IGNORING REDUNDANT SYMPTOMS IN MODULAR SELF-HEALING SYSTEMS
First Claim
1. A self-healing system comprising:
- an event bus configured to transmit events in the self-healing system;
a correlation engine coupled to the event bus, the correlation engine configured to correlate events transmitted on the event bus into a correlated event set, the correlated event set indicating a possible fault condition in the system, the correlation engine further configured to evaluate a plurality of correlation rules, the plurality of correlation rules being arranged in a hierarchal rule structure to correlate the events;
an analysis engine coupled to the event bus, the analysis engine configured to perform analysis on the correlated event set, determine at least one corrective action to be performed in response to the correlated event set, and send a deactivation event to the correlation engine upon initiation of the corrective action, the deactivation event including the correlated event set; and
wherein the correlation engine is further configured to deactivate all correlation rules within the hierarchal rule structure that are used to generate only the correlated event set.
5 Assignments
0 Petitions
Accused Products
Abstract
Techniques for processing events in a self-healing system. In one embodiment, the system receives system events, one or more of which may indicate a possible fault condition in the system. A hierarchal rule structure is used to generate a correlated event set. A determining operation determines at least one corrective action to be performed in response to the correlated event set. A deactivating operation deactivates all correlation rules within the hierarchal rule structure that are only used to generate the correlated event set. Repeated instances of the same fault condition are prevented from being processed by the self-healing system.
45 Citations
21 Claims
-
1. A self-healing system comprising:
-
an event bus configured to transmit events in the self-healing system; a correlation engine coupled to the event bus, the correlation engine configured to correlate events transmitted on the event bus into a correlated event set, the correlated event set indicating a possible fault condition in the system, the correlation engine further configured to evaluate a plurality of correlation rules, the plurality of correlation rules being arranged in a hierarchal rule structure to correlate the events; an analysis engine coupled to the event bus, the analysis engine configured to perform analysis on the correlated event set, determine at least one corrective action to be performed in response to the correlated event set, and send a deactivation event to the correlation engine upon initiation of the corrective action, the deactivation event including the correlated event set; and wherein the correlation engine is further configured to deactivate all correlation rules within the hierarchal rule structure that are used to generate only the correlated event set. - View Dependent Claims (2, 3, 4, 5, 6, 7)
-
-
8. A method for processing events in a computer system, the method comprising:
-
receiving at least one system event, the at least one system event indicating a possible fault condition in the system; utilizing a hierarchal rule structure to generate a correlated event set; determining at least one corrective action to be performed in response to the correlated event set; and deactivating all correlation rules within the hierarchal rule structure that are only used to generate the correlated event set. - View Dependent Claims (9, 10, 11, 12, 13, 14)
-
-
15. A computer program product for processing events in a computer system, the computer program product comprising:
-
a computer usable medium having computer usable program code embodied therewith, the computer usable program code comprising; computer usable program code configured to receive at least one system event, the at least one system event indicating a possible fault condition in the system; computer usable program code configured to utilize a hierarchal rule structure to generate a correlated event set; computer usable program code configured to determine at least one corrective action to be performed in response to the correlated event set; and computer usable program code configured to deactivate all correlation rules within the hierarchal rule structure that are only used to generate the correlated event set. - View Dependent Claims (16, 17, 18, 19, 20, 21)
-
Specification