Methods for decomposing events from managed infrastructures

• US 10,474,520 B2
• Filed: 11/14/2016
• Issued: 11/12/2019
• Est. Priority Date: 04/29/2013
• Status: Active Grant

• Current Assignee: Dell Products LP (Dell Technologies Inc.)
• Original Assignee: Moogsoft Inc. (Dell Technologies Inc.)
• Inventors: Tee, Philip, Harper, Robert Duncan, Silvey, Charles Mike
• Primary Examiner(s): Maskulinski, Michael
• Application Number:
  US15/350,950
• Publication Number:
  US 20170060663A1
• Time in Patent Office: 1,093 Days
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/0775 Content or structure details of the error report, e.g. specific table structure, specific error fields
• CPC Class Codes: G06F 11/0778 Dumping, i.e. gathering error/state information after a fault for later diagnosis
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/30 Monitoring
• CPC Class Codes: G06F 11/328 Computer systems status display G06F11/327 takes precedence
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/9024 Graphs; Linked lists G06F16/9027 takes precedence
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/0823 Errors, e.g. transmission errors
• CPC Class Codes: H04L 51/063 Content adaptation, e.g. replacement of unsuitable content
• CPC Class Codes: H04L 67/75 Indicating network or usage conditions on the user display

Abstract

A method is provided for clustering events. Messages are received at an extraction engine from managed infrastructure that includes managed infrastructure physical hardware that supports the flow and processing of information. Events are produced that relate to the managed infrastructure. The events are converted into words and subsets used to group the events that relate to failures or errors in the managed infrastructure, including the managed infrastructure physical hardware. One or more common characteristics of events are determined and clusters of events are produced relating to the failure or errors in the managed infrastructure. A source address is used for each event as is a graph topology of the managed infrastructure to assign a graph coordinate to the event. Membership in a cluster indicates a common factor of the events that is a failure or an actionable problem in the physical hardware managed infrastructure directed to supporting the flow and processing of information. In response to production of the clusters one or more physical changes are made in the managed infrastructure hardware.

Claims

1. A method for clustering events, comprising:

receiving messages at an extraction engine from a managed infrastructure that includes physical hardware managed infrastructure that supports infrastructure data;

providing a text input module coupled to the extraction engine;

producing events that relate to the managed infrastructure and converting the events into a sequence of attributes that have text or numerical values indicative of a state of a hardware component;

using the extraction engine to extract text or numerical values from event messages and convert them into words and subtexts

determining one or more common steps to ascertain how many clusters to extract from events, where membership in a cluster indicates a common factor that can be a failure or an actionable problem in the managed infrastructure, where membership in a cluster indicates a common set of attributes of the events that is a failure or an actionable problem in the physical hardware managed infrastructure directed to infrastructure data, in response to production of the clusters of events one or more physical changes in a managed infrastructure hardware is made;

using a source address for each event and a graph topology of the managed infrastructure to assign a graph coordinate to the event when a graph topology is executed.

2. The method of claim 1, wherein the managed infrastructure is from a business organization.

3. The method of claim 1, wherein the managed infrastructure includes, computers, network devices, appliances, mobile devices, text or numerical values from which those text or numerical values indicate a state of any hardware or software component of the managed infrastructure.

4. The method of claim 1, further comprising:

a publication message bus.

5. The method of claim 1, further comprising:

a data bus web server coupled to one or more user interfaces.

6. The method of claim 1, wherein a plurality of link access modules are in communication with a data bus.

7. The method of claim 1, further comprising:

a database.

8. The method of claim 1, wherein a dictionary is generated with the word and subtexts using Shannon Entropy, −

ln(1/NGen) and normalizes the words and subtexts.

9. The method of claim 8, wherein normalized words and subtexts are mapped from a common 0.0 to a non-common 1.0.

10. The method of claim 1, further comprising:

an entropy database that in operation normalizes entropy for events.

11. The method of claim 10, wherein normalized entropy for events is mapped to a common, 0.0 and a non-common, 1.0.

12. The method of claim 1, wherein entropy is assigned to alerts.

13. The method of claim 12, wherein the alerts are passed to a sigalizer engine.

14. The method of claim 13, wherein the sigalizer engine generates clusters of alerts.

15. The method of claim 1, further comprising:

determining hop and a proximity of the source of the event.

16. The method of claim 1, further comprising:

calculating one or more distances between tile vectors.