WO2003107178A2 - Method and system for simplifying distributed server management - Google Patents

Method and system for simplifying distributed server management Download PDF

Info

Publication number
WO2003107178A2
WO2003107178A2 PCT/US2003/017927 US0317927W WO03107178A2 WO 2003107178 A2 WO2003107178 A2 WO 2003107178A2 US 0317927 W US0317927 W US 0317927W WO 03107178 A2 WO03107178 A2 WO 03107178A2
Authority
WO
WIPO (PCT)
Prior art keywords
server
virmal
servers
absttact
cau
Prior art date
Application number
PCT/US2003/017927
Other languages
French (fr)
Other versions
WO2003107178A3 (en
Inventor
Thomas Martin Kraus
Vijay G. Manwani
Sekhar Muddana
Balaji Srinivasa
Ravi Reddy
Original Assignee
Bladelogic, Inc.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Bladelogic, Inc. filed Critical Bladelogic, Inc.
Priority to AU2003243426A priority Critical patent/AU2003243426A1/en
Priority to EP16192226.5A priority patent/EP3139541B1/en
Priority to EP03760238.0A priority patent/EP1573520B1/en
Priority to EP06026527A priority patent/EP1772803A3/en
Publication of WO2003107178A2 publication Critical patent/WO2003107178A2/en
Publication of WO2003107178A3 publication Critical patent/WO2003107178A3/en

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/02—Standardisation; Integration
    • H04L41/022—Multivendor or multi-standard integration
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/466—Transaction processing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0803—Configuration setting
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0803—Configuration setting
    • H04L41/0806—Configuration setting for initial configuration or provisioning, e.g. plug-and-play
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0803—Configuration setting
    • H04L41/0813—Configuration setting characterised by the conditions triggering a change of settings
    • H04L41/082—Configuration setting characterised by the conditions triggering a change of settings the condition being updates or upgrades of network functionality
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0803—Configuration setting
    • H04L41/084—Configuration by using pre-existing information, e.g. using templates or copying from other elements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/085—Retrieval of network configuration; Tracking network configuration history
    • H04L41/0853—Retrieval of network configuration; Tracking network configuration history by actively collecting configuration information or by backing up configuration information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/085—Retrieval of network configuration; Tracking network configuration history
    • H04L41/0859—Retrieval of network configuration; Tracking network configuration history by keeping history of different configuration generations or by rolling back to previous configuration versions
    • H04L41/0863—Retrieval of network configuration; Tracking network configuration history by keeping history of different configuration generations or by rolling back to previous configuration versions by rolling back to previous configuration versions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1001—Protocols in which an application is distributed across nodes in the network for accessing one among a plurality of replicated servers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1001—Protocols in which an application is distributed across nodes in the network for accessing one among a plurality of replicated servers
    • H04L67/1004—Server selection for load balancing
    • H04L67/1008—Server selection for load balancing based on parameters of servers, e.g. available memory or workload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1001—Protocols in which an application is distributed across nodes in the network for accessing one among a plurality of replicated servers
    • H04L67/1004—Server selection for load balancing
    • H04L67/1014—Server selection for load balancing based on the content of a request
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/14—Error detection or correction of the data by redundancy in operation
    • G06F11/1402—Saving, restoring, recovering or retrying
    • G06F11/1471—Saving, restoring, recovering or retrying involving logging of persistent data for recovery
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2201/00—Indexing scheme relating to error detection, to error correction, and to monitoring
    • G06F2201/84—Using snapshots, i.e. a logical point-in-time copy of the data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1001—Protocols in which an application is distributed across nodes in the network for accessing one among a plurality of replicated servers
    • H04L67/1034—Reaction to server failures by a load balancer

