <b>208</b> then dispatches (step <b>308</b>) the incident report, to the determined third party resource.

0035The third party resource to which the incident report is sent may respond with status information relating thereto, and this is received by the incident manager <b>204</b> and processed accordingly (step <b>310</b>). Such status information may be relayed back to the local incident tracking system <b>110</b> to enable the status of the incident to be tracked locally within the IT infrastructure <b>114</b>.

0036If a third party resource is able to resolve the incident the resolution information provided by the third party resource is received by the incident manager <b>204</b>. The incident manager <b>204</b> provides (step <b>312</b>) at least a portion of the received resolution information back to the support automation module <b>112</b> which, depending on the nature of the resolution information can automatically apply the resolution information to resolve the incident. For example, the resolution information provided by a third party resource may be a software patch or update to be executed or to be applied to an object within the local IT infrastructure <b>114</b>. Other examples of resolution information may be configuration data to be updated or applied, rebooting information, a link to an Internet based resource, or any other generally known resolution information.

0037If the local incident tracking system <b>110</b> determines that the resolution information successfully resolved the incident the incident is closed thereon, and the updated incident status is sent to the external support system <b>200</b> to enable the incident status to be closed on both the external support system <b>200</b> and on any other third party resources previously solicited by the external support system <b>200</b> during the resolution of the incident.

0038The incident report analyser may, depending on the received incident report, relate to problems with more than one third party object. In this case, the external support system <b>200</b> manages the resolution of the multiple issues in parallel, in a similar manner to that described above. For example, an incident report may comprise information relating to the computer system used, the monitored software object and one or more software plug-ins, each of which could be provided by different vendors. An incident could have been generated as a result of a problem with one or more of these components.

0039In a yet further embodiment when the incident report analyser <b>202</b> determines that an incident was generated as a result with multiple managed objects or multiple components in a single managed object, the incident report analyser <b>202</b> priorities the resolution of each problem, attempting to obtain resolution of each problem in a sequential manner. For example, where a plug-in caused a problem resolution is first sought with the vendor of the plug-in. If resolution is not obtained, resolution of the problem may be appropriately sough via the vendor of the identified computer system, and so on.

0040In an alternative embodiment the external support automation module <b>200</b> is provided internal to the local IT infrastructure <b>114</b> and functions in substantially the same manner as described above.

0041It will be appreciated that embodiments of the present invention can be realised in the form of hardware, software or a combination of hardware and software. Any such software may be stored in the form of volatile or non-volatile storage such as, for example, a storage device like a ROM, whether erasable or rewritable or not, or in the form of memory such as, for example, RAM, memory chips, device or integrated circuits or on an optically or magnetically readable medium such as, for example, a CD, DVD, magnetic disk or magnetic tape. It will be appreciated that the storage devices and storage media are embodiments of machine-readable storage that are suitable for storing a program or programs that, when executed, implement embodiments of the present invention. Accordingly, embodiments provide a program comprising code for implementing a system or method as claimed in any preceding claim and a machine readable storage storing such a program. Still further, embodiments of the present invention may be conveyed electronically via any medium such as a communication signal carried over a wired or wireless connection and embodiments suitably encompass the same.