AUTOMATED EVENT CORRELATION

• US 20080276253A1
• Filed: 05/04/2007
• Published: 11/06/2008
• Est. Priority Date: 05/04/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Bendapudi, Perraju, Khandrika, Rajasekhar
• Granted Patent: US 8,205,215 B2
• Time in Patent Office: Days
• US Class Current: 719/318
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications

Abstract

Events captured at an application are compared to event correlation instances, wherein an event correlation instance represents a relationship between events of components of the application. The event of a plurality of events that is a potential root cause event of the plurality of events is determined. The potential root cause event and component associated with the potential root cause event are outputted.

Claims

1. A method, comprising:

comparing events captured at an application to event correlation instances, wherein an event correlation instance represents a relationship between events of components of the application;

determining which event of a plurality of events is a potential root cause event of the plurality of events; and

outputting the potential root cause event and component associated with the potential root cause event.

2. The method of claim 1 wherein comparing events captured at the application to event correlation instances includes flagging event correlation instances that match an event.

3. The method of claim 2 wherein determining which event of the plurality of events is the potential root cause event of the plurality of events includes generating an event mapping using the flagged event correlation instances, wherein the event mapping links together related event correlation instances.

4. The method of claim 3 wherein determining which event of the plurality of events is the potential root cause event of the plurality of events includes backtracking through the event mapping to find the potential root cause event.

5. The method of claim 1, further comprising:

receiving the events from a central event database, wherein captured events of the application are stored in the central event database.

6. The method of claim 1, further comprising:

instantiating an event correlation template to create an event correlation instance.

7. The method of claim 6, further comprising:

creating the event correlation template in response to user input at an event correlation creation user interface (UI).

8. The method of claim 6, further comprising:

downloading the event correlation template from an Internet site.

9. The method of claim 1, further comprising:

displaying the potential root cause event and associated component in a potential root cause user interface (UI).

10. One or more computer readable media including computer readable instructions that when executed perform operations comprising:

comparing events captured at a distributed application to event correlation instances, wherein an event correlation instance represents a relationship between events of components of the distributed application;

determining which event of a plurality of events is a potential root cause event of the plurality of events; and

outputting the potential root cause event and component associated with the potential root cause event.

11. The one or more computer readable media of claim 10 wherein comparing events captured at the distributed application to event correlation instances includes:

flagging a first event correlation instance that matches a first event, wherein the first event correlation includes a first causal event and a first resulting event; and

flagging a second event correlation instance that matches a second event, wherein the second event correlation includes a second causal event and a second resulting event.

12. The one or more computer readable media of claim 11 wherein determining which event of the plurality of events is the potential root cause event of the plurality of events includes:

generating an event mapping using the flagged first and second event correlation instances, wherein the event mapping links together the first and second event correlation instances, wherein the first resulting event of the first event correlation is the same as the second causal event of the second event correlation instance.

13. The one or more computer readable media of claim 12 wherein determining which event of the plurality of events is the potential root cause event of the plurality of events includes:

backtracking from the second resulting event to the second causal event; and

backtracking from the second causal event to the first causal event, wherein the first causal event is the potential root cause event.

14. The one or more computer readable media of claim 10 wherein the computer readable instructions when executed further perform operations comprising:

instantiating an event correlation instance from a event correlation template in response to user input.

15. The one or more computer readable media of claim 14 wherein the computer readable instructions when executed further perform operations comprising:

creating the event correlation template in response to user input.

16. A system, comprising:

an event correlation database to store event correlation instances, wherein an event correlation instance to represent a relationship between events of components of a distributed application; and

an event correlation engine to compare events having occurred at the distributed application to the event correlation instances stored in the event correlation database and to determine which event, and corresponding component, was a potential root cause event of a plurality of events.

17. The system of claim 16 wherein to compare events having occurred at the distributed application to the event correlation instances stored in the event correlation database includes:

flagging event correlation instances that match an event.

18. The system of claim 17 wherein to determine which event, and corresponding component, was the potential root cause of a plurality of events includes:

generating an event mapping using the flagged event correlation instances, wherein the event mapping links together related event correlation instances; and

backtracking through the event mapping to find the potential root cause event.

19. The system of claim 16, further comprising:

a central event database to store events captured at the distributed application and to provide the events to the event correlation engine.

20. The system of claim 16 wherein the event correlation database to store event correlation templates, wherein an event correlation instance is instantiated from an event correlation template.