Definitions

  • This invention relates to the field of server management and, more particularly, to the management of servers in a heterogeneous computing environment.
  • IT Information Technology
  • chaUenges due to a significant increase in the number of servers in an enterprise's IT infrastructure and the adoption of distributed electronic business appUcations.
  • These chaUenges have resulted from: (1) a transition from cUent- server to Internet-based architectures, resulting in frequent interactions between different types of servers; and (2) the use of component appUcation servers, such as J2EE (Java 2 Platform, Enterprise Edition) and .NET, to generate components, tools, systems, and complex appUcation models.
  • J2EE Java 2 Platform, Enterprise Edition
  • .NET complex appUcation models.
  • an IT aclrninistrator may need to juggle hundreds of incompatible software appUcation configurations and track thousands of server components for the thirty to forty servers he or she manages.
  • Microsoft Window- based operating system servers are even more difficult to correct and configure than UNIX and Linux operating system based servers, due to a large number of server components having complex interdependencies.
  • system management tools are available from Microsoft, they have been designed to target only smaU-scale homogenous Windows-based computing environments, and not the large and heterogeneous computing environment supporting multiple operating systems that most IT administrators have to manage.
  • an authenticated user such as a IT system administrator, can securely and simultaneously control and configure multiple servers, supporting different operating systems, by implementing a virtual server from the user's management system.
  • the user is authenticated by an operating-system-user-context-inheritance model or standard authentication protocols, such as a pubUc key protocol, a Kerberos protocol, or a shared secret protocol.
  • a "virtual server” model is used.
  • a virtual server is an abstract model representing a coUection of actual target servers. To represent these multiple physical servers as one virtual server, the abstract system caUs that extend execution of operating-system-specific system caUs to multiple servers regardless of their supported operating systems are used.
  • a virtual server is implemented by a virtual server cUent and a coUection of virmal server agents associated with a coUection of actual servers.
  • the virtual server cUent may be implemented by a network-aware code Ubrary, such as "Ubnc,” which is implemented as a network-aware version of the "Ubc" Ubrary.
  • the virmal server cUent is a Ubrary, such as "Ubnc.”
  • the user's management system contains a software appUcation system, such as a command program (also referred to as a command line interface) or a configuration manager, which generates abstract system caUs to request services to be performed on the target servers.
  • the virmal server cUent receives the abstract system caUs and instantiates the abstract system caUs in a thread-safe manner. The thread-safe instantiation ensures simultaneous execution of the system caUs on multiple target servers, while sharing the single virmal server cUent among these multiple target servers and their associated virtual server agents.
  • the virtual server cUent identifies the target server(s) and their associate virtual server agent(s) to receive the abstract system caUs.
  • the virmal server cUent identifies the target server(s) in response to a server identifier included in the abstract system caU. Examples of the server identifier include a host name specified in a path and a network address. The server identifier may also be inferred from a group of servers to which the target server belongs.
  • the virmal server cUent transmits the abstract system caUs to the identified virtual server agent for execution on the target server.
  • the virmal server cUent may encrypt the abstract system caUs using standard encryption protocols, such as the SSL protocol, the Kerberos protocol, or the shared secret protocol, to secure communication between the virmal server cUent and the virtual server agent.
  • the virmal server cUent may specify priority, CPU utiUzation, and/or memory utilization of the abstract system caU on the identified target server.
  • the virmal server agent After the virmal server agent receives the abstract system caUs from the virmal server cUent, the virmal server agent translates the abstract system caU into an operating system-specific system caU, so that system call can be executed on the operating system-specific target server.
  • the virmal server agent identifies the source host of the user's management system to determine the encryption protocol used on the abstract system caU.
  • the virmal server agent decrypts the abstract system caU after learning about the encryption protocol used by the virmal server cUent. From the decrypted abstract system call, the virtual server agent identifies the authenticated user.
  • the virmal server agent contains software modules that can map the authenticated user (presented user) to another user (effective user) and locate a corresponding local user identity on the target server for the effective user, and impersonate the effective user as a local user on the target server associated with the virmal server agent. In one embodiment, if the effective user is not identified as a recognized local user on the target server, the user is designated as a local guest user on the target server.
  • the virmal server agent further restricts the user's access to the target server through a software module that limits the user to performing predetermined actions or accessing predetermines resources on the target server, based on a role-based access control model and/or access control Usts (ACLs).
  • ACLs access control Usts
  • the translated system caUs are then executed on the target server in a thread-safe manner and the results of the execution are transported from the virmal server agent to the virmal server cUent.
  • the virmal server agent maintains an audit log to record the names of users and the abstract system caUs executed on the target server.
  • the appUcation system can aggregate multiple abstract system caUs into a single high-level abstract system caU, which in turn is transported to the virmal server cUent.
  • the virmal server cUent After receiving the high-level abstract system caU, the virmal server cUent disintegrates the high-level abstract system caU into the original multiple abstract system caUs and instantiates these original abstract system caUs individuaUy. Accordingly, the virmal server agent receives the individual abstract system caUs for execution on the associated target server.
  • the virmal server cUent after receiving the high-level abstract system caU from the appUcation program, the virmal server cUent instantiates the high-level abstract system caU as a whole.
  • the identified virmal server agent receives the high-level abstract system call, rather than the original multiple abstract system caUs.
  • the virmal server agent in mrn translates the high- level abstract system into the individual operating system-specific system caUs to be executed on its associated target server.
  • the virmal server modifies an existing non-distributed appUcation supporting only one specific operating system to function as a network-aware appUcation that is appUcable across servers or devices supporting different operating systems by substituting a non network-aware system caU with an abstract system caU.
  • a non- distributed Unix sheU program can function as a network-aware appUcation program that is adaptable across multiple servers or devices supporting non-Unix operating systems.
  • non-distributed scripting languages such as Perl and Python, can function as network aware-appUcation programs that are appUcable across multiple servers and devices supporting different operating systems.
  • software configuration components also referred to as server objects
  • server objects software configuration components having intricate interdependencies with other server components
  • fine-grain appUcation change operations can be uniformly and simultaneously implemented across the heterogeneous servers, rather than implementing different appUcation change operations for each of the servers individuaUy.
  • a centralized management system can automaticaUy track changes, configure, and manage multiple servers to provide compUance in accordance with predefined poUcies by incorporating the methods and systems described above.
  • This invention also relates to a method and system for executing and undoing distributed server change operations for a coUection of server objects across multiple target servers in a transaction-safe manner.
  • transaction-safe means that aU required steps of each server change operation are completed before the distributed server change operation is deemed completed, and if an error occurs while performing the required steps on the target servers, any changes made from these steps are undone.
  • Examples of distributed sever change operations for a coUection of server objects may be installing, copying, updating, or deleting server objects.
  • a coUection of server objects can be copied from a single source to multiple remote target servers.
  • aU the changes caused by copying this coUection of server objects can be reversed on the affected multiple remote target servers.
  • server change operations for a coUection of server objects are specified in a transaction package.
  • server change operations are specified in a transaction package to change code and content (files, appUcations, compound components, etc.), configure parameters of multiple servers simultaneously, and roU- back the changes in the event of a failure.
  • Server change operations in the transaction package can be specified to occur on primitive server objects, compound server objects, abstract configuration server objects, and component server objects.
  • a primitive server object is an elemental server object that serves as a basis for aU other types of server objects.
  • a compound server object is a server object containing primitive server objects and other related compound server objects.
  • An abstract configuration server object is a special type of a primitive server object that represents an entry in a configuration file when the configuration file is mapped to a common abstract configuration file format using a configuration file-specific grammar.
  • a component server object is a sequenced coUection of server objects that contains prerequisite and inheritance information about other types of server objects.
  • the transaction package includes a transaction context, a parameter file, error handling actions, a sequencing instruction for the change operations, and target server prerequisites for executing the change operations, in addition to the specified change operations.
  • the transaction context is identified by begin-transaction and end-transaction statements that encapsulate the server object change operations.
  • the parameter file specifies parameter values for each of the identified target servers. These parameter values are communicated to the identified target servers along with the transaction package.
  • the parameter file contains parameters referencing parameter values that are identical across the target servers.
  • the parameter file contains parameters referencing parameter values that are distinct for each of the target servers.
  • the transaction package supports several types of errors, such as soft errors and hard errors, in its error handling actions.
  • the sequencing instruction provides an execution sequence for the specified change operations. If this instruction is not provided locaUy within the transaction package, an external dependency graph is accessed to provide an execution sequence for the specified change operations.
  • the transaction package also provides the prerequisite information for the target servers to execute the specified change operations.
  • the user may optionaUy elect to proceed with a dry run. The dry run provides an additional set of tests to see if the server object change operations can be carried out by the recipient target servers before making any changes.
  • the specified change operations are executed on each of the identified target servers in a transaction-safe manner using the parameter values.
  • the specified change operations can be reversed when a user makes an expUcit request or when an error is detected in a transaction log maintained for the transaction package, after a partial or fuU execution of the change operations.
  • the transaction log keeps track of details of aU the steps performed, so that each performed step of a change operation can be retraced and reversed from the affected target servers.
  • multiple transaction packages can be assembled into a transaction project. AU the change operations specified in a transaction project can be executed in a transaction-safe manner.
  • a server object is one or a coUection of related configuration parameters and server assets, such as files, directories, registries, patches, packages, services, and appUcations.
  • server objects there are four types of server objects: a primitive server object, a compound server object, an abstract configuration server object, and a component server object.
  • a primitive server object is an elemental server object that serves as a basis for aU other types of server objects.
  • a compound server object is a server object containing primitive server objects and other related compound server objects.
  • An abstract configuration server object is a special type of a primitive server object that represents an entry in a configuration file when the configuration file is mapped to a common abstract configuration file format using a configuration file-specific grammar.
  • a component server object is a sequenced coUection of server objects that contains prerequisite and inheritance information about other types of server objects.
  • server objects in multiple servers can be browsed in real time. While browsing, a coUection of server object identifiers (without values) can be selected and manuaUy coUected in a template.
  • the template may be imported from an external vendor.
  • the template may include one or more previously defined templates.
  • the values of the server objects identified in the template can be recorded for a specific server (also referred to as a "gold server") through a process caUed "snapshot," which coUects the values (also referred to as “snapshot results") and saves them in a reference model.
  • the reference model may be an imported reference model created by an external vendor.
  • the reference model may include one ore more previously defined reference models.
  • the reference model may be used to derive compUance rules, such as baseline configuration values and compUance ranges, from the coUected values for other servers on the network. By comparing other Uve servers to the reference model, the systems and methods track compUance and changes in the configuration of the other servers on the network.
  • a snapshot result can be used to capture the configuration of a server at an arbitrary point in time.
  • the configuration may include server objects that are expUcidy selected from a server or that are impUcidy selected via the template.
  • the snapshot results can also be recurring snapshots of a server taken at scheduled time intervals.
  • the first snapshot serves as a baseline for subsequent snapshots, so that for the subsequent snapshots, only the changes against the baseline are captured.
  • any snapshot can be reconstructed to show the entire configuration of a server at a specific time in the time intervals by combining the baseline with the incremental changes saved for the particular snapshot results.
  • these snapshots taken over a period of time can be used by the user to analyze changes on the server over time.
  • a single snapshot or recurring snapshots can be used to track change at an arbitrary point in time or over a scheduled period of time.
  • server change operations are generated to correct these discrepancies.
  • these server change operations can be presented to the servers as a transaction package so that the change operations can be executed across multiple servers in a transaction-safe manner to synchronize the target servers to the reference model or to the snapshots.
  • the user updates the reference model and packages the updates in a transaction packages to synchronize the target servers to the reference model.
  • the reference model can be used to provision a new server that is newly added to the network to ensure consistency in the configuration of the servers on the network.
  • the servers on the network can restore their previous configuration from the reference model or the snapshots, so that in case of server failure, the server can be restored to recover its existing configuration and contents.
  • a Uve server can be compared against another Uve server by comparing the server objects identified in the template.
  • the user can expUcidy select server objects that are commonly shared between these Uve servers and compare them accordingly.
  • the systems and methods according to the invention manage categoricaUy related configuration parameters across different servers by modeling the parameters in templates.
  • Server objects also referred to as configuration parameters
  • a template per server type categories such as an appUcation server category, a database server category, and a web server category.
  • the server objects are then categorized by configuration parameter type categories (e.g., network parameters, capacity parameters, availabiUty parameters, performance parameters, and security parameters), sub-categories, and associate key words based on its function.
  • a new template can be derived from the first template that combines the categoricaUy related server objects across the server categories manages the configuration parameters as if they belonged to a single server. For example, the configuration parameters of an individual web server related to security can be changed in concert with security parameters of an appUcation server and a database server.
  • FIG. 1 is a block diagram depicting an embodiment of a system for managing multiple servers in a heterogeneous computing environment.
  • FIG. 2 is a block diagram depicting a virmal server cUent in accordance with an embodiment of the invention.
  • FIG. 3 is a block diagram depicting a virmal server agent in accordance with an embodiment of the invention.
  • FIG. 4 is a flowchart depicting an embodiment of a method for receiving and executing a system caU from an appUcation program.
  • FIG. 5 is a flowchart depicting the details of instantiating an abstract system caU in one embodiment of the method of FIG. 4.
  • FIG. 6 is a screen shot of an embodiment of a system implementing the method of FIG. 4.
  • FIG. 7 is a block diagram depicting an embodiment of a system for executing and undoing distributed server change operations in a transaction-safe manner.
  • FIG. 8 is a flowchart depicting an embodiment of a system for executing and undoing distributed server change operations in a transaction-safe manner.
  • FIG. 9 is a flowchart depicting an embodiment of a method for executing and undoing distributed server change operations in a transaction-safe manner.
  • FIG. 10 is a block diagram depicting an embodiment of a system for configuring multiple servers in a heterogeneous computing environment.
  • FIG. 11 is a flowchart depicting an embodiment of a method for configuring multiple servers in a heterogeneous computing environment.
  • FIG. 12 is a block diagram depicting an embodiment of a system for managing server objects as described in a embodiment of the invention.
  • FIG. 13 is a block diagram depicting an exemplary embodiment of the system of FIG. 12.
  • FIG. 14 is a user interface display in an embodiment for a system implementing the method of FIG. 11.
  • a user 10 such as a system administrator, manages a number of servers 15A, 15B, 15C, 15D, generaUy 15, which are computers, each of which can be of the same or of different types than the other servers 15.
  • the servers 15 are typicaUy server-class general-purpose computers, which provide services (e.g. software appUcations and/or data) to other computers via one or more computer networks.
  • the servers may be appUcation servers, routers, firewaUs, load balancers, storage controUers, or a combination of these or other computers or network devices.
  • appUcation servers are databases, such as the Oracle database from Oracle Corporation of Redwood City, CaUfornia or other business appUcations.
  • AppUcation servers may also include web servers, such as the Apache web server from the Apache Foundation, and Internet Information Server (IIS) from Microsoft Corporation of Redmond, WA.
  • IIS Internet Information Server
  • other programs can be provided by the servers 15.
  • server is not limited to server-class computers or appUcation servers, but refers generaUy to computers on which the embodiments of the invention operate, which may include other types of computers or network devices.
  • each of the servers 15 may use a different operating system.
  • server 15A uses MICROSOFT WINDOWS (e.g., WINDOWS NT and WINDOWS 2000), available from Microsoft Corporation of Redmond, WA;
  • server 15B uses SUN SOLARIS, available from Sun Microsystems, Inc. of Santa Clara, CA;
  • server 15C uses RED HAT LINUX, avadable from Red Hat, Inc. of Durham, N.C.;
  • server 15D uses IBM ALX, avadable from IBM of Armonk, NY.
  • WINDOWS e.g., WINDOWS NT and WINDOWS 2000
  • server 15B uses SUN SOLARIS, available from Sun Microsystems, Inc. of Santa Clara, CA
  • server 15C uses RED HAT LINUX, avadable from Red Hat, Inc. of Durham, N.C.
  • server 15D uses IBM ALX, avadable from IBM of Armonk, NY.
  • One of the benefits of the system is its abiUty to operate in an environment having heterogen
  • the user 10 manages the servers 15 via a management system 20.
  • the management system 20 is typicaUy a server-class computer that provides the user 10 with an abiUty to manager servers 15 in a consistent manner through use of appUcation programs 25.
  • the management system 20 may be one of the servers 15, or any server-class computer that can communicate with the servers 15 over a network. Any of the target servers 15 can be designated as the management system, as long as the designated server includes appropriate appUcation programs and software modules to manage remotely located servers.
  • AppUcation programs 25 in the management system 20 can include one or more of a command-line sheU program 25A and related programs for executing sheU commands (e.g., UNIX sheU commands such as Is, mv, rm, etc.), a configuration manager 25B for managing system configuration, and/or other appUcations 25C.
  • the appUcation programs 25, which in some implementations are "network-aware,” communicate abstract system caUs to a virmal server cUent 30, which in turn communicates the abstract system caUs to the servers 15 that are the target(s) for execution of the operations requested by the abstract system caUs.
  • the "network-aware" appUcations are able to request services from heterogeneous servers supporting different operating systems without having to modify their architecture to support each of the different operating systems.
  • the user 10 enters commands, such as Unix sheU commands, to the sheU program 25A via a command line interface.
  • Commands can be entered, for example, to distribute files, directories, software packages, and patches to the target servers 15.
  • Commands can also be entered to edit configuration files of the target servers 15.
  • commands can be entered to remotely reboot the target servers 15, and stop and start change operation on the target servers 15.
  • the Unix sheU command "Is" which requests a server computer to Ust a directory of files, may be modified to be used with the user's management system 20 and the virmal server cUent 30 to Ust a directory of files from any of the target servers 15.
  • the "Is" command is used in the normal manner, except that the user 10 can identify a target server 15 for the command in a path associated with the command. For example, if the target server 15A is named "targetserverl," the user 10 may enter the command "Is //targetserverl/path/" to Ust the files in the specified path on the target server 15A. [0061] To implement this Is command of the sheU program 25A on the user's management system 20, the sheU program 25A translates the system caUs caUed by the "Is" command into one or more abstract system caUs.
  • the management system 20 may include a configuration manager 25B.
  • the configuration manager 25B is used to configure one or more of the servers 15.
  • the configuration manager is a software appUcation program that implements server change operations that are in turn translated into the corresponding operating system specific commands on the target servers 15.
  • an appUcation program 25 directs abstract system caUs to specific target servers 15.
  • the appUcation program 25 can also direct abstract system caUs to a group of servers.
  • a group of servers can be pre-defined or dynamicaUy defined based on attributes such as operating systems, capacity, IP address ranges, and instaUed appUcations.
  • the appUcation program 25 can direct an abstract system caU to a group of servers, consisting of a subset of servers 15 running the Linux operating system. AppUcation program 25 thus can deploy a command onto a server in this group without specifying a particular server in the subset.
  • the appUcation program 25 does not need to keep track of each server, nor determine which servers have sufficient capacity or features to run the program; rather, the appUcation program 25 can deploy commands (or change operations) to a predetermined group, and the virmal server cUent 30 decides which specific server should run these operations.
  • the virmal server cUent 30, which may be included in the management system 20, presents the servers 15 to the appUcation programs 25 as a single "virmal server" on which system caU operations can be executed.
  • the virmal server cUent 30 is implemented by a software Ubrary, which in one implementation is roughly analogous to the C Ubrary, Ubc.
  • the appUcation programs 25 can be staticaUy or dynamicaUy linked to the virmal server Ubrary, which is caUed Ubnc.
  • non network-aware appUcation programs 25 are converted to network-aware programs by replacing caUs to the Ubc Ubrary with equivalent caUs to the Ubnc Ubrary, which provides abstract network-aware system caUs.
  • the virmal server cUent 30 may be implemented as part of an operating system.
  • the operating system running the user's management system 20 can receive abstract system caUs and communicate them to the remote target servers 15. Accordingly, for purposes of executing an abstract system caU a target servers 15, the source of the abstract system caU is immaterial.
  • the virmal server cUent 30 communicates with the servers 15 through virmal server agents 35 associated with the servers 15, which wiU be described in detad below.
  • the virmal server cUent 30 communicates with virmal server agents 35 to present the multiple physical target servers 15 as a single virmal server to the appUcation programs 25.
  • the virmal server intercepts the abstract system caUs via the virmal server cUent 30 and routes the abstract system caUs to the virmal server agents 35.
  • the virmal server cUent 30 When the virmal server cUent 30 receives an abstract system caU from an appUcation program 25, the virmal server cUent 30 checks the abstract system caU to determine whether this system caU is a local caU or a remote caU. If the abstract system caU is a local caU, then the operating system running the management system 20 executes the system caU locaUy. If the abstract system caU is determined to be a remote caU, the virmal server cUent 30 sends the abstract system caU to a virmal server agent 35 associated with a target server 15 via a message protocol.
  • the virmal server cUent 30 when an "ropen" abstract system caU, representing a remote file open command, is received by the virmal server cUent 30, the data representing the "ropen” command and parameters associated with the "ropen” command are sent to appropriate virmal server agents 35.
  • the target-servers 15 for a system caU are identified by the user 10 or the appUcation programs 25.
  • the virtual server cUent 30 identifies the target servers 15 from their virmal server agents 35 and determines where the system caU should be directed. [0069]
  • the virmal server agents 35 receive abstract system caUs from the virmal server cUent 30 and prepare the abstract system caUs for their associated target servers 15.
  • each of the virmal server agents 35 receives the abstract system caU.
  • the virmal server agents 35 provide security measures to ensure that the user 10 is authorized to access the target servers 15, and that the virmal server agent 35 controls the user access, as provided by the associated target server 15.
  • the virmal server agent 35 translates the abstract system caU into an operating system specific caU directed to its associated target server 15.
  • the target server 15 executes the abstract system caU and returns the results back to the virmal server agent 35, which in turn sends the results back to the appropriate appUcation programs 25 via the virmal server cUent 30.
  • the virmal server agents 35 are software modules attached to their corresponding target servers 15.
  • the virmal server agents 35 are software modules that are not attached to their corresponding target servers 15, but are in communication with their associated remotely located target servers 15.
  • one of the virmal server agents 35 can represent a group of physical servers. Thus, if the same command needs to be executed on multiple servers, these servers can be aggregated into a group, represented by a single virmal server agent 35, so that appropriate system caUs can be made to a group of servers simultaneously via that virmal server agent 35.
  • abstract system caUs may include aU types of system caUs including file system caUs, operating system caUs, and the like.
  • An abstract system caU typicaUy is implemented as a modification of an analogous standard operating system specific caU.
  • any appUcation program can make operating system agnostic abstract system caUs.
  • any generic appUcation program can be made into a network aware-appUcation that can operate transparentiy across servers supporting different operating systems.
  • only the system caUs that are appUcable to aU of the target servers 15 can be modeled as abstract system caUs.
  • the target servers 15 include Unix-based servers, it may not be possible to model a system caU to update a registry as an abstract system caU, since a registry, which is a Windows specific object, does not exist and has no relevance for Unix- based server platforms.
  • the virmal server cUent 30 includes various software modules which implement its functionaUty. These modules include a receiver 40 that receives an abstract system caU made by an appUcation program 25, and forwards the abstract system caU to an instantiator 42.
  • the receiver 40 is a software module that acts a messenger between the software appUcation programs 25 and the instantiator 42.
  • the receiver 40 receives the abstract system caU from one of the software appUcation programs 25 used by the user 10.
  • the receiver 40 then forwards the abstract system caU direcdy to the instantiator 42.
  • the receiver 40 may receive standard operating system specific system caUs from an appUcation program 25. The receiver forwards such standard system caUs to the instantiator 42 for the instantiator 42 to decide to where the system caUs should be directed.
  • the instantiator 42 instantiates abstract system caUs in a thread-safe manner.
  • the thread- safe instantiation shares a single resource between multiple operations without requiring changes to the architecture of the appUcation programs requesting the operations.
  • TypicaUy thread-safe instantiation shares the same virmal server cUent 30 between multiple simultaneous execution of system caUs.
  • the use of the shared resource, such as the virmal server cUent 30, is coordinated, so that the execution of one operation does not impact the execution of other operations.
  • the appUcation programs 25 can instantiate multiple commands (or operations) via the instantiator 42.
  • the appUcation programs 25 may invoke multiple "ropen” system caUs that are directed to one or more target servers 15.
  • the "ropen” system caU is received by the instantiator 42 in the virmal server cUent 30.
  • the instantiator 42 then distributes the "ropen” abstract system caU to each of the virmal server agents associated with the target servers, so that multiple "ropen” caUs can be executed simultaneous by the target servers 15.
  • the instantiator 42 is implemented as a software Ubrary that provides routines that represent the abstract system caUs.
  • the software Ubrary is caUed "Ubnc.”
  • Iibnc is a "network-aware" Ubrary that is analogous to the standard C Ubrary.
  • the Libnc Ubrary supports the network aware appUcation programs 25 by instantiating the abstract system caUs generated by the appUcation programs 25.
  • the instantiator 42 determines to which virmal server agents 35 an abstract system caU should be directed.
  • the instantiator 42 identifies target servers 15 by finding the target server identifiers specified in the abstract system caU.
  • the target server identifier may include a path name, which in turn may include a host name or a network address (e.g., IP address) for the server.
  • the target server 15 may also be identified by server names expUcidy stated in a file which is to be run on specific named servers. Alternatively, the server identity may be inferred from a subset of servers or a group of servers (e.g., a group of Linux servers) to which the target server 15 belongs.
  • the instantiator 42 Before transmitting the abstract system caU to the virmal server agents 35, the instantiator 42 can also specify the priority, CPU utilization, and memory utilization of the system caU for the target servers 15, so that the identified target server 15 platforms can perform the requested services as specified by the virmal server cUent 30. Once the abstract system caU has been instantiated, it is sent to an encryptor 44 for further processing.
  • the encryptor 44 encrypts the abstract system caU before sending it to a transmitter 46 for transmission to the virmal server agents 35.
  • the encryptor 44 uses standard encryption protocols and algorithms to secure communication between the virmal server cUent 30 and the virmal server agents 35. Examples of standard encryption protocols include, but are not limited to, SSL (Secure Sockets Layer), Kerberos, and Shared Secret protocols. SSL uses a pubUc key to encrypt data. Kerberos assigns a unique key to each authorized user. Standard encryption algorithm includes, but are not limited to, DES (Data Encryption Standard), 3DES (Triple DES), Blowfish, and AES (Advanced Encryption Standard).
  • the encryption protocol and algorithm used by the encryptor 44 must be supported by each virmal server agent 35 with which the virmal server cUent 30 wiU communicate. For example, if the virmal server cUent 30 supports SSL, the virmal server agent 35 must be able to support SSL for that protocol to be used. If the virmal server cUent 30 supports Kerberos, the virmal server agent 35 must also be able to support Kerberos for that protocol to be used. [0082]
  • the transmitter 46 uses a network interface protocol, such as TCP/IP or Ethernet, to send the abstract system caU over a network to the virmal server agents 35. The transmitter transmits the same abstract system caU to each target virmal server agent.
  • the transmitter 46 uses an IP address to determine to which of the target servers 15 an abstract system caU should be sent.
  • An IP address may be direcdy included in the abstract system caU or may be inferred from a server identifier included in the abstract system caU.
  • the virmal server agent 35 accepts the abstract system caU containing the IP address of the target server 15 associated with that virmal server agent 35. Once the virmal server agent 35 receives the abstract system caU, the virmal server agent 35 processes the abstract system caU for execution on the target server 15. [0083] Referring to FIG. 3, each virmal server agent 35 includes software modules that implement its functionaUty.
  • These modules include a receiver 50, which receives abstract system caUs from the virmal server cUent 30, and transfers the abstract system caUs to a decryptor module 52.
  • the user 10 is authenticated to ensure that the user 10 is in fact the person he or she claims to be.
  • the user 10 can be authenticated in many ways. In one embodiment, the user 10 is authenticated by the operating system of the management system 20 and the target servers 15 subsequendy inherit the user's 10 identity. In another embodiment, SRP (Secure Remote Password) or PKI Cryptography (X.509 Certificates) is used to authenticate user 10.
  • SRP Secure Remote Password
  • PKI Cryptography X.509 Certificates
  • the Kerberos 5 system can be used to authenticate the user 10 by assigning a unique private key to the user 10.
  • the source identifier module 52 identifies the source machine, e.g., the user's management system 20.
  • the source identifier module 52 first determines the source machine through a network address (e.g., IP address) that was submitted to the virmal server agent 35 from the virmal server cUent 30 with the abstract system caU and checks to see if the source host is authorized.
  • the source module 52 determines the security protocols to be used by the virmal server agent 35 for encryption and decryption.
  • the virmal server agent 35 can support different security protocols.
  • the virmal server agent 35 can flexibly support either SSL or Kerberos based on the security protocol of the incoming data from the virmal server cUent 30.
  • the abstract system caU is sent to a decryptor 54, which decrypts the abstract system caU.
  • the user identifier module 55 identifies the user 10 invoking the appUcation programs 25 from the source machine and verifies that the user 10 is authorized to access the source machine.
  • an identity mapper 56 and an impersonator 58 provide additional security measures as the user 10 tries to access the remote target servers 15 from the user's management system 20.
  • the identity mapper 56 optionaUy maps the authenticated user (presented user) to another user (effective user) and locates a local user identity on the target server 15 that corresponds to the authenticated identity of the effective user.
  • the impersonator 58 the user 10 is impersonated on a remote target server 15, so that if the effective user is identified and exists as a local user on the remote target server 15, the user 10 takes on the local identity of the effective user and the permissions provided by that identity on the remote target server 15.
  • the user's 10 access to the remote target server 15 is further restricted to the appropriate levels provided by the permissions granted to the effective user's local identity on the remote server 15. For example, if the user 10 is authenticated as "Joe" on the management system 20 and mapped to an effective user "Jane", local permissions of "Jane” wiU be available to the user 10 on the remote target server 15. If "Jane” does not exist on the remote target server 15, then the user 10 wiU be given a guest account. In one embodiment, the combination of the presented user and the role, which is defined by Role Based Access Control (RBAC), is mapped to an effective user.
  • RBAC Role Based Access Control
  • the effective user's access for presented user 10 is further restricted by an authorizer 60, which permits the user 10 to perform predetermined actions or access predetermined resources on a particular target server 15.
  • This is achieved by using Access Control Lists (ACLs) to manage the effective user's access to resources on the remote target servers 15.
  • ACLs Access Control Lists
  • the ACL informs the operating systems of the remote target servers 15 of the access rights of the effective user on specific server resources, such as files or directories. For example, if the user 10 is mapped to the effective user "junior administrator", then the user 10 is only permitted to perform read-only commands on certain directories or files of a group of remote target servers 15 and cannot effect any changes to the target servers 15.
  • a translator 62 translates the abstract system caU into a standard operating system caU that is understandable and executable by the target server 15.
  • the translator 62 examines the abstract system caU and identifies a standard operating system specific system caU that is analogous to the abstract system caU and is supported by the operating system running the associated target server 15. Once the analogous standard system caU is identified, the translator changes the abstract system caU to the standard system caU. This standard operating system caU is forwarded to an executor 66 for execution on the target server 15.
  • the executor 66 performs the services that are requested by the standard system caU.
  • the executor 66 is the operating system running on the target server 15.
  • the operating system examines system caUs and carries out the operations requested by the system caU by, for example, communicating with other appUcations running on the target server 15.
  • An audit log 64 is maintained by each virmal server agent 35 to keep track of the names of the users and aU the activities performed by each user, and to troubleshoot server changes and configuration errors.
  • the audit log 64 saves information about the activities requested and performed by authorized users, information about data, such as the system caUs and the results of the system caUs, that were transferred back and forth between the virmal server cUent 30 and the virmal server agent 35, as weU as aU parameters associated with the abstract system caU.
  • the content of the audit log 64 is then transmitted to a centralized aggregated log kept for aU of the virmal server agents 35.
  • a first example of security measures inco ⁇ orated in an embodiment of the virmal server implementation foUows First, the user 10 logs into the management system and is authenticated as "Joe" during the login process. This authentication process can be achieved by using a known network authentication server, such as NTLM, K5, AD, APM, NIS, etc., depending on the operating system running on the management system 20. After the user "Joe” is authenticated in the management system 20, the user “Joe” is authenticated for the target servers 15 by inheriting the user "Joe” identity through the management system 20.
  • the user 10 enters a "Is" command, requesting a Usting of files on the remote target server 15A, through the sheU command program 25A on the management system 20.
  • the sheU command program 25A generates an abstract system caU in response to the command and sends the abstract system caU to the virmal server cUent 30 to proceed with the user's 10 request.
  • the virmal server cUent 30 examines the security configuration of the abstract system caU and encrypts the system caU using a shared secret key scheme with a encryption algorithm, such as DES, 3DES, or Blowfish.
  • a shared secret key scheme such as DES, 3DES, or Blowfish.
  • the target server's 15A agent 35A attempts to decrypt the message using the secret key shared with the virmal server cUent 30.
  • the virmal server agent 35A checks to see if the user "Joe” is recognized as a local user on the target server 15A through an effective user. If the user "Joe" is recognized as a local user, then the virmal server agent examines the access control Ust to determine if the combination of the user
  • the user 10 is authenticated using of SRP or PKI Certificates. Once the user 10 is authenticated the user 10 enters an "Is" command, requesting a Usting of files on the remote server 15A, through the sheU command program 25A on the management system 20. The sheU command program 25A generates an abstract system caU in response to the command and sends the abstract system caU to the virmal server cUent 30.
  • the virmal server cUent 30 examines the security configuration of the abstract system caU and encrypts the abstract system caU using pubUc key cryptography, standard encryption algorithms, such as DES, 3DES, or Blowfish, may be used for exchange of session key between the virmal server cUent 30 and the target server agent 35A to estabUsh a cornrnunication session between them.
  • pubUc key cryptography standard encryption algorithms, such as DES, 3DES, or Blowfish
  • the virmal server agent 35A After decrypting the abstract system caU received by the virmal server agent 35A, the virmal server agent 35A checks to see if the user "Joe" is recognized as a local user on the target server 15A through an effective user. If the user "Joe" is recognized as a local user, then the virmal server agent 35A examines the ACL to determine if the combination of the user 10, target server 15A, and the abstract system caU is aUowed. If the combination is aUowed, then the access control Ust is used to determine whether any further restrictions apply to the user's 10 access to the target server 15A.
  • the virmal server agent 35A executes the system caU in accordance with any security restrictions, and encrypts the results using the estabUshed session key. The results of the "Is" command are then sent back to the virmal server cUent 30, where they are decrypted and displayed to the user.
  • a third example of security measures inco ⁇ orated in an embodiment of the virmal server implementation foUows. If the management system 20 has an existing Kerberos 5 (K5) infrastructure in place, the user 10 can be authenticated by entering a Kerberos password to the management system 20.
  • the user 10 enters the "Is" command, requesting a Usting of files on the remote target server 15A, through the sheU command program 25A on the management system 20.
  • the sheU command program 25A generates an abstract system caU in response to the command and sends the abstract system caU to the virmal server cUent 30 to proceed with the user's 10 request.
  • the virmal server cUent 30 then sends the abstract system caU and a Kerberos ticket, which is retrieved from a Kerberos Domain ControUer (KDC) to the virmal server agent 35A.
  • KDC Kerberos Domain ControUer
  • the virmal server agent 35A After the virmal server agent 35A receives the abstract system caU and the ticket, the virmal server agent 35A vaUdates the abstract system caU by verifying the ticket via the KDC. Once vaUdated, the virmal server agent 35A checks to see if the user "Joe" is recognized as a local user on the target server 15A through an effective user. If the user "Joe" is recognized as a local user, then the virmal server agent examines the ACL to determine if the combination of the user "Joe" 10, target server 15A, and the abstract system caU is aUowed. If the combination is aUowed, then the access control Ust is used to determine whether any further restrictions apply to the user's 10 access to the target server 15A.
  • the virmal server agent 35A executes the system caU in accordance with any security restrictions, encrypts the results using a Kerberos key.
  • the results of the "Is" command are sent back to the virmal server cUent 30, where they are decrypted and displayed to the user.
  • FIG. 4 a method for managing multiple servers as a single virmal server is described.
  • the system represents multiple servers as a single virmal server.
  • step 410 based on a user's request for operations to be performed on target servers, the virmal server cUent 30 receives an abstract systems caU from an appUcation program 25.
  • step 420 the virmal server cUent instantiates the abstract system caUs and sends the abstract system caU to the virmal server agents 35 for execution.
  • FIG. 5 shows steps involved in instantiating an abstract system caU.
  • the virmal server cUent 30 identifies the target servers 15 through target server identifiers provided within the abstract system caU.
  • the abstract system caU is transmitted to the virmal server agents associated with the identified target servers.
  • the virmal server agents 35 prepare the abstract system caU for the target servers 15, so that the abstract system caU can be the executed on the target servers 15.
  • the abstract system caUs are translated into standard Windows NT/W2K specific system caUs that are executable by the operating system running on the target server 15A.
  • the virmal server cUent 30 receives the results of the execution from the virmal server agents 35.
  • multiple commands generate multiple system caUs, which can be aggregated into a single high-level abstract system caU by an appUcation program 25.
  • the abstract system caUs carrying out these commands can be aggregated into one high-level abstract system caU.
  • the virmal server cUent 30 can disintegrate the high level abstract system caU into the original abstract system caUs and transmit the abstract system caUs separately to virmal server agent 35.
  • FIG. 6 is a screenshot showing a command being issued to multiple servers through the management system 20. As shown here, server names used as parameters for commands are preceded by two slashed to distinguish them from a path name, which is generaUy separated by a slash.
  • the user 10 manages the target servers 15 by executing and undoing distributed server change operations across the target servers 15 in a transaction safe-manner, using the virmal server implementation described above.
  • Distributed server change operations request the operating systems of the target servers 15 to update, delete, instaU, and/or copy server assets and/or configuration file entries of the target servers 15.
  • Transaction-safe server change operations ensure that aU of the required steps of each server change operation are completed before the distributed server change operations are deemed completed. Further, if an error occurs while performing the required steps on the target servers 15, any changes made from these steps are undone, and values of the target servers' 15 assets and/or configuration entries are returned to the values they had before execution of the server change operations.
  • the appUcation programs 25 can generate a transaction package that bundles an instruction set and necessary server contents for the operating system of each of the target servers 15 to carry out the server change operations.
  • the configuration manager 25B generates a transaction package 700 that includes files or configuration file entries 705 (together referred to as server objects), a parameter file 710, and an instruction set 715 to carry out the server change operations on one or more target servers 15 that are specified by an external file, as requested by the configuration manager 25B.
  • server objects files or configuration file entries 705 (together referred to as server objects), a parameter file 710, and an instruction set 715 to carry out the server change operations on one or more target servers 15 that are specified by an external file, as requested by the configuration manager 25B.
  • the instruction set 715 includes an execution sequence of the server change operations provided for the operating systems of the target servers 15 that carry out the server change operations. If this information is not provided in the instruction set 715 in the transaction package 700, an external dependency graph 720 is accessed to provide an execution sequence of the server change operations.
  • the external dependency graph 720 can provide information about directional relationships between server objects. In particular, if NT- based program A is a prerequisite for another NT-based program B, to successfuUy execute programs A and B, program A must start before program B and program B must stop before program A.
  • sequence information is used to order the sequence of change operations for the server objects that are specified in the transaction package
  • sequence information is also used to add impUed server object change operations for related server objects, such as server objects that depend on and/or depend from these specified server objects, that are not specified in the transaction package.
  • the sequence information adds the impUed instruction to stop program B and then stop program A based on the directional relationship between programs A and B.
  • the sequence information from the dependency graph determines the sequences of server change operations to be performed not only on the specified server objects, but also on their related server objects.
  • the sequence information also causes the server change operations to stop and to be reversed not only on the specified servers, but also on the related server objects.
  • the instruction set 715 provides the sequence information for the server change operations, the instruction set 715 overrides the sequence information provided by the dependency graph 720. Similar to the sequence information provided by the dependency graph 720, the instruction set 715 provides the information related to the order in which the server change operations should be performed. The related server objects of the specified server objects are provided, so that the server change operations can effect changes on the related server objects, as weU as the specified server objects.
  • the instruction set 715 also provides dependency information between types of servers.
  • the instruction set 715 specifies server change operations to occur on any of the four types of server objects 705: primitive server objects, compound server objects, abstract configuration server objects, and component server objects.
  • a primitive server object is an elemental server object that serves as a basis for aU other types of server objects.
  • primitive server objects include, but are not limited to, files, directories, Redhat Package Manager files, and configuration file entries for text configuration files, such as the "inetd.conf ' file.
  • primitive server objects include, but are not limited to, files, directories, packages, patches, and configuration files entries for configuration files, such as the "inetd.conf file.
  • primitive server objects include, but are not limited to, files, file ACLs, directories, directory ACLs, appUcation programs, hot fixes, the registry entries, registry entry ACLs, COM/COM+ (component object model) catalog entries, Metabase entries, users, accounts, and configuration file entries for aU configuration files, such as ".ini" files.
  • a compound server object is a server object containing primitive server objects and other related compound server objects.
  • an extended component object model (COM+) object an NT or W2K-based compound server object
  • contains primitive server objects such as a COM+ catalog entry, NT registry entries, and DLL files.
  • an Ente ⁇ rise JavaBeans (EJB) object a compound server object, contains primitive server objects including a Java Archive (JAR) file and multiple configuration file entries.
  • a server process is a compound server object, containing primitive server objects, such as configuration file entries (e.g., a permission entry, a priority entry, a control signal entry), files, and executables.
  • An abstract configuration server object is a special type of a primitive server object that represents an entry in a configuration file via a corresponding entry in an abstract configuration file, where mapping of a configuration file to a common abstract configuration format is provided by a configuration file-specific grammar.
  • configuration file entries are stored in ".ini” files or XML configuration files.
  • configuration file entries are stored in text files such as "inetd.conf files or "httpd.conf , or XML configuration files.
  • a common abstract configuration format is provided by normaUzing configuration file entries through a supported configuration file-specific grammar.
  • server change operations may be made based on the normalized abstract configuration file entries.
  • the change operations requested by the abstract configuration file entries are performed, and the changes are then communicated to the actual configuration file entries.
  • configuration file entries can be individuaUy managed through use of abstract configuration file entries, without having to change the entire configuration file each time a server change operation changes an individual entry.
  • Configuration file-specific grammars may be provided for numerous systems, including Solaris, Linux, NT4/W2K, Apache, Web Logic, and Web Sphere.
  • a component server object is a sequenced coUection of server objects.
  • an NT Service Pack is a sequenced coUection of NT Hot Fixes to be appUed in a predefined order. Accordingly, a coUection of predefined related change operations can be effected in order through a component server.
  • the instruction set 715 specifies the server change operations to be made across the target servers 15 on a coUection of predetermined server objects by communicating with the server objects (e.g., files or configuration file entries 705), the dependency graph 720, and the parameter file 710.
  • Server change operations can be used to deploy or copy files, directories, and software packages to the target servers 15. Change operations can also be used to edit configuration file entries 705 without having to log into each target server 15.
  • the instruction set 715 provides the information needed by the target servers 15 and their associated virmal server agents 35 to carry out the server change operations.
  • the instruction set 715 provides a transaction context that is identified by begin-transaction and end-transaction statements encapsulating the server object change operations. After the begin-transaction statement is made, the instruction set provides the necessary information to perform the change operations requested by the appUcation programs 25. [0113]
  • the instruction set 715 also provides error-handling instructions for the target servers and their associated virmal server agents. In one embodiment, several types of errors are avadable. Soft errors are available to alert the target servers and their virmal server agents of a likelihood of occurrence of an error during server change operations. Because no actual error has occurred, the user 10 may ignore the soft errors and continue with the execution of the server change operations. Alternatively, the user 10 may instruct the virmal server agents to expUcidy undo aU the changes made from the execution of the server change operations after reviewing the error information returned by the soft errors.
  • Hard errors are available to notify the virmal server agents of an occurrence of an error during the performance of server change operations on the target servers.
  • the hard errors can be programmed to automaticaUy trigger undo operations to undo any of the changes made during the execution of the server change operations.
  • the hard errors can be programmed to abort the execution of the remainder of transaction package change operations.
  • the hard errors are triggered by error conditions set forth in the instruction set 715. These error conditions specify that if certain conditions occur, the hard errors should be sent to the target servers and their associated virmal server agents.
  • the instruction set 715 also includes prerequisite information for the instructions.
  • An example of this prerequisite information can include, but are not limited to, the minimum set of change operation instructions that must be specified in a transaction package for its successful execution. For example, to successfuUy add a COM+ component on the target servers, instructions for adding the COM+ entr in the catalog, the corresponding Registry entry, and the corresponding DLL file must be specified in the transaction package.
  • Another example of the prerequisite information can include types of permissions needed to carry out the change operations, rriinirnurn disk space required by the target servers 15, and the type of operating system required.
  • the prerequisite information can also include impUcit instructions for hierarchical server objects.
  • the parent directory for the file should exist in the target servers, so that the file can be created under the specified parent directory in these servers.
  • the instruction set 715 defines the changes that need to be made on the server objects by using named parameters, and later replacing the parameters with actual values obtained from a parameter file 710.
  • the virmal server agents 35 receive the transaction package 700 on behalf of their associated target servers 15, and replace the named parameters with values obtained from the parameter file 710. These named parameters are particularly useful when performing server change operations on server objects that are directed to multiple target servers 15, because the named parameter representing the identity of each target server can be replaced with the actual server identifiers by the virmal server agents 35.
  • named parameters of an instruction can reference a path name for a target server 15 that includes a host name or an IP address of the target server 15. These parameters are replaced with actual server identifiers for each target server 15, as provided in the parameter file(s) 710.
  • the parameter file 710 can be either a global parameter file or a host- specific parameter file.
  • a global parameter file contains parameters that are configured by the user 10, thus the identical global parameter file is passed to aU target servers 15.
  • a host specific parameter file contains parameters that are specific to each of target servers 15, thus the host specific parameter file is different for each of target servers 15.
  • Parameter values contained in the global parameter file are useful when copying the same server object to the same destination on multiple target servers 15. Examples of this type of parameter are the user's name and password.
  • the parameter values contained in the host-specific parameter file are resolved by each of the target servers 15. Examples of these parameters are host names, and path names of the target servers 15. In addition, there are intrinsic parameters that are resolved through host environment variables on the target server.
  • one or more parameter files 710 are associated with one or more target servers. For example, for a Window-based target server, "windir" and IP address are examples of host environment variables that can be used to resolve intrinsic parameters associated with one or more target servers and passed via the transaction package 700. [0118] Referring to FIGS.
  • a transaction package 700 can be used to carry out these change operations using an XML-based instruction set 715.
  • each virmal server agent 35 is divided into two parts. One part of the virmal server agent 35 is an XML API that can inte ⁇ ret the XML-based instruction set 715 contained in the transaction package 700, and the other part of the virmal server agent 35 is a system caU API that can inte ⁇ ret abstract system caUs.
  • a virmal server agent 35 receives an XML-based transaction package 700 through the virmal server cUent 30, the XML-based instruction set 715 in the transaction package 700 can be inte ⁇ reted via the XML API.
  • the transaction package 700 can be implemented with a text-based instruction set 715.
  • the commands of the text-based instruction set 715 are translated into abstract system caUs that are in turn inte ⁇ reted by the system caU API.
  • Package_l .XML specifying a prerequisite, transaction context, compound server object, sequence, and error handling information using an XML-based instruction set 715.
  • the Parameter file foo.params contains
  • $TOKENl as a parameter that corresponds to user id - "R2D2 ⁇ web-aclrnins”
  • $TOKEN2 as a parameter to password for R2D2 ⁇ web-admins - "c3-po"
  • the ⁇ blpackage schema> tag denotes the beginning of the instruction set 715.
  • the ⁇ name>, ⁇ description> and ⁇ source type> tags respectively provide the package name, description, and source server, in this example "web-demol,” server, from where the package was created.
  • the ⁇ param> tag is use to specify location, in this example "c: ⁇ program files ⁇ app", of parameters having the name of "$APP_PATH" within the package 700, while ⁇ aram-file> tag is used to specify an external parameter file 710 caUed "foo.params".
  • the MS Windows operating system version greater than 5 and with service pack 2
  • the ⁇ depends> tag indicates that SQL Server, version 8, is a pre-requisite for the package.
  • the error handUng information which is introduced with the ⁇ FailIF> tag, specifies that the server operations should fail if error level faUs below 4.
  • the execution sequence information for the server change operations is provided under the ⁇ depends> tag.
  • the order of the operations, -stop w3svc, add service RSCDsvc, start w3svc, add file ado.dU, and add file svchost. exe would occur in the foUowing order: stop w3svc, add file svchostexe, add service RSCDsvc, start w3svc, and add file ado.dU.
  • the server assets that are being affected by the server change operations are specified under the ⁇ assets> tag.
  • Each file has a corresponding nested File ACL having the ⁇ acl key> tags.
  • the parameter file 710 "foo.params" has two parameters that are used in the transaction package 700, named as "$TOKENl" and "$TOKEN2". Instead of passing physical values directed to each target server, the named parameters are sent, and are resolved by the parameter file 710 when the parameter file 710 substitutes the actual values that are specific for each target servers 15 for the named parameters.
  • these values can be a path for a coUection of server objects (e.g., files), a user name, or a password.
  • server objects e.g., files
  • the first parameter, $TOKENl corresponds to the user name "R2D2 ⁇ web-admins”
  • the parameter $TOKEN 2 corresponds to the password "c3-po.”
  • multiple ttansaction packages can be aggregated into a ttansaction project 725.
  • the transaction project 725 coordinates the transaction packages 700 and their server change operations, so that each server change operation can be executed in a ttansaction safe manner.
  • XML ttansaction project 725 containing a ttansaction package named "BLPkg_web.XML," directed to six web servers, a ttansaction package named "BLPkg_web.XML,” directed to six web servers, a ttansaction package named
  • BLPkg_app.XML directed to two appUcation servers, and a ttansaction package named "BLPkg_db.XML,” directed to two database servers: ⁇ PROJECT> ⁇ BLPkg> ⁇ Name>BLPkg_web.XML ⁇ /Name>
  • the package "BLPkg_web.XML” is to be executed on six web servers named Web Serverl through Web Server ⁇ , the package “BLPkg_app.XML” is to be executed on two appUcation servers, and the package “BLPkg_db.XML” is to be executed on two database servers.
  • the configuration manager 25B or any of the appUcation programs 25, prepares the ttansaction package 700 and instructs the virmal server cUent 30 to pass the package 700 to the virmal server agents 35 associated with the target servers. After receiving the ttansaction package 700, the virmal server agents 35 unpack the package 700 and execute the operations on their associated target servers 15. A method for achieving this is shown in FIG. 8 [0127] In Step 800, Configuration manager 25B checks the prerequisite information of the requested change operations. Examples of the prerequisite information include checks related to integrity and completeness of package such as prompting for user name and password if required, making sure simple dependencies are resolved, and making sure the corresponding files are in the package.
  • step 810 the configuration manager 25B checks for the sequence information setting forth the execution order of the requested change operations in the package's instruction set 715. If the sequence information is not provided in the instruction set 715, the configuration manager 25B accesses the external dependency graph 720 to obtain the sequence information. After completion of step 810, in step 815, the configuration manager 25B transfers the package 700 and the associated files and parameter files to the virmal server agents 35 via the virmal server cUent 30. [0129] In one embodiment, the virmal server agent 35 receives the completed ttansaction package 700 via the virmal server cUent 30.
  • the named parameters are substituted with acmal values.
  • the virmal server agent 35 then executes the server change operations specified in the ttansaction package for its associated target server 15.
  • the virmal server cUent 30 may ttansport only the parameter file 710 and the instruction set 715, without the acmal files or any of the server objects, to the virmal server agent 35, in case the user 10 optionaUy elects to proceed with a dry run.
  • the dry run provides an additional set of tests to see if the instruction set 715 can be carried out by the recipient virmal server agent 35 before making any changes on the target server 15.
  • the virmal server agent 35 After the virmal server agent 35 receives a partial transaction package 700 from the virtual server cUent 30, in step 820, the parameters are substituted with acmal values as provided in the parameter file 710. After completing the dry run, the configuration manager 25B can transfer the entire package 700 to the virmal server agents 35 via the virtual server cUent 30 for acmal execution. [0130] Before executing the operations on each target server 15, in step 835, the agent updates an undo log. The undo log, which is maintained for each target server, records the executed operations, and tracks the changes made by these operations, so that if an error occurs while executing the servers change operations, the operations can be undone as recorded in the undo log.
  • the undo log which is maintained for each target server, records the executed operations, and tracks the changes made by these operations, so that if an error occurs while executing the servers change operations, the operations can be undone as recorded in the undo log.
  • the undo log is identical in structure to the transaction package, but with the parameter files arranged in reverse order and the change operations recorded in reverse order.
  • the server change operations are executed on the target servers 15.
  • step 900 one or more appUcation programs 25 generate and specify change operations using a ttansaction package 700. Different types of server objects and corresponding target servers 15 are supported through the instruction set provided in the ttansaction package 700.
  • the appUcation program specifies the target server(s) to which the server change operations are directed.
  • the appUcation program specifies the parameter file that provides parameters and their corresponding values defined for each of the target servers, and places this information in the ttansaction package 700.
  • the server cUent 30 sends the server change operation from the appUcation program 25 to the virmal server agents 35 on the target servers 15.
  • the target servers 15 execute the server change operations in a transaction-safe manner.
  • the configuration manager 25B is an exemplary appUcation program 25 that tracks changes and compUance and configures target servers by generating and deploying a ttansaction package 700.
  • the configuration manager 25B provides a method and system for configuring different servers using a variety of software modules, such as a browser 1000, a template 1010, a recorder 1020, a reference model 1030, a comparator 1040, and a corrector 1050.
  • the browser 1000 browses server objects in different servers in real time, to examine the current configuration of the server objects contained inside of the servers 15. First, the user selects a server he/she wishes to browse.
  • the template 1010 may be imported from an external vendor.
  • the template 1010 may also be created by including one or more previously defined templates.
  • the template 1010 is an abstract template that identifies server objects contained in a server. For example, if an Apache server contains files, and configuration file entries, an Apache server template 1010 contains identifiers that are sufficient to identify the files and configuration file entries of the Apache server. After identifying server objects on the template 1010, values of these identified server objects are recorded to configure servers on the network.
  • the recorder 1020 takes a snapshot of values (e.g., attributes) associated with a coUection of server objects.
  • the recorder 1020 takes a snapshot of values of the server objects identified in the template 1010.
  • the values may come from any of the servers browsed by the browser. Alternatively, the values may come from a selected server, also referred to as a gold server.
  • Examples of the values (or attributes) of files recorded in the snapshots include, but are not limited to, file names, sizes, permissions, owners, creation dates, modification dates, and versions.
  • Examples of directory attributes (or values) recorded in snapshots are directory locations, permissions, creation dates, and modification dates.
  • registry entry attributes recorded in snapshots are field names, and corresponding values.
  • the recorded values or snapshot results of the gold server are used to derive baseline values and compUance ranges in the reference model 1030.
  • the snapshot results can be direcdy used to track changes, configure existing servers and provision new servers on the network. Snapshot results record a configuration of a server at a point in time, thus they cannot be changed.
  • the reference model 1030 can be edited to represent the reference implementation for compUance or provisioning pu ⁇ oses.
  • the reference model 1030 can provide information, such as baseline values and compUance ranges, for use by other servers in the network to identify their drift in comparison to the gold server.
  • the baseline values provide basis for configuration of other servers.
  • the compUance ranges are ranges of acceptable configuration values that are acceptable for other servers for these servers to be in compUance.
  • the reference model 1030 may be an imported reference model that was created by an external vendor.
  • the reference model 1030 may include one or more previously defined reference models.
  • the comparator 1040 compares a server to the reference model 1030 to track changes and track compUance in the server.
  • a snapshot of a current configuration of a server captured at an arbitrary point in time can be compared against a Uve-version of the captured server to track changes in the captured server.
  • the configuration of a server can include expUcidy selected server objects that are on the server or impUcidy selected server objects provided through the template 1010.
  • the snapshot results of recurring snapshots of a server taken at scheduled time intervals (e.g., daily, weekly, etc.) can be used to track changes in the captured server.
  • the first snapshot of the server serves as a baseline, so that for subsequent snapshots, only the changes against the baseline are saved in the snapshot results.
  • any snapshot result taken during these time intervals can be reconstructed to view its entire configuration and content by combining the baseline with the incremental changes saved in the snapshot result.
  • the incremental changes show changes occurred in the configuration of the server over a period of time for the user to analyze the changes of this particular server.
  • the comparator 1040 compares a Uve-version of the server to the baseline snapshot to track and save only changes on the server.
  • two Uve servers can be compared against each other without the snapshots or the reference model 1030, on an ad-hoc basis.
  • the user 10 may expUcidy select server objects that are commonly shared between the two Uve servers so that the comparator 1040 can compare the values of the sever objects between these servers.
  • the comparator 1040 compares the values of the server objects that are impUcidy provided by the template 1010.
  • the corrector 1050 corrects the discrepancies in each target server.
  • the corrector 1050 examines the discrepancies and generates server change operations that request services from the operating systems running on the target servers to correct these discrepancies.
  • server change operations can be presented to the servers as a transaction package 700 to remove discrepancies and synchronize the target servers to the reference model 1030 in a transaction-safe manner.
  • configuration updates to the target servers can be made by the transaction package 700.
  • the configuration manager 25B first makes aU the updates to the reference model 1030, which then packages the discrepancies (inttoduced in the reference model) as updates in the ttansaction package 700.
  • the ttansaction package 700 is propagated to the target servers to synchronize them to the updated reference model
  • the reference model 1030 can also be used to provision a new server to ensure consistency in the configuration of the servers in the network when a new server is added.
  • an Apache reference model 1030 can be used to provision a new Apache server so that the configuration of aU Apache servers in the network are consistent with each other.
  • both the reference model 1030 and snapshots can be used restore a previous configuration of a server in case of a disaster recovery. In particular, in case of a server failure, this server can recover its most recent configuration and contents by reconstructing the server's configuration from the snapshots taken over a period of time.
  • FIG. 11 shows an exemplary method of tracking changes and compUance, and correcting component as weU as parameter-level changes across multiple servers.
  • the configuration manager 25B browses servers in the network to obtain server asset and configuration (together referred to as server objects) status information for each server.
  • server objects server objects
  • selected server objects and their dependent server objects are browsed in real time.
  • Uve servers in the network and their stored server objects can be browsed via a Graphic User Interface (GUI) which presents the servers and server objects hierarchicaUy.
  • GUI Graphic User Interface
  • the configuration manager 25B selects identifiers of the browsed server objects to be in the template 1010.
  • the identifiers can include any information about the server object that is sufficient to identify the server object.
  • the configuration manager selects a gold server, to provide a baseline configuration and configuration ranges for other servers in the network.
  • snapshots of the values of the server objects identified in the template that are present in the gold server are recorded in the reference model 1030.
  • the reference model estabUshes compUance rules, such as the baseline configuration and the compUance ranges.
  • the snapshots of the values are not recorded in the reference model. Instead, the snapshot results of a server can be used to direcdy compare against a Uve-version of this server to ttack changes.
  • the configuration manager 25B selects servers and their respective configuration parameters (also referred to as server objects) to compare against the reference model 1030.
  • These servers can be selected from any Uve servers on the network. Alternatively, these Uve- version servers can also be direcdy compared against their own snapshots, taken at an arbittary point in a time, or taken over a specific period, without the reference model 1030, to ttack compUance and changes in these servers.
  • the results of the comparing step 1125 can be viewed item-by-item, by showing which software (or server objects) are instaUed or not instaUed, or host-by-host, by showing each server and the server objects present on the server.
  • a correcting step 1130 fixes the servers to be in compUance by synchronizing configuration of these servers with the reference model 1030 or the snapshots. Moreover, a newly added servers can be provisioned to be consistent with other servers by synchronizing this new server to the reference model 1030.
  • the configuration manager 25B can manage the same type of configuration parameters (also referred to as server objects) across different servers by specifying one or more categories for the parameters in templates.
  • the template 1200 first specifies the "server-type” category (e.g., appUcation server category 1210, web server category 1215, and database server category 1220) to specify to what type of server each server object in the network belongs, and then specifies the "parameter-type” category (e.g., network parameters, capacity parameters, availabiUty parameters, performance parameters, security parameters) to specify the parameter type to which each server object belongs.
  • server object in the template 1200 can be classified under one or more categories, sub-categories and keywords.
  • sub-categories can include encryption type and authentication type
  • keywords can include "read-only" and constant.
  • Internet 1300 and intranet 1305 are available to different categories of servers 1215, 1210, 1220 through firewaUs 1310.
  • Web server category 1215 include an IIS server 1215A for intranet services and Apache Servers 1215B, 1215C for the HTTP/FTP and Wireless/Video Internet services respectively.
  • AppUcation server category 1210 include servers running sales appUcations 1210A, on-line brokerage appUcations 1210B, and customer service appUcation 1210C.
  • Database server category 1220 include sales, trading, and account databases 1220A, 1220B, and 1220C.
  • each server object in the template 1200 is placed into a parameter category based on its function and server type.
  • the server objects may be grouped into network parameters 1330, capacity parameters 1335, availabiUty parameters 1340, performance parameters 1345, and security parameters 1350.
  • the configuration manager 25B selects categoricaUy related server objects from each category of servers and stores them in the template 1200. For example, aU the security parameters in the appUcation server category 1210 and aU the network parameters in the appUcation server category 1210 are stored in the template 1200. [0150] Referring again to FIG.
  • web server configuration parameters a, b, c, d, e are respectively categorized as network parameters 1330, capacity parameters 1335, availabiUty parameters 1340, performance parameters 1345, and security parameters 1350.
  • appUcation server configuration parameters i, U, iii, iv, v are respectively categorized as network parameters 1330, capacity parameters 1335, availabiUty parameters 1340, performance parameters 1345, and security parameters 1350.
  • database server configuration parameters I, II, III, IV, V are respectively categorized as network parameters 1330, capacity parameters 1335, availabiUty parameters 1340, performance parameters 1345, and security parameters 1350.
  • a new template can be derived from the template 1200 to isolate the categorically related server objects across the server categories and manage the configuration parameters as if they belonged to a single server.
  • security configuration parameters of an individual web server can be changed in concert with other security configuration parameters for other web servers, as weU as for appUcation servers and database servers.
  • web server network parameter a can be changed in concert with network parameters i of the appUcation server category 1210 and parameter I of the database server category 1220.
  • Web server capacity parameter b can be changed in concert with other capacity parameters U of the appUcation server category 1210 and II of the database server category 1220. Likewise, correlated changes of parameters can be performed for the availabiUty parameters 1346, the performance parameters 1345, and the security parameters 1350.
  • an exemplary screenshot of a GUI-based configuration manager 25B includes a module referred to as an asset browser 1400, which aUows a user 10 to browse Uve remote target servers 15, and to manage and store frequendy used server assets (also referred to as server objects).
  • the asset browser 1400 is divided into two panes.
  • the left pane 1410 functions as either a Servers pane or a Depots pane, depending on a tab 1420 selected by the user 10.
  • the Contents pane 1430 on the right side displays the contents of an item selected in the Servers or the Depots pane.
  • the left pane 1410 displays the Servers pane which shows a hierarchical depiction of the servers that the user 10 manages.
  • the user 10 may arrange the servers into groups based on geographical location and/or operating system. Server groups are divided into the eastern and western divisions of an ente ⁇ rise, and within those groups, another level of hierarchy for Windows, UNIX, and Linux-based servers. More specificaUy in FIG. 14, within the servers in the Easter Division 1440, the patches object 1460 in the sun 2 server 1450 is selected.
  • the Contents pane 1430 shows the contents of the patches object 1460.
  • the Depots pane (not shown) can display central repositories of commonly accessed server objects (e.g., aU files, software to be deployed, and pointers to the content of the files and software residing in other servers in the network).
  • server objects e.g., aU files, software to be deployed, and pointers to the content of the files and software residing in other servers in the network.
  • the Depots pane stores scheduled tasks to be performed, snapshots of server objects, SheU scripts, and ttansaction packages 700.
  • the configuration manager browses Uve servers on a network, tracks changes and compUance in the servers by comparing their server objects against a reference model or a snapshot, and identifying any discrepancies from the reference model or the snapshot.
  • the reference model may be used to audit other servers, to determine how configurations of the other servers have changed from the reference model.
  • a server's own snapshot can be taken arbitrarily, or over a specific period of time to ttack changes in the server, without using the reference model.
  • the server objects being compared in the audit process are provided automaticaUy by the configuration manager via templates.
  • the user may manuaUy select the server objects to compare.
  • AdditionaUy the audit process can be scheduled to ttack compUance over time.
  • the configuration manager 25B After identifying server configuration discrepancies present in the servers, the configuration manager 25B corrects the discrepancies by generating a transaction package 700, that contains server change operations to be performed on the servers 15.
  • the ttansaction package 700 bundles configuration changes operations and corresponding instructions to be deployed on remote target servers 15 to correct any discrepancies that exist in server objects contained in those servers 15.
  • the configuration manager 25B can instaU any types of server objects from a single source to multiple locations.
  • the configuration manger 25B can uninstaU software, and undo server object deployments on the remote target servers 15.
  • certain values inside the ttansaction package 700 can be parameterized and subsequendy replaced with real values during the deployment of the ttansaction package 700 on the target servers 15, without changing the contents of the ttansaction package 700 for each target server 15.
  • the configuration manager 25B can be used to move a working MS SQL server database from a gold server to multiple target servers 15, to dupUcate the changes made in this database to multiple servers.
  • the user 10 copies the changes made on the SQL Server database to the reference model, so that the configuration manager 25B can later bundle these changes to other instances of the same SQL Server database in the remote target servers 15.
  • the reference model and the remote target servers 15 have the same initial instaUation of the SQL Server database.
  • the configuration manager takes a snapshot of the gold server to create a reference model that is used as a baseline to compare the SQL Server databases between the gold server and the target servers 15. The necessary database changes are first made to the gold server.
  • the configuration manager 25B creates a ttansaction package 700 to bundle these changes to be deployed on the target servers 15.
  • the configuration manager 25B deploys the ttansaction package 700 to the virmal server agents 35 associated with the target servers 15 to request these changes to be made on their SQL Server databases.
  • the fimctionaUty of the systems and methods described above may be implemented as software on one or more general pu ⁇ ose computers.
  • the software may be written in any one of a number of high-level languages, such as FORTRAN, PASCAL, C, C++, LISP, JAVA, or BASIC.
  • the software may be written in a script, macro, or functionaUty embedded in commerciaUy available software, such as EXCEL or VISUAL BASIC. AdditionaUy, the software could be implemented in an assembly language directed to a microprocessor resident on a computer.
  • the software could be implemented in Intel 80x86 assembly language if it were configured to run on an IBM PC or PC clone.
  • the software may be embedded on an article of manufacture including, but not limited to, a "computer-readable medium" such as a floppy disk, a hard disk, an optical disk, a magnetic tape, a PROM, an EPROM, or CD-ROM.

