Abstract: A computer system for behavioral analytics of native Information Technology Service Management (ITSM) incident handling data includes a processor, a memory, a de-normalized target data source for behavioral analysis, a transformation processor, and a statistical processor. The transformation processor reads an identified portion of the ITSM data and creates new normalized fields for the de-normalized target data source by parsing selected text fields from the portion of ITSM data. The created new normalized fields include a working group field and an associated support level field. The transformation processor further creates new de-normalized aggregation fields for the incipient de-normalized target data source based on the newly created normalized fields. The newly created de-normalized aggregation fields include fields characterizing incident handling behavior. A statistical processor further processes target data for behavioral analytics.

Abstract: An event graph schema for a technology landscape may be determined, where the technology landscape is characterized using scores assigned to performance metrics. The event graph schema may include a plurality of nodes corresponding to the performance metrics and the scores, and directional edges connecting node pairs of the plurality of nodes, with each directional edge having a score-dependent validity criteria defined by scores of a corresponding node pair. Anomalous scores associated with an event within the technology landscape may be used to find anomalous nodes. Valid edges connecting two of the anomalous nodes and satisfying the score-dependent validity criteria thereof may be used to determine at least one path that includes the valid edges and connected anomalous nodes. In this way, it is possible to traverse the at least one path to identify at least one of the connected anomalous nodes as a root cause node of the event.

Abstract: A method for securing a networked computer system executing an application includes identifying a vulnerable computer resource in the networked computer system, determining all computer resources in the networked computer system that are accessible from, or are accessed by, the vulnerable computer resource, and prioritizing implementation of a remediation action to secure the vulnerable computer resource if a vulnerability path extends from the vulnerable computer resource to a critical computer resource that contains sensitive information. The remediation action to secure the vulnerable computer resource is a safe remediation action that does not impact availability of the application executing on the networked computer system.

Abstract: Performance data characterizing operations of an application may be collected by time interval, and a plurality of keys may be associated with each element of the performance data. A first time interval may be received. An iterative group-and-filter search may be executed against the keyed elements within the first time interval, each iteration including an iteration key used to perform a key-based grouping operation followed by a group-based filter operation, wherein each iteration key is added to a composite key at each iteration. A selection of at least one keyed element within the first time interval and obtained from the iterative group-and-filter search may be received. A second time interval that precedes the first time interval may be received, and the keyed elements may be filtered using the composite key and within the second time interval to return the at least one keyed element within the second time interval.

Abstract: A cloud-native proxy gateway is reachable from a central server and from an isolated cloud VM. A method allows legacy (non-cloud native) solutions to establish a secure connection to the isolated cloud VM, even when incoming port flows are not enabled. The method involves transforming a TCP/IP network connection request into a cloud API call, ignoring IP addresses, and instead using a unique cloud resource identifier as the primary network routing methodology. In response to a communication connection request by the central server, the isolated VM establishes a reverse tunnel to the cloud-native proxy gateway. Communication flow initiated by the central server proceeds through the reverse tunnel to the isolated VM, avoiding an issue of duplicate IP addresses in the cloud.

Abstract: Described systems and techniques enable the intake of large numbers of files having widely varying structures and formats, as well as generation of dynamic slot indexes that enable fast and reliable searching of the files. Unique data patterns within the files are used to generate unique pattern models, which enable model-specific mappings of file fields to slots of a dynamic slot index. Accordingly, the dynamic slot indexes may reuse a single slot for multiple fields. Complex queries may then be processed in a time-efficient and resource-efficient manner, even when rapidly ingesting huge numbers of files having indeterminate data patterns from many different sources.

Abstract: A data management system includes a data reconciliation engine that identifies data sources that contain data records referencing a resource and determines whether each of the identified data sources is a creative data source or an additive data source. When all of the identified data sources are additive data sources, the reconciliation engine terminates a data reconciliation process. When all of the identified data sources are not additive data sources, the reconciliation engine finds a first creative data source from among the identified data sources, and initiates the data reconciliation process by merging data from the identified data sources including the first creative data source, one data source-by-one data source, into a reconciled data record.

Abstract: Described techniques enable inter-environment communication, including isolating two runtime environments from one another as needed to ensure that operations of one runtime environment do not negatively affect operations of the other runtime environment during the inter-environment communication. Such isolation may be maintained when the two runtime environments use different addressing schemes, and when the two runtime environments use different call linkage techniques for identifying, locating, and passing stored parameters or other data.

Abstract: For a first record of a batch of records, a first timestamp may be determined to be stored with the first record in a database into which the batch of records are to be loaded as part of a database loading process. For each remaining record of the batch of records, a future timestamp may be generated using the first timestamp, until a final timestamp of a final record of the batch of records is generated. For a load completion time at which the database loading process completes, prior to the final timestamp, a wait time until a batch completion time may be determined by comparing the load completion time and the final timestamp, and waiting for the wait time to reach the batch completion time. If the load completion time is at or after the final timestamp, the batch completion time may be reached at the load completion time.

