Method, data processing system, and computer program product for generating visualization output of event correlation information

• US 20050289230A1
• Filed: 06/24/2004
• Published: 12/29/2005
• Est. Priority Date: 06/24/2004
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Chen, Xiaoping, Lavery, Andrew Jason, McKinney, Howard Milton
• Granted Patent: US 8,626,894 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]

Abstract

A method for graphically representing events at runtime in an event management system is provided. A plurality of events including a first event and a second event are received that define respective states of one or more networked devices. A cause-effect event relation is identified between the first event, the second event, and a projected event responsive, to receiving the first and second events. A runtime visualization output is generated that includes a graphical representation of the first event, the second event, the projected event and the event relation

Claims

1. A method for graphically representing events at runtime in an event management system, the method comprising the computer implemented steps of:

receiving a plurality of events including a first event defining a state of a networked device and a second event defining a state of a networked device;

responsive to receiving the first event and the second event, identifying an event relation between the first event, the second event and a projected event; and

generating a runtime visualization output that includes a graphical representation of the first event, the second event, the projected event and the event relation.

2. The method of claim 1, wherein the step of identifying includes:

interrogating an event relation database having records each defining at least one event; and

receiving a return data set including an identification of the event relation.

3. The method of claim 1, wherein the step of generating includes:

graphically outputting a graph having a first node representative of the first event, a second node representative of the second event, and a third node representative of the projected event.

4. The method of claim 3, wherein the step of graphically outputting includes:

graphically outputting a graph edge connecting the first node and the third node, wherein the graph edge is a graphical representation of the event relation.

5. The method of claim 4, wherein the first node is a source node of the graph edge, and the third node is a target node of the graph edge.

6. The method of claim 1, wherein the graphical representation of the first event is graphically distinct from the graphical representation of the projected event.

7. The method of claim 1, further including:

retrieving property data associated with the first event, the second event, and the projected event.

8. The method of claim 1, wherein the event relation database defines cause-effect relations between the first event, the second event, and the projected event.

9. A computer program product in a computer readable medium for graphically representing events at runtime in an event management system, the computer program product comprising:

first instructions for receiving a first event defining a state of a networked device and a second event defining a state of a networked device;

second instructions for interrogating a database that defines a cause-effect event relation between the first event, the second event, and an associated event; and

third instructions for, responsive to the second instructions interrogating the database, generating respective graphical representations of the first event, the second event, the associated event, and the event relation.

10. The computer program product of claim 9, wherein the graphical representations comprise a directed graph.

11. The computer program product of claim 10, wherein the graphical representations of the first event, the second event, and the associated event are respective graph nodes.

12. The computer program product of claim 9, wherein the graphical representation of the event relation comprises a directed edge from the graphical representation of the first event and the second event to the graphical representation of the associated event.

13. The computer program product of claim 9, wherein the graphical representation of the first event and the second event is graphically distinct from the graphical representation of the associated event.

14. The computer program product of claim 9, wherein the second instructions are adapted to index a record with an identifier of the first event and the second event.

15. The computer program product of claim 9, wherein the second instructions, responsive to interrogating the database, receive a return data set including an identifier of the associated event.

16. A data processing system for graphically representing events in an event management system at runtime, comprising:

a memory that contains a set of instructions and a database defining an event relation between a first event, a second event, and an associated event;

a network adapter adapted to receive event messages from networked devices; and

a processing unit, responsive to execution of the set of instructions, that reads the first event and the second event conveyed to the network adapter and formulates a query that includes an identifier of the first event and the second event, wherein the processing unit generates a runtime visualization output including a respective graphical representation of the first event, the second event, the associated event, and the event relation responsive to execution of the query.

17. The data processing system of claim 16, wherein the database comprises a plurality of records each respectively defining a causal relation between a plurality of events.

18. The data processing system of claim 16, wherein the associated event is identified in a return data set upon submission of the query to the database.

19. The data processing system of claim 16, wherein the graphical representations of the first event, the second event, the associated event, and the event relation comprise a directed graph.

20. The data processing system of claim 16, wherein the graphical representation of the first event and the second event is distinguished from the graphical representation of the associated event.