Event clustering system

• US 10,402,428 B2
• Filed: 12/12/2016
• Issued: 09/03/2019
• Est. Priority Date: 04/29/2013
• Status: Active Grant

• Current Assignee: Dell Products LP (Dell Technologies Inc.)
• Original Assignee: Moogsoft Inc. (Dell Technologies Inc.)
• Inventors: Tee, Philip, Spreenberg, Peter
• Primary Examiner(s): Brooks, David T.
• Application Number:
  US15/376,110
• Publication Number:
  US 20170212952A1
• Time in Patent Office: 995 Days
• Field of Search: 719318
• CPC Class Codes: G06F 16/2237 Vectors, bitmaps or matrices
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/065 related to network devices
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters

Abstract

An event clustering system includes an extraction engine in communication with a managed infrastructure. A sigalizer engine that includes one or more of an NMF engine, a k-means clustering engine and a topology proximity engine. The sigalizer engine determines one or more common characteristics or features from events that includes one or more event parameters. The sigalizer engine uses the common features of events to produce clusters of events relating to the failure or errors in the managed infrastructure. Membership in a cluster indicates a common factor of the events that is a failure or an actionable problem in the physical hardware managed infrastructure directed to supporting the flow and processing of information. Each of an event parameter is converted into a numerical representation.

Claims

1. An event clustering system, comprising:

a first processor that is an extraction processor in communication with a managed infrastructure;

a second processor that includes one or more of a Non-negative Matrix Factorization, a (“

NMF”

) processor, a k-means clustering processor and a topology proximity processor, the second processor determining one or more common characteristics or features from events that includes one or more event parameters, the second processor using the common features of events to produce clusters of events relating to the failure or errors in the managed infrastructure, where membership in a cluster indicates a common factor of the events that is a failure or an actionable problem in the physical hardware managed infrastructure directed to supporting the flow and processing of information;

a third processor that is a compare and merge processor which receives outputs from the second processor, the compare and merge processor communicating with one or more user interfaces, the second processor or a third processors uses a source address for each event make a change to at least a portion of the managed infrastructure; and

wherein each of an event parameter is converted into a numerical representation.

2. The system of claim 1, wherein an event can include both numeric and non-numerical or text parameters.

3. The system of claim 1, wherein the system is configured to receive events as they are received.

4. The system of claim 2, wherein the system breaks parameters that are non-numerical.

5. The system of claim 1, wherein an event has one or more fields that are nested values.

6. The system of claim 5, wherein nested values are lists and can be nested name-value pairs.

7. The system of claim 5, wherein nested values decompose into text or numeric values and the text is converted to one or more numeric values.

8. The system of claim 1, wherein events include alerts.

9. The system of claim 1, wherein parameters include subjects.

10. The system of claim 1, wherein parameters include one or more attributes.

11. The system of claim 1, wherein an event includes an instance of one or more parameters that are examined or analyzed.

12. The system of claim 1, wherein parameters include features.

13. The system of claim 1, wherein a feature is a numerical value of a parameter.

14. The system of claim 1, wherein a parameter vector is a concatenation of all of the parameters of an individual event.

15. The system of claim 14, wherein a parameter vector is a feature vector.

16. The system of claim 14, wherein a manager is an attribute of an event.

17. The system of claim 16, wherein values of a manager can change from one organization to another.

18. The system of claim 15 wherein parameters are converted into numerical representations with the use of one or more feature vectors.

19. The system of claim 18 wherein each parameter is represented by one or more columns of a table in a final feature vector.

20. The system of claim 18, wherein the one or more feature vectors are created in order to do a conversion of non-numerical and text parameters.

21. The system of claim 18, wherein one or more feature vectors is created for each parameter of the event.

22. The system of claim 21, wherein one or more feature vectors is created for each parameter of the event and is represented by one or more columns of a table in a final feature vector.

23. The system of claim 18, where each parameter represents a number where there is a natural ordering or scale or a textual description.

24. The system of claim 18, wherein each parameter represents a type of categorical value or enumeration.

25. The system of claim 18, wherein a parameter is not contained within a single event itself and is derived from an entire set of events.

26. The system of claim 18, wherein a column of a table represents a time and can be sorted in any time desired.

27. The system of claim 26, wherein an importance of a parameter is based on time.

28. The system of claim 27, wherein time is represented in at least one of:

an absolute value;

an assembled parameter, in order of arrival;

ordered by time; and

order by severity.

29. The system of claim 1, wherein parameters can have multiple attributes.

30. The system of claim 19, wherein the system provides for different categories as well as the creation of as many columns as there are categories.

31. The system of claim 13, wherein severity is a number of a feature vector and occupies one column of the feature vector.

32. The system of claim 19, wherein a text based parameter extraction method is used for a word, wherein the text based parameter can include shingles and tokenization, and are used that for multiple letter segments of a word.

33. The system of claim 32, wherein the system is configured to receive a number of shingles.

34. The system of claim 33, wherein a parameter can include a plurality of words and a plurality of host names.

35. The system of claim 34, wherein a number of columns in the table required is the number of unique shingles across all host names.

36. The system of claim 23, wherein the system is configured to look at individual phrases rather than shingles.

37. The system of claim 36, wherein the feature vector has as many columns in the table as there are unique words.

38. The system of claim 37, wherein manager changes from organization to organization, where manager is a term provided by an organization.

39. The system of claim 38, wherein the feature vector columns of the table represent description and manager.

40. The system of claim 26, wherein the system is configured to examine through tokenization to convert sentences into words and can get rid of stop words.

41. The system of claim 32, wherein stemming is used to de-pluralize words.