Abstract

A method and system fox managing a large number of servers and their server components distributed throughout a heterogeneous computing environment is provided. In one embodiment, an authenticated user, such as an IT system administrator, can securely and simultaneously control and configure multiple servers, supporting different operating systems, through a "virtual server." A virtual server is an abstract model representing a collection of actual target servers. To represent multiple physical servers as one virtual server, abstract system calls that extend execution of operating-system-specific system calls to multiple servers, regardless of their supported operating systems, are used. A virtual server is implemented by a virtual server client and a collection of virtual server agents associated with a collection of actual servers. A method and system for executing and undoing distributed server change operations for a collection of server objects across multiple target servers in a transaction-safe manner is provided. In one embodiment, server change operations fox a collection of server objects, such as files and configuration file entries, are specified in a transaction package. The target servers to which the specified change operation axe directed are also identified in the transaction package. Parameter values for each of the identified target servers are specified through a parameter file in the transaction package. The transaction package is sent to the identified target servers, which execute the change operations on the target servers in a transaction-safe manner using these parameter values. A method and system for configuring heterogeneous servers across a network through modules that can browse, snapshot, track changes, track compliance, correct server objects on each of the servers, and provision new servers is provided. In one embodiment, server objects on multiple servers can be browsed in real time. While browsing, a collection of server object identifiers can be selected and collected in a template. The values of the server objects identified in the template can be recorded for a "gold server" through a "snapshot" process, which collects the values and saves them in a reference model. By comparing other live servers to the reference model, discrepancies in configuration of the other live servers can be identified and corrected. The reference models can also be used to provision a new server. Alternative to the reference model, an arbitrary snapshot or scheduled snapshots of a server can be used to track change and compliance in that server.