Abstract: When a restart event is detected within a technology landscape, restart-impacted performance metrics and non-restart-impacted performance metrics may be identified. The non-restart-impacted performance metrics may continue to be included within a performance characterization of the technology landscape. The restart-impacted performance metrics may be monitored, while being excluded from the performance characterization. The restart-impacted performance metric of the restart-impacted performance metrics may be transitioned to a non-restart-impacted performance metric, based on a monitored value of the restart-impacted performance metric following the restart event.

Abstract: A method for troubleshooting abnormal behavior of an application hosted on a networked computer system. The method may be implemented by a root cause analyzer. The method includes tracking a single application performance metric across all the clients of an application hosted on a networked computer system and analyzing an aggregated application based on the single application metric. The method involves determining outlier client attributes associated with an abnormal transaction of the application and ranking the outlier client attributes based on comparisons of historical and current abnormal transactions. The method associates one or more of the ranked outlier client attributes with the root cause of the current abnormal transaction. Association rule learning is used to associate one or more of the ranked outlier client attributes with the root cause.

Abstract: Described is a method for work assignment queue elimination. The method includes maintaining at least one data structure including an ordered list of ticket assignment rules and assignment result metrics, receiving a ticket indicating a system problem, assigning the ticket based on the ordered list of ticket assignment rules, the system problem and the assignment result metrics, collecting metrics based on the ticket assignment, and revising the assignment result metrics based on the collected metrics.

Abstract: A first datastore discovers a configuration item (CI), without a persistent unique identifier in a distributed datastores environment. When the first datastore has authoritative naming rights, it determines an authoritative identification for the CI. When the first datastore has advisory naming rights, it suggests a name for the CI to a second datastore having authoritative naming rights. The second datastore determines that a pre-existing identification for the CI in the second datastore is the authoritative identification for the CI. If there is no pre-existing identification for the CI in the second data store, the second data store accepts the suggested name as the authoritative identification for the CI. When the first datastore has no naming rights for the CI, it sends the CI to a third data store having authoritative naming rights for the CI to get an authoritative identification for the CI.

Abstract: A computer-implemented method is presented for reporting application programs linked to by an application running under an online transaction processor of a mainframe computing environment. An intercept program is implanted in an address space of the online transaction processor. A task executing outside of the address space of the online transaction processor identifies an address for a target domain gate program supported in a domain by the online transaction processor; identifies an address for an unused domain gate program supported in the domain by the online transaction processor; replaces the address for the unused domain gate program with the address for the target domain gate program; and replaces the address for the target domain gate program with an address for the intercept program.

Abstract: Disclosed is a method, a system and a computer readable medium for additive independent object modification. The method includes determining an association between an independent object modification and a base object of a software application, modifying at least one element of the base object based on the associated independent object modification, and configuring the software application to execute in a computer system using the modified base object.

Abstract: An automated system is presented for unit testing an application in a mainframe execution environment. A plurality of stub objects reside in the mainframe execution environment, such that each stub object in the plurality of stub objects represents a different stub type. A command translator table is configured with an entry for each command available for an online transaction processor. Each entry in the command translator table specifies a stub type for the command and includes a listing of possible arguments associated with the given command, such that each possible argument in the listing of possible arguments has a specified category type. A test configurator executes in the mainframe execution environment and is configured to receive and parse a test input file. A setup routine interacts with the test configurator to receive records from the test input file.

Abstract: A non-transitory computer-readable storage medium may comprise instructions for determining health statuses of multiple virtual machine templates stored thereon. When executed by at least one processor, the instructions may be configured to cause a health status server to at least run multiple scripts against multiple virtual machines, each of the multiple virtual machines being generated from one of the multiple virtual machine templates, and generate, for each of the multiple virtual machines, an output report indicating success or failure for each of the multiple scripts.

Abstract: A modeling system has a database that: stores information of resources of a computer network service. A server f has a graphical user interface application for creating and editing service models. The application receives user-entered search criteria and searches information in the database based on the criteria. The search criteria can include a name, type, attribute, and other information of the resources. In addition, the search criteria can be a user-entered search query entered that has one or more logical or Boolean conditions relating resource attributes to attribute values. Using information obtained through searching, the application is used to create at least a portion of a service model of the computer network service. Once created, the application is used to initiate publishing of at least a portion of the service model to one or more impact managers of the computer network service.

Abstract: A content engine may utilize a configuration management database (CMDB) to manage a configuration of a technology landscape. A curation manager 102 may utilize a plurality of article sources to provide, in collaboration with the content engine, a plurality of enriched articles that are specific to the technology landscape. The enriched articles enable an IT administrator using the content engine to execute IT administration duties in a fast, efficient, reliable, and timely manner.

Abstract: Methods and systems enable a database reorganization to occur without a database outage. In one aspect, the method includes creating a shadow copy of a database, the shadow having at least one partition associated with a plurality of first data sets and the database having at least a first partition associated with a plurality of second data sets and a second partition associated with a plurality of third data sets. The method also includes reorganizing the at least one partition of the shadow, taking the first partition offline, replacing the plurality of second data sets with the plurality of first data sets in a schema, and restarting the first partition.