Using and updating topological relationships amongst a set of nodes in event clustering

• US 10,678,610 B2
• Filed: 04/11/2018
• Issued: 06/09/2020
• Est. Priority Date: 04/11/2018
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Ebrahimi, Mohammad Sadegh, Patti, Raghu Hanumanth Reddy, Garvey, Dustin
• Primary Examiner(s): Ho, Andy
• Application Number:
  US15/950,987
• Publication Number:
  US 20190317834A1
• Time in Patent Office: 790 Days
• Field of Search: 719318
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 17/18 for evaluating statistical data , e.g. average values, frequency distributions, probability functions, regression analysis forecasting specially adapted for a specific administrative, business or logistic context G06Q10/04
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: G06F 2209/544 Remote
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications

Abstract

Using and updating topological relationships amongst a set of nodes in event clustering is disclosed. A current event occurs on a current node. A first cluster of related events includes a first event, occurring on a first node, that is time-correlated with the current event. The first cluster does not include any event that is topologically-correlated with the current event based on the existing set of topological relationships. A level of interdependence is determined between (a) occurrence of events on the current node and (b) occurrence of events on the first node. Based on the level of interdependence, the current event is added to the first cluster. Further, an event-based topological relationship between the first node and the second node is added to the set of topological relationships. Subsequently, clustering for new events may be determined based on the event-based topological relationship between the first node and the second node.

Claims

1. A non-transitory computer readable medium comprising instructions which, when executed by one or more hardware processors, cause performance of operations comprising:

identifying a plurality of events that occur on a set of nodes in a computing environment;

determining a first cluster of related events, from the plurality of events, based on an existing set of topological relationships associated with the set of nodes;

determining that there is event co-occurrence between (a) one or more events of the first cluster of related events and (b) a first event that is not within the first cluster of related events;

based at least on the event co-occurrence between (a) the one or more events of the first cluster of related events and (b) the first event;

determining an event-based topological relationship between (a) a first node, of the set of nodes, that is associated with at least one event of the first cluster of related events and (b) a second node, of the set of nodes, that is associated with the first event but not associated with any event of the first cluster of related events;

identifying a second event that is associated with the first node;

identifying a third event, not already within the plurality of events, that is associated with the second node; and

based at least on the event-based topological relationship;

clustering the second event and the third event into a second cluster of related events.

2. The medium of claim 1, wherein:

the operations further comprise;

determining a level of interdependence between occurrence of events on the first node and occurrence of events on the second node;

determining that the level of interdependence is above a threshold value; and

determining the event-based topological relationship between the first node and the second node is further based on determining that the level of interdependence is above the threshold value.

3. The medium of claim 2, wherein determining the level of interdependence comprises:

determining a first probability of a cluster having a fourth event on the second node;

determining a second probability of a cluster having both (a) a fifth on the second node and (b) a sixth event on the first node that is within a threshold duration of time from the fifth event on the second node; and

dividing the second probability by the first probability to obtain the level of interdependence.

4. The medium of claim 1, wherein:

the operations further comprise;

determining that the one or more events of the first cluster of related events and the first event satisfy a statistical criteria; and

determining the event-based topological relationship between the first node and the second node is further based on determining that the one or more events of the first cluster of related events and the first event satisfy the statistical criteria.

5. The medium of claim 1, wherein the operations further comprise:

adding the event-based topological relationship between the first node and the second node to the existing set of topological relationships.

6. The medium of claim 1, wherein the existing set of topological relationships includes:

a topological relationship that is determined based on one or more configuration files associated with one or more of the set of nodes.

7. The medium of claim 1, wherein the existing set of topological relationships includes:

a topological relationship that is specified via user input.

8. The medium of claim 1, wherein identifying the first cluster of related events based on the existing set of topological relationships associated with the set of nodes comprises:

determining that a fourth event and a fifth event occur within a threshold duration of time of each other;

determining that a third node, on which the fourth event occurs, and a fourth node, on which the fifth event occurs, are within a threshold number of hops from each other based on the existing set of topological relationships; and

determining that the fourth event and the fifth event are within the first cluster of related events.