Description

METHOD AND SYSTEM FOR SIMPLIFYING DISTRIBUTED SERVER MANAGEMENT
Cross-Reference To Related Application
[0001] This application claims priority to and the benefit of U.S. Provisional Patent Application Serial No. 60/388,112 filed June 12, 2002, entided METHOD AND SYSTEM FOR SIMPLIFYING SERVER MANAGEMENT; U.S. Provisional Patent AppUcation Serial No. 60/453,308 filed March 10, 2003, entitled METHOD AND SYSTEM FOR SIMPLIFYING
SERVER MANAGEMENT; U.S. Patent AppUcation Serial No. 10/414,958 filed April 16, 2003, entided METHOD AND SYSTEM FOR EXECUTING AND UNDOING DISTRIBUTED SERVER CHANGE OPERATIONS; U.S. Patent AppUcation Serial No. 10/414,959 filed April 16, 2003, entided METHOD AND SYSTEM FOR SIMPLIFYING DISTRIBUTED SERVER MANAGEMENT; and U.S. Patent AppUcation Serial No. 10/414,887 filed April 16, 2003, entitled METHOD AND SYSTEM FOR MODEL-BASED HETEROGENEOUS SERVER CONFIGURATION MANAGEMENT the entire disclosures of which are hereby incorporated by reference.
Technical Field [0002] This invention relates to the field of server management and, more particularly, to the management of servers in a heterogeneous computing environment.
Background Information [0003] Information Technology (IT) administrators are facing new chaUenges due to a significant increase in the number of servers in an enterprise's IT infrastructure and the adoption of distributed electronic business appUcations. These chaUenges have resulted from: (1) a transition from cUent- server to Internet-based architectures, resulting in frequent interactions between different types of servers; and (2) the use of component appUcation servers, such as J2EE (Java 2 Platform, Enterprise Edition) and .NET, to generate components, tools, systems, and complex appUcation models. Faced with these chaUenges, an IT aclrninistrator may need to juggle hundreds of incompatible software appUcation configurations and track thousands of server components for the thirty to forty servers he or she manages.
[0004] Currendy available configuration tools are inadequate to manage a large number of software appUcation configuration and server components across multiple servers in a heterogeneous computing environment. To manage and configure heterogeneous servers, particularly in the complex business computing infrastructure, many IT administrators use enterprise systems management (ESM) products offering monitoring tools to automate problem identification across multiple servers. However, these monitoring tools do not provide a centralized management system with a centralized configuration database, which can centraUy keep track of current server components and their interdependencies across the different servers.
[0005] In addition, these ESM products provide Utde or no help in correcting or configuring server components in a heterogeneous computing environment. For UNIX and Linux operating system- based servers, despite the open-source and internaUy developed tools and scripts to handle simple configuration changes to J2EE configurations, neither the tools nor the scripts can be easily extended to address complex distributed appUcations.
[0006] Microsoft Window- based operating system servers are even more difficult to correct and configure than UNIX and Linux operating system based servers, due to a large number of server components having complex interdependencies. Although system management tools are available from Microsoft, they have been designed to target only smaU-scale homogenous Windows-based computing environments, and not the large and heterogeneous computing environment supporting multiple operating systems that most IT administrators have to manage.
[0007] Because of the inadequacies in currendy available management tools, significant portions of any server configuration change operations have to be made manuaUy by the IT administrator for each server. Accordingly, human errors can occur from these manual change operations, and from manual monitoring and tracking of each server's configuration, resulting in frequent server misconfigurations and system downtime.
Summary of the Invention [0008] To aUeviate this situation, systems and methods according to the invention can be used to manage a large number of servers and their server components distributed throughout a heterogeneous computing environment.
[0009] In one embodiment, an authenticated user, such as a IT system administrator, can securely and simultaneously control and configure multiple servers, supporting different operating systems, by implementing a virtual server from the user's management system. In one embodiment, the user is authenticated by an operating-system-user-context-inheritance model or standard authentication protocols, such as a pubUc key protocol, a Kerberos protocol, or a shared secret protocol.
[0010] In some embodiments, a "virtual server" model is used. A virtual server is an abstract model representing a coUection of actual target servers. To represent these multiple physical servers as one virtual server, the abstract system caUs that extend execution of operating-system-specific system caUs to multiple servers regardless of their supported operating systems are used. A virtual server is implemented by a virtual server cUent and a coUection of virmal server agents associated with a coUection of actual servers. The virtual server cUent may be implemented by a network-aware code Ubrary, such as "Ubnc," which is implemented as a network-aware version of the "Ubc" Ubrary. In another embodiment, the virmal server cUent is a Ubrary, such as "Ubnc." [0011] The user's management system contains a software appUcation system, such as a command program (also referred to as a command line interface) or a configuration manager, which generates abstract system caUs to request services to be performed on the target servers. In one embodiment, the virmal server cUent receives the abstract system caUs and instantiates the abstract system caUs in a thread-safe manner. The thread-safe instantiation ensures simultaneous execution of the system caUs on multiple target servers, while sharing the single virmal server cUent among these multiple target servers and their associated virtual server agents. In the instantiating process, the virtual server cUent identifies the target server(s) and their associate virtual server agent(s) to receive the abstract system caUs. In one embodiment, the virmal server cUent identifies the target server(s) in response to a server identifier included in the abstract system caU. Examples of the server identifier include a host name specified in a path and a network address. The server identifier may also be inferred from a group of servers to which the target server belongs.
[0012] Also, in the instantiating process, the virmal server cUent transmits the abstract system caUs to the identified virtual server agent for execution on the target server. Before the transmission of the abstract system caU, the virmal server cUent may encrypt the abstract system caUs using standard encryption protocols, such as the SSL protocol, the Kerberos protocol, or the shared secret protocol, to secure communication between the virmal server cUent and the virtual server agent. In addition, before the transmission of the abstract system caU, the virmal server cUent may specify priority, CPU utiUzation, and/or memory utilization of the abstract system caU on the identified target server. [0013] After the virmal server agent receives the abstract system caUs from the virmal server cUent, the virmal server agent translates the abstract system caU into an operating system-specific system caU, so that system call can be executed on the operating system-specific target server. Before translating the abstract system caU, in one embodiment, the virmal server agent identifies the source host of the user's management system to determine the encryption protocol used on the abstract system caU. The virmal server agent decrypts the abstract system caU after learning about the encryption protocol used by the virmal server cUent. From the decrypted abstract system call, the virtual server agent identifies the authenticated user. In addition, the virmal server agent contains software modules that can map the authenticated user (presented user) to another user (effective user) and locate a corresponding local user identity on the target server for the effective user, and impersonate the effective user as a local user on the target server associated with the virmal server agent. In one embodiment, if the effective user is not identified as a recognized local user on the target server, the user is designated as a local guest user on the target server. The virmal server agent further restricts the user's access to the target server through a software module that limits the user to performing predetermined actions or accessing predetermines resources on the target server, based on a role-based access control model and/or access control Usts (ACLs). [0014] The translated system caUs are then executed on the target server in a thread-safe manner and the results of the execution are transported from the virmal server agent to the virmal server cUent. In one embodiment, the virmal server agent maintains an audit log to record the names of users and the abstract system caUs executed on the target server.
[0015] In another embodiment, the appUcation system can aggregate multiple abstract system caUs into a single high-level abstract system caU, which in turn is transported to the virmal server cUent. After receiving the high-level abstract system caU, the virmal server cUent disintegrates the high-level abstract system caU into the original multiple abstract system caUs and instantiates these original abstract system caUs individuaUy. Accordingly, the virmal server agent receives the individual abstract system caUs for execution on the associated target server.
[0016] In yet another embodiment, after receiving the high-level abstract system caU from the appUcation program, the virmal server cUent instantiates the high-level abstract system caU as a whole. Thus, the identified virmal server agent receives the high-level abstract system call, rather than the original multiple abstract system caUs. The virmal server agent in mrn translates the high- level abstract system into the individual operating system-specific system caUs to be executed on its associated target server.
[0017] In another embodiment, the virmal server modifies an existing non-distributed appUcation supporting only one specific operating system to function as a network-aware appUcation that is appUcable across servers or devices supporting different operating systems by substituting a non network-aware system caU with an abstract system caU. In one exemplary embodiment, a non- distributed Unix sheU program can function as a network-aware appUcation program that is adaptable across multiple servers or devices supporting non-Unix operating systems. In another exemplary embodiment, non-distributed scripting languages, such as Perl and Python, can function as network aware-appUcation programs that are appUcable across multiple servers and devices supporting different operating systems.
[0018] In another ernbodiment, software configuration components (also referred to as server objects) having intricate interdependencies with other server components can be defined and characterized under a single unified system. Through this unified system, fine-grain appUcation change operations can be uniformly and simultaneously implemented across the heterogeneous servers, rather than implementing different appUcation change operations for each of the servers individuaUy.
[0019] In yet another embodiment, a centralized management system can automaticaUy track changes, configure, and manage multiple servers to provide compUance in accordance with predefined poUcies by incorporating the methods and systems described above. [0020] This invention also relates to a method and system for executing and undoing distributed server change operations for a coUection of server objects across multiple target servers in a transaction-safe manner. Here, transaction-safe means that aU required steps of each server change operation are completed before the distributed server change operation is deemed completed, and if an error occurs while performing the required steps on the target servers, any changes made from these steps are undone.
[0021] Examples of distributed sever change operations for a coUection of server objects may be installing, copying, updating, or deleting server objects. In one exemplary embodiment, a coUection of server objects can be copied from a single source to multiple remote target servers. Likewise, aU the changes caused by copying this coUection of server objects can be reversed on the affected multiple remote target servers.
[0022] In one embodiment, server change operations for a coUection of server objects, such as files and configuration file entries, are specified in a transaction package. In particular, server change operations are specified in a transaction package to change code and content (files, appUcations, compound components, etc.), configure parameters of multiple servers simultaneously, and roU- back the changes in the event of a failure. Server change operations in the transaction package can be specified to occur on primitive server objects, compound server objects, abstract configuration server objects, and component server objects. A primitive server object is an elemental server object that serves as a basis for aU other types of server objects. A compound server object is a server object containing primitive server objects and other related compound server objects. An abstract configuration server object is a special type of a primitive server object that represents an entry in a configuration file when the configuration file is mapped to a common abstract configuration file format using a configuration file-specific grammar. A component server object is a sequenced coUection of server objects that contains prerequisite and inheritance information about other types of server objects. [0023] In one embodiment, the server change operations in a transaction package are specified in an XML-based instruction set. In another embodiment, the server change operations are specified in a text-based instruction set.
[0024] In one embodiment, the transaction package includes a transaction context, a parameter file, error handling actions, a sequencing instruction for the change operations, and target server prerequisites for executing the change operations, in addition to the specified change operations. The transaction context is identified by begin-transaction and end-transaction statements that encapsulate the server object change operations. The parameter file specifies parameter values for each of the identified target servers. These parameter values are communicated to the identified target servers along with the transaction package. In one embodiment, the parameter file contains parameters referencing parameter values that are identical across the target servers. In another embodiment, the parameter file contains parameters referencing parameter values that are distinct for each of the target servers. The transaction package supports several types of errors, such as soft errors and hard errors, in its error handling actions. The sequencing instruction provides an execution sequence for the specified change operations. If this instruction is not provided locaUy within the transaction package, an external dependency graph is accessed to provide an execution sequence for the specified change operations. The transaction package also provides the prerequisite information for the target servers to execute the specified change operations. [0025] In one embodiment, the user may optionaUy elect to proceed with a dry run. The dry run provides an additional set of tests to see if the server object change operations can be carried out by the recipient target servers before making any changes.
[0026] After the transaction package is communicated to the target servers, the specified change operations are executed on each of the identified target servers in a transaction-safe manner using the parameter values. [0027] In one embodiment, the specified change operations can be reversed when a user makes an expUcit request or when an error is detected in a transaction log maintained for the transaction package, after a partial or fuU execution of the change operations. The transaction log keeps track of details of aU the steps performed, so that each performed step of a change operation can be retraced and reversed from the affected target servers. [0028] In another embodiment, multiple transaction packages can be assembled into a transaction project. AU the change operations specified in a transaction project can be executed in a transaction-safe manner. [0029] This invention also relates to a method and system for configuring heterogeneous servers across a network by providing modules that can browse, snapshot, track changes, track compUance, restore previous configuration, make updates on each of the servers, and provision new servers and appUcations. [0030] A server object is one or a coUection of related configuration parameters and server assets, such as files, directories, registries, patches, packages, services, and appUcations. In one embodiment, there are four types of server objects: a primitive server object, a compound server object, an abstract configuration server object, and a component server object. A primitive server object is an elemental server object that serves as a basis for aU other types of server objects. A compound server object is a server object containing primitive server objects and other related compound server objects. An abstract configuration server object is a special type of a primitive server object that represents an entry in a configuration file when the configuration file is mapped to a common abstract configuration file format using a configuration file-specific grammar. A component server object is a sequenced coUection of server objects that contains prerequisite and inheritance information about other types of server objects.
[0031] In one embodiment, server objects in multiple servers can be browsed in real time. While browsing, a coUection of server object identifiers (without values) can be selected and manuaUy coUected in a template. In another embodiment, the template may be imported from an external vendor. In yet another embodiment, the template may include one or more previously defined templates.
[0032] The values of the server objects identified in the template can be recorded for a specific server (also referred to as a "gold server") through a process caUed "snapshot," which coUects the values (also referred to as "snapshot results") and saves them in a reference model. In one embodiment, the reference model may be an imported reference model created by an external vendor. In another embodiment, the reference model may include one ore more previously defined reference models. In one embodiment, the reference model may be used to derive compUance rules, such as baseline configuration values and compUance ranges, from the coUected values for other servers on the network. By comparing other Uve servers to the reference model, the systems and methods track compUance and changes in the configuration of the other servers on the network. [0033] Alternatively, instead of saving the snapshot results in the reference model, a snapshot result can be used to capture the configuration of a server at an arbitrary point in time. The configuration may include server objects that are expUcidy selected from a server or that are impUcidy selected via the template. In another embodiment, the snapshot results can also be recurring snapshots of a server taken at scheduled time intervals. In this embodiment, the first snapshot serves as a baseline for subsequent snapshots, so that for the subsequent snapshots, only the changes against the baseline are captured. Thus, any snapshot can be reconstructed to show the entire configuration of a server at a specific time in the time intervals by combining the baseline with the incremental changes saved for the particular snapshot results. In addition, these snapshots taken over a period of time can be used by the user to analyze changes on the server over time. Moreover, a single snapshot or recurring snapshots can be used to track change at an arbitrary point in time or over a scheduled period of time. [0034] After comparing servers on the network and identifying the discrepancies present in the compared servers, server change operations are generated to correct these discrepancies. In one embodiment, these server change operations can be presented to the servers as a transaction package so that the change operations can be executed across multiple servers in a transaction-safe manner to synchronize the target servers to the reference model or to the snapshots. Similarly, to update target servers, the user updates the reference model and packages the updates in a transaction packages to synchronize the target servers to the reference model.
[0035] In one embodiment, the reference model can be used to provision a new server that is newly added to the network to ensure consistency in the configuration of the servers on the network.
[0036] In another embodiment, the servers on the network can restore their previous configuration from the reference model or the snapshots, so that in case of server failure, the server can be restored to recover its existing configuration and contents.
[0037] In yet another embodiment, a Uve server can be compared against another Uve server by comparing the server objects identified in the template. In another embodiment, the user can expUcidy select server objects that are commonly shared between these Uve servers and compare them accordingly.
[0038] In one embodiment, the systems and methods according to the invention manage categoricaUy related configuration parameters across different servers by modeling the parameters in templates. Server objects (also referred to as configuration parameters) are categorized in a template per server type categories, such as an appUcation server category, a database server category, and a web server category. In the same template, the server objects are then categorized by configuration parameter type categories (e.g., network parameters, capacity parameters, availabiUty parameters, performance parameters, and security parameters), sub-categories, and associate key words based on its function. A new template can be derived from the first template that combines the categoricaUy related server objects across the server categories manages the configuration parameters as if they belonged to a single server. For example, the configuration parameters of an individual web server related to security can be changed in concert with security parameters of an appUcation server and a database server.
Brief Description of the Drawings
[0039] In the drawings, like reference characters generaUy refer to the same parts throughout the different views. Also, the drawings are not necessarily to scale, emphasis instead generaUy being placed upon iUustrating the principles of the invention. [0040] FIG. 1 is a block diagram depicting an embodiment of a system for managing multiple servers in a heterogeneous computing environment.
[0041] FIG. 2 is a block diagram depicting a virmal server cUent in accordance with an embodiment of the invention.
[0042] FIG. 3 is a block diagram depicting a virmal server agent in accordance with an embodiment of the invention.
[0043] FIG. 4 is a flowchart depicting an embodiment of a method for receiving and executing a system caU from an appUcation program.
[0044] FIG. 5 is a flowchart depicting the details of instantiating an abstract system caU in one embodiment of the method of FIG. 4. [0045] FIG. 6 is a screen shot of an embodiment of a system implementing the method of FIG. 4.
[0046] FIG. 7 is a block diagram depicting an embodiment of a system for executing and undoing distributed server change operations in a transaction-safe manner.
[0047] FIG. 8 is a flowchart depicting an embodiment of a system for executing and undoing distributed server change operations in a transaction-safe manner. [0048] FIG. 9 is a flowchart depicting an embodiment of a method for executing and undoing distributed server change operations in a transaction-safe manner.
[0049] FIG. 10 is a block diagram depicting an embodiment of a system for configuring multiple servers in a heterogeneous computing environment.
[0050] FIG. 11 is a flowchart depicting an embodiment of a method for configuring multiple servers in a heterogeneous computing environment.
[0051] FIG. 12 is a block diagram depicting an embodiment of a system for managing server objects as described in a embodiment of the invention.
[0052] FIG. 13 is a block diagram depicting an exemplary embodiment of the system of FIG. 12. [0053] FIG. 14 is a user interface display in an embodiment for a system implementing the method of FIG. 11.
Detailed Description [0054] Referring to FIG. 1, a user 10, such as a system administrator, manages a number of servers 15A, 15B, 15C, 15D, generaUy 15, which are computers, each of which can be of the same or of different types than the other servers 15. The servers 15 are typicaUy server-class general-purpose computers, which provide services (e.g. software appUcations and/or data) to other computers via one or more computer networks. For example, the servers may be appUcation servers, routers, firewaUs, load balancers, storage controUers, or a combination of these or other computers or network devices.
[0055] Examples of appUcation servers are databases, such as the Oracle database from Oracle Corporation of Redwood City, CaUfornia or other business appUcations. AppUcation servers may also include web servers, such as the Apache web server from the Apache Foundation, and Internet Information Server (IIS) from Microsoft Corporation of Redmond, WA. In addition to these examples, other programs can be provided by the servers 15. It should be understood that as used herein, the term "server" is not limited to server-class computers or appUcation servers, but refers generaUy to computers on which the embodiments of the invention operate, which may include other types of computers or network devices. [0056] As shown, each of the servers 15 may use a different operating system. For example, server 15A uses MICROSOFT WINDOWS (e.g., WINDOWS NT and WINDOWS 2000), available from Microsoft Corporation of Redmond, WA; server 15B uses SUN SOLARIS, available from Sun Microsystems, Inc. of Santa Clara, CA; server 15C uses RED HAT LINUX, avadable from Red Hat, Inc. of Durham, N.C.; and server 15D uses IBM ALX, avadable from IBM of Armonk, NY. It wiU be understood that this is just one example of the operating systems that may be used on the servers 15, and other combinations and operating systems may be used on the servers 15 in accordance with embodiments of the invention. One of the benefits of the system is its abiUty to operate in an environment having heterogeneous servers.
[0057] In one embodiment, the user 10 manages the servers 15 via a management system 20. The management system 20 is typicaUy a server-class computer that provides the user 10 with an abiUty to manager servers 15 in a consistent manner through use of appUcation programs 25. The management system 20 may be one of the servers 15, or any server-class computer that can communicate with the servers 15 over a network. Any of the target servers 15 can be designated as the management system, as long as the designated server includes appropriate appUcation programs and software modules to manage remotely located servers. [0058] AppUcation programs 25 in the management system 20 can include one or more of a command-line sheU program 25A and related programs for executing sheU commands (e.g., UNIX sheU commands such as Is, mv, rm, etc.), a configuration manager 25B for managing system configuration, and/or other appUcations 25C. The appUcation programs 25, which in some implementations are "network-aware," communicate abstract system caUs to a virmal server cUent 30, which in turn communicates the abstract system caUs to the servers 15 that are the target(s) for execution of the operations requested by the abstract system caUs. Advantageously, through use of the abstract system caUs, the "network-aware" appUcations are able to request services from heterogeneous servers supporting different operating systems without having to modify their architecture to support each of the different operating systems.
[0059] For example, the user 10 enters commands, such as Unix sheU commands, to the sheU program 25A via a command line interface. Commands can be entered, for example, to distribute files, directories, software packages, and patches to the target servers 15. Commands can also be entered to edit configuration files of the target servers 15. In addition, commands can be entered to remotely reboot the target servers 15, and stop and start change operation on the target servers 15. [0060] For example, in one implementation, the Unix sheU command "Is," which requests a server computer to Ust a directory of files, may be modified to be used with the user's management system 20 and the virmal server cUent 30 to Ust a directory of files from any of the target servers 15. From the user's 10 perspective, the "Is" command is used in the normal manner, except that the user 10 can identify a target server 15 for the command in a path associated with the command. For example, if the target server 15A is named "targetserverl," the user 10 may enter the command "Is //targetserverl/path/" to Ust the files in the specified path on the target server 15A. [0061] To implement this Is command of the sheU program 25A on the user's management system 20, the sheU program 25A translates the system caUs caUed by the "Is" command into one or more abstract system caUs. These abstract system caUs are sent to the virmal server cUent 30, which in turn sends the abstract system caUs to appropriate target servers 15, in this case, the target server 15A. After execution of the command on the target servers 15, the results are communicated back to the user 10 via the appUcation programs 25 and the virmal server cUent 30. [0062] Other programs can be made "network aware". For example, in some implementation, script interpreters, such as interpreters for the Perl and Python scripting languages can be modified to work with the virmal server cUent 30. GeneraUy, selected system caUs made by an appUcation program are translated into abstract system caUs, which are communicated through the virmal server cUent 30 to the servers 15. [0063] In addition to providing sheU commands and other appUcation programs, the management system 20 may include a configuration manager 25B. In one embodiment, the configuration manager 25B is used to configure one or more of the servers 15. The configuration manager is a software appUcation program that implements server change operations that are in turn translated into the corresponding operating system specific commands on the target servers 15.
[0064] In one implementation, an appUcation program 25 directs abstract system caUs to specific target servers 15. In another implementation, the appUcation program 25 can also direct abstract system caUs to a group of servers. A group of servers can be pre-defined or dynamicaUy defined based on attributes such as operating systems, capacity, IP address ranges, and instaUed appUcations. For example, the appUcation program 25 can direct an abstract system caU to a group of servers, consisting of a subset of servers 15 running the Linux operating system. AppUcation program 25 thus can deploy a command onto a server in this group without specifying a particular server in the subset. In this way, the appUcation program 25 does not need to keep track of each server, nor determine which servers have sufficient capacity or features to run the program; rather, the appUcation program 25 can deploy commands (or change operations) to a predetermined group, and the virmal server cUent 30 decides which specific server should run these operations. [0065] The virmal server cUent 30, which may be included in the management system 20, presents the servers 15 to the appUcation programs 25 as a single "virmal server" on which system caU operations can be executed. The virmal server cUent 30 is implemented by a software Ubrary, which in one implementation is roughly analogous to the C Ubrary, Ubc. The appUcation programs 25 can be staticaUy or dynamicaUy linked to the virmal server Ubrary, which is caUed Ubnc. In one embodiment, non network-aware appUcation programs 25 are converted to network-aware programs by replacing caUs to the Ubc Ubrary with equivalent caUs to the Ubnc Ubrary, which provides abstract network-aware system caUs. [0066] In an alternative embodiment, the virmal server cUent 30 may be implemented as part of an operating system. For example, the operating system running the user's management system 20 can receive abstract system caUs and communicate them to the remote target servers 15. Accordingly, for purposes of executing an abstract system caU a target servers 15, the source of the abstract system caU is immaterial. [0067] In some embodiments, the virmal server cUent 30 communicates with the servers 15 through virmal server agents 35 associated with the servers 15, which wiU be described in detad below. The virmal server cUent 30 communicates with virmal server agents 35 to present the multiple physical target servers 15 as a single virmal server to the appUcation programs 25. As an abstract representation of a coUection of the physical servers 15, the virmal server intercepts the abstract system caUs via the virmal server cUent 30 and routes the abstract system caUs to the virmal server agents 35.
[0068] When the virmal server cUent 30 receives an abstract system caU from an appUcation program 25, the virmal server cUent 30 checks the abstract system caU to determine whether this system caU is a local caU or a remote caU. If the abstract system caU is a local caU, then the operating system running the management system 20 executes the system caU locaUy. If the abstract system caU is determined to be a remote caU, the virmal server cUent 30 sends the abstract system caU to a virmal server agent 35 associated with a target server 15 via a message protocol. For example, when an "ropen" abstract system caU, representing a remote file open command, is received by the virmal server cUent 30, the data representing the "ropen" command and parameters associated with the "ropen" command are sent to appropriate virmal server agents 35. The target-servers 15 for a system caU are identified by the user 10 or the appUcation programs 25. The virtual server cUent 30 identifies the target servers 15 from their virmal server agents 35 and determines where the system caU should be directed. [0069] The virmal server agents 35 receive abstract system caUs from the virmal server cUent 30 and prepare the abstract system caUs for their associated target servers 15. When the virmal server cUent 30 determines to which virmal server agents an abstract system caU should be directed, each of the virmal server agents 35 receives the abstract system caU. As a part of preparing the abstract system caU for the associated target servers 15, the virmal server agents 35 provide security measures to ensure that the user 10 is authorized to access the target servers 15, and that the virmal server agent 35 controls the user access, as provided by the associated target server 15. Once the user 10 is authorized, the virmal server agent 35 translates the abstract system caU into an operating system specific caU directed to its associated target server 15. The target server 15 executes the abstract system caU and returns the results back to the virmal server agent 35, which in turn sends the results back to the appropriate appUcation programs 25 via the virmal server cUent 30.
[0070] In one embodiment, the virmal server agents 35 (also referred to as Remote System CaU Daemon or RSCD agents) are software modules attached to their corresponding target servers 15. In another embodiment, the virmal server agents 35 are software modules that are not attached to their corresponding target servers 15, but are in communication with their associated remotely located target servers 15.
[0071] In some embodiments, instead of acting as a messenger that sends an abstract system caU to a specific target server 15, one of the virmal server agents 35 can represent a group of physical servers. Thus, if the same command needs to be executed on multiple servers, these servers can be aggregated into a group, represented by a single virmal server agent 35, so that appropriate system caUs can be made to a group of servers simultaneously via that virmal server agent 35. [0072] GeneraUy, abstract system caUs may include aU types of system caUs including file system caUs, operating system caUs, and the like. An abstract system caU typicaUy is implemented as a modification of an analogous standard operating system specific caU. For example, the abstract system caU "ropen" is analogous to a standard system caU "open," which opens a file on a server. [0073] With minor modifications to an appUcation program's source code, any appUcation program can make operating system agnostic abstract system caUs. By changing the system caUs to abstract system caUs, any generic appUcation program can be made into a network aware-appUcation that can operate transparentiy across servers supporting different operating systems.
[0074] In one embodiment, only the system caUs that are appUcable to aU of the target servers 15 can be modeled as abstract system caUs. For example, if the target servers 15 include Unix-based servers, it may not be possible to model a system caU to update a registry as an abstract system caU, since a registry, which is a Windows specific object, does not exist and has no relevance for Unix- based server platforms.
[0075] Referring to FIG. 2, in one embodiment, the virmal server cUent 30 includes various software modules which implement its functionaUty. These modules include a receiver 40 that receives an abstract system caU made by an appUcation program 25, and forwards the abstract system caU to an instantiator 42. The receiver 40 is a software module that acts a messenger between the software appUcation programs 25 and the instantiator 42. In one embodiment, the receiver 40 receives the abstract system caU from one of the software appUcation programs 25 used by the user 10. The receiver 40 then forwards the abstract system caU direcdy to the instantiator 42. In another embodiment, the receiver 40 may receive standard operating system specific system caUs from an appUcation program 25. The receiver forwards such standard system caUs to the instantiator 42 for the instantiator 42 to decide to where the system caUs should be directed.
[0076] The instantiator 42 instantiates abstract system caUs in a thread-safe manner. The thread- safe instantiation shares a single resource between multiple operations without requiring changes to the architecture of the appUcation programs requesting the operations. TypicaUy, thread-safe instantiation shares the same virmal server cUent 30 between multiple simultaneous execution of system caUs. The use of the shared resource, such as the virmal server cUent 30, is coordinated, so that the execution of one operation does not impact the execution of other operations. In one embodiment of the thread-safe instantiation, the appUcation programs 25 can instantiate multiple commands (or operations) via the instantiator 42. For example, the appUcation programs 25 may invoke multiple "ropen" system caUs that are directed to one or more target servers 15. The "ropen" system caU is received by the instantiator 42 in the virmal server cUent 30. The instantiator 42 then distributes the "ropen" abstract system caU to each of the virmal server agents associated with the target servers, so that multiple "ropen" caUs can be executed simultaneous by the target servers 15. [0077] In one embodiment, the instantiator 42 is implemented as a software Ubrary that provides routines that represent the abstract system caUs. One particular implementation of the software Ubrary is caUed "Ubnc." Iibnc is a "network-aware" Ubrary that is analogous to the standard C Ubrary. The Libnc Ubrary supports the network aware appUcation programs 25 by instantiating the abstract system caUs generated by the appUcation programs 25. [0078] In one embodiment, the instantiator 42 determines to which virmal server agents 35 an abstract system caU should be directed. The instantiator 42 identifies target servers 15 by finding the target server identifiers specified in the abstract system caU. The target server identifier may include a path name, which in turn may include a host name or a network address (e.g., IP address) for the server. The target server 15 may also be identified by server names expUcidy stated in a file which is to be run on specific named servers. Alternatively, the server identity may be inferred from a subset of servers or a group of servers (e.g., a group of Linux servers) to which the target server 15 belongs. [0079] Before transmitting the abstract system caU to the virmal server agents 35, the instantiator 42 can also specify the priority, CPU utilization, and memory utilization of the system caU for the target servers 15, so that the identified target server 15 platforms can perform the requested services as specified by the virmal server cUent 30. Once the abstract system caU has been instantiated, it is sent to an encryptor 44 for further processing.
[0080] The encryptor 44 encrypts the abstract system caU before sending it to a transmitter 46 for transmission to the virmal server agents 35. The encryptor 44 uses standard encryption protocols and algorithms to secure communication between the virmal server cUent 30 and the virmal server agents 35. Examples of standard encryption protocols include, but are not limited to, SSL (Secure Sockets Layer), Kerberos, and Shared Secret protocols. SSL uses a pubUc key to encrypt data. Kerberos assigns a unique key to each authorized user. Standard encryption algorithm includes, but are not limited to, DES (Data Encryption Standard), 3DES (Triple DES), Blowfish, and AES (Advanced Encryption Standard). [0081] The encryption protocol and algorithm used by the encryptor 44 must be supported by each virmal server agent 35 with which the virmal server cUent 30 wiU communicate. For example, if the virmal server cUent 30 supports SSL, the virmal server agent 35 must be able to support SSL for that protocol to be used. If the virmal server cUent 30 supports Kerberos, the virmal server agent 35 must also be able to support Kerberos for that protocol to be used. [0082] The transmitter 46 uses a network interface protocol, such as TCP/IP or Ethernet, to send the abstract system caU over a network to the virmal server agents 35. The transmitter transmits the same abstract system caU to each target virmal server agent. In one embodiment, the transmitter 46 uses an IP address to determine to which of the target servers 15 an abstract system caU should be sent. An IP address may be direcdy included in the abstract system caU or may be inferred from a server identifier included in the abstract system caU. The virmal server agent 35 accepts the abstract system caU containing the IP address of the target server 15 associated with that virmal server agent 35. Once the virmal server agent 35 receives the abstract system caU, the virmal server agent 35 processes the abstract system caU for execution on the target server 15. [0083] Referring to FIG. 3, each virmal server agent 35 includes software modules that implement its functionaUty. These modules include a receiver 50, which receives abstract system caUs from the virmal server cUent 30, and transfers the abstract system caUs to a decryptor module 52. [0084] Before the user 10 can access the user's management system 20, the user 10 is authenticated to ensure that the user 10 is in fact the person he or she claims to be. The user 10 can be authenticated in many ways. In one embodiment, the user 10 is authenticated by the operating system of the management system 20 and the target servers 15 subsequendy inherit the user's 10 identity. In another embodiment, SRP (Secure Remote Password) or PKI Cryptography (X.509 Certificates) is used to authenticate user 10. In yet another embodiment, the Kerberos 5 system can be used to authenticate the user 10 by assigning a unique private key to the user 10. [0085] The source identifier module 52 identifies the source machine, e.g., the user's management system 20. The source identifier module 52 first determines the source machine through a network address (e.g., IP address) that was submitted to the virmal server agent 35 from the virmal server cUent 30 with the abstract system caU and checks to see if the source host is authorized. [0086] By identifying the source machine, the source module 52 determines the security protocols to be used by the virmal server agent 35 for encryption and decryption. In one embodiment, the virmal server agent 35 can support different security protocols. For example, the virmal server agent 35 can flexibly support either SSL or Kerberos based on the security protocol of the incoming data from the virmal server cUent 30. Next, the abstract system caU is sent to a decryptor 54, which decrypts the abstract system caU. From the decrypted abstract system caU, the user identifier module 55 identifies the user 10 invoking the appUcation programs 25 from the source machine and verifies that the user 10 is authorized to access the source machine.
[0087] After the user is identified by the user identifier 55, an identity mapper 56 and an impersonator 58 provide additional security measures as the user 10 tries to access the remote target servers 15 from the user's management system 20. The identity mapper 56 optionaUy maps the authenticated user (presented user) to another user (effective user) and locates a local user identity on the target server 15 that corresponds to the authenticated identity of the effective user. Through the impersonator 58, the user 10 is impersonated on a remote target server 15, so that if the effective user is identified and exists as a local user on the remote target server 15, the user 10 takes on the local identity of the effective user and the permissions provided by that identity on the remote target server 15. Thus, the user's 10 access to the remote target server 15 is further restricted to the appropriate levels provided by the permissions granted to the effective user's local identity on the remote server 15. For example, if the user 10 is authenticated as "Joe" on the management system 20 and mapped to an effective user "Jane", local permissions of "Jane" wiU be available to the user 10 on the remote target server 15. If "Jane" does not exist on the remote target server 15, then the user 10 wiU be given a guest account. In one embodiment, the combination of the presented user and the role, which is defined by Role Based Access Control (RBAC), is mapped to an effective user. For example, user "Joe" having the role of a junior administrator can be mapped to an effective user named "junior administrator." Another user "Bob" also having the role of a junior administrator can be mapped to the same effective user named "junior aclministrator."
[0088] The effective user's access for presented user 10 is further restricted by an authorizer 60, which permits the user 10 to perform predetermined actions or access predetermined resources on a particular target server 15. This is achieved by using Access Control Lists (ACLs) to manage the effective user's access to resources on the remote target servers 15. The ACL informs the operating systems of the remote target servers 15 of the access rights of the effective user on specific server resources, such as files or directories. For example, if the user 10 is mapped to the effective user "junior administrator", then the user 10 is only permitted to perform read-only commands on certain directories or files of a group of remote target servers 15 and cannot effect any changes to the target servers 15. [0089] After the user is authorized, a translator 62 translates the abstract system caU into a standard operating system caU that is understandable and executable by the target server 15. The translator 62 examines the abstract system caU and identifies a standard operating system specific system caU that is analogous to the abstract system caU and is supported by the operating system running the associated target server 15. Once the analogous standard system caU is identified, the translator changes the abstract system caU to the standard system caU. This standard operating system caU is forwarded to an executor 66 for execution on the target server 15.
[0090] Once the executor 66 receives a standard operating system caU, the executor 66 performs the services that are requested by the standard system caU. In one embodiment, the executor 66 is the operating system running on the target server 15. The operating system examines system caUs and carries out the operations requested by the system caU by, for example, communicating with other appUcations running on the target server 15.
[0091] An audit log 64 is maintained by each virmal server agent 35 to keep track of the names of the users and aU the activities performed by each user, and to troubleshoot server changes and configuration errors. For example, the audit log 64 saves information about the activities requested and performed by authorized users, information about data, such as the system caUs and the results of the system caUs, that were transferred back and forth between the virmal server cUent 30 and the virmal server agent 35, as weU as aU parameters associated with the abstract system caU. The content of the audit log 64 is then transmitted to a centralized aggregated log kept for aU of the virmal server agents 35.
[0092] A first example of security measures incoφorated in an embodiment of the virmal server implementation foUows. First, the user 10 logs into the management system and is authenticated as "Joe" during the login process. This authentication process can be achieved by using a known network authentication server, such as NTLM, K5, AD, APM, NIS, etc., depending on the operating system running on the management system 20. After the user "Joe" is authenticated in the management system 20, the user "Joe" is authenticated for the target servers 15 by inheriting the user "Joe" identity through the management system 20.
[0093] Next, the user 10 enters a "Is" command, requesting a Usting of files on the remote target server 15A, through the sheU command program 25A on the management system 20. The sheU command program 25A generates an abstract system caU in response to the command and sends the abstract system caU to the virmal server cUent 30 to proceed with the user's 10 request. The virmal server cUent 30 examines the security configuration of the abstract system caU and encrypts the system caU using a shared secret key scheme with a encryption algorithm, such as DES, 3DES, or Blowfish. Once the abstract system caU is encrypted, the system caU is communicated across a network to the virmal server agent 35A of the target server 15A.
[0094] When the virmal server agent 35A receives the abstract system caU, the target server's 15A agent 35A attempts to decrypt the message using the secret key shared with the virmal server cUent 30. The virmal server agent 35A checks to see if the user "Joe" is recognized as a local user on the target server 15A through an effective user. If the user "Joe" is recognized as a local user, then the virmal server agent examines the access control Ust to determine if the combination of the user
"Joe" 10, target server 15A, and the abstract system caU is aUowed. If the combination is aUowed, then the access control Ust is used to determine whether any further restrictions apply to the user's 10 access to the target server 15A. The virmal server agent 35A executes the system caU in accordance with any security restrictions, encrypts the results using the same-shared secret key. The results of the "Is" command are sent back to the virmal server cUent 30, where they are decrypted and displayed to the user.
[0095] In a second example of security measures incoφorated in an embodiment of the virmal server, the user 10 is authenticated using of SRP or PKI Certificates. Once the user 10 is authenticated the user 10 enters an "Is" command, requesting a Usting of files on the remote server 15A, through the sheU command program 25A on the management system 20. The sheU command program 25A generates an abstract system caU in response to the command and sends the abstract system caU to the virmal server cUent 30. The virmal server cUent 30 examines the security configuration of the abstract system caU and encrypts the abstract system caU using pubUc key cryptography, standard encryption algorithms, such as DES, 3DES, or Blowfish, may be used for exchange of session key between the virmal server cUent 30 and the target server agent 35A to estabUsh a cornrnunication session between them.
