Correlating computing network events

• US 10,623,235 B2
• Filed: 10/23/2017
• Issued: 04/14/2020
• Est. Priority Date: 12/04/2012
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Stern, Edith H., Stewart, Kristian J.
• Primary Examiner(s): Derose, Volvick
• Application Number:
  US15/790,984
• Publication Number:
  US 20180048517A1
• Time in Patent Office: 904 Days
• CPC Class Codes: H04L 41/0613 based on the type or category of the network elements
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/065 involving logical or physical relationship, e.g. grouping and hierarchies
• CPC Class Codes: H04L 41/0668 by dynamic selection of recovery network elements, e.g. replacement by the most appropriate element after failure
• CPC Class Codes: H04L 41/0686 Additional information in the notification, e.g. enhancement of specific meta-data
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/0843 based on generic templates
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 65/40 Support for services or applications
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/75 Indicating network or usage conditions on the user display
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 69/40 for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A method for correlating computing network events includes identifying computing resources to be deployed. An identification of a correlation pattern comprising a set of the resources to be deployed is received and a correlation identifier is assigned to the correlation pattern. Each resource of the correlation pattern is configured to include the correlation identifier with an event generated by the respective resource. The resources are then deployed in a computing environment.

Claims

1. A method, comprising:

identifying computing resources to be deployed;

receiving an identification of a correlation pattern comprising a set of the resources to be deployed;

assigning a correlation identifier to the correlation pattern;

configuring each resource of the correlation pattern to include the correlation identifier with an a fault event packet generated by the respective resource, wherein a quantity of fault events to assess is reduced based on the correlation identifier; and

deploying the resources in a computing environment.

2. The method of claim 1, further comprising:

receiving a plurality of events from deployed resources;

identifying a correlation identifier associated with each of the plurality of received events; and

correlating the events having a common correlation identifier.

3. The method of claim 2, further comprising providing an indication of the correlated events.

4. The method of claim 2, further comprising condensing a plurality of indications of correlated events to a single indication.

5. The method of claim 1, further comprising associating the correlation pattern with a deployed application.

6. The method of claim 1, further comprising providing the correlation identifier to the respective resources of the correlation pattern upon deployment of the respective resources.

7. A method, comprising:

receiving a deployment request for a computing service;

identifying a deployment template corresponding to the requested computing service, the deployment template indicating resources needed for providing the computing service;

identifying available resources based on the deployment template;

targeting available resource elements for deployment;

deploying the targeted resource elements in a computing environment;

associating with the deployment template in a memory an identification of a resource set indicating each of the deployed resource elements; and

responsive to receiving an event including a resource identifier, identifying the resource set having the deployed resource corresponding to the resource identifier and correlating the event with at least one other active event corresponding to the resource set.

8. The method of claim 7, further comprising providing an indication of the correlated events.

9. The method of claim 8, further comprising condensing a plurality of indications of correlated events to a single indication.

10. The method of claim 7, further comprising associating the resource set with a deployed application.

11. A method, comprising:

discovering a topology of a computing environment;

receiving, by a deployment system, a request for a computing service;

creating a correlation identifier based on an identifier of the deployment system;

targeting resources to deploy in the computing environment to provide the computing service; and

configuring one or more of the targeted resources to include the correlation identifier in a payload of an event the respective resource emits while deployed in the computing environment.

12. The method of claim 11, further comprising appending another identifier to the identifier of the deployment system to create the correlation identifier.

13. The method of claim 11, further comprising providing the correlation identifier to the respective resources upon deployment of the respective resources.

14. The method of claim 11, further comprising identifying a deployment template corresponding to the requested computing service, the deployment template indicating the resources needed for providing the computing service.

15. The method of claim 14, further comprising associating with the deployment template in a memory an identification of a resource set indicating each of the targeted resources.