Data Model

The data model in BMC Atrium Discovery is unique in the way it allows the data produced to be represented in a consistent and understandable manner.

The data model stores different types of related data in separate areas of the model. This allows a high degree of clarity in what a particular piece of information represents and where it came from.

The main types of data represented in the model are:

• Directly Discovered Data
• Knowledge Information
• Inferred Information
• Provenance Information
  For more information about the BMC Atrium Discovery data model see the BMC Atrium Discovery Node Lifecycle Document

Directly Discovered Data

Directly Discovered Data is data that the Discovery Engine has discovered; it has not undergone any processing beyond simple parsing. Everything that the Discovery Engine finds that may be of interest is stored, regardless of whether it is understood or not. It is stored in a structured form that can be queried and reported on, making it easy to construct certain kinds of discovery reports, and aids in developing new patterns.

Network connections and listening ports are stored as nodes and related through DiscoveredList nodes to the respective DiscoveryAccess node. Patterns take the raw discovery data and use it to relate nodes together and add it to the model of the environment.

Directly discovered information is the information that is obtained directly from a target host via particular discovery techniques. Examples of directly discovered information includes items such as the kind of processor in a host, the amount of RAM it has, its running processes, its network connections and so on.

Discovery information is aged and removed over time. BMC Atrium Discovery supports a simple aging strategy that removes all information on discovery accesses that are older than a certain age, and the associated directly discovered data nodes.

Knowledge Information

Knowledge Data is supplied through Technology Knowledge Updates and includes static information about products, publishers and so on.
Knowledge information is information about hardware, applications and software products and their versions, and is included in the patterns supplied with BMC Atrium Discovery and Technology Knowledge Updates.

Inferred Information

Inferred information is information that is reasoned from directly discovered data, and it is this information which will be of primary interest to most users. These include items such as Hosts, Subnets, SIs (Software Instances), and BAIs (Business Application Instances).

The inference of any type of node can be controlled by the user by writing patterns which are run by the reasoning engine. It includes classifications of discovered processes, groupings of discovered information into running instances of products, and so on.

A Host node is not considered directly discovered information, since a level of inference is required to decide which Host a discovered endpoint corresponds to, and whether it corresponds to a host at all.

Provenance Information

By linking data items and their attributes to the evidence for them, BMC Atrium Discovery enables its data to be easily verified; a prerequisite for trusting it. This feature is called "Provenance".
Provenance Data is created by the Reasoning Engine and consists of relationships between Directly Discovered Data items and entities inferred from them – a relationship back to the source from the inferred entity. For example, there is a provenance relationship between each Software Instance (SI) and the data that caused the SI to be inferred – typically one or more processes, files, or the like.
Provenance information is meta-information describing how the other information came to exist. It is generated as Reasoning builds and maintains the model. Provenance information is stored as relationships in the model.

• Inference types
  • Primary – indicates that the existence of the evidence node is the reason that the inferred node was created.
  • Contributor – indicates that the evidence node provided information used in building the inferred node.
  • Associate – indicates that we know there is a relationship between the evidence node and the inferred node.
  • Relationship – indicates that we know a relationship exists because of the evidence node.
  • Deletion – indicates that the removal of the inferred node was due to withdrawal of the evidence node.
• Maintaining pattern – the pattern maintaining a Software Instance.

For example, the following illustration shows software instance provenance information for an Apache Tomcat Application server software instance.

Relationship Data Provenance

When a relationship is established, an inference to that relationship can be created to indicate the reason this relationship was originally made. This relationship data provenance can be viewed when you click the Show Provenance button. Clicking the Show Provenance button enables the provenance view on every page where it is available.

For example, the following illustration shows the relationship between a Subnet and Network Interface derived from the data model.