[0096] After decrypting the abstract system caU received by the virmal server agent 35A, the virmal server agent 35A checks to see if the user "Joe" is recognized as a local user on the target server 15A through an effective user. If the user "Joe" is recognized as a local user, then the virmal server agent 35A examines the ACL to determine if the combination of the user 10, target server 15A, and the abstract system caU is aUowed. If the combination is aUowed, then the access control Ust is used to determine whether any further restrictions apply to the user's 10 access to the target server 15A. The virmal server agent 35A executes the system caU in accordance with any security restrictions, and encrypts the results using the estabUshed session key. The results of the "Is" command are then sent back to the virmal server cUent 30, where they are decrypted and displayed to the user. [0097] A third example of security measures incoφorated in an embodiment of the virmal server implementation foUows. If the management system 20 has an existing Kerberos 5 (K5) infrastructure in place, the user 10 can be authenticated by entering a Kerberos password to the management system 20. Once the user 10 is logged in as the authenticated user "Joe," the user 10 enters the "Is" command, requesting a Usting of files on the remote target server 15A, through the sheU command program 25A on the management system 20. The sheU command program 25A generates an abstract system caU in response to the command and sends the abstract system caU to the virmal server cUent 30 to proceed with the user's 10 request. The virmal server cUent 30 then sends the abstract system caU and a Kerberos ticket, which is retrieved from a Kerberos Domain ControUer (KDC) to the virmal server agent 35A.
[0098] After the virmal server agent 35A receives the abstract system caU and the ticket, the virmal server agent 35A vaUdates the abstract system caU by verifying the ticket via the KDC. Once vaUdated, the virmal server agent 35A checks to see if the user "Joe" is recognized as a local user on the target server 15A through an effective user. If the user "Joe" is recognized as a local user, then the virmal server agent examines the ACL to determine if the combination of the user "Joe" 10, target server 15A, and the abstract system caU is aUowed. If the combination is aUowed, then the access control Ust is used to determine whether any further restrictions apply to the user's 10 access to the target server 15A. The virmal server agent 35A executes the system caU in accordance with any security restrictions, encrypts the results using a Kerberos key. The results of the "Is" command are sent back to the virmal server cUent 30, where they are decrypted and displayed to the user. [0099] Referring now to FIG. 4, a method for managing multiple servers as a single virmal server is described. First, in step 400, the system represents multiple servers as a single virmal server. Next, in step 410, based on a user's request for operations to be performed on target servers, the virmal server cUent 30 receives an abstract systems caU from an appUcation program 25. Finally, in step 420, the virmal server cUent instantiates the abstract system caUs and sends the abstract system caU to the virmal server agents 35 for execution. [0100] FIG. 5 shows steps involved in instantiating an abstract system caU. First in step 422, the virmal server cUent 30 identifies the target servers 15 through target server identifiers provided within the abstract system caU. Once the target servers are identified, in step 424, the abstract system caU is transmitted to the virmal server agents associated with the identified target servers. The virmal server agents 35 prepare the abstract system caU for the target servers 15, so that the abstract system caU can be the executed on the target servers 15. For example, for the target server 15A, the abstract system caUs are translated into standard Windows NT/W2K specific system caUs that are executable by the operating system running on the target server 15A. Upon completion of execution of the system caU, in step 426, the virmal server cUent 30 receives the results of the execution from the virmal server agents 35. [0101] In one embodiment, multiple commands generate multiple system caUs, which can be aggregated into a single high-level abstract system caU by an appUcation program 25. For example, if two commands, such as copy and change permission commands, are to be made to a target server 15A, the abstract system caUs carrying out these commands, such as ropen, rread, rwrite, and rchmod system caUs, can be aggregated into one high-level abstract system caU. When received by the virmal server cUent 30, the virmal server cUent 30 can disintegrate the high level abstract system caU into the original abstract system caUs and transmit the abstract system caUs separately to virmal server agent 35. In another embodiment, instead of disintegrating the high-level system caU into the original abstract system caUs at the virmal server cUent 30, the high-level abstract system caU is received by a virmal server agent 35, which in turn translates the high-level abstract system caU into separate operating system specific system caUs to be executed on the target server 15. [0102] FIG. 6 is a screenshot showing a command being issued to multiple servers through the management system 20. As shown here, server names used as parameters for commands are preceded by two slashed to distinguish them from a path name, which is generaUy separated by a slash. For examples, "//redhatbizl/etc" specifies the /etc path on the server named "redhatbizl." Thus, as seen in the screenshot, to compare the "/etc/hosts" file on two different servers, one named "redhatbizl," and the other named "redhatbiz2," the user 10 enters the command "diff //redhatbizl /etc/hosts // redhatbiz2/etc/hosts."
[0103] Referring back to FIG. 1 , in an alternative embodiment, the user 10 manages the target servers 15 by executing and undoing distributed server change operations across the target servers 15 in a transaction safe-manner, using the virmal server implementation described above.
Distributed server change operations request the operating systems of the target servers 15 to update, delete, instaU, and/or copy server assets and/or configuration file entries of the target servers 15. Transaction-safe server change operations ensure that aU of the required steps of each server change operation are completed before the distributed server change operations are deemed completed. Further, if an error occurs while performing the required steps on the target servers 15, any changes made from these steps are undone, and values of the target servers' 15 assets and/or configuration entries are returned to the values they had before execution of the server change operations. In one embodiment, the appUcation programs 25 can generate a transaction package that bundles an instruction set and necessary server contents for the operating system of each of the target servers 15 to carry out the server change operations.
[0104] Referring to FIG. 7, in one embodiment, the configuration manager 25B generates a transaction package 700 that includes files or configuration file entries 705 (together referred to as server objects), a parameter file 710, and an instruction set 715 to carry out the server change operations on one or more target servers 15 that are specified by an external file, as requested by the configuration manager 25B.
[0105] In one embodiment, the instruction set 715 includes an execution sequence of the server change operations provided for the operating systems of the target servers 15 that carry out the server change operations. If this information is not provided in the instruction set 715 in the transaction package 700, an external dependency graph 720 is accessed to provide an execution sequence of the server change operations. For example, the external dependency graph 720 can provide information about directional relationships between server objects. In particular, if NT- based program A is a prerequisite for another NT-based program B, to successfuUy execute programs A and B, program A must start before program B and program B must stop before program A. Although the sequence information is used to order the sequence of change operations for the server objects that are specified in the transaction package, the sequence information is also used to add impUed server object change operations for related server objects, such as server objects that depend on and/or depend from these specified server objects, that are not specified in the transaction package. In particular, continuing from the previous example, if the only change instruction provided in a transaction package is to stop program A, the sequence information adds the impUed instruction to stop program B and then stop program A based on the directional relationship between programs A and B. Thus, the sequence information from the dependency graph determines the sequences of server change operations to be performed not only on the specified server objects, but also on their related server objects. If an error occurs w iile performing the service change operations, the sequence information also causes the server change operations to stop and to be reversed not only on the specified servers, but also on the related server objects. [0106] As described above, if the instruction set 715 provides the sequence information for the server change operations, the instruction set 715 overrides the sequence information provided by the dependency graph 720. Similar to the sequence information provided by the dependency graph 720, the instruction set 715 provides the information related to the order in which the server change operations should be performed. The related server objects of the specified server objects are provided, so that the server change operations can effect changes on the related server objects, as weU as the specified server objects. The instruction set 715 also provides dependency information between types of servers. For example, if an appUcation server depends on a database server, the sequence information provided in the instruction set 715 wiU instruct the execution of the database server change operations before the execution of the appUcation server change operations. [0107] In one embodiment, the instruction set 715 specifies server change operations to occur on any of the four types of server objects 705: primitive server objects, compound server objects, abstract configuration server objects, and component server objects. A primitive server object is an elemental server object that serves as a basis for aU other types of server objects. For example, for Linux-based servers, primitive server objects include, but are not limited to, files, directories, Redhat Package Manager files, and configuration file entries for text configuration files, such as the "inetd.conf ' file. For Solaris-based servers, primitive server objects include, but are not limited to, files, directories, packages, patches, and configuration files entries for configuration files, such as the "inetd.conf file. For MS NT or W2K-based servers, primitive server objects include, but are not limited to, files, file ACLs, directories, directory ACLs, appUcation programs, hot fixes, the registry entries, registry entry ACLs, COM/COM+ (component object model) catalog entries, Metabase entries, users, accounts, and configuration file entries for aU configuration files, such as ".ini" files. [0108] A compound server object is a server object containing primitive server objects and other related compound server objects. For example, an extended component object model (COM+) object, an NT or W2K-based compound server object, contains primitive server objects, such as a COM+ catalog entry, NT registry entries, and DLL files. In yet another example, an Enteφrise JavaBeans (EJB) object, a compound server object, contains primitive server objects including a Java Archive (JAR) file and multiple configuration file entries. In another example, a server process is a compound server object, containing primitive server objects, such as configuration file entries (e.g., a permission entry, a priority entry, a control signal entry), files, and executables. [0109] An abstract configuration server object is a special type of a primitive server object that represents an entry in a configuration file via a corresponding entry in an abstract configuration file, where mapping of a configuration file to a common abstract configuration format is provided by a configuration file-specific grammar. For example, in the MS NT/W2K environment, configuration file entries are stored in ".ini" files or XML configuration files. In the UNLX environment, configuration file entries are stored in text files such as "inetd.conf files or "httpd.conf , or XML configuration files.
[0110] To reconcile the difference between the configuration file entry formats across different servers, a common abstract configuration format is provided by normaUzing configuration file entries through a supported configuration file-specific grammar. By modeling each configuration file entry as an abstract configuration file entry through this normalization process, server change operations may be made based on the normalized abstract configuration file entries. The change operations requested by the abstract configuration file entries are performed, and the changes are then communicated to the actual configuration file entries. Thus, in this embodiment, configuration file entries can be individuaUy managed through use of abstract configuration file entries, without having to change the entire configuration file each time a server change operation changes an individual entry. Configuration file-specific grammars may be provided for numerous systems, including Solaris, Linux, NT4/W2K, Apache, Web Logic, and Web Sphere.
[0111] A component server object is a sequenced coUection of server objects. For example, an NT Service Pack is a sequenced coUection of NT Hot Fixes to be appUed in a predefined order. Accordingly, a coUection of predefined related change operations can be effected in order through a component server.
[0112] In addition to the constituencies of the instruction set 715 described above, the instruction set 715 specifies the server change operations to be made across the target servers 15 on a coUection of predetermined server objects by communicating with the server objects (e.g., files or configuration file entries 705), the dependency graph 720, and the parameter file 710. Server change operations can be used to deploy or copy files, directories, and software packages to the target servers 15. Change operations can also be used to edit configuration file entries 705 without having to log into each target server 15. In one embodiment, the instruction set 715 provides the information needed by the target servers 15 and their associated virmal server agents 35 to carry out the server change operations. In one embodiment, the instruction set 715 provides a transaction context that is identified by begin-transaction and end-transaction statements encapsulating the server object change operations. After the begin-transaction statement is made, the instruction set provides the necessary information to perform the change operations requested by the appUcation programs 25. [0113] The instruction set 715 also provides error-handling instructions for the target servers and their associated virmal server agents. In one embodiment, several types of errors are avadable. Soft errors are available to alert the target servers and their virmal server agents of a likelihood of occurrence of an error during server change operations. Because no actual error has occurred, the user 10 may ignore the soft errors and continue with the execution of the server change operations. Alternatively, the user 10 may instruct the virmal server agents to expUcidy undo aU the changes made from the execution of the server change operations after reviewing the error information returned by the soft errors.
[0114] Hard errors are available to notify the virmal server agents of an occurrence of an error during the performance of server change operations on the target servers. In one embodiment, the hard errors can be programmed to automaticaUy trigger undo operations to undo any of the changes made during the execution of the server change operations. In another embodiment, the hard errors can be programmed to abort the execution of the remainder of transaction package change operations. The hard errors are triggered by error conditions set forth in the instruction set 715. These error conditions specify that if certain conditions occur, the hard errors should be sent to the target servers and their associated virmal server agents.
[0115] The instruction set 715 also includes prerequisite information for the instructions. An example of this prerequisite information can include, but are not limited to, the minimum set of change operation instructions that must be specified in a transaction package for its successful execution. For example, to successfuUy add a COM+ component on the target servers, instructions for adding the COM+ entr in the catalog, the corresponding Registry entry, and the corresponding DLL file must be specified in the transaction package. Another example of the prerequisite information can include types of permissions needed to carry out the change operations, rriinirnurn disk space required by the target servers 15, and the type of operating system required. In addition, the prerequisite information can also include impUcit instructions for hierarchical server objects. For example, to add a file in the target servers, the parent directory for the file should exist in the target servers, so that the file can be created under the specified parent directory in these servers. [0116] In one embodiment, the instruction set 715 defines the changes that need to be made on the server objects by using named parameters, and later replacing the parameters with actual values obtained from a parameter file 710. The virmal server agents 35 receive the transaction package 700 on behalf of their associated target servers 15, and replace the named parameters with values obtained from the parameter file 710. These named parameters are particularly useful when performing server change operations on server objects that are directed to multiple target servers 15, because the named parameter representing the identity of each target server can be replaced with the actual server identifiers by the virmal server agents 35. For example, named parameters of an instruction can reference a path name for a target server 15 that includes a host name or an IP address of the target server 15. These parameters are replaced with actual server identifiers for each target server 15, as provided in the parameter file(s) 710. [0117] In one embodiment, the parameter file 710 can be either a global parameter file or a host- specific parameter file. A global parameter file contains parameters that are configured by the user 10, thus the identical global parameter file is passed to aU target servers 15. A host specific parameter file contains parameters that are specific to each of target servers 15, thus the host specific parameter file is different for each of target servers 15. Parameter values contained in the global parameter file are useful when copying the same server object to the same destination on multiple target servers 15. Examples of this type of parameter are the user's name and password.
For parameter values contained in the host-specific parameter file, the parameter values are resolved by each of the target servers 15. Examples of these parameters are host names, and path names of the target servers 15. In addition, there are intrinsic parameters that are resolved through host environment variables on the target server. In one embodiment, one or more parameter files 710 are associated with one or more target servers. For example, for a Window-based target server, "windir" and IP address are examples of host environment variables that can be used to resolve intrinsic parameters associated with one or more target servers and passed via the transaction package 700. [0118] Referring to FIGS. 1 and 7, in one embodiment, instead of using abstract system caUs to carry out server change operations generated by the appUcation programs 25, a transaction package 700 can be used to carry out these change operations using an XML-based instruction set 715. To accommodate both system caU level commands and XML-based instruction sets, each virmal server agent 35 is divided into two parts. One part of the virmal server agent 35 is an XML API that can inteφret the XML-based instruction set 715 contained in the transaction package 700, and the other part of the virmal server agent 35 is a system caU API that can inteφret abstract system caUs. Thus, when a virmal server agent 35 receives an XML-based transaction package 700 through the virmal server cUent 30, the XML-based instruction set 715 in the transaction package 700 can be inteφreted via the XML API. In an alternative embodiment, the transaction package 700 can be implemented with a text-based instruction set 715. The commands of the text-based instruction set 715 are translated into abstract system caUs that are in turn inteφreted by the system caU API. [0119] Below is an example of an XML-based transaction package, named "Package_l .XML," specifying a prerequisite, transaction context, compound server object, sequence, and error handling information using an XML-based instruction set 715. Package_l.XML
•blpackage schema-version="2.0" created-date="02/12/03" modified- date= " 02 /22/02 " revision= " 23 " > <name> name of the blpackage </name>
<description> description of the package </description>
< source type="host">web-demol</source>
<!-- default parameters --> <param name="$APP_PATH"> c:\program files\app </param> <param-f ile>f oo.params</param-f ile>
<applies-to>
<condition> <os>"$(os) = Windows "</os>
<os-version>$ (os-version) > 5</os-version> < service -pack>2</ service -pack> </condition> </applies-to>
<!-- requires the following items before we deploy this package --> <depends>
<condition> <application>SQL server</application> <version>$ (version) = 8.0 </version> </condition> </depends>
<!-- failure conditions if the following exit on target --> <FailIf>
<ErrorLevel <4
/> </FailIf >
<transaction id=M0">
<command id = "1005" undo="net start w3svc">net stop w3svc</command> <service action="add" refid="1003" key="RSCDsvc"> <depends>
<file refid="1002"/> </depends> </service>
<command id = "1006" undo="net stop w3svc">net start w3svc </command> <file action="add" key="%WINDIR%ado.dll" refid="1001"/>
<file action="add" key="%WINDIR%/System32/svchost .exe" refid="1002" />
<assets>
<file id="1001"> <name>ado.dll</name>
<source>0</source> <attributes>2</a tributes> <created-date>02/l2/03</created-date> <modified-date>02/22/03</modified-date> <ownerx/owner>
<group>0</group>
<acl key="%WINDIR%ado.dll" owner="BUILTIN\Administrators"> <ace action="add" id="1313">web admins</ace> <acemode>0</acemode>
<aceflags>3</aceflags> <acemask>H79817</acemask>
<ace action="add" id="1314">dbas</ace> <acemode>l</acemode> <aceflags>3</aceflags> <acemask>2032127</acemask>
</acl> </file>
<file id="1002">
<name>svchost .exe</name> <source>0</source> <attributes>2</attributes>
<created-date>02/12/03</created-date> <modified-date>02/22/03</modified-date> <owner></owner> <group>0</group>
<acl key="%WINDIR%ado.dll" owner="BUILTIN\Administrators"> <ace action="add" id="1313">web admins</ace> <acemode>0</acemode> <aceflags>3</aceflags> <acemask>1179817</acemask>
<ace action="add" id="1314">dbas</ace> <acemode>1</acemode> <aceflags>3</aceflags> <acemask>2032127</acemask>
</acl> </file>
<service id="1003" name="RSCDsvc">
<binary_path>%WINDIR%/System32/svchost . exe</binary_jpath> <name>RSCDs c</name> <descriptionx/description> <state>Stopped</state> <runas>
<userid>$Tokenl</userid> <pwd>$Token2</pwd> </runas> </service> </assets> </transaction> </blpackage>
The Parameter file foo.params contains
$TOKENl as a parameter that corresponds to user id - "R2D2\web-aclrnins" $TOKEN2 as a parameter to password for R2D2\web-admins - "c3-po"
[0120] In this example, the <blpackage schema> tag denotes the beginning of the instruction set 715. The <name>, <description> and <source type> tags respectively provide the package name, description, and source server, in this example "web-demol," server, from where the package was created. The <param> tag is use to specify location, in this example "c:\program files\app", of parameters having the name of "$APP_PATH" within the package 700, while <ρaram-file> tag is used to specify an external parameter file 710 caUed "foo.params". In the prerequisite section, which is introduced with the <appUes-to> tag, the MS Windows operating system, version greater than 5 and with service pack 2, is specified as a prerequisite to carry out this instruction set. Also in the prerequisite section, the <depends> tag, indicates that SQL Server, version 8, is a pre-requisite for the package. The error handUng information, which is introduced with the <FailIF> tag, specifies that the server operations should fail if error level faUs below 4.
[0121] The <transaction id="0"> tag introduces the set of change operations requested, and any dependency information for the specified server change operations. The execution sequence information for the server change operations is provided under the <depends> tag. In this example, the order of the operations, -stop w3svc, add service RSCDsvc, start w3svc, add file ado.dU, and add file svchost. exe, would occur in the foUowing order: stop w3svc, add file svchostexe, add service RSCDsvc, start w3svc, and add file ado.dU. [0122] The server assets that are being affected by the server change operations are specified under the <assets> tag. This example has three assets - two files, id=1001 and id=1002, and one service, id=1003. Each file has a corresponding nested File ACL having the <acl key> tags. [0123] The parameter file 710, "foo.params" has two parameters that are used in the transaction package 700, named as "$TOKENl" and "$TOKEN2". Instead of passing physical values directed to each target server, the named parameters are sent, and are resolved by the parameter file 710 when the parameter file 710 substitutes the actual values that are specific for each target servers 15 for the named parameters. As shown in this example, these values can be a path for a coUection of server objects (e.g., files), a user name, or a password. In this example, the first parameter, $TOKENl, corresponds to the user name "R2D2\web-admins", and the parameter $TOKEN 2 corresponds to the password "c3-po."
[0124] In one embodiment, multiple ttansaction packages can be aggregated into a ttansaction project 725. The transaction project 725 coordinates the transaction packages 700 and their server change operations, so that each server change operation can be executed in a ttansaction safe manner. Below is an example of an XML ttansaction project 725 containing a ttansaction package named "BLPkg_web.XML," directed to six web servers, a ttansaction package named
"BLPkg_app.XML," directed to two appUcation servers, and a ttansaction package named "BLPkg_db.XML," directed to two database servers: <PROJECT> <BLPkg> <Name>BLPkg_web.XML</Name>
<Hosts>Web Serverl</Hosts> <Hosts>Web Server2</Hosts> <Hosts>Web Server3</Hosts> <Hosts>Web Server4</Hosts> <Hosts>Web Server5</Hosts>
<Hosts>Web Server6</Hosts> </BLPkg>
<BLPkg> <Name>BLPkg_app.XML</Name>
<Hosts>App Serverl</Hosts>
<Hosts>App Server2</Hosts> </BLPkg>
<BLPkg>
<Name>BLPkg_db.XML< /Name> <Hosts>Db Serverl</Hosts> <Hosts>Db Server2</Hosts> </BLPkg> </PROJECT>
[0125] In this example, first, the package "BLPkg_web.XML" is to be executed on six web servers named Web Serverl through Web Serverό, the package "BLPkg_app.XML" is to be executed on two appUcation servers, and the package "BLPkg_db.XML" is to be executed on two database servers.
[0126] The configuration manager 25B, or any of the appUcation programs 25, prepares the ttansaction package 700 and instructs the virmal server cUent 30 to pass the package 700 to the virmal server agents 35 associated with the target servers. After receiving the ttansaction package 700, the virmal server agents 35 unpack the package 700 and execute the operations on their associated target servers 15. A method for achieving this is shown in FIG. 8 [0127] In Step 800, Configuration manager 25B checks the prerequisite information of the requested change operations. Examples of the prerequisite information include checks related to integrity and completeness of package such as prompting for user name and password if required, making sure simple dependencies are resolved, and making sure the corresponding files are in the package.
[0128] After the prerequisites are checked in step 800, in step 810, the configuration manager 25B checks for the sequence information setting forth the execution order of the requested change operations in the package's instruction set 715. If the sequence information is not provided in the instruction set 715, the configuration manager 25B accesses the external dependency graph 720 to obtain the sequence information. After completion of step 810, in step 815, the configuration manager 25B transfers the package 700 and the associated files and parameter files to the virmal server agents 35 via the virmal server cUent 30. [0129] In one embodiment, the virmal server agent 35 receives the completed ttansaction package 700 via the virmal server cUent 30. On the virmal server agent 35, in step 820, the named parameters are substituted with acmal values. The virmal server agent 35 then executes the server change operations specified in the ttansaction package for its associated target server 15. In another embodiment, instead of transporting the completed ttansaction package 700, the virmal server cUent 30 may ttansport only the parameter file 710 and the instruction set 715, without the acmal files or any of the server objects, to the virmal server agent 35, in case the user 10 optionaUy elects to proceed with a dry run. The dry run provides an additional set of tests to see if the instruction set 715 can be carried out by the recipient virmal server agent 35 before making any changes on the target server 15. After the virmal server agent 35 receives a partial transaction package 700 from the virtual server cUent 30, in step 820, the parameters are substituted with acmal values as provided in the parameter file 710. After completing the dry run, the configuration manager 25B can transfer the entire package 700 to the virmal server agents 35 via the virtual server cUent 30 for acmal execution. [0130] Before executing the operations on each target server 15, in step 835, the agent updates an undo log. The undo log, which is maintained for each target server, records the executed operations, and tracks the changes made by these operations, so that if an error occurs while executing the servers change operations, the operations can be undone as recorded in the undo log. This can be achieved by tracing back the steps performed during the server change operations using the undo log records. In one embodiment, the undo log is identical in structure to the transaction package, but with the parameter files arranged in reverse order and the change operations recorded in reverse order. FinaUy in step 840, the server change operations are executed on the target servers 15. [0131] Referring now to FIG. 9, a method for executing and undoing server change operation in a transaction safe manner is described. In step 900, one or more appUcation programs 25 generate and specify change operations using a ttansaction package 700. Different types of server objects and corresponding target servers 15 are supported through the instruction set provided in the ttansaction package 700. Next, in step 910, the appUcation program specifies the target server(s) to which the server change operations are directed. In step 920, the appUcation program specifies the parameter file that provides parameters and their corresponding values defined for each of the target servers, and places this information in the ttansaction package 700. In step 930, the server cUent 30 sends the server change operation from the appUcation program 25 to the virmal server agents 35 on the target servers 15. In step 940, the target servers 15 execute the server change operations in a transaction-safe manner. Configuration Manager
[0132] Referring now to FIG. 10, the configuration manager 25B is an exemplary appUcation program 25 that tracks changes and compUance and configures target servers by generating and deploying a ttansaction package 700. The configuration manager 25B provides a method and system for configuring different servers using a variety of software modules, such as a browser 1000, a template 1010, a recorder 1020, a reference model 1030, a comparator 1040, and a corrector 1050. [0133] The browser 1000 browses server objects in different servers in real time, to examine the current configuration of the server objects contained inside of the servers 15. First, the user selects a server he/she wishes to browse. Through browsing, a coUection of server object identifiers that identify each server object are selected and entered into the template 1010. Alternatively, instead of building the template 1010 from browsing, the template 1010 may be imported from an external vendor. The template 1010 may also be created by including one or more previously defined templates. In one embodiment, the template 1010 is an abstract template that identifies server objects contained in a server. For example, if an Apache server contains files, and configuration file entries, an Apache server template 1010 contains identifiers that are sufficient to identify the files and configuration file entries of the Apache server. After identifying server objects on the template 1010, values of these identified server objects are recorded to configure servers on the network. [0134] In one embodiment, the recorder 1020 takes a snapshot of values (e.g., attributes) associated with a coUection of server objects. In another embodiment the recorder 1020 takes a snapshot of values of the server objects identified in the template 1010. The values may come from any of the servers browsed by the browser. Alternatively, the values may come from a selected server, also referred to as a gold server. Examples of the values (or attributes) of files recorded in the snapshots include, but are not limited to, file names, sizes, permissions, owners, creation dates, modification dates, and versions. Examples of directory attributes (or values) recorded in snapshots are directory locations, permissions, creation dates, and modification dates. Examples of registry entry attributes recorded in snapshots are field names, and corresponding values.
[0135] In one embodiment, the recorded values or snapshot results of the gold server are used to derive baseline values and compUance ranges in the reference model 1030. In another embodiment, instead of creating the reference model, the snapshot results can be direcdy used to track changes, configure existing servers and provision new servers on the network. Snapshot results record a configuration of a server at a point in time, thus they cannot be changed. However, the reference model 1030 can be edited to represent the reference implementation for compUance or provisioning puφoses.
[0136] For example, when the snapshots of the gold server are taken by the recorder 1020, the values coUected in the snapshots are saved in the reference model 1030. Based on the values of the gold server, the reference model 1030 can provide information, such as baseline values and compUance ranges, for use by other servers in the network to identify their drift in comparison to the gold server. The baseline values provide basis for configuration of other servers. The compUance ranges are ranges of acceptable configuration values that are acceptable for other servers for these servers to be in compUance. Alternative to creating a reference model 1030, the reference model 1030 may be an imported reference model that was created by an external vendor. Also, the reference model 1030 may include one or more previously defined reference models. Subsequendy, the comparator 1040 compares a server to the reference model 1030 to track changes and track compUance in the server. [0137] In another example, a snapshot of a current configuration of a server captured at an arbitrary point in time can be compared against a Uve-version of the captured server to track changes in the captured server. The configuration of a server can include expUcidy selected server objects that are on the server or impUcidy selected server objects provided through the template 1010. [0138] In yet another example, the snapshot results of recurring snapshots of a server taken at scheduled time intervals (e.g., daily, weekly, etc.) can be used to track changes in the captured server. In this example, the first snapshot of the server serves as a baseline, so that for subsequent snapshots, only the changes against the baseline are saved in the snapshot results. Thus, any snapshot result taken during these time intervals can be reconstructed to view its entire configuration and content by combining the baseline with the incremental changes saved in the snapshot result. Moreover, the incremental changes show changes occurred in the configuration of the server over a period of time for the user to analyze the changes of this particular server. Subsequentiy, the comparator 1040 compares a Uve-version of the server to the baseline snapshot to track and save only changes on the server. [0139] In one embodiment, two Uve servers can be compared against each other without the snapshots or the reference model 1030, on an ad-hoc basis. In this embodiment, the user 10 may expUcidy select server objects that are commonly shared between the two Uve servers so that the comparator 1040 can compare the values of the sever objects between these servers. In another example of this embodiment, the comparator 1040 compares the values of the server objects that are impUcidy provided by the template 1010.
[0140] After comparing the servers and identifying the discrepancies present in the compared servers, the corrector 1050 corrects the discrepancies in each target server. The corrector 1050 examines the discrepancies and generates server change operations that request services from the operating systems running on the target servers to correct these discrepancies. As described previously, server change operations can be presented to the servers as a transaction package 700 to remove discrepancies and synchronize the target servers to the reference model 1030 in a transaction-safe manner. Similarly, in one embodiment, configuration updates to the target servers can be made by the transaction package 700. In particular, the configuration manager 25B first makes aU the updates to the reference model 1030, which then packages the discrepancies (inttoduced in the reference model) as updates in the ttansaction package 700. The ttansaction package 700 is propagated to the target servers to synchronize them to the updated reference model
1030.
[0141] The reference model 1030 can also be used to provision a new server to ensure consistency in the configuration of the servers in the network when a new server is added. For example, an Apache reference model 1030 can be used to provision a new Apache server so that the configuration of aU Apache servers in the network are consistent with each other. [0142] In addition, both the reference model 1030 and snapshots can be used restore a previous configuration of a server in case of a disaster recovery. In particular, in case of a server failure, this server can recover its most recent configuration and contents by reconstructing the server's configuration from the snapshots taken over a period of time. With the reference model 1030, in case of a server fadure, the server can look to the basis values of the gold server in the reference model 1030 and synchronize to this configuration to be in compUance again. [0143] FIG. 11 shows an exemplary method of tracking changes and compUance, and correcting component as weU as parameter-level changes across multiple servers. In step 1100, the configuration manager 25B browses servers in the network to obtain server asset and configuration (together referred to as server objects) status information for each server. In the browsing step 1100, selected server objects and their dependent server objects are browsed in real time. In one embodiment, Uve servers in the network and their stored server objects can be browsed via a Graphic User Interface (GUI) which presents the servers and server objects hierarchicaUy.
[0144] Next, in step 1105, the configuration manager 25B, selects identifiers of the browsed server objects to be in the template 1010. The identifiers can include any information about the server object that is sufficient to identify the server object. Next in step 1110, the configuration manager selects a gold server, to provide a baseline configuration and configuration ranges for other servers in the network. In step 1115 snapshots of the values of the server objects identified in the template that are present in the gold server are recorded in the reference model 1030. Based on the values recorded in the reference model 1030, in step 1115, the reference model estabUshes compUance rules, such as the baseline configuration and the compUance ranges. Alternatively, the snapshots of the values are not recorded in the reference model. Instead, the snapshot results of a server can be used to direcdy compare against a Uve-version of this server to ttack changes.
[0145] In step 1120, the configuration manager 25B selects servers and their respective configuration parameters (also referred to as server objects) to compare against the reference model 1030. These servers can be selected from any Uve servers on the network. Alternatively, these Uve- version servers can also be direcdy compared against their own snapshots, taken at an arbittary point in a time, or taken over a specific period, without the reference model 1030, to ttack compUance and changes in these servers. The results of the comparing step 1125 can be viewed item-by-item, by showing which software (or server objects) are instaUed or not instaUed, or host-by-host, by showing each server and the server objects present on the server. [0146] FinaUy, based on the discrepancies obtained during the comparing step 1120, a correcting step 1130 fixes the servers to be in compUance by synchronizing configuration of these servers with the reference model 1030 or the snapshots. Moreover, a newly added servers can be provisioned to be consistent with other servers by synchronizing this new server to the reference model 1030. [0147] Referring to FIG. 12, in one embodiment, the configuration manager 25B can manage the same type of configuration parameters (also referred to as server objects) across different servers by specifying one or more categories for the parameters in templates. The template 1200 first specifies the "server-type" category (e.g., appUcation server category 1210, web server category 1215, and database server category 1220) to specify to what type of server each server object in the network belongs, and then specifies the "parameter-type" category (e.g., network parameters, capacity parameters, availabiUty parameters, performance parameters, security parameters) to specify the parameter type to which each server object belongs. Each server object in the template 1200 can be classified under one or more categories, sub-categories and keywords. In one example, for security parameters, sub-categories can include encryption type and authentication type, and keywords can include "read-only" and constant.
[0148] Referring briefly to FIG. 13, an example of the system described with reference to FIG. 12 is shown. In this example, Internet 1300 and intranet 1305 are available to different categories of servers 1215, 1210, 1220 through firewaUs 1310. Web server category 1215 include an IIS server 1215A for intranet services and Apache Servers 1215B, 1215C for the HTTP/FTP and Wireless/Video Internet services respectively. AppUcation server category 1210 include servers running sales appUcations 1210A, on-line brokerage appUcations 1210B, and customer service appUcation 1210C. Database server category 1220 include sales, trading, and account databases 1220A, 1220B, and 1220C. [0149] Referring again to FIG. 12, each server object in the template 1200 is placed into a parameter category based on its function and server type. For example, the server objects may be grouped into network parameters 1330, capacity parameters 1335, availabiUty parameters 1340, performance parameters 1345, and security parameters 1350. The configuration manager 25B selects categoricaUy related server objects from each category of servers and stores them in the template 1200. For example, aU the security parameters in the appUcation server category 1210 and aU the network parameters in the appUcation server category 1210 are stored in the template 1200. [0150] Referring again to FIG. 13, for the web server category 1215, web server configuration parameters a, b, c, d, e are respectively categorized as network parameters 1330, capacity parameters 1335, availabiUty parameters 1340, performance parameters 1345, and security parameters 1350. For the appUcation server category 1210, appUcation server configuration parameters i, U, iii, iv, v are respectively categorized as network parameters 1330, capacity parameters 1335, availabiUty parameters 1340, performance parameters 1345, and security parameters 1350. Sirnuarly, for the database server category 1220, database server configuration parameters I, II, III, IV, V are respectively categorized as network parameters 1330, capacity parameters 1335, availabiUty parameters 1340, performance parameters 1345, and security parameters 1350.
[0151] After categorizing aU the server objects in the template 1200 by the server-type categories and the parameter-type categories, a new template can be derived from the template 1200 to isolate the categorically related server objects across the server categories and manage the configuration parameters as if they belonged to a single server. For example, security configuration parameters of an individual web server can be changed in concert with other security configuration parameters for other web servers, as weU as for appUcation servers and database servers. In the example shown in FIG. 13, for instance, web server network parameter a can be changed in concert with network parameters i of the appUcation server category 1210 and parameter I of the database server category 1220. Sir larly, Web server capacity parameter b can be changed in concert with other capacity parameters U of the appUcation server category 1210 and II of the database server category 1220. Likewise, correlated changes of parameters can be performed for the availabiUty parameters 1346, the performance parameters 1345, and the security parameters 1350.
[0152] Referring to FIG. 14, an exemplary screenshot of a GUI-based configuration manager 25B includes a module referred to as an asset browser 1400, which aUows a user 10 to browse Uve remote target servers 15, and to manage and store frequendy used server assets (also referred to as server objects). The asset browser 1400 is divided into two panes. The left pane 1410 functions as either a Servers pane or a Depots pane, depending on a tab 1420 selected by the user 10. The Contents pane 1430 on the right side displays the contents of an item selected in the Servers or the Depots pane. [0153] In FIG. 14, the left pane 1410 displays the Servers pane which shows a hierarchical depiction of the servers that the user 10 manages. For example, the user 10 may arrange the servers into groups based on geographical location and/or operating system. Server groups are divided into the eastern and western divisions of an enteφrise, and within those groups, another level of hierarchy for Windows, UNIX, and Linux-based servers. More specificaUy in FIG. 14, within the servers in the Easter Division 1440, the patches object 1460 in the sun 2 server 1450 is selected. The Contents pane 1430 shows the contents of the patches object 1460.
[0154] The Depots pane (not shown) can display central repositories of commonly accessed server objects (e.g., aU files, software to be deployed, and pointers to the content of the files and software residing in other servers in the network). In additions, the Depots pane stores scheduled tasks to be performed, snapshots of server objects, SheU scripts, and ttansaction packages 700. Example
[0155] In an overaU example of operation of the configuration manage, the configuration manager browses Uve servers on a network, tracks changes and compUance in the servers by comparing their server objects against a reference model or a snapshot, and identifying any discrepancies from the reference model or the snapshot. By making records of the values of the gold server's server objects through a snapshot and saving the results as a reference model, the reference model may be used to audit other servers, to determine how configurations of the other servers have changed from the reference model. Alternatively, a server's own snapshot can be taken arbitrarily, or over a specific period of time to ttack changes in the server, without using the reference model. In one example, the server objects being compared in the audit process are provided automaticaUy by the configuration manager via templates. In another example, the user may manuaUy select the server objects to compare. AdditionaUy, the audit process can be scheduled to ttack compUance over time. [0156] After identifying server configuration discrepancies present in the servers, the configuration manager 25B corrects the discrepancies by generating a transaction package 700, that contains server change operations to be performed on the servers 15. The ttansaction package 700 bundles configuration changes operations and corresponding instructions to be deployed on remote target servers 15 to correct any discrepancies that exist in server objects contained in those servers 15. With the transaction package 700, the configuration manager 25B can instaU any types of server objects from a single source to multiple locations. Simnarly, the configuration manger 25B can uninstaU software, and undo server object deployments on the remote target servers 15. As discussed previously, certain values inside the ttansaction package 700 can be parameterized and subsequendy replaced with real values during the deployment of the ttansaction package 700 on the target servers 15, without changing the contents of the ttansaction package 700 for each target server 15.
[0157] In one particular example, the configuration manager 25B can be used to move a working MS SQL server database from a gold server to multiple target servers 15, to dupUcate the changes made in this database to multiple servers. To achieve this dupUcation, the user 10 copies the changes made on the SQL Server database to the reference model, so that the configuration manager 25B can later bundle these changes to other instances of the same SQL Server database in the remote target servers 15. The reference model and the remote target servers 15 have the same initial instaUation of the SQL Server database. The configuration manager takes a snapshot of the gold server to create a reference model that is used as a baseline to compare the SQL Server databases between the gold server and the target servers 15. The necessary database changes are first made to the gold server. Next, the configuration manager 25B creates a ttansaction package 700 to bundle these changes to be deployed on the target servers 15. The configuration manager 25B deploys the ttansaction package 700 to the virmal server agents 35 associated with the target servers 15 to request these changes to be made on their SQL Server databases.
[0158] In some embodiments, the fimctionaUty of the systems and methods described above may be implemented as software on one or more general puφose computers. In such an embodiment, the software may be written in any one of a number of high-level languages, such as FORTRAN, PASCAL, C, C++, LISP, JAVA, or BASIC. Further, the software may be written in a script, macro, or functionaUty embedded in commerciaUy available software, such as EXCEL or VISUAL BASIC. AdditionaUy, the software could be implemented in an assembly language directed to a microprocessor resident on a computer. For example, the software could be implemented in Intel 80x86 assembly language if it were configured to run on an IBM PC or PC clone. The software may be embedded on an article of manufacture including, but not limited to, a "computer-readable medium" such as a floppy disk, a hard disk, an optical disk, a magnetic tape, a PROM, an EPROM, or CD-ROM.
[0159] Variations, modifications, and other implementations of what is described herein wiU occur to those of ordinary skiU in the art without departing from the spirit and the scope of the invention as claimed. Accordingly, the invention is to be defined not by the preceding illustrative description but instead by the spirit and scope of the foUowing claims. [0160] What is claimed is:

