System for decomposing events from managed infrastructures

• US 10,346,229 B2
• Filed: 04/21/2017
• Issued: 07/09/2019
• Est. Priority Date: 04/29/2013
• Status: Active Grant

• Current Assignee: Dell Products LP (Dell Technologies Inc.)
• Original Assignee: Moogsoft Inc. (Dell Technologies Inc.)
• Inventors: Tee, Philip, Harper, Robert Duncan, Silvey, Charles Mike
• Primary Examiner(s): Ehne, Charles
• Application Number:
  US15/493,439
• Publication Number:
  US 20170315856A1
• Time in Patent Office: 809 Days
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/076 by exceeding a count or rate limit, e.g. word- or bit count limit
• CPC Class Codes: G06F 11/0772 Means for error signaling, e.g. using interrupts, exception flags, dedicated error registers
• CPC Class Codes: G06F 11/0778 Dumping, i.e. gathering error/state information after a fault for later diagnosis
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: G06F 11/30 Monitoring
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/327 Alarm or error message display
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/9024 Graphs; Linked lists G06F16/9027 takes precedence
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/065 involving logical or physical relationship, e.g. grouping and hierarchies
• CPC Class Codes: H04L 41/0883 Semiautomatic configuration, e.g. proposals from system
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/0823 Errors, e.g. transmission errors
• CPC Class Codes: H04L 51/216 Handling conversation history, e.g. grouping of messages in sessions or threads
• CPC Class Codes: H04L 67/535 : Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 67/55 : Push-based network services
• CPC Class Codes: H04L 69/40 : for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06

Abstract

A system is provided for clustering events. A first engine receives message data from a managed infrastructure that includes managed infrastructure physical hardware which supports the flow and processing of information. A second engine determines common characteristics of events and produces clusters of events relating to the failure of errors in the managed infrastructure. Membership in a cluster indicates a common factor of the events that is a failure or an actionable problem in the physical hardware managed infrastructure directed to supporting the flow and processing of information. Events are produced that relate to the managed infrastructure while converting the events into words and subsets used to group the events that relate to failures or errors in the managed infrastructure, including the managed infrastructure physical hardware. A situation room is provided with a collaborative interface (UI) for decomposing events from managed infrastructures. The (UI) is available by one or more designated individuals relative to one or more failures or errors in a managed infrastructure.

Claims

1. A system for clustering events, comprising:

a first engine that receives message data from a managed infrastructure that includes managed infrastructure physical hardware which supports the flow and processing of information;

a second engine that determines common characteristics of events and produces clusters of events relating to the failure of errors in the managed infrastructure, where membership in a cluster indicates a common factor of the events that is a failure or an actionable problem in the physical hardware managed infrastructure directed to supporting the flow and processing of information, and producing events that relate to the managed infrastructure while converting the events into words and subsets used to group the events that relate to failures or errors in the managed infrastructure, including the managed infrastructure physical hardware;

a collaborative interface (UI) for decomposing events from managed infrastructures, the (UI) being available by one or more designated individuals relative to one or more failures or errors in a managed infrastructure; and

wherein the second engine uses a source address for each event to make a change in at least a portion of the managed infrastructure, and in response to producing events relating to the managed infrastructure while converting the events into words and subsets and makes physical changes to at least a portion of the managed infrastructure physical hardware.

2. The system of claim 1, wherein the situation room is coupled to or includes a database of solutions to failures or errors in a managed infrastructure.

3. The system of claim 2, wherein the database includes prior solutions to failures or errors in a managed infrastructure.

4. The system of claim 1, wherein the situation room includes a plurality of collaborative interfaces.

5. The system of claim 1, wherein the situation room is accessable by a plurality of designated people.

6. The system of claim 1, wherein the situation room allows for coloration of a plurality of people to resolve a failure or error in a managed infrastructure.

7. The system of claim 1, wherein the managed infrastructure includes one or more of:

computers, network devices, appliances, mobile devices, text or numerical values from which those text or numerical values indicate a state of any hardware or software component of the managed infrastructure.

8. The system of claim 7, wherein the managed infrastructure generates data that include attributes selected from at least one of, time, source a description of the event, textural or numerical values from which those text or numerical values indicate a state of any hardware or software component of the managed infrastructure.

9. The system of claim 1, further comprising:

a publication message bus.

10. The system of claim 1, further comprising:

a data bus web server coupled to one or more user interfaces.

11. The system of claim 1, further comprising:

a plurality of link access modules in communication with the extraction and signalizer engines.

12. The system of claim 1, wherein the UI is configured to access one or more databases.

13. The system of claim 1, wherein the extraction engine reformats data from the events to create reformatted data.

14. The system of claim 13, wherein the reformatted data is received at a system bus.

15. The system of claim 1, wherein the UI is configured to reduce a number of actions a user makes relative management of the physical hardware managed infrastructure.

16. The system of claim 1, wherein the UI is configured to allow one or more users to execute incident management with or without collaborative interactivity relative to physical hardware managed infrastructure.

17. The system of claim 1, wherein the UI is configured to allow one or more users to execute incident management relative to physical hardware managed infrastructure with or without collaborative interactivity in a situation room that is executed using the UI.

18. The system of claim 1, wherein the UI provides one or more of:

a summary view;

a top level, and a UI relative to physical hardware managed infrastructure open situations.

19. The system of claim 1, wherein the UI is configured to display physical hardware managed infrastructure services that can be impacted.

20. The system of claim 1, further comprising:

interface logic configured to allow business application software to export application data to be displayed at the UI in an interactive visual format.

21. The system of claim 1, wherein the UI is configured to use real time data.

22. The system of claim 21, wherein the real time data is from a single or multiple sources.

23. The system of claim 1, wherein the UI includes one or more data fields within a file.

24. The system of claim 1, wherein the UI is configured to provide a graphical representation of data from one or more data sources and information from one or more data fields.

25. The system of claim 1, wherein the UI is configured to create and display clustering messages.

26. The system of claim 1, wherein the UI is configured to provide a graphical representation of data from one or more data sources and information from one or more data fields.