Situation dashboard system and method from event clustering

• US 10,489,226 B2
• Filed: 01/27/2017
• Issued: 11/26/2019
• Est. Priority Date: 04/29/2013
• Status: Active Grant

• Current Assignee: Dell Products LP (Dell Technologies Inc.)
• Original Assignee: Moogsoft Inc. (Dell Technologies Inc.)
• Inventors: Tee, Philip, Harper, Robert, Silvey, Charles Mike, Leonard, Andrew John, Townsend, Jeffrey Ellison
• Primary Examiner(s): Burke, Jeff A
• Assistant Examiner(s): Vu, Thong H
• Application Number:
  US15/417,497
• Publication Number:
  US 20170141947A1
• Time in Patent Office: 1,033 Days
• Field of Search: 707601
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/0769 Readable error formats, e.g. cross-platform generic formats, human understandable formats
• CPC Class Codes: G06F 11/0772 Means for error signaling, e.g. using interrupts, exception flags, dedicated error registers
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/358 Browsing; Visualisation therefor
• CPC Class Codes: G06F 16/904 Browsing; Visualisation therefor for navigating the web G06F16/954; browsing optimisation for the web G06F16/957
• CPC Class Codes: G06F 3/0481 based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance
• CPC Class Codes: G06Q 10/00 Administration; Management
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/065 involving logical or physical relationship, e.g. grouping and hierarchies
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 51/216 Handling conversation history, e.g. grouping of messages in sessions or threads
• CPC Class Codes: H04L 51/224 providing notification on incoming messages, e.g. pushed notifications of received messages

Abstract

A user interface system is provided. A first engine receives message data from managed infrastructure that includes managed infrastructure physical hardware which supports the flow and processing of information. A second engine determines common characteristics of events and produces clusters of events relating to the failure of errors in the managed infrastructure, where membership in a cluster indicates a common factor of the events that is a failure or an actionable problem in the physical hardware managed infrastructure directed to supporting the flow and processing of information. One or more situations are created that are a collection of one or more events or alerts representative of the actionable problem in the managed infrastructure. An external connection adapter is coupled to the first and second engines and configured to provide access to one or more data fields within a file. A display computer system maps using a graphical user interface the one or more data fields relating to situations from clustered messages received from managed infrastructure to data from one or more data sources. The display computer system generates a dashboard display from a configuration in the file that includes situations from clustered messages received from managed infrastructure.

Claims

1. A user interface system, comprising:

a first engine, that can be an extraction engine, configured to receive message data from managed infrastructure that includes managed infrastructure physical hardware with a plurality of hardware elements that support the flow and processing of information;

a second engine, selected from at least one of;

a signalizer engine, a Non-negative Matrix Factorization (NMF engine), a k-means clustering engine and a topology proximity engine, that determines common characteristics of events and produces clusters of events relating to the failure of errors in the managed infrastructure, where membership in a cluster indicates a common factor of the events that is a failure or an actionable problem in the physical hardware managed infrastructure directed to supporting the flow and processing of information;

creating one or more situations that is a collection of one or more events or alerts representative of the actionable problem in the managed infrastructure;

an external connection adapter coupled to the first and second engines and configured to provide access to one or more data fields within a file;

a third engine coupled to the first and second engines, the third engine assigning a graph coordinate to an event, each of a graph coordinate clustering events to determine hop proximity of a source of the event; and

s

a display computer system configured to map using a graphical user interface the one or more data fields relating to situations from clustered messages received from managed infrastructure to data from one or more data sources the display computer system configured to generate a dashboard display from a configuration in the file that includes situations from clustered messages received from the managed infrastructure, the display computer system configured to access the managed infrastructure physical hardware with the plurality of hardware elements, the display computer system including a collaborative interface (UI) accessible by at least two parties, wherein the collaborative interface is used by the at least two parties to make one or more physical changes in a managed infrastructure hardware.

2. The system of claim 1, wherein the first engine is an extraction engine.

3. The system of claim 2, wherein the first engine in operation receives messages from the managed infrastructure.

4. The system of claim 3, wherein the first engine in operation produces events that relate to the managed infrastructure.

5. The system of claim 4, wherein the events are converted into words and subsets used to group the events into clusters that relate to failures or errors in the managed infrastructure.

6. The system of claim 1, wherein the second engine is a signalizer engine.

7. The system of claim 1, wherein the second engine is configured to determine one or more common characteristics of events and produces clusters relating to events.

8. The system of claim 1, wherein an optimal subset of attributes is extracted for each event and turned into a vector.

9. The system of claim 1, wherein the third engine inputs a list of devices.

10. The system of claim 1, wherein the second engine includes or is coupled to a k-means clustering engine that user graph coordinates to generate one or more clusters that brings together events with similar characteristics.

11. The system of claim 1, wherein the second engine includes or is coupled to an NMF engine that first extracts clusters that have greater importance.

12. The system of claim 11, wherein the clusters are assign a start and an end time.

13. The system of claim 1, wherein the managed infrastructure is from a business organization.

14. The system of claim 13, wherein the managed infrastructure includes, computers, network devices, appliances, mobile devices, text or numerical values from which those text or numerical values indicate a state of any hardware or software component of the managed infrastructure.

15. The system of claim 14, wherein the managed infrastructure generates data that include attributes selected from at least one of, time, source a description of the event, textural or numerical values from which those text or numerical values indicate a state of any hardware or software component of the managed infrastructure.

16. The system of claim 1, further comprising:

a publication message bus.

17. The system of claim 1, further comprising:

a data bus web server coupled to one or more user interfaces.

18. The system of claim 1, wherein a plurality of link access modules are in communication with a data bus.

19. The system of claim 1, further comprising:

a database.

20. The system of claim 1, wherein the extraction engine reformats data from the events to create reformatted data.

21. The system of claim 20, wherein the reformatted data is received at the system bus.

22. The system of claim 1, wherein a dictionary is generated with word and subtexts using Shannon Entropy, −

ln(1/NGen) and normalizes the words and subtexts.

23. The system of claim 22, wherein normalized words and subtexts are mapped from a common 0.0 to a non-common 1.0.

24. The system of claim 1, further comprising:

an entropy database that in operation normalizes entropy for events.

25. The system of claim 24, wherein normalized entropy for events is mapped to a common, 0.0 and a non-common, 1.0.

26. The system of claim 1, wherein entropy is assigned to the alerts.

27. The system of claim 1, wherein the alerts are run in parallel with activities of the first engine.

28. The system of claim 1, wherein the alerts are passed to the second engine.