9. The medium of claim 1, wherein the operations further comprise:

based at least on the event co-occurrence between (a) the one or more events of the first cluster of related events and (b) the first event;

adding the first event to the first cluster of related events.

10. The medium of claim 1, wherein the first cluster of related events and the second cluster of related events are different.

11. The medium of claim 1, wherein the first cluster of related events is same as the second cluster of related events.

12. The medium of claim 1, wherein the operations further comprise:

presenting, at a user interface, information associated with the second cluster of related events, wherein the information associated with the second cluster of related events indicates that the second cluster of related events includes the second event and the third event.

13. The medium of claim 1, wherein the operations further comprise:

responsive to determining that the second cluster of related events includes the second event and the third event;

selecting the second event for analysis without selecting the third event for analysis.

14. The medium of claim 1, wherein the operations further comprise:

determining that the third event, within the second cluster of related events, has been resolved;

responsive to determining that the third event has been resolved;

indicating that the second event, within the second cluster of related events, is also resolved.

15. A method, comprising:

identifying a plurality of events that occur on a set of nodes in a computing environment;

determining a first cluster of related events, from the plurality of events, based on an existing set of topological relationships associated with the set of nodes;

determining that there is event co-occurrence between (a) one or more events of the first cluster of related events and (b) a first event that is not within the first cluster of related events;

based at least on the event co-occurrence between (a) the one or more events of the first cluster of related events and (b) the first event;

determining an event-based topological relationship between (a) a first node, of the set of nodes, that is associated with at least one event of the first cluster of related events and (b) a second node, of the set of nodes, that is associated with the first event but not associated with any event of the first cluster of related events;

identifying a second event that is associated with the first node;

identifying a third event, not already within the plurality of events, that is associated with the second node; and

based at least on the event-based topological relationship;

clustering the second event and the third event into a second cluster of related events;

wherein the method is performed by at least one device including a hardware processor.

16. The method of claim 15, further comprising:

determining a level of interdependence between occurrence of events on the first node and occurrence of events on the second node;

determining that the level of interdependence is above a threshold value;

wherein determining the event-based topological relationship between the first node and the second node is further based on determining that the level of interdependence is above the threshold value.

17. The method of claim 16, wherein determining the level of interdependence comprises:

determining a first probability of a cluster having a fourth event on the second node;

determining a second probability of a cluster having both (a) a fifth on the second node and (b) a sixth event on the first node that is within a threshold duration of time from the fifth event on the second node; and

dividing the second probability by the first probability to obtain the level of interdependence.

18. A system, comprising:

at least one device including a hardware processor; and

the system being configured to perform operations comprising;

identifying a plurality of events that occur on a set of nodes in a computing environment;

determining a first cluster of related events, from the plurality of events, based on an existing set of topological relationships associated with the set of nodes;

determining that there is event co-occurrence between (a) one or more events of the first cluster of related events and (b) a first event that is not within the first cluster of related events;

based at least on the event co-occurrence between (a) the one or more events of the first cluster of related events and (b) the first event;

determining an event-based topological relationship between (a) a first node, of the set of nodes, that is associated with at least one event of the first cluster of related events and (b) a second node, of the set of nodes, that is associated with the first event but not associated with any event of the first cluster of related events;

identifying a second event that is associated with the first node;

identifying a third event, not already within the plurality of events, that is associated with the second node; and

based at least on the event-based topological relationship;

clustering the second event and the third event into a second cluster of related events.

19. The system of claim 18, wherein:

the operations further comprise;

determining a level of interdependence between occurrence of events on the first node and occurrence of events on the second node;

determining that the level of interdependence is above a threshold value; and

determining the event-based topological relationship between the first node and the second node is further based on determining that the level of interdependence is above the threshold value.

20. The system of claim 19, wherein determining the level of interdependence comprises:

determining a first probability of a cluster having a fourth event on the second node;

determining a second probability of a cluster having both (a) a fifth on the second node and (b) a sixth event on the first node that is within a threshold duration of time from the fifth event on the second node; and

dividing the second probability by the first probability to obtain the level of interdependence.