SYSTEMS AND METHODS FOR EVENT DETECTION

• US 20080276131A1
• Filed: 07/22/2008
• Published: 11/06/2008
• Est. Priority Date: 03/31/2005
• Status: Abandoned Application

• Current Assignee: GlobalFoundries, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Pickover, Clifford A., Chefalas, Thomas E., Bantz, David F., Mestrianni, Steven J.
• Application Number:
  US12/177,266
• Publication Number:
  US 20080276131A1
• Time in Patent Office: Days
• US Class Current: 714/47
• CPC Class Codes: G06F 11/0748 in a remote unit communicating with a single-box computer node experiencing an error/fault remote testing G06F11/2294
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting

Abstract

A system accesses a log of events on more than one computing system and scans these logs in an effort to determine the likely cause of various items of interest, events, or problems. These items of interest often include improper or frustrating behavior of a computer system, but may also include delightful or beneficial behaviors for which a user, group of users, company, service, or help desk seeks a cause. Once the likely source of the item of interest is found, a test may be performed to confirm the source of the problem and warning or corrective action taken.

Claims

1. A computer-method of event detection in computer systems, said method comprising the steps of:

detecting an item of interest;

determining at least one event near to the item of interest;

correlating the at least one event with the item of interest; and

thereafter determining at least one probable cause of the item of interest.

2. The method according to claim 1, wherein the item of interest comprises at least one of:

malfunctioning software, slow software, adware, spyware, at least one virus, corruption of information, defective I/O, defective network connectivity, browser highjacking, beneficial system behavior.

3. The method according to claim 1, wherein said step of determining at least one event is undertaken via analyzing at least one event within a predetermined time threshold on at least one machine.

4. The method according to claim 3, wherein the at least one machine comprises at least one of:

a user'"'"'s machine and a machine other than a user'"'"'s machine.

5. The method according to claim 1, wherein said step of determining at least one event is performed via a finite-state acceptor.

6. The method according to claim 1, wherein said correlating step comprises at least one of:

analyzing at least one event and an item of interest of a user; and

analyzing at least one event and an item of interest of another user.

7. The method according to claim 1, wherein said step of determining at least one probable cause comprises testing a corrective method and ascertaining whether the corrective method adequately attends to the item of interest on one or more machines.

8. The method according to claim 1, wherein the at least one event comprises at least one of:

at least one mouse event;

at least one keyboard event;

at least one browser requests via at least one of http and ftp;

at least one mail event via SMTP;

running software;

file creation;

file alteration;

software installation, hardware installation, at least one signature of a CPU, disk, I/O, or memory use.

9. The method according to claim 1, wherein the method is implemented on a computer network which comprises at least one of:

a peer model network, a shared server model network.

10. The method according to claim 1, wherein said step of detecting the item of interest is performed in a site remote from the item of interest.

11. The method according to claim 10, wherein the step of detecting the item of interest is performed by a service provider other than an owner of a machine in which the item of interest occurred and wherein the detection is performed on a fee-per-service basis.

12. An apparatus for providing event detection in computer systems, said apparatus comprising:

an arrangement for detecting an item of interest;

an arrangement for determining at least one event near to the item of interest;

an arrangement for correlating the at least one event with the item of interest; and

an arrangement for thereafter determining at least one probable cause of the item of interest.

13. The apparatus according to claim 12, wherein the item of interest comprises at least one of:

malfunctioning software, slow software, adware, spyware, at least one virus, corruption of information, defective I/O, defective network connectivity, browser hijacking.

14. The apparatus according to claim 12, wherein said arrangement for determining at least one event is adapted to analyze at least one event within a predetermined time threshold on at least one machine.

15. The apparatus according to claim 14, wherein the at least one machine comprises at least one of:

a user'"'"'s machine and a machine other than a user'"'"'s machine.

16. The apparatus according to claim 12, wherein said arrangement for determining at least one event is adapted to determine at least one event via a finite-state acceptor.

17. The apparatus according to claim 12, wherein said correlating arrangement is adapted to perform at least one of:

analyzing at least one event and an item of interest of a user; and

analyzing at least one event and an item of interest of another user.

18. The apparatus according to claim 12, wherein said arrangement for determining at least one probable cause is adapted to test a corrective apparatus and ascertaining whether the corrective apparatus adequately attends to the item of interest on one or more machines.

19. The apparatus according to claim 12, wherein the at least one event comprises at least one of:

at least one mouse event;

at least one keyboard event;

at least one browser requests via at least one of http and ftp;

at least one mail event via SMTP;

running software;

file creation;

file alteration;

software installation, hardware installation, at least one signature of a CPU, disk, I/O, or memory use.

20. The apparatus according to claim 12, wherein the apparatus is implemented on a computer network which comprises at least one of:

a peer model network, a shared server model network.

21. The apparatus according to claim 12, wherein said arrangement for detecting an item of interest is located in a site remote from the item of interest.

22. The apparatus according to claim 21, wherein said arrangement for detecting an item of interest is operated by a service provider other than an owner of a machine in which the item of interest occurred and wherein the detection is performed on a fee-per-service basis.

23. A program storage device readable by machine, tangibly embodying a program of instructions executed by the machine to perform method steps for event detection in computer systems, said method comprising the steps of:

detecting an item of interest;

determining at least one event near to the item of interest;

correlating the at least one event with the item of interest; and

thereafter determining at least one probable cause of the item of interest.