Dynamic Partitioning of Event Patterns for Determining Symptoms

• US 20090113242A1
• Filed: 10/25/2007
• Published: 04/30/2009
• Est. Priority Date: 10/25/2007
• Status: Active Grant

• Current Assignee: LinkedIn Corporation (Microsoft Corporation)
• Original Assignee: International Business Machines Corporation
• Inventors: Nastacio, Denilson, Miller, Brent A., Perazolo, Marcelo
• Granted Patent: US 7,793,151 B2
• Time in Patent Office: Days
• US Class Current: 714/25
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36

Abstract

Events experienced by resources are locally processed by secondary autonomic managers into consolidated events. These consolidated events are then transmitted to a primary autonomic manager, which recognizes symptoms of conditions found in a computer system that utilizes the resources. The primary autonomic manager is thus able to leverage information in a symptom catalog to process the consolidated events to recognize such symptoms.

Claims

1. A method for identifying event-correlated symptoms in a computer system, the method comprising:

associating an original pattern of computer events with a symptom of a computer system;

partitioning the original pattern of computer events into multiple sub-patterns;

associating at least one of the multiple sub-patterns with a single consolidated event;

receiving, at a secondary autonomic manager, multiple events from a resource;

correlating, at the secondary autonomic manager, the multiple events received at the secondary autonomic manager with a particular sub-pattern that describes the single consolidated event;

converting, at the secondary autonomic manager, the particular sub-pattern into the single consolidated event;

transmitting the single consolidated event from the secondary autonomic manager to a primary autonomic manager, wherein the single consolidated event is transmitted on a bus that couples the secondary autonomic manager to the primary autonomic manager;

replacing, at the primary autonomic manager, the particular sub-pattern in the original pattern with the single consolidated event to create a prepared pattern; and

utilizing, at the primary autonomic manager, the prepared pattern to identify the symptom.

2. The method of claim 1, wherein the resource is a hardware resource in the computer system.

3. The method of claim 1, wherein the resource is a software resource in the computer system.

4. The method of claim 1, wherein the symptom describes an anomaly in the computer system.

5. The method of claim 4, further comprising:

generating a corrective response to the anomaly.

6. The method of claim 1, wherein all sub-patterns are composed of multiple resource events.

7. A system comprising:

a processor;

a data bus coupled to the processor;

a memory coupled to the data bus; and

a computer-usable medium embodying computer program code, the computer program code comprising instructions executable by the processor and configured for identifying event-correlated symptoms in a computer system by performing the steps of;

associating an original pattern of computer events with a symptom of a computer system;

partitioning the original pattern of computer events into multiple sub-patterns;

associating at least one of the multiple sub-patterns with a single consolidated event;

receiving, at a secondary autonomic manager, multiple events from a resource;

correlating, at the secondary autonomic manager, the multiple events received at the secondary autonomic manager with a particular sub-pattern that describes the single consolidated event;

converting, at the secondary autonomic manager, the particular sub-pattern into the single consolidated event;

transmitting the single consolidated event from the secondary autonomic manager to a primary autonomic manager, wherein the single consolidated event is transmitted on a bus that couples the secondary autonomic manager to the primary autonomic manager;

replacing, at the primary autonomic manager, the particular sub-pattern in the original pattern with the single consolidated event to create a prepared pattern; and

utilizing, at the primary autonomic manager, the prepared pattern to identify the symptom.

8. The system of claim 7, wherein the resource is a hardware resource in the computer system.

9. The system of claim 7, wherein the resource is a software resource in the computer system.

10. The system of claim 7, wherein the symptom describes an anomaly in the computer system.

11. The system of claim 10, further comprising:

generating a corrective response to the anomaly.

12. The system of claim 7, wherein all sub-sequence patterns are composed of multiple resource events.

13. A computer program product for identifying event-correlated symptoms in computer system, the computer program product comprising:

a computer usable medium having computer usable program code embodied therewith, the computer usable program code comprising;

computer usable program code configured to associate an original sequence pattern of computer events with a symptom of a computer system;

computer usable program code configured to partition the original sequence pattern of computer events into multiple sub-sequence patterns;

computer usable program code configured to associate at least one of the multiple sub-sequence patterns with a single consolidated event;

computer usable program code configured to receive, at a secondary autonomic manager, multiple events from a resource;

computer usable program code configured to correlate, at the secondary autonomic manager, the multiple events received at the secondary autonomic manager with a particular sub-sequence pattern that describes the single consolidated event;

computer usable program code configured to convert, at the secondary autonomic manager, the particular sub-sequence pattern into the single consolidated event;

computer usable program code configured to transmit the single consolidated event from the secondary autonomic manager to a primary autonomic manager, wherein the single consolidated event is transmitted on a bus that couples the secondary autonomic manager to the primary autonomic manager, and wherein bandwidth on the bus is conserved by the transmission of the single consolidated event instead of the particular sub-sequence pattern;

computer usable program code configured to replace, at the primary autonomic manager, the particular sub-sequence pattern in the original sequence pattern with the single consolidated event to create a prepared sequence pattern; and

utilizing, at the primary autonomic manager, the prepared sequence pattern to identify the symptom.

14. The computer program product of claim 13, wherein the resource is a hardware resource in the computer system.

15. The computer program product of claim 13, wherein the resource is a software resource in the computer system.

16. The computer program product of claim 13, wherein the symptom describes an anomaly in the computer system.

17. The computer program product of claim 16, wherein the computer usable program code further comprises:

computer usable program code configured to generating a corrective response to the anomaly.

18. The computer program product of claim 13, wherein all sub-sequence patterns are composed of multiple resource events.

19. The computer program product of claim 13, wherein the computer usable medium is a component of a remote server, and wherein the computer usable program code is deployable to a local client computer from the remote server.

20. The computer program product of claim 13, wherein the computer usable program code is capable of being provided by a service provider to a customer on an on-demand basis.