Claims

CLAIMS 1. A method for receiving and executing a system caU from a software appUcation program on one of a pluraUty of servers, the method comprising the steps of: (a) providing a representation of a pluraUty of servers as a single virmal server, the representation of the single virmal server implemented by a virtual server cUent and a pluraUty of virmal server agents each running on a respective one of the pluraUty of servers; (b) receiving, by the virmal server cUent, an absttact system caU from a software appUcation program; and (c) instantiating in a thread-safe manner the absttact system caU by: identifying, by the virmal server cUent, a target server to receive the absttact system caU, and identifying a corresponding virmal server agent associated with the target server; transmitting the abstract system caU to the identified agent for execution on the target server; and receiving execution results from the agent.
2. The method of claim 1, wherein at least two of the pluraUty of servers have different operating systems.
3. The method of claim 1 further comprising the step of aggregating at least the absttact system caU and a second absttact system caU into a high-level absttact system caU.
4. The method of claim 3 further comprising the steps of (i) receiving, by the virmal server cUent, the high-level absttact system caU; (ii) disintegrating, by the virmal server cUent, the high-level abstract system caU into the at least the absttact system caU and the second abstract system caU; and (hi) instantiating in a thread-safe manner each of the at least the absttact system caU and the second absttact system caU.
5. The method of claim 3 further comprising the steps of: (i) receiving, by the virmal server cUent, the high-level absttact system caU; and (n) instantiating in a thread-safe manner the high-level abstract system caU.
6. The method of claim 1, wherein the instantiating step (c), the virmal server cUent is implemented by a network-aware code Ubrary.
7. The method of claim 6, wherein the network-aware code Ubrary is a Ubnc.
8. The method of claim 6, wherein the virmal server cUent is a Ubnc.
9. The method of claim 1, wherein the identifying step comprises identifying the target virmal server agent to receive the absttact system caU in response to a server identifier included in the abstract system caU.
10. The method of claim 9, wherein the server identifier comprises a host name specified in a path.
11. The method of claim 9, wherein the server identifier comprises a network address.
12. The method of claim 11 , wherein the server identifier is inferred from a group of servers the target server belongs.
13. The method of claim 1, further comprising after the transmitting step, the steps of: (i) translating, by the virmal server agent, the abstract system caU into an operating system specific system caU to be executed by the target server; and (n) executing, by the target server, the operating system specific system caU in a thread-safe manner.
14. The method of claim 1 further comprising: before the ttansniitting step, specifying at least one of priority, CPU utilization, and memory utilization of the absttact system caU on the target servers associated with the identified virmal server agents.
15. The method of claim 1 further comprising: (i) authenticating a user of the software appUcation program and a management system operating the software appUcation program; (U) after the instantiating step (c), encrypting, by the virmal server cUent, the absttact system caU; (iii) identifying, by the virmal server agent, the management system and the user; (iv) decrypting, by the virmal server agent, the encrypted absttact system caU; (v) mapping the identified user to an associated local user of the target server; (vi) impersonating the identified user as the mapped local user on the target server; (vn) authorizing the decrypted absttact system caU for the mapped local user based on at least one of role-based access control model and access control Usts; and (vi) mamtaining an audit log to record the name of the user and the absttact system caU executed on the target server.
16. The method of claim 15, wherein the authenticating step (i) is performed substantiaUy in accordance with a pubUc key protocol.
17. The method of claim 15, wherein the authenticating step and the encrypting step are performed substantiaUy in accordance with Kerberos protocol.
18. The method of claim 15, wherein the authenticating step and the encrypting step are performed substantiaUy in accordance with Shared Secret protocol.
19. The method of claim 1 further comprising: modifying an existing non-disttibuted appUcation to function as a network-aware appUcation by substituting a non network-aware system caU with the absttact system caU.
20. The method of claim 19, wherein the modifying step comprises modifying a non-distributed Unix sheU to function as the network-aware appUcation program.
21. The method of claim 19, wherein the modifying step comprises modifying a non-distributed scripting language to function as the network aware-appUcation program.
22. The method of claim 21, wherein the non-distributed scripting language comprises Perl.
23. The method of claim 21, wherein the non-distributed scripting language comprises Python.
24. The method of claim 1, wherein the software appUcation program comprises a configuration manager.
25. A virmal server, having a virmal server cUent and a virmal server agent, for representing a pluraUty of servers as an abstract model, wherein the virmal server comprises, (a) a virmal server cUent receiver for receiving an absttact system caU from a software appUcation program; (b) a virmal server cUent instantiator, in communication with the virmal server cUent receiver, for instantiating the absttact system caU in a thread-safe manner; (c) a virmal server cUent transmitter, in communication with the virmal server cUent instantiator, for transmitting the absttact system caU; (d) a virmal server agent receiver for receiving the absttact system caU from the virmal server cUent transmitter; (e) a virmal server agent translator for translating the absttact system caU to an operating system specific system caU; and (f) a target server executor for executing the operating system specific system caU on a target server associated with the virmal server agent in a thread-safe manner.
26. The virmal server of claim 25, wherein at least two of the pluraUty of servers have different operating systems.
27. The virmal server of claim 25 further comprising an aggregator for aggregating at least the absttact system caU and a second absttact system caU into a high-level abstract system caU.
28. The virmal server of claim 27 further comprising: (i) a virmal server cUent receiver for receiving the high-level abstract system caU and disintegrating the high-level abstract system caU into the at least the absttact system caU and the second absttact system caU; and (ii) the virmal server cUent instantiator for instantiating in a thread-safe manner each of the at least the abstract system caU and the second abstract system caU.
29. The virmal server of claim 27 further comprising: (i) a virmal server cUent receiver for receiving the high-level abstract system caU; and (n) the virmal server cUent instantiator for instantiating the high-level absttact system caU in a thread-safe manner.
30. The virmal server of claim 25, wherein the virmal server cUent is implemented by a network- aware code Ubrary.
31. The virmal server of claim 30, wherein the network-aware code Ubrary is a Ubnc.
32. The virmal server of claim 30, wherein the virmal server cUent is a Ubnc.
33. The virmal server of claim 25, wherein the virmal server cUent instantiator identifies the target virmal server agent to receive the absttact system caU in response to a server identifier included in the absttact system caU.
34. The virmal server of claim 33, wherein the server identifier comprises a host name specified in a path.
35. The virmal server of claim 33, wherein the server identifier comprises a network address.
36. The virmal server of claim 35, wherein the server identifier is inferred from a group of servers the target server belongs.
37. The virmal server of claim 25, whereas the virmal server cUent transmitter specifies at least one of priority, CPU utilization, and memory utilization of the absttact system caU on the target servers associated with the identified virmal server agents.
38. The virmal server of claim 25 further comprising: (i) an authenticator for authenticating a user of the software appUcation program and a management system operating the software appUcation program; (n) a virmal server cUent encryptor for encrypting the absttact system caU; (Hi) a virmal server agent identifier for identifying the management system and the user; (iv) a virmal server agent decryptor for decrypting the encrypted absttact system caU; (v) a virmal server agent mapper for mapping the identified user to an associated local user of the target server; (vi) a virmal server agent impersonator for impersonating the identified user as the mapped local user on the target server; (vh) a virtual server agent authorizer for authorizing the decrypted absttact system caU for the mapped local user based on at least one of role-based access conttol model and access conttol Usts; and (vi) an audit log for recording the name of the user and the abstract system caU executed on the target server.
39. The virmal server of claim 38, wherein the virmal server cUent encryptor performs substantiaUy in accordance with a pubUc key protocol.
40. The virmal server of claim 38, wherein the authenticator and the virmal server cUent encryptor perform substantiaUy in accordance with a Kerberos protocol.
41. The virmal server of claim 38, wherein the authenticator and the virmal server cUent encryptor perform substantiaUy in accordance with a Shared Secret protocol.
42. The virmal server of claim 25 further modifies an existing non-disttibuted appUcation to function as a network-aware appUcation by substimting a non network-aware system caU with the absttact system caU.
43. The virmal server of claim 42 further modifies a non-distributed Unix sheU to function as the network-aware appUcation program.
44. The virmal server of claim 42 further modifies a non-distributed scripting language to function as the network aware-appUcation program.
45. The virmal server of claim 44, wherein the non-distributed scripting language comprises Perl.
46. The virmal server of claim 44, wherein the non-distributed scripting language comprises Python.
47. The virmal server of claim 25, wherein the software appUcation program comprises a configuration manager.
48. A method for securely executing a system caU on a remote computer, the method comprising the steps of: (a) receiving, by a virmal server cUent running on a first computer, an absttact system caU from an appUcation caUed by an authenticated user; (b) instantiating in a thread-safe manner the absttact system caU by: identifying, by the virmal server cUent, a virmal server agent running on a remote computer to receive the absttact system caU; (c) encrypting, by the virmal server cUent, the absttact system caU; (d) communicating the encrypted absttact system caU to the virmal server agent; (e) identifying, by the virmal server agent, the first computer and the authenticated user (f) decrypting, by the virmal server agent, the encrypted absttact system caU; (g) mapping the authenticated user to a local user on the remote computer; (h) impersonating the authenticated user as the local user on the remote computer; (i) authorizing the decrypted absttact system caU for the local user based on at least one of role-based access conttol model and access conttol Usts; (j) translating the absttact system caU to an operating system specific system caU; and (k) executing as the local user, by the virmal server agent, the operating system specific system caU on the remote computer.
49. The method of claim 48 further comprising: before the receiving step (a), authenticating a user using an operating system user context inheritance model.
50. The method of claim 48 further comprising: before the receiving step (a), authenticating a user substantiaUy in accordance with a pubUc key protocol.
51. The method of claim 48 further comprising: before the receiving step (a), authenticating a user substantiaUy in accordance with a Kerberos protocol.
52. The method of claim 48, wherein the identifying step (g), if the authenticated user is not identified as a local user in the identifying step (g), then designating the authenticated user as a local guest.
53. The method of claim 48, wherein the authorizing step (h) comprises authorizing the decrypted first absttact system caU for the local user based on at least one of role-based access conttol model and access conttol Usts substantiaUy in accordance with Kerberos protocol.
54. The method of claim 48, wherein the authorizing step (h) comprises authorizing the decrypted first absttact system caU for the local user based on at least one of role-based access conttol model and access conttol Usts substantiaUy in accordance with SSL protocol.
55. The method of claim 48 further comprising: after the executing step (i), encrypting results of the executing step (i); and returning the encrypted results to the virmal server cUent.
56. The method of claim 48, further comprising: mamtaining an audit log, by the virmal server cUent and the identified virmal server agent, that includes names of the authenticated user and the absttact system caU performed.
57. A virmal server for securely executing a system caU on a remote computer, the virmal server comprising: (a) a virmal server cUent receiver running on a first computer for receiving an abstract system caU from an appUcation caUed by an authenticated user; (b) a virmal server cUent instantiator, in communication with the virmal server cUent receiver, for instantiating the absttact system caU in a thread-safe manner by identifying a virmal server agent running on a remote computer to receive the first absttact system caU; (c) a virmal server cUent encryptor, in communication with the virmal server cUent instantiator, for encrypting the absttact system caU; (d) a virmal server cUent transmitter for communicating the encrypted absttact system caU to the virmal server agent; (e) a virmal server agent identifier, in communication with the virmal server agent decryptor, for identifying the authenticated user and the first computer; (f) a virmal server agent decryptor, in communication with the virmal server cUent transmitter, for decrypting the encrypted absttact system caU; (g) a virmal server agent mapper, in communication with the identifier and the decryptor, for mapping the authenticated user to a local user on the remote computer; (h) a virmal server agent impersonator for impersonating the authenticated user as the local user on the remote computer; (i) a virmal server agent authorizer, in communication with the virmal server agent impersonator, for authorizing the decrypted absttact system caU for the local user based on at least one of role-based access conttol model and access conttol Usts; 0 a virmal server agent translator for translating the absttact system caU to an operating system specific system caU; and (k) a virmal server agent executor, in communication with the virmal server agent authorizer, for executing the operating system specific system caU as the local user on the remote computer.
58. The virmal server of claim 57 further comprising: an authenticator for authenticating a user using an operating system user context inheritance model.
59. The virmal server of claim 58, wherein the authenticator performs substantiaUy in accordance with a pubUc key protocol.
60. The virmal server of claim 58, wherein the authenticator performs substantiaUy in accordance with Kerberos protocol.
61. The virmal server of claim 57, if the authenticated user is not identified as a local user by the virmal server agent identifier, then designate the authenticated user as a local guest.
62. The virmal server of claim 57, wherein the virmal server agent authorizer performs substantiaUy in accordance with Kerberos protocol.
63. The virmal server of claim 57, wherein the virmal server agent authorizer performs substantiaUy in accordance with SSL protocol.
64. The virmal server of claim 57, wherein the virmal server agent executor encrypts results of the executing step (i); and returns the encrypted results to the virmal server cUent.
65. The virmal server of claim 57, further comprising: an audit log, maintained by the virmal server cUent and the identified virmal server agents, that includes names of the authenticated users and the abstract system caU performed.
66. A method for executing change operations across a pluraUty of servers in a transaction-safe manner, the method comprising the steps of: (a) specifying change operations for a coUection of server objects in a transaction package, wherein the objects comprise at least one of files and configuration file entries; (b) identifying at least one target server for execution of the change operations specified in the ttansaction package; (c) specifying parameter values for each of the identified target servers; (d) cor numcating the transaction package to the identified target servers; and (e) executing the specified change operations on each of the identified target servers in a transaction-safe manner using the parameter values.
67. The method of claim 66, wherein the server objects comprise at least one of a primitive server object, a compound server object, an abstract configuration server object, and a component server object.
68 The method of claim 67, wherein the primitive server object comprises an elemental server object.
69. The method of claim 67, wherein the compound server object comprises at least one of the primitive server objects and the compound server objects.
70. The method of claim 67, wherein the absttact configuration server object comprises an entry in a configuration file mapped to a corresponding entry in a common absttact configuration file format.
71. The method of claim 67, wherein the component server object comprises a sequenced coUection of server objects.
72. The method of claim 66, wherein the specifying step (a), the ttansaction package comprises an XML-based instruction set.
73. The method of claim 66, wherein the specifying step (a), the ttansaction package comprises a text-based instruction set.
74. The method of claim 66, in addition to the specified change operations in the ttansaction package, the ttansaction package in the specifying step (a) further comprises: (i) a ttansaction context; (U) a parameter file comprising the parameter values specific to each of the identified target servers; (Ui) error handling actions; (iv) a sequencing instruction for the specified change operations; and (v) prerequisite information.
75. The method of claim 74, wherein the (i) ttansaction context in the ttansaction package comprises begin-ttansaction and end-transaction statements that encapsulate the specified change operations.
76. The method of claim 74, wherein the (U) parameter file comprises group-level parameter values that are identical across the identified target servers.
77. The method of claim 76, wherein the (n) parameter file comprises the parameter values that are distinct for each of the identified target servers and override the group-level parameter values if specified.
78. The method of claim 74. wherein the (in) error hanclling actions comprise soft error and a hard error.
79. The method of claim 74, wherein the (iv) sequencing instruction for the server change operations is provided locaUy from the ttansaction package.
80. The method of claim 79, wherein the (iv) sequencing instruction for the server change operations is provided from an external dependency graph, if the sequencing instruction is not provided locaUy from the ttansaction package.
81. The method of claim 74, wherein the (v) prerequisite information comprises prerequisite information for the identified target servers to execute the specified change operations.
82. The method of claim 66 further comprising the steps of: (i) maintaining a transaction log for the ttansaction package, wherein the ttansaction log comprises detads of aU steps performed during execution of the change operations specified in the ttansaction package; (U) after a successful completion of the executing step (e), optionaUy reversing the executed change operations via an exphcit user request; and (Ui) automaticaUy reversing the executed change operations, after detecting an occurrence of an error.
83. The method of claim 66 further comprising the steps of optionaUy performing a dry-run on the ttansaction package.
84. The method of claim 66 further comprising: (i) assembling a pluraUty of ttansaction packages into a transaction project; and (n) executing change operations specified in each ttansaction package in the transaction project in a transaction-safe manner.
85. A transaction package for executing change operations across a pluraUty of target servers in a transaction-safe manner, the ttansaction package comprising: (a) an instruction set for specifying change operations for a pluraUty of server objects and identifying at least one target server for execution of the specified change operations on the identified target servers; and (b) a parameter file, in communication with the instruction set, for comprising parameter values specific to each of the identified target servers.
86. The ttansaction package of claim 85, wherein the (b) parameter file comprises group-level parameter values that are identical across the identified target servers.
87. The ttansaction package of claim 86, wherein the (b) parameter file comprises the parameter values that are distinct for each of the identified target servers and override the group-level parameter values if specified.
88. The ttansaction package of claim 85, wherein the server objects comprise at least one of a primitive server object, a compound server object, an absttact configuration server object, and a component server object.
89. The ttansaction package of claim 88, wherein the primitive server object comprises an elemental server object.
90. The ttansaction package of claim 88, wherein the compound server object comprises at least one of the primitive server objects and the compound server objects.
91. The transaction package of claim 88, wherein the absttact configuration server object comprises an entry in a configuration file mapped to a corresponding entry in a common absttact configuration file format.
92. The ttansaction package of claim 88, wherein the component server object comprises a sequenced coUection of server objects.
93. The transaction package of claim 85, wherein the instruction set is an XML-based instruction set.
94. The ttansaction package of claim 85, wherein the instruction set is a text-based instruction set.
95. The ttansaction package of claim 85, in addition to the specified change operations in the instruction set, the instruction set further comprises: (i) a ttansaction context; (ii) error handling actions; (Hi) a sequencing instruction for the specified change operations; and (iv) prerequisite information.
96. The ttansaction package of claim 95, wherein the (i) transaction context comprises begin- ttansaction and end-transaction statements that encapsulate the specified change operations.
97. The ttansaction package of claim 95, wherein the (H) error handling actions comprise a soft error and a hard error.
98. The ttansaction package of claim 95, wherein the (Hi) sequencing instruction for the server change operations is provided locaUy from instruction set.
99. The ttansaction package of claim 98, wherein the (Hi) sequencing instruction for the server change operations is provided from an external dependency graph, if the sequencing instruction is not provided locaUy from the instruction set.
100. The transaction package of claim 95, wherein the (iv) prerequisite information comprises prerequisite information for the identified target servers to execute the specified change operations.
101. The ttansaction package of claim 85, wherein a dry-run is optionaUy performed on the ttansaction package.
102. The ttansaction package of claim 85, wherein the ttansaction package and a second ttansaction package is assembled into a ttansaction project to execute the change operations specified in each ttansaction package in a transaction-safe manner.
103. The transaction package of claim 85, wherein the ttansaction package maintains: (i) a ttansaction log comprising detaUs of aU steps performed during execution of the change operations specified in the ttansaction package; (H) after a successful completion of at least one of the change operations, an expUcit user request for optionaUy reversing the executed change operations using the details provided from the ttansaction log; and (Hi) an error signal for automaticaUy reversing the executed change operations using the detads provided from the ttansaction log.
104. A method for configuring a pluraUty of heterogeneous servers across a network, the method comprising: (a) browsing server objects in each of a pluraUty of servers across a network; (b) selecting identifiers of at least one browsed server objects to create a template; (c) selecting a gold server from the pluraUty of servers; (d) recording values of the server object identifiers selected in a template from the gold server to create a reference model; (e) comparing a second server from the pluraUty of servers to the reference model; and (f) correcting discrepancies of the second server against the reference model.
105. The method of claim 104, wherein the server objects in the browsing step (a) comprise at least one of files and configuration file entries.
106. The method of claim 105, wherem the server objects in the browsing step (a) comprise at least one of a primitive server object, a compound server object, an absttact configuration server object, and a component server objects.
107. The method of claim 106, wherem the primitive server object comprises an elemental server object.
108. The method of claim 106, wherem the compound server object comprises at least one of the primitive server objects, the absttact configuration server objects, the component server objects and the compound server objects.
109. The method of claim 106, wherem the absttact configuration server object comprises an entry Hi a configuration file mapped to a corresponding entry Hi a common absttact configuration file format.
110. The method of claim 106, wherem the component server object comprises a sequenced coUection of server objects.
111. The method of claim 104, wherein the selecting step (b), the template comprises a manuaUy created template.
112. The method of claim 104, wherem the selecting step (b), the template comprises an externaUy imported template.
113. The method of claim 104, wherein the selecting step (b), the template comprises at least one of previously defined templates.
114. The method of claim 104, wherem the recording step (d), the reference model comprises a manuaUy created template.
115. The method of claim 104, wherein the recording step (d), the reference model comprises at least one of previously defined reference models.
116. The method of claim 104, wherem the recording step (d) comprises arbitrarily taking a snapshot of the current configuration of a first server.
117. The method of claim 116, wherem the comparing step (e) comprises comparing a Hve- version of the first server to the snapshot.
118. The method of claim 116, wherein the correcting step (f) further comprises restoring a previous configuration of the first server from a snapshot.
119. The method of claim 104, wherein the recording step (d) comprises recurrendy taking a pluraUty of snapshots of a first server at predetermined time intervals, wherein a first snapshot from the pluraUty of snapshots forms a baseline for subsequent snapshots from the pluraUty of snapshots and the subsequent snapshots capture changes against the baseline over time.
120. The method of claim 119, wherein the comparing step (e) comprises recurrendy taking a pluraUty of audits of a Uve server at predetermined time intervals to track compUance against at least one of the baseline snapshot and the reference model over time.
121. The method of claim 104, wherem the comparing step (e) further comprises comparing Uve servers by: (i) comparing values of expUcidy selected sever objects that are commonly shared between a first Uve server and a second Uve server. (H) comparing values of impUcidy selected sever objects that are impUcidy specified Hi the template.
122. The method of claim 104, wherem the correcting step (f) further comprises restoring a previous configuration of the second server from the reference model.
123. The method of claim 104 further comprising: provisioning a newly-added thkd server on the network Hi accordance with the reference model.
124. The method of claim 104, wherein the correcting step (f) further comprises: after the comparing the comparing step (e), coUecting the discrepancies identified Hi a ttansaction package to execute a pluraUty of server change operations on the second server; and synchronizing the second server with the reference model.
125. The method of claim 104 further comprising: updating the reference model; and propagating the updates to the pluraUty of servers with a ttansaction package.
126. The method of claim 104 further comprising: (i) categorizing in a template each of the server objects into categories, sub-categories, and associated keywords; and (H) selecting categoricaUy related server objects Hi second templates.
127. The method of claim 126, wherein the categorizing step (i), the categories comprise server type categories including at least one of an appUcation server category, a web server category, and a database server category.
128. The method of claim 126, wherein the categorizing step (i), the categories comprise configuration parameter type categories Hicluding at least one of network parameters, capacity parameters, availabiUty parameters, performance parameters, and security parameters.
129. A system for configuring a pluraUty of heterogeneous servers across a network, the system comprising: (a) a browser for browsing server objects Hi each of a pluraUty of servers across a network; (b) a template comprising a selected pluraUty of identifiers of at least one browsed server objects; (c) a recorder for recording values of the selected pluraUty of server object identifiers in the template from at least one of the pluraUty of servers. (d) a reference model comprising recorded values of the selected pluraUty of server object identifiers Hi the template from a gold server of the pluraUty of servers; (e) a comparator, in communication with the reference model, for comparing a second server from the pluraUty of servers to the reference model; and (f) a corrector, Hi communication with the comparator, for correcting discrepancies of the second server against the reference model.
130. The system of claim 129, wherem the server objects comprise at least one of files and configuration file entries.
131. The system of claim 130, wherein the server objects comprise at least one of a primitive server object, a compound server object, an abstract configuration server object, and a component server object.
132. The system of claim 131, wherein the primitive server object comprises an elemental server object.
133. The system of claim 131, wherein the compound server object comprises at least one of the primitive server objects, the absttact configuration server objects, the component server objects, and the compound server objects.
134. The system of claim 131, wherein the abstract configuration server object comprises an entry Hi a configuration file mapped to a corresponding entry Hi a common absttact configuration file format.
135. The system of claim 131, wherein the component server object comprises a sequenced coUection of server objects.
136. The system of claim 129, wherein the template comprises a manuaUy created template.
137. The system of claim 129, wherein the template comprises an externaUy imported template.
138. The system of claim 129, wherein the template comprises at least one of previously defined templates.
139. The system of claim 129, wherein the reference model comprises a manuaUy created template.
140. The system of claim 129, wherein the reference model comprises at least one of previously defined reference models.
141. The system of claim 129, wherein the recorder arbitrarily takes a snapshot of the current configuration of a first server.
142. The system of claim 141, wherein the comparator compares a Uve-version of the first server to the snapshot.
143. The system of claim 141, wherein the corrector further restores a previous configuration of the first server from the snapshot.
144. The system of claim 129, wherem the recorder recurrendy takes a pluraUty of snapshots of a first server at predetermined time intervals, wherein a first snapshot from the pluraUty of snapshots forms a baseline for subsequent snapshots of the pluraUty of snapshots and the subsequent snapshots capture changes against the baseline over time.
145. The system of claim 144, wherein the comparator recurrendy takes a pluraUty of audits of a Uve server at predetermined time intervals to ttack compUance against at least one of the baseline snapshot and the reference model over time.
146. The system of claim 129, wherein the comparator compares Uve servers by: (i) comparing values of expUcidy selected sever objects that are commonly shared between a first Uve server and a second Uve server. (H) comparing values of impUcidy selected sever objects that are impUcidy specified Hi the template.
147. The system of claim 129, wherem the corrector further restores a previous configuration of the second server from the reference model.
148. The system of claim 129 further comprising: provisioning a newly-added third server on the network n accordance with the reference model.
149. The system of claim 129, wherein the correcting step further coUects the discrepancies identified Hi a ttansaction package to execute a pluraUty of server change operations on the second server; and synchronizing the second server with the reference model.
150. The system of claim 129 further comprising: an updater for updating the reference model and propagating the updates to the pluraUty of servers with a ttansaction package.
151. The system of claim 129 further comprising: (i) a first template categorizing each of the server objects into categories, sub-categories, and associated keywords; and (H) second templates including a selected group of categoricaUy related server objects by server type categories.
152. The system of claim 151, wherein the categories comprise server type categories HicludHig at least one of an appUcation server category, a web server category, and a database server category.
153. The system of claim 151, wherein the categories comprise configuration parameter type categories including at least one of network parameters, capacity parameters, avauabiHty parameters, performance parameters, and security parameters.
154. The system of claim 129, wherein the reference model comprises an externaUy imported template.
PCT/US2003/017927 2002-06-12 2003-06-05 Method and system for simplifying distributed server management WO2003107178A2 (en)

Priority Applications (4)

Application Number Priority Date Filing Date Title
AU2003243426A AU2003243426A1 (en) 2002-06-12 2003-06-05 Method and system for simplifying distributed server management
EP16192226.5A EP3139541B1 (en) 2002-06-12 2003-06-05 Method and system for performing distributed server change operations in a transaction-safe manner
EP03760238.0A EP1573520B1 (en) 2002-06-12 2003-06-05 Method and system for simplifying distributed server management
EP06026527A EP1772803A3 (en) 2002-06-12 2003-06-05 Method and system for performing distributed server change operations in a transaction-safe manner

Applications Claiming Priority (10)

Application Number Priority Date Filing Date Title
US38811202P 2002-06-12 2002-06-12
US60/388,112 2002-06-12
US45330803P 2003-03-10 2003-03-10
US60/453,308 2003-03-10
US10/414,959 2003-04-16
US10/414,887 2003-04-16
US10/414,959 US8447963B2 (en) 2002-06-12 2003-04-16 Method and system for simplifying distributed server management
US10/414,958 US7249174B2 (en) 2002-06-12 2003-04-16 Method and system for executing and undoing distributed server change operations
US10/414,958 2003-04-16
US10/414,887 US8549114B2 (en) 2002-06-12 2003-04-16 Method and system for model-based heterogeneous server configuration management

Publications (2)

Publication Number Publication Date
WO2003107178A2 true WO2003107178A2 (en) 2003-12-24
WO2003107178A3 WO2003107178A3 (en) 2005-12-15

Family

ID=29740828

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/US2003/017927 WO2003107178A2 (en) 2002-06-12 2003-06-05 Method and system for simplifying distributed server management

Country Status (5)

Country Link
US (8) US7249174B2 (en)
EP (4) EP1573520B1 (en)
AU (1) AU2003243426A1 (en)
ES (1) ES2548302T3 (en)
WO (1) WO2003107178A2 (en)

Cited By (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1615130A2 (en) * 2004-07-07 2006-01-11 Sap Ag Dynamic Log for a computer system consisting of servers providing services
US20060184653A1 (en) * 2005-02-16 2006-08-17 Red Hat, Inc. System and method for creating and managing virtual services
US7680825B2 (en) 2005-12-30 2010-03-16 Sap Ag Systems and methods for generating tenant-specific properties for use in a provider-tenant environment
US7689593B2 (en) 2005-12-30 2010-03-30 Sap Ag Systems and methods for accessing a shared space in a provider-tenant environment
US7693851B2 (en) 2005-12-30 2010-04-06 Sap Ag Systems and methods for implementing a shared space in a provider-tenant environment
US7698284B2 (en) 2005-12-30 2010-04-13 Sap Ag Systems and methods for deploying a tenant in a provider-tenant environment
US7739348B2 (en) 2006-12-29 2010-06-15 Sap Ag Systems and methods for accessing a shared space in a provider-tenant environment by using middleware
US7917607B2 (en) 2005-12-30 2011-03-29 Sap Ag Software management systems and methods, including use of such systems and methods in a provider-tenant environment
US8042150B2 (en) 2008-12-08 2011-10-18 Motorola Mobility, Inc. Automatic generation of policies and roles for role based access control
US8224828B2 (en) 2009-12-22 2012-07-17 Sap Ag Multi-client generic persistence for extension fields
WO2015105799A1 (en) * 2014-01-09 2015-07-16 Citrix Systems, Inc. System and method for cloud-based probing and diagnostics

