addmi 11-intro to-patterns

© 2009 BMC Educational Services

Introduction to Patterns

How the Intelligence Works


Outline

Pattern Basics What is a pattern? Where do I get new patterns? Pattern Controls

Demystifying Patterns Pattern components Patterns and the Model Patterns and Provenance

Simple Pattern Configuration


Pattern Basics


What Is a Pattern?

A way to customise Atrium Discovery so it can infer things in the datastore based upon data collected

Patterns are event driven Written in The Pattern Language (TPL) Common software types can recognised by built-in TKU (updated

monthly) Some organisations need their own custom written patterns

Extend discovery information collected Uncommon or custom software components Business Applications which are specific to the organization


What Can Patterns Do?

Triggered during the discovery process A certain OS version is found A certain process is running

Can take the initial information collected and use it to collect new data Pattern matching details within the process arguments

May go back to the host and run other commands Collect configuration files Collect inventory information from databases Use very specific commands to discover version

Pattern management under the discovery tab Discovery -> Pattern Management


Where Do I Get New Patterns?

The Knowledge Update (TKU) service Regular releases of a TKU

A TKU can contain New Patterns Updates to existing Patterns Updates to End of Life Data Updates to Hardware Reference Data

Updated every month, with new/updated patterns TKU-CORE-2009-06-1.zip

Core patterns for detecting Software Instances TKU-DBDETAILS-2009-06-1.zip

Deep database discovery TKU-SUPPORTDETAILS-2009-06-1.zip

Last dates for software support


Upload and Activate Patterns

Upload a single pattern TPL files (.tpl) Forms a single Pattern Package

Upload batches of patterns In zip files The zip file is the Pattern Package


Controlling Patterns

Patterns are grouped into packages, which are grouped into modules

Activate or deactivate patterns to change the behavior of discovery


Deactivate and Delete

If a package or pattern is deactivated, it does not execute during Discovery Can reactivate to include in the next discovery run

Deleting a pattern or package of patterns: all data which was inferred based upon patterns in that package is also

deleted


Demystifying Patterns


Example Pattern

Each pattern must have a trigger If matched successfully this become the Primary Inference for

the SI or BAI Triggers are matched at the point of discovery

Triggered on DDD node

Finds a host node in the datastore

Infers a Software Instance node


Triggers

Every pattern has a trigger Contained within the “triggers” declaration

When a pattern “fires” the trigger declaration has been met Example: the host has a certain process running Example: An SI has been created or modified


Trigger Example


Data Model

Discovery

Result

Discovery

Run

Discovery

Access

Discovery

Result

Discovery

ResultDiscovery

Result

Discovery

Access

Discovery

Result

Discovery

ResultDiscovery

Result

Discovery

Run

Discovery

Access

Discovery

Result

Discovery

ResultDiscovery

Result

Discovery

Access

Discovery

Result

Discovery

ResultDiscovery

Result

Discovery

Run

Discovery

Access

Discovery

Result

Discovery

ResultDiscovery

Result

Discovery

Access

Discovery

Result

Discovery

Result

Host Host Host

Software

Instance

Software

Instance

Software

Instance

Software

Instance

Software

Instance

Business

Application

Business

ApplicationPattern


Data Model – Provenance

Provenance is the source of all inferred information and is automatically tracked Stored with Inference relationships Referred to by the role of the evidence node

The three core roles: Primary Contributor Associate

Superseded relationships – marked destroyed


Data Model – Maintainer and Request

Maintainer and Request inference relationships are a specific type of provenance

Every node created or update by a pattern is linked back to the pattern that is responsible for it’s maintenance:

Every pattern based discovery request, successful or not, is linked back to the pattern that requested it

Business

ApplicationPattern

Maintainer

Discovery

ResultPattern

Request


Data Model – Current Live Provenance

Discovery

Result

Discovery

Run

Discovery

Access

Discovery

Result

Discovery

ResultDiscovery

Result

Discovery

Access

Discovery

Result

Discovery

ResultDiscovery

Result

Discovery

Run

Discovery

Access

Discovery

Result

Discovery

ResultDiscovery

Result

Discovery

Access

Discovery

Result

Discovery

ResultDiscovery

Result

Discovery

Run

Discovery

Access

Discovery

Result

Discovery

ResultDiscovery

Result

Discovery

Access

Discovery

Result

Discovery

Result

Host Host Host

Software

Instance

Software

Instance

Software

Instance

Software

Instance

Software

Instance

Business

Application

Business

ApplicationPattern


Data Model – Old Superseded Provenance

Discovery

Result

Discovery

Run

Discovery

Access

Discovery

Result

Discovery

ResultDiscovery

Result

Discovery

Access

Discovery

Result

Discovery

ResultDiscovery

Result

Discovery

Run

Discovery

Access

Discovery

Result

Discovery

ResultDiscovery

Result

Discovery

Access

Discovery

Result

Discovery

ResultDiscovery

Result

Discovery

Run

Discovery

Access

Discovery

Result

Discovery

ResultDiscovery

Result

Discovery

Access

Discovery

Result

Discovery

Result

Host Host Host

Software

Instance

Software

Instance

Software

Instance

Software

Instance

Software

Instance

Business

Application

Business

ApplicationPattern


Data Model – Maintainer

Discovery

Result

Discovery

Run

Discovery

Access

Discovery

Result

Discovery

ResultDiscovery

Result

Discovery

Access

Discovery

Result

Discovery

ResultDiscovery

Result

Discovery

Run

Discovery

Access

Discovery

Result

Discovery

ResultDiscovery

Result

Discovery

Access

Discovery

Result

Discovery

ResultDiscovery

Result

Discovery

Run

Discovery

Access

Discovery

Result

Discovery

ResultDiscovery

Result

Discovery

Access

Discovery

Result

Discovery

Result

Host Host Host

Software

Instance

Software

Instance

Software

Instance

Software

Instance

Software

Instance

Business

Application

Business

ApplicationPattern


SI Provenance Example


Host Provenance Example

Use the “Show Provenance” button to show

Provenance is defined as: The records or documents authenticating such an object or the history

of its ownership.


SI Version Provenance

How we know the full version of java? Click through the provenance link to the DiscoveredCommandResult

node


SI Version Provenance Results

Answer: The java version was determined as the result of running the java

command with the “-fullversion” flag


Maintaining Pattern


Pattern Configuration


Why Have Configurations?

Allows changes to behaviour using the UI Without pattern editing, or reactivation

Typical uses Turn pattern options on/off Update paths to find files or commands Any other parameters


Where Does it Appear? (1)

If configuration blocks are defined in the pattern


Where Does It Appear? (2)

On the “All pattern module configurations” page Discovery > Pattern Management > View Configuration of all Patterns


How Changes Are Applied

User must have correct permission to edit: reasoning/pattern/config Otherwise can view readonly

Changes take place immediately Be careful if discovery is running Warning shown if this is the case


Online Documentation: http://www.tideway.com/confluence/display/81/Pattern+Management http://www.tideway.com/confluence/display/Configipedia/Schedule+and+Roadmap

Further Resources

addmi 11-intro to-patterns

Technology

discovery request

discovery information

point of discovery

atrium discovery

behavior of discovery

deep database discovery

patterns patterns

pattern basics