Model-Based Event Processing

• US 20070250525A1
• Filed: 04/21/2006
• Published: 10/25/2007
• Est. Priority Date: 04/21/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Rizzi, Lorenzo, Sanghvi, Ashvinkumar
• Granted Patent: US 8,635,596 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/3447 Performance evaluation by modeling
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications

Abstract

Model-based event processing is described. In an embodiment, a model of a system includes managed entities and relationships between the managed entities. Events associated with the managed entities are identified and determined to be correlated if the managed entities with which the events are associated have a relationship according to the model.

Claims

1. A method comprising:

discovering a concrete model of a system that includes managed entities and relationships between the managed entities;

identifying events associated with the managed entities; and

determining that the events are correlated if the managed entities with which the events are associated have a relationship according to the model.

2. A method as recited in claim 1, wherein the model is expressed in a modeling language including at least one of:

an XML Schema;

a System definition Modeling language.

3. A method as recited in claim 1, wherein generating the model of the system includes accessing a preexisting model of the system.

4. A method as recited in claim 1, wherein relationships between managed entities include at least one of:

a direct relationship;

an indirect relationship.

5. A method as recited in claim 1, wherein the managed entities include at least one of:

a domain;

a computer;

a sub net;

a server;

an application;

an Internet gateway;

a database;

a disk;

a service;

a cost center;

a data center;

a website;

a web service;

a process.

6. A method as recited in claim 1, wherein identifying the events comprises generating an event record commemorating each event, the event record including a reference to the managed entity with which the event is associated.

7. A method as recited in claim 1, wherein events include counters and metrics regarding a managed entity.

8. A method as recited in claim 1, further comprising issuing at least one of:

a report including information regarding correlated events;

an alert.

9. A method as recited in claim 1, wherein identifying the events associated with the managed entities includes:

generating an event record for each event; and

storing each event record in a database.

10. A method comprising:

accessing a model of a system comprising managed entities and relationships among the managed entities;

generating information regarding events associated with the managed entities; and

identifying as correlated events, events associated with managed entities having a relationship defined by the model.

11. A method as recited in claim 10, wherein generating the information comprises generating a record for each event including information regarding an identity of the managed entity associated with the event.

12. A method as recited in claim 11, wherein records are generated from customized instrumentation associated with each managed entity.

13. A method as recited in claim 10, further comprising issuing at least one of a report or an alert when correlated events are identified.

14. A method as recited in claim 10, wherein accessing a model of a system comprises creating a concrete model of the system by discovering instances of types and relationships between managed entities described in an abstract model.

15. One or more computer readable media having stored thereon computer executable instructions that, when executed by one or more processors, causes the one or more processors to:

retrieve an abstract model of a system that includes definitions of managed entities in the system;

discover instances of types and relationships between managed entities described in the abstract model to create a concrete model;

access events associated with the managed entities; and

correlate events associated with managed entities having a relationship.

16. One or more computer readable media as recited in claim 15, further comprising computer executable instructions that, when executed by the one or more processors, cause the one or more processors to identify concrete instances and types of relationships between managed entities of the system using methods described in the abstract model of the system.

17. One or more computer readable media as recited in claim 15, wherein relationships between managed entities include at least one of:

a direct relationship;

an indirect relationship.

18. One or more computer readable media as recited in claim 15, further comprising computer executable instructions that, when executed by the one or more processors, cause the one or more processors to retrieve records associated with the plurality of events from an event collection server.

19. One or more computer readable media as recited in claim 18, further comprising computer executable instructions that, when executed by the one or more processors, cause the one or more processors to determine an association between an event and a managed entity by examining a managed entity identifier in the record associated with the event.

20. One or more computer readable media as recited in claim 15, further comprising computer executable instructions that, when executed by the one or more processors, cause the one or more processors to issue a communication when correlated events are identified.