Families Citing this family (308)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2002318692A (en) * 2001-04-19 2002-10-31 Sony Corp Installation support system, installation support device, installation support method, program for supporting installation and recording medium in which the same program is recorded
US7685126B2 (en) 2001-08-03 2010-03-23 Isilon Systems, Inc. System and methods for providing a distributed file system utilizing metadata to track information about data stored throughout the system
US7146524B2 (en) 2001-08-03 2006-12-05 Isilon Systems, Inc. Systems and methods for providing a distributed file system incorporating a virtual hot spare
US7945652B2 (en) * 2002-08-06 2011-05-17 Sheng (Ted) Tai Tsao Display multi-layers list item in web-browser with supporting of concurrent multi-users
US7249174B2 (en) * 2002-06-12 2007-07-24 Bladelogic, Inc. Method and system for executing and undoing distributed server change operations
US6990656B2 (en) * 2002-06-27 2006-01-24 Microsoft Corporation Dynamic metabase store
US8140635B2 (en) 2005-03-31 2012-03-20 Tripwire, Inc. Data processing environment change management methods and apparatuses
US8073935B2 (en) * 2002-07-25 2011-12-06 Oracle America, Inc. Pluggable semantic verification and validation of configuration data
US7469338B2 (en) * 2002-07-29 2008-12-23 Broadcom Corporation System and method for cryptographic control of system configurations
US8812640B2 (en) * 2002-08-06 2014-08-19 Sheng Tai (Ted) Tsao Method and system for providing multi-layers item list in browsers with supporting of concurrent multiple users
US20120079389A1 (en) * 2002-08-06 2012-03-29 Tsao Sheng Tai Ted Method and Apparatus For Information Exchange Over a Web Based Environment
JP2004078268A (en) * 2002-08-09 2004-03-11 Fujitsu Ltd Information processor, information processing method and program
US7370092B2 (en) * 2002-09-12 2008-05-06 Computer Sciences Corporation System and method for enhanced software updating and revision
US7363540B2 (en) * 2002-10-22 2008-04-22 Microsoft Corporation Transaction-safe FAT file system improvements
US7174420B2 (en) * 2002-10-22 2007-02-06 Microsoft Corporation Transaction-safe FAT file system
US7074827B2 (en) * 2002-10-24 2006-07-11 Sucampo Ag (Usa) Inc. Method for treating ocular hypertension and glaucoma
EP1563411B1 (en) 2002-11-14 2013-06-19 EMC Corporation Systems and methods for restriping files in a distributed file system
AU2003900055A0 (en) * 2003-01-06 2003-01-23 Concept Development Pty Ltd A method and system of web site construction
JP4152755B2 (en) * 2003-01-10 2008-09-17 富士通株式会社 Server device having a function of switching between old and new program modules
JP4567293B2 (en) * 2003-01-21 2010-10-20 株式会社日立製作所 file server
US20100145752A1 (en) * 2004-05-11 2010-06-10 Davis James E Adaptable workflow and communications system
US7454483B2 (en) 2003-05-14 2008-11-18 Microsoft Corporation Method and apparatus for configuring servers
US8296167B2 (en) * 2003-06-17 2012-10-23 Nigel King Process certification management
US7899693B2 (en) 2003-06-17 2011-03-01 Oracle International Corporation Audit management workbench
US8005709B2 (en) * 2003-06-17 2011-08-23 Oracle International Corporation Continuous audit process control objectives
US7941353B2 (en) * 2003-06-17 2011-05-10 Oracle International Corporation Impacted financial statements
US7890464B2 (en) * 2003-06-20 2011-02-15 Innopath Software, Inc. Processing software images and generating difference files
US7620704B2 (en) * 2003-06-30 2009-11-17 Microsoft Corporation Method and apparatus for configuring a server
US20050138150A1 (en) * 2003-07-11 2005-06-23 Computer Associates Think, Inc. System and method for graphically presenting change and configuration management information
US20050044215A1 (en) * 2003-08-22 2005-02-24 Cohen Alain J. System for automatic import, analysis, and reporting of network configuration and status information
US7500235B2 (en) * 2003-09-05 2009-03-03 Aol Time Warner Interactive Video Group, Inc. Technique for updating a resident application and associated parameters in a user terminal through a communications network
US7818718B2 (en) * 2003-09-30 2010-10-19 Sap Ag Undoing user actions in a client program
US20050080811A1 (en) * 2003-10-10 2005-04-14 Cendura Corporation Configuration management architecture
DE10356368A1 (en) * 2003-11-28 2005-06-23 Abb Patent Gmbh System for automatic generation and installation of functionalities into data files, esp. system components in distributed automation system, includes system planning tool
US7614051B2 (en) * 2003-12-16 2009-11-03 Microsoft Corporation Creating file systems within a file in a storage technology-abstracted manner
US7568195B2 (en) * 2003-12-16 2009-07-28 Microsoft Corporation Determining a maximal set of dependent software updates valid for installation
US7549042B2 (en) * 2003-12-16 2009-06-16 Microsoft Corporation Applying custom software image updates to non-volatile storage in a failsafe manner
US7549148B2 (en) 2003-12-16 2009-06-16 Microsoft Corporation Self-describing software image update components
US20050132357A1 (en) * 2003-12-16 2005-06-16 Microsoft Corporation Ensuring that a software update may be installed or run only on a specific device or class of devices
US8601099B1 (en) * 2003-12-30 2013-12-03 Sap Ag System and method for managing multiple sever node clusters using a hierarchical configuration data structure
US20050198652A1 (en) * 2004-01-13 2005-09-08 Huscher Anthony A. Dynamic link library (DLL) for providing server enhancements
US7512971B2 (en) * 2004-01-29 2009-03-31 Newisys, Inc. Method and system for enabling remote access to a computer system
US7478421B2 (en) * 2004-02-04 2009-01-13 Toshiba Corporation System and method for role based access control of a document processing device
US20090119755A1 (en) * 2004-02-04 2009-05-07 Kodimer Marianne L System and method for role based access control of a document processing device
EP1566940A1 (en) * 2004-02-20 2005-08-24 Alcatel Alsthom Compagnie Generale D'electricite A method, a service system, and a computer software product of self-organizing distributing services in a computing network
US20050209899A1 (en) * 2004-03-16 2005-09-22 Oracle International Corporation Segregation of duties reporting
US20070276970A1 (en) * 2004-03-17 2007-11-29 Abb Research Ltd. Data Consistency Validation
TW200535602A (en) * 2004-04-16 2005-11-01 Hon Hai Prec Ind Co Ltd A system and method for testing motherboards automatically
US20050262495A1 (en) * 2004-05-18 2005-11-24 Bea Systems, Inc. Administration mode for server applications
US20050262494A1 (en) * 2004-05-18 2005-11-24 Bea Systems, Inc. Production redeployment through application versioning
US7660879B2 (en) * 2004-05-20 2010-02-09 Ananthan Bala Srinivasan System and method for application deployment service
EP1769353A2 (en) * 2004-05-21 2007-04-04 Computer Associates Think, Inc. Method and apparatus for dynamic memory resource management
WO2005116833A1 (en) * 2004-05-21 2005-12-08 Computer Associates Think, Inc. Method and apparatus for dynamic cpu resource management
US20060031431A1 (en) * 2004-05-21 2006-02-09 Bea Systems, Inc. Reliable updating for a service oriented architecture
EP1769388A4 (en) * 2004-05-21 2012-01-11 Computer Ass Think Inc Method and system for web-based enterprise change and configuration management reports
US20050278723A1 (en) * 2004-06-14 2005-12-15 Feinleib David A System and method for remote administration from a windows client of computer systems running the Linux operating system
US7500227B1 (en) * 2004-06-22 2009-03-03 Unisys Corporation Process and system for intercepting a .NET method at runtime
US20060088027A1 (en) * 2004-07-07 2006-04-27 Wolfgang Becker Dynamic log for computer systems of server and services
US7971255B1 (en) 2004-07-15 2011-06-28 The Trustees Of Columbia University In The City Of New York Detecting and preventing malcode execution
US7984443B2 (en) * 2004-07-22 2011-07-19 Computer Associates Think, Inc. System and method for normalizing job properties
US8028285B2 (en) * 2004-07-22 2011-09-27 Computer Associates Think, Inc. Heterogeneous job dashboard
US8427667B2 (en) * 2004-07-22 2013-04-23 Ca, Inc. System and method for filtering jobs
US9600216B2 (en) * 2004-07-22 2017-03-21 Ca, Inc. System and method for managing jobs in heterogeneous environments
US7886296B2 (en) * 2004-07-22 2011-02-08 Computer Associates Think, Inc. System and method for providing alerts for heterogeneous jobs
US8126943B2 (en) * 2004-08-09 2012-02-28 International Business Machines Corporation Autonomic virtual log configuration
US20060159077A1 (en) * 2004-08-20 2006-07-20 Vanecek George Jr Service-oriented middleware for managing interoperability of heterogeneous elements of integrated systems
US8464250B1 (en) * 2004-09-23 2013-06-11 Transcontinental Events, Llc System and method for on-demand cloning of virtual machines
US7752602B1 (en) * 2004-09-28 2010-07-06 Hewlett-Packard Development Company, L.P. Reversible atomic steps to undo application startup
US8055711B2 (en) 2004-10-29 2011-11-08 Emc Corporation Non-blocking commit protocol systems and methods
US8238350B2 (en) 2004-10-29 2012-08-07 Emc Corporation Message batching with checkpoints systems and methods
US8051425B2 (en) * 2004-10-29 2011-11-01 Emc Corporation Distributed system with asynchronous execution systems and methods
US8064438B1 (en) * 2004-11-22 2011-11-22 At&T Intellectual Property Ii, L.P. Method and apparatus for determining the configuration of voice over internet protocol equipment in remote locations
US7694298B2 (en) * 2004-12-10 2010-04-06 Intel Corporation Method and apparatus for providing virtual server blades
US9639554B2 (en) 2004-12-17 2017-05-02 Microsoft Technology Licensing, Llc Extensible file system
US8606830B2 (en) 2004-12-17 2013-12-10 Microsoft Corporation Contiguous file allocation in an extensible file system
US7873596B2 (en) 2006-05-23 2011-01-18 Microsoft Corporation Extending cluster allocations in an extensible file system
US8321439B2 (en) 2004-12-17 2012-11-27 Microsoft Corporation Quick filename lookup using name hash
US7934215B2 (en) * 2005-01-12 2011-04-26 Microsoft Corporation Smart scheduler
US7730183B2 (en) * 2005-01-13 2010-06-01 Microsoft Corporation System and method for generating virtual networks
US20060190532A1 (en) * 2005-02-23 2006-08-24 Kalyana Chadalavada Apparatus and methods for multiple user remote connections to an information handling system via a remote access controller
US20060242277A1 (en) 2005-03-31 2006-10-26 Tripwire, Inc. Automated change approval
US7447889B2 (en) * 2005-04-20 2008-11-04 Hewlett-Packard Development Company, L.P. Method and apparatus for configuring a computer system utilizing a read only memory storing an option file containing selectable configuration options and a script file
US20060265583A1 (en) * 2005-05-20 2006-11-23 Tamar Eilam Method, system, and product for identifying provisioning operations via planning methods
US8046777B2 (en) * 2005-06-02 2011-10-25 The Mathworks, Inc. Calling of late bound functions from an external program environment
US8176158B2 (en) 2005-08-09 2012-05-08 Tripwire, Inc. Information technology governance and controls methods and apparatuses
US8171238B1 (en) 2007-07-05 2012-05-01 Silver Peak Systems, Inc. Identification of data stored in memory
US7571344B2 (en) * 2005-08-12 2009-08-04 Silver Peak Systems, Inc. Ensuring data integrity in network memory
US8392684B2 (en) 2005-08-12 2013-03-05 Silver Peak Systems, Inc. Data encryption in a network memory architecture for providing data based on local accessibility
US8095774B1 (en) 2007-07-05 2012-01-10 Silver Peak Systems, Inc. Pre-fetching data into a memory
US8370583B2 (en) 2005-08-12 2013-02-05 Silver Peak Systems, Inc. Network memory architecture for providing data based on local accessibility
US10318894B2 (en) * 2005-08-16 2019-06-11 Tripwire, Inc. Conformance authority reconciliation
US8489562B1 (en) 2007-11-30 2013-07-16 Silver Peak Systems, Inc. Deferred data storage
US8929402B1 (en) 2005-09-29 2015-01-06 Silver Peak Systems, Inc. Systems and methods for compressing packet data by predicting subsequent data
US8811431B2 (en) 2008-11-20 2014-08-19 Silver Peak Systems, Inc. Systems and methods for compressing packet data
US8104033B2 (en) 2005-09-30 2012-01-24 Computer Associates Think, Inc. Managing virtual machines based on business priorty
US8225313B2 (en) * 2005-10-19 2012-07-17 Ca, Inc. Object-based virtual infrastructure management
US7917474B2 (en) 2005-10-21 2011-03-29 Isilon Systems, Inc. Systems and methods for accessing and updating distributed data
US7788303B2 (en) 2005-10-21 2010-08-31 Isilon Systems, Inc. Systems and methods for distributed system scanning
US7551572B2 (en) 2005-10-21 2009-06-23 Isilon Systems, Inc. Systems and methods for providing variable protection
US7797283B2 (en) 2005-10-21 2010-09-14 Isilon Systems, Inc. Systems and methods for maintaining distributed data
US20070124255A1 (en) * 2005-11-28 2007-05-31 Tripwire, Inc. Pluggable heterogeneous reconciliation
US9189291B2 (en) * 2005-12-12 2015-11-17 International Business Machines Corporation Sharing a kernel of an operating system among logical partitions
US20070192344A1 (en) * 2005-12-29 2007-08-16 Microsoft Corporation Threats and countermeasures schema
US20070156420A1 (en) * 2005-12-29 2007-07-05 Microsoft Corporation Performance modeling and the application life cycle
US20070157311A1 (en) * 2005-12-29 2007-07-05 Microsoft Corporation Security modeling and the application life cycle
US7890315B2 (en) 2005-12-29 2011-02-15 Microsoft Corporation Performance engineering and the application life cycle
US20070156901A1 (en) * 2005-12-30 2007-07-05 Wolfgang Becker Generation and use of table links in a provider-tenant environment
US20070156902A1 (en) * 2005-12-30 2007-07-05 Becker Wolfgang A Systems and methods for implementing a tenant space in a provider-tenant environment
US8726271B1 (en) * 2005-12-30 2014-05-13 United Services Automobile Association (Usaa) Method and system for installing software
US20070156849A1 (en) * 2005-12-30 2007-07-05 Wolfgang Becker Systems and methods for delivering software upgrades in a provider-tenant environment
US20070162969A1 (en) * 2005-12-30 2007-07-12 Becker Wolfgang A Provider-tenant systems, and methods for using the same
US7885841B2 (en) 2006-01-05 2011-02-08 Oracle International Corporation Audit planning
US7818788B2 (en) * 2006-02-14 2010-10-19 Microsoft Corporation Web application security frame
US7848261B2 (en) 2006-02-17 2010-12-07 Isilon Systems, Inc. Systems and methods for providing a quiescing protocol
US7596615B2 (en) * 2006-02-22 2009-09-29 Microsoft Corporation Multi-server automated redundant service configuration
US20070234345A1 (en) * 2006-02-22 2007-10-04 Microsoft Corporation Integrated multi-server installation
US7853945B2 (en) * 2006-02-22 2010-12-14 Michael Kramer Integrated computer server imaging
US7712137B2 (en) * 2006-02-27 2010-05-04 Microsoft Corporation Configuring and organizing server security information
US7840398B2 (en) * 2006-03-28 2010-11-23 Intel Corporation Techniques for unified management communication for virtualization systems
US7756898B2 (en) 2006-03-31 2010-07-13 Isilon Systems, Inc. Systems and methods for notifying listeners of events
US20070282964A1 (en) * 2006-06-06 2007-12-06 International Business Machines Corporation Method and apparatus for processing remote shell commands
US8079019B2 (en) * 2007-11-21 2011-12-13 Replay Solutions, Inc. Advancing and rewinding a replayed program execution
US9201703B2 (en) * 2006-06-07 2015-12-01 International Business Machines Corporation Sharing kernel services among kernels
US8755381B2 (en) 2006-08-02 2014-06-17 Silver Peak Systems, Inc. Data matching using flow based packet data storage
US8885632B2 (en) 2006-08-02 2014-11-11 Silver Peak Systems, Inc. Communications scheduler
US10453029B2 (en) 2006-08-03 2019-10-22 Oracle International Corporation Business process for ultra transactions
US7899800B2 (en) 2006-08-18 2011-03-01 Isilon Systems, Inc. Systems and methods for providing nonlinear journaling
US7822932B2 (en) 2006-08-18 2010-10-26 Isilon Systems, Inc. Systems and methods for providing nonlinear journaling
US7590652B2 (en) 2006-08-18 2009-09-15 Isilon Systems, Inc. Systems and methods of reverse lookup
US7882071B2 (en) 2006-08-18 2011-02-01 Isilon Systems, Inc. Systems and methods for a snapshot of data
US7953704B2 (en) 2006-08-18 2011-05-31 Emc Corporation Systems and methods for a snapshot of data
US7680842B2 (en) 2006-08-18 2010-03-16 Isilon Systems, Inc. Systems and methods for a snapshot of data
US7680836B2 (en) 2006-08-18 2010-03-16 Isilon Systems, Inc. Systems and methods for a snapshot of data
US20080059123A1 (en) * 2006-08-29 2008-03-06 Microsoft Corporation Management of host compliance evaluation
JP4359609B2 (en) * 2006-11-15 2009-11-04 株式会社日立製作所 Computer system, system software update method, and first server device
US8286029B2 (en) 2006-12-21 2012-10-09 Emc Corporation Systems and methods for managing unavailable storage devices
US7593938B2 (en) 2006-12-22 2009-09-22 Isilon Systems, Inc. Systems and methods of directory entry encodings
US20080162536A1 (en) * 2006-12-29 2008-07-03 Becker Wolfgang A Systems and methods for extending shared data structures with tenant content in a provider-tenant environment
US20080162490A1 (en) * 2006-12-29 2008-07-03 Becker Wolfgang A Methods and systems for automatic registration during deployment of a tenant
US8069184B2 (en) 2006-12-29 2011-11-29 Sap Ag Systems and methods to implement extensibility of tenant content in a provider-tenant environment
US20080162483A1 (en) * 2006-12-29 2008-07-03 Becker Wolfgang A Methods and systems for protecting shared tables against unauthorized overwriting from a tenant space in a mega-tenancy environment
US20080163204A1 (en) * 2006-12-29 2008-07-03 Dennis Morgan Method and apparatus for inventory and/or policy-based management of virtual machines on a computing device
US7933869B2 (en) 2006-12-29 2011-04-26 Sap Ag Method and system for cloning a tenant database in a multi-tenant system
US7509448B2 (en) 2007-01-05 2009-03-24 Isilon Systems, Inc. Systems and methods for managing semantic locks
US20080168311A1 (en) * 2007-01-08 2008-07-10 Microsoft Corporation Configuration debugging comparison
US7747664B2 (en) 2007-01-16 2010-06-29 Microsoft Corporation Storage system format for transaction safe file system
US7613738B2 (en) 2007-01-16 2009-11-03 Microsoft Corporation FAT directory structure for use in transaction safe file system
US20080201705A1 (en) 2007-02-15 2008-08-21 Sun Microsystems, Inc. Apparatus and method for generating a software dependency map
US8966080B2 (en) 2007-04-13 2015-02-24 Emc Corporation Systems and methods of managing resource utilization on a threaded computer system
US7900015B2 (en) 2007-04-13 2011-03-01 Isilon Systems, Inc. Systems and methods of quota accounting
US7779048B2 (en) 2007-04-13 2010-08-17 Isilon Systems, Inc. Systems and methods of providing possible value ranges
US20090019522A1 (en) * 2007-04-27 2009-01-15 Bea Systems, Inc. Web based application constructor using data spaces
US8832495B2 (en) 2007-05-11 2014-09-09 Kip Cr P1 Lp Method and system for non-intrusive monitoring of library components
US20090006619A1 (en) * 2007-06-29 2009-01-01 Microsoft Corporation Directory Snapshot Browser
JP5142186B2 (en) * 2007-07-03 2013-02-13 Ｋｄｄｉ株式会社 Network setting restoration method and system
US7949692B2 (en) 2007-08-21 2011-05-24 Emc Corporation Systems and methods for portals into snapshot data
US7882068B2 (en) 2007-08-21 2011-02-01 Isilon Systems, Inc. Systems and methods for adaptive copy on write
US7966289B2 (en) 2007-08-21 2011-06-21 Emc Corporation Systems and methods for reading objects in a file system
US7948921B1 (en) 2007-09-20 2011-05-24 Silver Peak Systems, Inc. Automatic network optimization
US20090083738A1 (en) * 2007-09-25 2009-03-26 Microsoft Corporation Automated data object set administration
US20090100158A1 (en) * 2007-10-12 2009-04-16 Microsoft Corporation Backup and Recovery System for Multiple Device Environment
US8307115B1 (en) 2007-11-30 2012-11-06 Silver Peak Systems, Inc. Network memory mirroring
US8352906B2 (en) * 2007-12-28 2013-01-08 Cadence Design Systems, Inc. Method, system, and computer program product for implementing external domain independent modeling framework in a system design
US8650241B2 (en) * 2008-02-01 2014-02-11 Kip Cr P1 Lp System and method for identifying failing drives or media in media library
US8645328B2 (en) * 2008-02-04 2014-02-04 Kip Cr P1 Lp System and method for archive verification
US7974215B1 (en) * 2008-02-04 2011-07-05 Crossroads Systems, Inc. System and method of network diagnosis
US9015005B1 (en) 2008-02-04 2015-04-21 Kip Cr P1 Lp Determining, displaying, and using tape drive session information
US8442052B1 (en) 2008-02-20 2013-05-14 Silver Peak Systems, Inc. Forward packet recovery
US7949636B2 (en) 2008-03-27 2011-05-24 Emc Corporation Systems and methods for a read only mode for a portion of a storage system
US7870345B2 (en) 2008-03-27 2011-01-11 Isilon Systems, Inc. Systems and methods for managing stalled storage devices
US7953709B2 (en) 2008-03-27 2011-05-31 Emc Corporation Systems and methods for a read only mode for a portion of a storage system
US7984324B2 (en) 2008-03-27 2011-07-19 Emc Corporation Systems and methods for managing stalled storage devices
JP4924514B2 (en) * 2008-03-31 2012-04-25 富士通株式会社 Virtual machine management program, management server device, and virtual machine management method
JP5365051B2 (en) * 2008-03-31 2013-12-11 富士通株式会社 Management program, management apparatus and management method
US8135838B2 (en) 2008-04-08 2012-03-13 Geminare Incorporated System and method for providing data and application continuity in a computer system
US9720674B1 (en) 2008-05-05 2017-08-01 Open Invention Network, Llc Automating application of software patches to a server having a virtualization layer
US9501302B1 (en) * 2008-06-06 2016-11-22 Amdocs Software Systems Limited System, method, and computer program for combining results of event processing received from a plurality of virtual servers
US20090319653A1 (en) * 2008-06-20 2009-12-24 International Business Machines Corporation Server configuration management method
US20090328210A1 (en) * 2008-06-30 2009-12-31 Microsoft Corporation Chain of events tracking with data tainting for automated security feedback
US8914341B2 (en) 2008-07-03 2014-12-16 Tripwire, Inc. Method and apparatus for continuous compliance assessment
US10164861B2 (en) 2015-12-28 2018-12-25 Silver Peak Systems, Inc. Dynamic monitoring and visualization for network health characteristics
US9717021B2 (en) 2008-07-03 2017-07-25 Silver Peak Systems, Inc. Virtual network overlay
US10805840B2 (en) 2008-07-03 2020-10-13 Silver Peak Systems, Inc. Data transmission via a virtual wide area network overlay
US8743683B1 (en) 2008-07-03 2014-06-03 Silver Peak Systems, Inc. Quality of service using multiple flows
US9817680B1 (en) 2008-08-04 2017-11-14 Open Invention Network, Llc Application configuration tool
US8261342B2 (en) * 2008-08-20 2012-09-04 Reliant Security Payment card industry (PCI) compliant architecture and associated methodology of managing a service infrastructure
US8151273B2 (en) * 2008-08-28 2012-04-03 Microsoft Corporation Environment wide configuration system
US8731519B2 (en) * 2008-09-08 2014-05-20 At&T Mobility Ii Llc Mobile handset extension to a device
CN101686458B (en) 2008-09-28 2013-06-12 华为技术有限公司 Terminal configuration, management method and terminal device
US7882232B2 (en) * 2008-09-29 2011-02-01 International Business Machines Corporation Rapid resource provisioning with automated throttling
US8255875B2 (en) * 2008-09-30 2012-08-28 Rockwell Automation Technologies, Inc. Application builder for industrial automation
US8213924B2 (en) * 2008-10-06 2012-07-03 Facebook, Inc. Providing distributed online services for mobile devices
US8572608B2 (en) * 2008-10-22 2013-10-29 Vmware, Inc. Methods and systems for converting a related group of physical machines to virtual machines
US8099480B1 (en) * 2008-11-25 2012-01-17 Google Inc. Scalable workflow design for automated service management
US9268608B2 (en) * 2009-02-26 2016-02-23 Oracle International Corporation Automatic administration of UNIX commands
US20100217944A1 (en) * 2009-02-26 2010-08-26 Dehaan Michael Paul Systems and methods for managing configurations of storage devices in a software provisioning environment
US7925924B2 (en) 2009-03-23 2011-04-12 International Business Machines Corporation Method for command line interface restore points with support for an atomic sets of commands
US8955108B2 (en) * 2009-06-17 2015-02-10 Microsoft Corporation Security virtual machine for advanced auditing
CN101788991B (en) * 2009-06-23 2013-03-06 北京搜狗科技发展有限公司 Updating reminding method and system
US9866633B1 (en) 2009-09-25 2018-01-09 Kip Cr P1 Lp System and method for eliminating performance impact of information collection from media drives
DE102009043287A1 (en) * 2009-09-29 2011-03-31 Abb Technology Ag Method and device for installing and configuring a computer system
JP5635760B2 (en) * 2009-10-16 2014-12-03 キヤノン株式会社 Information processing system, information processing method, and computer program
US8843787B1 (en) 2009-12-16 2014-09-23 Kip Cr P1 Lp System and method for archive verification according to policies
US8245083B2 (en) 2009-12-24 2012-08-14 At&T Intellectual Property I, L.P. Systems, methods, and apparatus to debug a network application
PL3232610T3 (en) * 2010-03-22 2020-09-21 Koninklijke Kpn N.V. System and method for handling a configuration request
US8543861B1 (en) * 2010-04-02 2013-09-24 Symantec Corporation Systems and methods for diagnosing a network configuration of a computing device
US8700723B2 (en) * 2010-06-15 2014-04-15 Netzyn, Inc. Hierarchical display-server system and method
CN102959506B (en) * 2010-06-22 2017-04-26 慧与发展有限责任合伙企业 Methods and systems for planning application deployment
US10003514B2 (en) 2010-06-22 2018-06-19 Hewlett Packard Enteprrise Development LP Method and system for determining a deployment of applications
US9092576B2 (en) * 2010-06-25 2015-07-28 International Business Machines Corporation Non-intrusive measurement of content quality using dry runs with roll-back
US9292343B2 (en) * 2010-06-30 2016-03-22 Oracle International Corporation Method and system for performing deployment management
US9348609B2 (en) * 2010-08-02 2016-05-24 Sap Se Framework for ad-hoc process flexibility
US8356088B2 (en) * 2010-10-29 2013-01-15 Bank Of America Corporation Configuration management utility
US20130297755A1 (en) * 2010-11-23 2013-11-07 Nokia Siemens Networks Oy Network element configuration management
US9059898B2 (en) * 2010-12-07 2015-06-16 General Electric Company System and method for tracking configuration changes in enterprise product
US8607225B2 (en) 2010-12-28 2013-12-10 Oracle International Corporation Managed upgrades of components in an integrated software and hardware system
US8543671B1 (en) * 2010-12-30 2013-09-24 United States Automobile Association (USAA) Grouped computing device configuration management
US8682464B2 (en) * 2011-03-30 2014-03-25 Realtime Technology Ag System and method for generating a three-dimensional image
US10423509B2 (en) * 2011-08-05 2019-09-24 Entit Software Llc System and method for managing environment configuration using snapshots
US8510807B1 (en) * 2011-08-16 2013-08-13 Edgecast Networks, Inc. Real-time granular statistical reporting for distributed platforms
US9275369B2 (en) 2011-08-24 2016-03-01 Oracle International Corporation Demystifying obfuscated information transfer for performing automated system administration
US9021017B2 (en) * 2011-09-03 2015-04-28 Barracuda Networks, Inc. Configuring a plurality of diverse devices/services from an adaptive configuration control hyper-server apparatus
US9130991B2 (en) 2011-10-14 2015-09-08 Silver Peak Systems, Inc. Processing data packets in performance enhancing proxy (PEP) environment
US9229758B2 (en) 2011-10-28 2016-01-05 International Business Machines Corporation Passive monitoring of virtual systems using extensible indexing
US20130111018A1 (en) * 2011-10-28 2013-05-02 International Business Machines Coporation Passive monitoring of virtual systems using agent-less, offline indexing
CN102393857B (en) * 2011-11-01 2014-04-09 中兴通讯股份有限公司 Method and system for local call based on web page
KR20130048807A (en) * 2011-11-03 2013-05-13 한국전자통신연구원 System for clouding computing and methord for managing cloud servers thereof
US9626224B2 (en) 2011-11-03 2017-04-18 Silver Peak Systems, Inc. Optimizing available computing resources within a virtual environment
US9430209B2 (en) * 2011-12-16 2016-08-30 Sap Se Processing framework for generating pre-configuration packages
US10637918B2 (en) * 2012-02-27 2020-04-28 Red Hat, Inc. Load balancing content delivery servers
US9306843B2 (en) 2012-04-18 2016-04-05 Nicira, Inc. Using transactions to compute and propagate network forwarding state
US10235205B2 (en) 2012-05-24 2019-03-19 Citrix Systems, Inc. Remote management of distributed datacenters
US20140007197A1 (en) * 2012-06-29 2014-01-02 Michael John Wray Delegation within a computing environment
GB2504719A (en) 2012-08-07 2014-02-12 Ibm Grid based data mobility
US20140068040A1 (en) * 2012-09-04 2014-03-06 Bank Of America Corporation System for Enabling Server Maintenance Using Snapshots
US10346369B2 (en) 2012-10-11 2019-07-09 Delphix Corp. Retrieving point-in-time copies of a source database for creating virtual databases
US9489110B2 (en) * 2012-10-29 2016-11-08 Bank Of America Corporation Automatic deployment, configuration, and lifecycle management of applications and infrastructure components
US8938424B2 (en) * 2012-10-31 2015-01-20 Ca, Inc. System and method of assessing the state of a database product for installation consistency
US8977598B2 (en) * 2012-12-21 2015-03-10 Zetta Inc. Systems and methods for on-line backup and disaster recovery with local copy
US8977594B2 (en) * 2012-12-21 2015-03-10 Zetta Inc. Systems and methods for state consistent replication
US8904388B2 (en) * 2013-01-10 2014-12-02 Vce Company, Llc Scripting language executor service for applications
US9665366B2 (en) * 2014-09-26 2017-05-30 Oracle International Corporation Creation of a software configuration signature for software
US9304885B2 (en) 2013-06-18 2016-04-05 International Business Machines Corporation Passive monitoring of virtual systems using agent-less, near-real-time indexing
US9218139B2 (en) 2013-08-16 2015-12-22 International Business Machines Corporation Minimally disruptive virtual machine snapshots
WO2015047271A1 (en) * 2013-09-26 2015-04-02 Hewlett-Packard Development Company, L.P. Undoing changes made by threads
CN103593239B (en) * 2013-10-28 2017-06-06 大唐移动通信设备有限公司 The method and device of application process command process in LINUX system
KR101732889B1 (en) * 2013-11-04 2017-05-08 한국전자통신연구원 Apparatus and method for guaranteeing safe execution of a shell command in an embedded system
US9535853B2 (en) 2013-12-30 2017-01-03 International Business Machines Corporation Building an undo log for in-memory blocks of data
US9621653B2 (en) * 2014-02-14 2017-04-11 Western Digital Technologies, Inc. Method and apparatus for a network connected storage system
US10289547B2 (en) * 2014-02-14 2019-05-14 Western Digital Technologies, Inc. Method and apparatus for a network connected storage system
US9985970B2 (en) 2014-05-28 2018-05-29 Conjur, Inc. Individualized audit log access control for virtual machines
US10397213B2 (en) 2014-05-28 2019-08-27 Conjur, Inc. Systems, methods, and software to provide access control in cloud computing environments
US9680821B2 (en) * 2014-05-28 2017-06-13 Conjur, Inc. Resource access control for virtual machines
US11838851B1 (en) 2014-07-15 2023-12-05 F5, Inc. Methods for managing L7 traffic classification and devices thereof
US9948496B1 (en) 2014-07-30 2018-04-17 Silver Peak Systems, Inc. Determining a transit appliance for data traffic to a software service
US9875344B1 (en) 2014-09-05 2018-01-23 Silver Peak Systems, Inc. Dynamic monitoring and authorization of an optimization device
US9531542B2 (en) 2014-09-19 2016-12-27 Bank Of America Corporation Secure remote password
CN104331309B (en) * 2014-10-31 2018-04-17 北京思特奇信息技术股份有限公司 It is a kind of to configure the management method and system for realizing data add-in shell
US10686659B1 (en) * 2014-11-07 2020-06-16 EMC IP Holding Company LLC Converged infrastructure logical build optimization
US10834065B1 (en) 2015-03-31 2020-11-10 F5 Networks, Inc. Methods for SSL protected NTLM re-authentication and devices thereof
US9967134B2 (en) 2015-04-06 2018-05-08 Nicira, Inc. Reduction of network churn based on differences in input state
US10063629B2 (en) 2015-06-23 2018-08-28 Dell Products, L.P. Floating set points to optimize power allocation and use in data center
US10754494B2 (en) * 2015-06-23 2020-08-25 Dell Products, L.P. Method and control system providing one-click commissioning and push updates to distributed, large-scale information handling system (LIHS)
US10009232B2 (en) 2015-06-23 2018-06-26 Dell Products, L.P. Method and control system providing an interactive interface for device-level monitoring and servicing of distributed, large-scale information handling system (LIHS)
US10447757B2 (en) * 2015-08-20 2019-10-15 International Business Machines Corporation Self-service server change management
US10296502B1 (en) * 2015-08-24 2019-05-21 State Farm Mutual Automobile Insurance Company Self-management of data applications
US10204122B2 (en) 2015-09-30 2019-02-12 Nicira, Inc. Implementing an interface between tuple and message-driven control entities
CN107534569A (en) * 2015-11-18 2018-01-02 慧与发展有限责任合伙企业 Emerging system accordance inspection
US9882901B2 (en) * 2015-12-14 2018-01-30 International Business Machines Corporation End-to-end protection for shrouded virtual servers
US10560549B1 (en) * 2016-01-12 2020-02-11 Uber Technologies, Inc. Configuration updates of distributed applications
US10404698B1 (en) 2016-01-15 2019-09-03 F5 Networks, Inc. Methods for adaptive organization of web application access points in webtops and devices thereof
US10298589B2 (en) 2016-01-27 2019-05-21 International Business Machines Corporation User abstracted RBAC in a multi tenant environment
WO2017159894A1 (en) * 2016-03-16 2017-09-21 (주)엔키아 Virtualization integrated-management apparatus
JP6707949B2 (en) * 2016-03-29 2020-06-10 ブラザー工業株式会社 Computer program for terminal device
US11019167B2 (en) 2016-04-29 2021-05-25 Nicira, Inc. Management of update queues for network controller
US10432484B2 (en) 2016-06-13 2019-10-01 Silver Peak Systems, Inc. Aggregating select network traffic statistics
US9967056B1 (en) 2016-08-19 2018-05-08 Silver Peak Systems, Inc. Forward packet recovery with constrained overhead
CN106815010B (en) * 2016-12-09 2021-01-01 武汉斗鱼网络科技有限公司 Method and device for operating database
US10257082B2 (en) 2017-02-06 2019-04-09 Silver Peak Systems, Inc. Multi-level learning for classifying traffic flows
US11044202B2 (en) 2017-02-06 2021-06-22 Silver Peak Systems, Inc. Multi-level learning for predicting and classifying traffic flows from first packet data
US10771394B2 (en) 2017-02-06 2020-09-08 Silver Peak Systems, Inc. Multi-level learning for classifying traffic flows on a first packet from DNS data
US10892978B2 (en) 2017-02-06 2021-01-12 Silver Peak Systems, Inc. Multi-level learning for classifying traffic flows from first packet data
US10417073B2 (en) 2017-04-12 2019-09-17 Bank Of America Corporation Application server deployment system for domain generation and testing with an administrative server virtual machine and managed server virtual machines
US10296328B2 (en) * 2017-05-05 2019-05-21 Dell Products L.P. Infrastructure configuration and inventory manager
US10437625B2 (en) * 2017-06-16 2019-10-08 Microsoft Technology Licensing, Llc Evaluating configuration requests in a virtual machine
US10666507B2 (en) * 2017-06-30 2020-05-26 Microsoft Technology Licensing, Llc Automatic reconfiguration of dependency graph for coordination of device configuration
CN107343045B (en) * 2017-07-04 2021-03-19 北京百度网讯科技有限公司 Cloud computing system and cloud computing method and device for controlling server
US20190012161A1 (en) * 2017-07-07 2019-01-10 Bank Of America Corporation Distributed and self-deleting apparatus for fast software deployment and upgrade in a network
US11212210B2 (en) 2017-09-21 2021-12-28 Silver Peak Systems, Inc. Selective route exporting using source type
US10601907B2 (en) * 2017-09-22 2020-03-24 Artiste QB Net Inc. System and method for platform to securely distribute compute workload to web capable devices
TW201926108A (en) * 2017-12-04 2019-07-01 和碩聯合科技股份有限公司 Network security system and method thereof
US10725793B2 (en) 2018-01-19 2020-07-28 Red Hat Israel, Ltd. Configuration management task derivation
US10637721B2 (en) 2018-03-12 2020-04-28 Silver Peak Systems, Inc. Detecting path break conditions while minimizing network overhead
US11115272B1 (en) * 2018-04-12 2021-09-07 Amazon Technologies, Inc. Detecting configuration drift for computing resource stacks
US20190324743A1 (en) * 2018-04-24 2019-10-24 Cloud66 Inc. Configuration file management
CN108881435B (en) * 2018-06-15 2021-12-03 广东美的制冷设备有限公司 Real-time clock providing method, server, home appliance, system, and medium
US10868709B2 (en) 2018-09-10 2020-12-15 Oracle International Corporation Determining the health of other nodes in a same cluster based on physical link information
WO2020059957A1 (en) * 2018-09-17 2020-03-26 주식회사 드림에이스 Device for controlling software for vehicle
US10977095B2 (en) * 2018-11-30 2021-04-13 Microsoft Technology Licensing, Llc Side-by-side execution of same-type subsystems having a shared base operating system
US10896093B2 (en) 2019-01-15 2021-01-19 International Business Machines Corporation System reboot maintenance
CN110377498B (en) * 2019-05-27 2023-11-03 平安银行股份有限公司 Automatic credit card account testing method and device, electronic equipment and storage medium
US11442745B1 (en) * 2019-12-19 2022-09-13 Wells Fargo Bank, N.A. Interconnection discovery for automated standards assay
US11237847B1 (en) 2019-12-19 2022-02-01 Wells Fargo Bank, N.A. Automated standards-based computing system reconfiguration
US11502905B1 (en) 2019-12-19 2022-11-15 Wells Fargo Bank, N.A. Computing infrastructure standards assay
US11582105B2 (en) * 2020-06-30 2023-02-14 Lenovo Enterprise Solutions (Singapore) Pte. Ltd. Telemetry-based network switch configuration validation
US11552859B2 (en) * 2021-06-04 2023-01-10 OasisWorks Inc. Interactive graphical model-based configuration control of networked physical assets using logical transactional configuration change rules
US11558251B1 (en) * 2021-12-23 2023-01-17 Rakuten Mobile, Inc. Method, apparatus, and computer readable medium
WO2023211899A1 (en) * 2022-04-27 2023-11-02 Viam Inc. Device control system and method

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO1999031584A1 (en) * 1997-12-17 1999-06-24 Fujitsu Siemens Computers Gmbh Method for converting a system call

Family Cites Families (242)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US539435A (en) * 1895-05-21 And the o
US5175800A (en) 1987-03-23 1992-12-29 Case Group Plc Expert and data base system and method for communications network
US5155847A (en) 1988-08-03 1992-10-13 Minicom Data Corporation Method and apparatus for updating software at remote locations
US5495610A (en) * 1989-11-30 1996-02-27 Seer Technologies, Inc. Software distribution system to build and distribute a software release
AU6969391A (en) 1989-11-30 1991-06-26 Seer Technologies, Inc. Software distribution system
EP0463251A1 (en) 1990-06-28 1992-01-02 International Business Machines Corporation Software installation
US5295244A (en) 1990-09-17 1994-03-15 Cabletron Systems, Inc. Network management system using interconnected hierarchies to represent different network dimensions in multiple display views
US5249274A (en) 1990-10-24 1993-09-28 Vanderbilt University Simultaneous data-driven and demand-driven computational model for dynamically configured systems
EP0501613A3 (en) 1991-02-28 1993-09-01 Hewlett-Packard Company Heterogeneous software configuration management apparatus
JP3055970B2 (en) * 1991-06-20 2000-06-26 富士通株式会社 Method and apparatus for implementing interface between object-oriented languages
US5471617A (en) * 1991-06-24 1995-11-28 Compaq Computer Corporation Computer management system and associated management information base
US5586322A (en) 1992-06-11 1996-12-17 Beck; Robert E. Workgroup organized network manager with workstation comparison system
EP0592079A2 (en) * 1992-09-20 1994-04-13 Sun Microsystems, Inc. Automated software installation and operating environment configuration on a computer system
US5359730A (en) * 1992-12-04 1994-10-25 International Business Machines Corporation Method of operating a data processing system having a dynamic software update facility
US5459837A (en) 1993-04-21 1995-10-17 Digital Equipment Corporation System to facilitate efficient utilization of network resources in a computer network
US5664106A (en) 1993-06-04 1997-09-02 Digital Equipment Corporation Phase-space surface representation of server computer performance in a computer network
EP0706686B1 (en) 1993-07-01 1998-10-14 Legent Corporation System and method for distributed storage management on networked computer systems
JPH0764893A (en) * 1993-08-31 1995-03-10 Canon Inc Network system
CA2172517C (en) * 1993-09-24 2000-02-15 Sandeep Jain Method and apparatus for data replication
US5860012A (en) * 1993-09-30 1999-01-12 Intel Corporation Installation of application software through a network from a source computer system on to a target computer system
US5596579A (en) * 1993-10-01 1997-01-21 International Business Machines Corporation High performance machine for switched communications in a heterogeneous data processing network gateway
US5421009A (en) * 1993-12-22 1995-05-30 Hewlett-Packard Company Method of remotely installing software directly from a central computer
US5717950A (en) 1994-01-11 1998-02-10 Hitachi, Ltd. Input/output device information management system for multi-computer system
US5835911A (en) 1994-02-08 1998-11-10 Fujitsu Limited Software distribution and maintenance system and method
US5845090A (en) 1994-02-14 1998-12-01 Platinium Technology, Inc. System for software distribution in a digital computer network
US6732358B1 (en) 1994-03-24 2004-05-04 Ncr Corporation Automatic updating of computer software
US6088797A (en) 1994-04-28 2000-07-11 Rosen; Sholom S. Tamper-proof electronic processing device
US5694546A (en) 1994-05-31 1997-12-02 Reisman; Richard R. System for automatic unattended electronic information transport between a server and a client by a vendor provided transport software with a manifest list
US5586304A (en) 1994-09-08 1996-12-17 Compaq Computer Corporation Automatic computer upgrading
FR2728088A1 (en) 1994-12-13 1996-06-14 Inst Nat Rech Inf Automat METHOD FOR EXCHANGING INFORMATION IN CUSTOMER / SERVER MODE, BETWEEN STATIONS CONNECTED BY A COMMUNICATION NETWORK
GB9508283D0 (en) 1995-02-07 1995-06-14 British Telecomm Information services provision and management
US5872928A (en) 1995-02-24 1999-02-16 Cabletron Systems, Inc. Method and apparatus for defining and enforcing policies for configuration management in communications networks
US5832503A (en) 1995-02-24 1998-11-03 Cabletron Systems, Inc. Method and apparatus for configuration management in communications networks
US5655081A (en) 1995-03-08 1997-08-05 Bmc Software, Inc. System for monitoring and managing computer resources and applications across a distributed computing environment using an intelligent autonomous agent architecture
US5742829A (en) * 1995-03-10 1998-04-21 Microsoft Corporation Automatic software installation on heterogeneous networked client computer systems
US5650994A (en) 1995-05-16 1997-07-22 Bell Atlantic Network Services, Inc. Operation support system for service creation and network provisioning for video dial tone networks
US5696895A (en) 1995-05-19 1997-12-09 Compaq Computer Corporation Fault tolerant multiple network servers
US6421719B1 (en) 1995-05-25 2002-07-16 Aprisma Management Technologies, Inc. Method and apparatus for reactive and deliberative configuration management
US5764992A (en) * 1995-06-06 1998-06-09 Apple Computer, Inc. Method and apparatus for automatic software replacement
GB2302420A (en) * 1995-06-19 1997-01-15 Ibm Semantic network
US5920567A (en) 1995-06-29 1999-07-06 The Furukawa Electric Co., Ltd. Network related information transfer method for a connection device, and a data communication system
US5678002A (en) 1995-07-18 1997-10-14 Microsoft Corporation System and method for providing automated customer support
US6243396B1 (en) 1995-08-15 2001-06-05 Broadcom Eireann Research Limited Communications network management system
US5913040A (en) * 1995-08-22 1999-06-15 Backweb Ltd. Method and apparatus for transmitting and displaying information between a remote network and a local computer
SE507482C2 (en) 1995-10-09 1998-06-15 Ericsson Telefon Ab L M Redundancy communication management system and procedure
US5845077A (en) 1995-11-27 1998-12-01 Microsoft Corporation Method and system for identifying and obtaining computer software from a remote computer
US5748896A (en) 1995-12-27 1998-05-05 Apple Computer, Inc. Remote network administration methods and apparatus
KR100286008B1 (en) 1995-12-30 2001-04-16 윤종용 Method for automatically updating software program
US5732275A (en) * 1996-01-11 1998-03-24 Apple Computer, Inc. Method and apparatus for managing and automatically updating software programs
EP0880842B1 (en) 1996-02-15 2004-11-17 Telefonaktiebolaget LM Ericsson (publ) A management interworking unit and a method for producing such a unit
US5838907A (en) 1996-02-20 1998-11-17 Compaq Computer Corporation Configuration manager for network devices and an associated method for providing configuration information thereto
US5961588A (en) * 1996-02-22 1999-10-05 Alcatel Usa Sourcing, L.P. Handling of commands passed between the server and client stations of a telecommunications system
EP0882341A1 (en) 1996-02-22 1998-12-09 DSC Telecom L.P. A control system for a telecommunications system
US5821937A (en) 1996-02-23 1998-10-13 Netsuite Development, L.P. Computer method for updating a network design
US6047321A (en) * 1996-02-23 2000-04-04 Nortel Networks Corporation Method and apparatus for monitoring a dedicated communications medium in a switched data network
US5706502A (en) * 1996-03-25 1998-01-06 Sun Microsystems, Inc. Internet-enabled portfolio manager system and method
US6049671A (en) 1996-04-18 2000-04-11 Microsoft Corporation Method for identifying and obtaining computer software from a network computer
US5752042A (en) 1996-06-07 1998-05-12 International Business Machines Corporation Server computer for selecting program updates for a client computer based on results of recognizer program(s) furnished to the client computer
US6151643A (en) * 1996-06-07 2000-11-21 Networks Associates, Inc. Automatic updating of diverse software products on multiple client computer systems by downloading scanning application to client computer and generating software list on client computer
US6298120B1 (en) 1996-06-28 2001-10-02 At&T Corp. Intelligent processing for establishing communication over the internet
FR2751448B1 (en) * 1996-07-17 1999-01-15 Bull Sa METHOD FOR REAL-TIME MONITORING OF A COMPUTER SYSTEM FOR ITS ADMINISTRATION AND ASSISTANCE IN MAINTAINING IT IN OPERATION
US5958012A (en) 1996-07-18 1999-09-28 Computer Associates International, Inc. Network management system using virtual reality techniques to display and simulate navigation to network components
US6182139B1 (en) * 1996-08-05 2001-01-30 Resonate Inc. Client-side resource-based load-balancing with delayed-resource-binding using TCP state migration to WWW server farm
US6067582A (en) 1996-08-13 2000-05-23 Angel Secure Networks, Inc. System for installing information related to a software application to a remote computer over a network
US5996010A (en) 1996-08-29 1999-11-30 Nortel Networks Corporation Method of performing a network management transaction using a web-capable agent
US5781703A (en) 1996-09-06 1998-07-14 Candle Distributed Solutions, Inc. Intelligent remote agent for computer performance monitoring
US6304549B1 (en) 1996-09-12 2001-10-16 Lucent Technologies Inc. Virtual path management in hierarchical ATM networks
US5974572A (en) * 1996-10-15 1999-10-26 Mercury Interactive Corporation Software system and methods for generating a load test using a server access log
US5944782A (en) 1996-10-16 1999-08-31 Veritas Software Corporation Event management system for distributed computing environment
US20020059402A1 (en) * 1996-11-15 2002-05-16 Charles E. Belanger Server-sided internet-based platform independent operating system and application suite
US6035264A (en) * 1996-11-26 2000-03-07 Global Maintech, Inc. Electronic control system and method for externally controlling process in a computer system with a script language
US6112237A (en) 1996-11-26 2000-08-29 Global Maintech, Inc. Electronic monitoring system and method for externally monitoring processes in a computer system
US6044393A (en) 1996-11-26 2000-03-28 Global Maintech, Inc. Electronic control system and method for externally and directly controlling processes in a computer system
US6012088A (en) 1996-12-10 2000-01-04 International Business Machines Corporation Automatic configuration for internet access device
US6347398B1 (en) 1996-12-12 2002-02-12 Microsoft Corporation Automatic software downloading from a computer network
US6802061B1 (en) 1996-12-12 2004-10-05 Microsoft Corporation Automatic software downloading from a computer network
US6009274A (en) 1996-12-13 1999-12-28 3Com Corporation Method and apparatus for automatically updating software components on end systems over a network
US5987497A (en) * 1996-12-30 1999-11-16 J.D. Edwards World Source Company System and method for managing the configuration of distributed objects
US5918228A (en) * 1997-01-28 1999-06-29 International Business Machines Corporation Method and apparatus for enabling a web server to impersonate a user of a distributed file system to obtain secure access to supported web documents
US6225995B1 (en) * 1997-10-31 2001-05-01 Oracle Corporaton Method and apparatus for incorporating state information into a URL
US5923842A (en) * 1997-03-06 1999-07-13 Citrix Systems, Inc. Method and apparatus for simultaneously providing anonymous user login for multiple users
US6052722A (en) * 1997-03-07 2000-04-18 Mci Communications Corporation System and method for managing network resources using distributed intelligence and state management
US6192354B1 (en) * 1997-03-21 2001-02-20 International Business Machines Corporation Apparatus and method for optimizing the performance of computer tasks using multiple intelligent agents having varied degrees of domain knowledge
US6157956A (en) 1997-03-28 2000-12-05 Global Maintech, Inc. Heterogeneous computing interface apparatus and method using a universal character set
US6108420A (en) 1997-04-10 2000-08-22 Channelware Inc. Method and system for networked installation of uniquely customized, authenticable, and traceable software application
WO1998047057A2 (en) 1997-04-14 1998-10-22 R2K, Llc Registry management system
GB9707550D0 (en) * 1997-04-15 1997-06-04 British Telecomm Design of computer networks
US6314565B1 (en) 1997-05-19 2001-11-06 Intervu, Inc. System and method for automated identification, retrieval, and installation of multimedia software components
JP3932461B2 (en) 1997-05-21 2007-06-20 ソニー株式会社 Client device, image display control method, shared virtual space providing device and method, and recording medium
US6123737A (en) 1997-05-21 2000-09-26 Symantec Corporation Push deployment of software packages using notification transports
US6578077B1 (en) 1997-05-27 2003-06-10 Novell, Inc. Traffic monitoring tool for bandwidth management
US6816903B1 (en) 1997-05-27 2004-11-09 Novell, Inc. Directory enabled policy management tool for intelligent traffic management
US6029196A (en) * 1997-06-18 2000-02-22 Netscape Communications Corporation Automatic client configuration system
US6389464B1 (en) 1997-06-27 2002-05-14 Cornet Technology, Inc. Device management system for managing standards-compliant and non-compliant network elements using standard management protocols and a universal site server which is configurable from remote locations via internet browser technology
US6086623A (en) 1997-06-30 2000-07-11 Sun Microsystems, Inc. Method and implementation for intercepting and processing system calls in programmed digital computer to emulate retrograde operating system
US6226679B1 (en) * 1997-06-30 2001-05-01 Sun Microsystems, Inc. Common management information protocol (CMIP) agent registration methods systems and computer program products
US6138251A (en) 1997-06-30 2000-10-24 Sun Microsystems, Inc. Method and system for reliable remote object reference management
US7240094B2 (en) * 1997-07-03 2007-07-03 Centra Software Inc. Method and system for synchronizing and serving multimedia in a distributed network
US6003075A (en) * 1997-07-07 1999-12-14 International Business Machines Corporation Enqueuing a configuration change in a network cluster and restore a prior configuration in a back up storage in reverse sequence ordered
US6012100A (en) 1997-07-14 2000-01-04 Freegate Corporation System and method of configuring a remotely managed secure network interface
US5974258A (en) 1997-07-18 1999-10-26 International Business Machines Corporation Method and apparatus for performing single-function software operations on a server processor for a target of one or more processors in a network of processors
US6266809B1 (en) 1997-08-15 2001-07-24 International Business Machines Corporation Methods, systems and computer program products for secure firmware updates
US6134593A (en) 1997-09-30 2000-10-17 Cccomplete, Inc. Automated method for electronic software distribution
JP3152180B2 (en) * 1997-10-03 2001-04-03 日本電気株式会社 Semiconductor device and manufacturing method thereof
US6425005B1 (en) 1997-10-06 2002-07-23 Mci Worldcom, Inc. Method and apparatus for managing local resources at service nodes in an intelligent network
US6185466B1 (en) * 1997-10-06 2001-02-06 Proteus Industries, Inc. Distributed digital control system including modules with multiple stored databases and selector
JP3571526B2 (en) 1997-10-23 2004-09-29 富士通株式会社 System design / evaluation CAD system and its program storage medium
US6834389B1 (en) 1997-12-01 2004-12-21 Recursion Software, Inc. Method of forwarding messages to mobile objects in a computer network
US6618366B1 (en) 1997-12-05 2003-09-09 The Distribution Systems Research Institute Integrated information communication system
US6128729A (en) 1997-12-16 2000-10-03 Hewlett-Packard Company Method and system for automatic configuration of network links to attached devices
US6167358A (en) 1997-12-19 2000-12-26 Nowonder, Inc. System and method for remotely monitoring a plurality of computer-based systems
US6266335B1 (en) 1997-12-19 2001-07-24 Cyberiq Systems Cross-platform server clustering using a network flow switch
US6011288A (en) 1997-12-22 2000-01-04 Taiwan Semiconductor Manufacturing Company, Ltd. Flash memory cell with vertical channels, and source/drain bus lines
US6023464A (en) * 1997-12-23 2000-02-08 Mediaone Group, Inc. Auto-provisioning of user equipment
US6192518B1 (en) * 1998-01-22 2001-02-20 Mis Only, Inc. Method for distributing software over network links via electronic mail
JP3488617B2 (en) 1998-02-10 2004-01-19 シャープ株式会社 Remote fault management system using the Internet
JPH11266244A (en) * 1998-03-16 1999-09-28 Fujitsu Ltd Network constitution data generator and generation method
US6393386B1 (en) 1998-03-26 2002-05-21 Visual Networks Technologies, Inc. Dynamic modeling of complex networks and prediction of impacts of faults therein
US6282175B1 (en) * 1998-04-23 2001-08-28 Hewlett-Packard Company Method for tracking configuration changes in networks of computer systems through historical monitoring of configuration status of devices on the network.
US6167567A (en) 1998-05-05 2000-12-26 3Com Corporation Technique for automatically updating software stored on a client computer in a networked client-server environment
US6389126B1 (en) * 1998-05-07 2002-05-14 Mci Communications Corporation Service provisioning system for interactive voice response services
US6052720A (en) * 1998-05-14 2000-04-18 Sun Microsystems, Inc. Generic schema for storing configuration information on a server computer
US6202206B1 (en) 1998-05-14 2001-03-13 International Business Machines Corporation Simultaneous installation and configuration of programs and components into a network of server and client computers
US6098097A (en) 1998-05-14 2000-08-01 International Business Machines Corporation Controlling the installation and configuration of programs and components in a network of server and client computers through entries into a primary server computer
US6460070B1 (en) 1998-06-03 2002-10-01 International Business Machines Corporation Mobile agents for fault diagnosis and correction in a distributed computer environment
US6259448B1 (en) 1998-06-03 2001-07-10 International Business Machines Corporation Resource model configuration and deployment in a distributed computer network
US6249883B1 (en) 1998-06-29 2001-06-19 Netpro Computing, Inc. System and method for monitoring domain controllers
US6195760B1 (en) * 1998-07-20 2001-02-27 Lucent Technologies Inc Method and apparatus for providing failure detection and recovery with predetermined degree of replication for distributed applications in a network
US6418555B2 (en) 1998-07-21 2002-07-09 Intel Corporation Automatic upgrade of software
US6226788B1 (en) 1998-07-22 2001-05-01 Cisco Technology, Inc. Extensible network management system
US6286038B1 (en) 1998-08-03 2001-09-04 Nortel Networks Limited Method and apparatus for remotely configuring a network device
US6493749B2 (en) * 1998-08-17 2002-12-10 International Business Machines Corporation System and method for an administration server
US20020062334A1 (en) 1998-08-19 2002-05-23 Qiming Chen Dynamic agents for dynamic service provision
US6356863B1 (en) * 1998-09-08 2002-03-12 Metaphorics Llc Virtual network file server
US6401119B1 (en) * 1998-09-18 2002-06-04 Ics Intellegent Communication Software Gmbh Method and system for monitoring and managing network condition
US6546553B1 (en) * 1998-10-02 2003-04-08 Microsoft Corporation Service installation on a base function and provision of a pass function with a service-free base function semantic
US6101539A (en) 1998-10-02 2000-08-08 Kennelly; Richard J. Dynamic presentation of management objectives based on administrator privileges
GB2342198B (en) 1998-10-02 2003-10-22 Ibm Composite locking of objects in a database
US6381628B1 (en) 1998-10-02 2002-04-30 Microsoft Corporation Summarized application profiling and quick network profiling
US6205477B1 (en) * 1998-10-20 2001-03-20 Cisco Technology, Inc. Apparatus and method for performing traffic redirection in a distributed system using a portion metric
US6349306B1 (en) * 1998-10-30 2002-02-19 Aprisma Management Technologies, Inc. Method and apparatus for configuration management in communications networks
US6598090B2 (en) 1998-11-03 2003-07-22 International Business Machines Corporation Centralized control of software for administration of a distributed computing environment
US8121891B2 (en) * 1998-11-12 2012-02-21 Accenture Global Services Gmbh Personalized product report
US6728748B1 (en) * 1998-12-01 2004-04-27 Network Appliance, Inc. Method and apparatus for policy based class of service and adaptive service level management within the context of an internet and intranet
JP3184169B2 (en) 1999-01-14 2001-07-09 エヌイーシーソフト株式会社 Network device setting management system, network device setting management method, and recording medium recording network device setting management program
US6411961B1 (en) * 1999-01-15 2002-06-25 Metaedge Corporation Apparatus for providing a reverse star schema data model
US6334141B1 (en) 1999-02-02 2001-12-25 International Business Machines Corporation Distributed server for real-time collaboration
US6662221B1 (en) 1999-04-12 2003-12-09 Lucent Technologies Inc. Integrated network and service management with automated flow through configuration and provisioning of virtual private networks
US6801949B1 (en) 1999-04-12 2004-10-05 Rainfinity, Inc. Distributed server cluster with graphical user interface
US6463528B1 (en) 1999-04-20 2002-10-08 Covad Communications Group, Inc. Method and apparatus for simplifying the configuration of several models of customer premise equipment
US6738908B1 (en) * 1999-05-06 2004-05-18 Watchguard Technologies, Inc. Generalized network security policy templates for implementing similar network security policies across multiple networks
US6577614B1 (en) 1999-05-27 2003-06-10 Qwest Communications International Inc. System and method for OTA over CDMA data channel
US6473794B1 (en) 1999-05-27 2002-10-29 Accenture Llp System for establishing plan to test components of web based framework by displaying pictorial representation and conveying indicia coded components of existing network framework
US6442564B1 (en) * 1999-06-14 2002-08-27 International Business Machines Corporation Facilitating workload management by using a location forwarding capability
US6460082B1 (en) 1999-06-17 2002-10-01 International Business Machines Corporation Management of service-oriented resources across heterogeneous media servers using homogenous service units and service signatures to configure the media servers
US6405219B2 (en) * 1999-06-22 2002-06-11 F5 Networks, Inc. Method and system for automatically updating the version of a set of files stored on content servers
US6546392B1 (en) * 1999-06-25 2003-04-08 Mediaone Group, Inc. Self service gateway
US6604238B1 (en) 1999-07-26 2003-08-05 Hewlett-Packard Development Company, L.P. Method and system for installing software
JP3916806B2 (en) 1999-07-26 2007-05-23 富士通株式会社 Remote loading execution method, remote loading execution system, information processing apparatus, management apparatus, and computer-readable recording medium
US6345239B1 (en) * 1999-08-31 2002-02-05 Accenture Llp Remote demonstration of business capabilities in an e-commerce environment
US6332163B1 (en) * 1999-09-01 2001-12-18 Accenture, Llp Method for providing communication services over a computer network system
US6594723B1 (en) 1999-09-07 2003-07-15 Microsoft Corporation Method and apparatus for updating data in nonvolatile memory
US6396810B1 (en) * 1999-09-08 2002-05-28 Metasolv Software, Inc. System and method for analyzing communication paths in a telecommunications network
US6633907B1 (en) 1999-09-10 2003-10-14 Microsoft Corporation Methods and systems for provisioning online services
US6775830B1 (en) 1999-09-24 2004-08-10 Hitachi, Ltd. Computer system and a program install method thereof
US6732269B1 (en) 1999-10-01 2004-05-04 International Business Machines Corporation Methods, systems and computer program products for enhanced security identity utilizing an SSL proxy
EP1091522A2 (en) 1999-10-06 2001-04-11 Hewlett-Packard Company, A Delaware Corporation Copying configuration settings between electronic devices
US6516337B1 (en) * 1999-10-14 2003-02-04 Arcessa, Inc. Sending to a central indexing site meta data or signatures from objects on a computer network
US6754707B2 (en) 1999-10-28 2004-06-22 Supportsoft, Inc. Secure computer support system
US7237002B1 (en) * 2000-01-04 2007-06-26 International Business Machines Corporation System and method for dynamic browser management of web site
US6535227B1 (en) * 2000-02-08 2003-03-18 Harris Corporation System and method for assessing the security posture of a network and having a graphical user interface
US6735623B1 (en) * 2000-02-09 2004-05-11 Mitch Prust Method and system for accessing a remote storage area
US6983317B1 (en) 2000-02-28 2006-01-03 Microsoft Corporation Enterprise management system
WO2001067309A2 (en) 2000-03-03 2001-09-13 Radiant Logic, Inc. System and method for providing access to databases via directories and other hierarchical structures and interfaces
US6505245B1 (en) * 2000-04-13 2003-01-07 Tecsys Development, Inc. System and method for managing computing devices within a data communications network from a remotely located console
EP1292892A4 (en) 2000-04-14 2006-11-15 Goahead Software Inc A system and method for upgrading networked devices
US6964034B1 (en) * 2000-04-20 2005-11-08 International Business Machines Corporation Application development server and a mechanism for providing different views into the same constructs within a strongly encapsulated environment
US7062541B1 (en) * 2000-04-27 2006-06-13 International Business Machines Corporation System and method for transferring related data objects in a distributed data storage environment
US6880086B2 (en) 2000-05-20 2005-04-12 Ciena Corporation Signatures for facilitating hot upgrades of modular software components
AU2001264944A1 (en) * 2000-05-25 2001-12-03 Transacttools, Inc. A method, system and apparatus for establishing, monitoring, and managing connectivity for communication among heterogeneous systems
US7231436B1 (en) 2000-05-25 2007-06-12 Microsoft Corporation Object-based machine automation method and system
US6718379B1 (en) * 2000-06-09 2004-04-06 Advanced Micro Devices, Inc. System and method for network management of local area networks having non-blocking network switches configured for switching data packets between subnetworks based on management policies
US7113988B2 (en) * 2000-06-29 2006-09-26 International Business Machines Corporation Proactive on-line diagnostics in a manageable network
EP1297446B1 (en) 2000-07-05 2005-09-21 Ernst &amp; Young LLP Method and apparatus for providing computer services
GB0017336D0 (en) 2000-07-15 2000-08-30 Ibm Preferable modes of software package deployment
AU2001280685B2 (en) 2000-07-24 2007-08-02 Trendium, Inc. Network models, methods, and computer program products for managing a service independent of the underlying network technology
US6725453B1 (en) * 2000-08-23 2004-04-20 Microsoft Corporation Remote software installation and maintenance
US7003481B2 (en) * 2000-08-25 2006-02-21 Flatrock Ii, Inc. Method and apparatus for providing network dependent application services
US6686838B1 (en) * 2000-09-06 2004-02-03 Xanboo Inc. Systems and methods for the automatic registration of devices
US20020143904A1 (en) 2000-09-22 2002-10-03 Bair M. Zach Rapid network deployment
WO2002025438A1 (en) * 2000-09-22 2002-03-28 Patchlink.Com Corporation Non-invasive automatic offsite patch fingerprinting and updating system and method
US7054924B1 (en) * 2000-09-29 2006-05-30 Cisco Technology, Inc. Method and apparatus for provisioning network devices using instructions in extensible markup language
US20020154751A1 (en) 2000-10-18 2002-10-24 Thompson Richard H. Method for managing wireless communication device use including optimizing rate and service plan selection
WO2002034463A1 (en) * 2000-10-26 2002-05-02 Citizen Watch Co., Ltd. Method and device for automatically preparing processing program
US20020083146A1 (en) 2000-10-31 2002-06-27 Glenn Ferguson Data model for automated server configuration
WO2002037262A2 (en) 2000-10-31 2002-05-10 Loudcloud, Inc. Methods and systems for installing software onto computers
US8250570B2 (en) 2000-10-31 2012-08-21 Hewlett-Packard Development Company, L.P. Automated provisioning framework for internet site servers
AU2002214673A1 (en) 2000-10-31 2002-05-15 Loudcloud, Inc. Code deployment systems and methods
US6763361B1 (en) 2000-10-31 2004-07-13 Opsware, Inc. Object-oriented database abstraction and statement generation
WO2002037282A2 (en) 2000-10-31 2002-05-10 Loudcloud, Inc. A method for provisioning complex data storage devices
AU2002214679A1 (en) 2000-10-31 2002-05-15 Loudcloud, Inc. A data model for use in the automatic provisioning of central data storage devices
US6751702B1 (en) 2000-10-31 2004-06-15 Loudcloud, Inc. Method for automated provisioning of central data storage devices using a data model
AU2002214683A1 (en) 2000-10-31 2002-05-21 Loudcloud, Inc. A data model for automated server configuration
AU2002215391A1 (en) 2000-10-31 2002-05-21 Loudcloud, Inc. Automated provisioning framework for internet site servers
US6658426B1 (en) 2000-10-31 2003-12-02 Opsware Object-oriented database abstraction and statement generation
US7124289B1 (en) 2000-10-31 2006-10-17 Opsware Inc. Automated provisioning framework for internet site servers
US6978301B2 (en) * 2000-12-06 2005-12-20 Intelliden System and method for configuring a network device
US7013461B2 (en) * 2001-01-05 2006-03-14 International Business Machines Corporation Systems and methods for service and role-based software distribution
US7281047B2 (en) 2001-01-16 2007-10-09 Cognos Incorporated System and method for automatic provision of an application
US6792462B2 (en) 2001-01-16 2004-09-14 Netiq Corporation Methods, systems and computer program products for rule based delegation of administration powers
US20020095487A1 (en) 2001-01-18 2002-07-18 Robert Day System for registering, locating, and identifying network equipment
US6813766B2 (en) 2001-02-05 2004-11-02 Interland, Inc. Method and apparatus for scheduling processes based upon virtual server identifiers
US7120678B2 (en) * 2001-02-27 2006-10-10 Hewlett-Packard Development Company, L.P. Method and apparatus for configurable data collection on a computer network
US6862573B2 (en) * 2001-03-22 2005-03-01 Clear Technology, Inc. Automated transaction management system and method
US8019835B2 (en) 2001-04-20 2011-09-13 Hewlett-Packard Development Company, L.P. Automated provisioning of computing networks using a network database data model
US7152109B2 (en) 2001-04-20 2006-12-19 Opsware, Inc Automated provisioning of computing networks according to customer accounts using a network database data model
US7743147B2 (en) 2001-04-20 2010-06-22 Hewlett-Packard Development Company, L.P. Automated provisioning of computing networks using a network database data model
US6816897B2 (en) 2001-04-30 2004-11-09 Opsware, Inc. Console mapping tool for automated deployment and management of network devices
US20020158898A1 (en) 2001-04-30 2002-10-31 Hsieh Vivian G. Graphical user interfaces for viewing and configuring devices in an automated provisioning environment
US7131123B2 (en) 2001-04-30 2006-10-31 Opsware Inc. Automated provisioning of computing networks using a network database model
US7013462B2 (en) * 2001-05-10 2006-03-14 Hewlett-Packard Development Company, L.P. Method to map an inventory management system to a configuration management system
US6941367B2 (en) 2001-05-10 2005-09-06 Hewlett-Packard Development Company, L.P. System for monitoring relevant events by comparing message relation key
US20040015950A1 (en) * 2001-05-10 2004-01-22 International Business Machines Corporation Application service provider upgrades
US20050120101A1 (en) * 2001-06-11 2005-06-02 David Nocera Apparatus, method and article of manufacture for managing changes on a compute infrastructure
US20030037327A1 (en) * 2001-08-15 2003-02-20 International Business Machines Corporation Run-time rule-based topological installation suite
US7069395B2 (en) * 2001-10-05 2006-06-27 International Business Machines Corporation Storage area network methods and apparatus for dynamically enabled storage device masking
US7496645B2 (en) * 2001-10-18 2009-02-24 Hewlett-Packard Development Company, L.P. Deployment of business logic software and data content onto network servers
US7039705B2 (en) * 2001-10-26 2006-05-02 Hewlett-Packard Development Company, L.P. Representing capacities and demands in a layered computing environment using normalized values
US20030084104A1 (en) * 2001-10-31 2003-05-01 Krimo Salem System and method for remote storage and retrieval of data
US7043632B2 (en) * 2001-12-12 2006-05-09 Nortel Networks Limited End-to-end security in data networks
US6766364B2 (en) * 2002-01-15 2004-07-20 Telcordia Technologies, Inc. Template based configuration and validation of a network for enabling a requested service to be compatible with the previously enabled services
US20030149756A1 (en) 2002-02-06 2003-08-07 David Grieve Configuration management method and system
US6829617B2 (en) 2002-02-15 2004-12-07 International Business Machines Corporation Providing a snapshot of a subset of a file system
US7359387B2 (en) * 2002-03-01 2008-04-15 Verizon Business Global Llc Systems and methods for implementing virtual router
US7171659B2 (en) * 2002-03-19 2007-01-30 Sun Microsystems, Inc. System and method for configurable software provisioning
US20030200149A1 (en) * 2002-04-17 2003-10-23 Dell Products L.P. System and method for facilitating network installation
US7076567B1 (en) * 2002-04-25 2006-07-11 Oracle International Corporation Simplified application object data synchronization for optimized data storage
US20030229686A1 (en) * 2002-06-07 2003-12-11 Kris Kortright System and method for synchronizing the configuration of distributed network management applications
US7249174B2 (en) * 2002-06-12 2007-07-24 Bladelogic, Inc. Method and system for executing and undoing distributed server change operations
US7174747B2 (en) 2002-06-20 2007-02-13 Certainteed Corporation Use of corrugated hose for admix recycling in fibrous glass insulation
US8859184B2 (en) 2005-07-28 2014-10-14 Ricoh Company, Ltd. Write-once-read-many optical disk having low-to-high recording property accommodating short wavelength recording
US8839221B2 (en) * 2007-09-10 2014-09-16 Moka5, Inc. Automatic acquisition and installation of software upgrades for collections of virtual machines

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO1999031584A1 (en) * 1997-12-17 1999-06-24 Fujitsu Siemens Computers Gmbh Method for converting a system call

Non-Patent Citations (4)

* Cited by examiner, † Cited by third party
Title
ANONYMOUS: "LSF JobScheduler User's Guide" PLATFORM COMPUTING CORPORATION, August 1998 (1998-08), pages I-138, XP002328737 Retrieved from the Internet: URL:http://www.urz.uni-heidelberg.de/lsf3.2/pdf/jsusers.pdf> *
ANONYMOUS: "OpenBSD SSH(1) Manual Page" OPENBSD.ORG, 1999, pages 1-9, XP002328739 Retrieved from the Internet: URL:http://www.openbsd.org/cgi-bin/man.cgi?query=ssh> -& ANONYMOUS: "OpenBSD SSHD (8) Manual" OPENBSD.ORG, 1999, pages 1-7, XP002328740 Retrieved from the Internet: URL:http://www.openbsd.org/cgi-bin/man.cgi?query=sshd> -& ANONYMOUS: "OpenBSD SSH_CONFIG(5) Manual" OPENBSD.ORG, 1999, pages 1-7, XP002328741 Retrieved from the Internet: URL:http://www.openbsd.org/cgi-bin/man.cgi?query=ssh_config> -& ANONYMOUS: "OpenBSD SSHD_CONFIG(5) Manual" OPENBSD.ORG, 1999, pages 1-7, XP002328742 Retrieved from the Internet: URL:http://www.openbsd.org/cgi-bin/man.cgi?query=sshd_config> -& DERAADT: "OpenBSD ssh.c cvs revision 1.1" OPENBSD.ORG, 1999, pages 1-10, XP002328743 Retrieved from the Internet: URL:http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/ssh.c?rev=1.1&content-type=text/x-cvsweb-markup> -& DERAADT: "OpenBSD sshd.c cvs revision 1.1" 1999, pages 1-29, XP002328744 Retriev *
PAWLOWSKI B ET AL: "The NFS Version 4 Protocol" PROCEEDINGS OF THE INTERNATIONAL SYSTEM ADMINISTRATION AND NETWORKING CONFERENCE, 22 May 2000 (2000-05-22), pages 1-20, XP002262978 *
RIGHTNOUR T: "Clusterit version 2.0 (Archive)" TAR, 2001, pages 1-30, XP002328731 Retrieved from the Internet: URL:http://www.garbled.net/download/clusterit-2.0.tar.gz> *

Cited By (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1615130A2 (en) * 2004-07-07 2006-01-11 Sap Ag Dynamic Log for a computer system consisting of servers providing services
EP1615130A3 (en) * 2004-07-07 2007-10-03 Sap Ag Dynamic Log for a computer system consisting of servers providing services
US20060184653A1 (en) * 2005-02-16 2006-08-17 Red Hat, Inc. System and method for creating and managing virtual services
US8583770B2 (en) * 2005-02-16 2013-11-12 Red Hat, Inc. System and method for creating and managing virtual services
US7698284B2 (en) 2005-12-30 2010-04-13 Sap Ag Systems and methods for deploying a tenant in a provider-tenant environment
US7693851B2 (en) 2005-12-30 2010-04-06 Sap Ag Systems and methods for implementing a shared space in a provider-tenant environment
US7689593B2 (en) 2005-12-30 2010-03-30 Sap Ag Systems and methods for accessing a shared space in a provider-tenant environment
US7917607B2 (en) 2005-12-30 2011-03-29 Sap Ag Software management systems and methods, including use of such systems and methods in a provider-tenant environment
US7680825B2 (en) 2005-12-30 2010-03-16 Sap Ag Systems and methods for generating tenant-specific properties for use in a provider-tenant environment
US7739348B2 (en) 2006-12-29 2010-06-15 Sap Ag Systems and methods for accessing a shared space in a provider-tenant environment by using middleware
US8042150B2 (en) 2008-12-08 2011-10-18 Motorola Mobility, Inc. Automatic generation of policies and roles for role based access control
US8224828B2 (en) 2009-12-22 2012-07-17 Sap Ag Multi-client generic persistence for extension fields
WO2015105799A1 (en) * 2014-01-09 2015-07-16 Citrix Systems, Inc. System and method for cloud-based probing and diagnostics
US9614745B2 (en) 2014-01-09 2017-04-04 Citrix Systems, Inc. Systems and methods for cloud-based probing and diagnostics

Also Published As

Publication number Publication date
EP3139541B1 (en) 2021-08-25
WO2003107178A3 (en) 2005-12-15
EP1573520B1 (en) 2013-09-18
US8869132B2 (en) 2014-10-21
US20130232248A1 (en) 2013-09-05
EP3139541A1 (en) 2017-03-08
US9100283B2 (en) 2015-08-04
US20080104217A1 (en) 2008-05-01
US9794110B2 (en) 2017-10-17
US20030233431A1 (en) 2003-12-18
US10659286B2 (en) 2020-05-19
EP1786142A1 (en) 2007-05-16
EP1573520A2 (en) 2005-09-14
AU2003243426A1 (en) 2003-12-31
US20150326423A1 (en) 2015-11-12
US7249174B2 (en) 2007-07-24
ES2548302T3 (en) 2015-10-15
US8447963B2 (en) 2013-05-21
EP1772803A2 (en) 2007-04-11
US8296755B2 (en) 2012-10-23
US20180069747A1 (en) 2018-03-08
US8549114B2 (en) 2013-10-01
EP1786142B1 (en) 2015-08-12
US20030233571A1 (en) 2003-12-18
US20030233385A1 (en) 2003-12-18
US20130103808A1 (en) 2013-04-25
EP1772803A3 (en) 2007-04-18

Similar Documents

Publication Publication Date Title
US10659286B2 (en) Method and system for simplifying distributed server management
US20240089264A1 (en) Managing security groups for data instances
US7716719B2 (en) System and method for providing application services with controlled access into privileged processes
JP5833725B2 (en) Control services for relational data management
US7178144B2 (en) Software distribution via stages
RU2648956C2 (en) Providing devices as service
US7415509B1 (en) Operations architectures for netcentric computing systems
US7401133B2 (en) Software administration in an application service provider scenario via configuration directives
US20020091819A1 (en) System and method for configuring computer applications and devices using inheritance
US20040098446A1 (en) Portable computer detection for applying configuration settings in a networked environment
CN110210191A (en) A kind of data processing method and relevant apparatus
US6957426B2 (en) Independent tool integration
Buchanan et al. Azure Arc Servers: Using at Scale
Stanek IIS 8 Administration: The Personal Trainer for IIS 8.0 and IIS 8.5
Fan et al. 3D Repo in a Secure Cloud Environment; a Case Study

Legal Events

Date Code Title Description
AK Designated states

Kind code of ref document: A2

Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BY BZ CA CH CN CO CR CU CZ DE DK DM DZ EC EE ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NI NO NZ OM PH PL PT RO RU SC SD SE SG SK SL TJ TM TN TR TT TZ UA UG UZ VC VN YU ZA ZM ZW

AL Designated countries for regional patents

Kind code of ref document: A2

Designated state(s): GH GM KE LS MW MZ SD SL SZ TZ UG ZM ZW AM AZ BY KG KZ MD RU TJ TM AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IT LU MC NL PT RO SE SI SK TR BF BJ CF CG CI CM GA GN GQ GW ML MR NE SN TD TG

121 Ep: the epo has been informed by wipo that ep was designated in this application
DFPE Request for preliminary examination filed prior to expiration of 19th month from priority date (pct application filed before 20040101)
WWE Wipo information: entry into national phase

Ref document number: 2003760238

Country of ref document: EP

WWP Wipo information: published in national office

Ref document number: 2003760238

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: JP

WWW Wipo information: withdrawn in national office

Country of ref document: JP