MANAGEMENT BASED ON COMPUTER DYNAMICALLY ADJUSTED DISCRETE PHASES OF EVENT CORRELATION

• US 20090171704A1
• Filed: 12/28/2007
• Published: 07/02/2009
• Est. Priority Date: 12/28/2007
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: BOBAK, Mythili K., SWANSON, Michael D., MCCONNELL, Tim A.
• Granted Patent: US 8,682,705 B2
• Time in Patent Office: Days
• US Class Current: 705/7
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/0631 Resource planning, allocation, distributing or scheduling for enterprises or organisations
• CPC Class Codes: G06Q 10/103 Workflow collaboration or project management
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis

Abstract

Management of a customer'"'"'s IT environment is facilitated by correlating events that occur within the environment, obtaining information relating to those events, and performing actions, such as environment tuning or recovery actions, based on the information. Discrete phases of processing are used to obtain the information and/or perform the actions. One or more of these discrete processing phases have tunable time intervals associated therewith. That is, at least one time interval is dynamically adjusted based on the runtime state of the environment.

Claims

1. A computer-implemented method to facilitate event correlation, said method comprising:

executing a plurality of discrete phases of processing, in response to an occurrence of an event in an Information Technology (IT) environment, to obtain a set of related information associated with the event; and

adjusting a time interval associated with at least one discrete phase of the plurality of discrete phases based on real-time status of the IT environment, said adjusting affecting the obtained set of related information.

2. The computer-implemented method of claim 1, further comprising using the obtained set of related information to manage the IT environment.

3. The computer-implemented method of claim 2, wherein the obtained set of related information is used to manage availability of the IT environment.

4. The computer-implemented method of claim 3, wherein availability of the IT environment is managed within a specified goal.

5. The computer-implemented method of claim 4, wherein the specified goal comprises a recovery time objective.

6. The computer-implemented method of claim 5, wherein the recovery time objective is related to a business application of the IT environment.

7. The computer-implemented method of claim 1, wherein the plurality of discrete phases comprises first occurrence of the event, time from first occurrence of the event to a time to start collecting state information, time to stop collecting the state information, time to formulate an action plan for the one or more events, projected time to end taking action.

8. The computer-implemented method of claim 7, wherein the projected time to end is prior to a goal objective of one or more resources affected by the event.

9. The computer-implemented method of claim 1, wherein the adjusting provides a delay to enable additional information relating to the event to be included in the set of related information.

10. The computer-implemented method of claim 1, wherein one or more relationships are used to obtain the set of related information.

11. The computer-implemented method of claim 10, wherein the relationships comprise at least one of one or more implied relationships or one or more explicit relationships.

12. The computer-implemented method of claim 1, wherein time to complete each discrete phase is determined at runtime.

13. The computer-implemented method of claim 1, wherein the time for each discrete phase is dynamically calculated to achieve a goal specified for the IT environment.

14. The computer-implemented method of claim 1, wherein the event comprises occurrence of a plurality of correlated failures.

15. A system to facilitate event correlation, said system comprising:

at least one processor to execute a plurality of discrete phases of processing, in response to an occurrence of an event in an Information Technology (IT) environment, to obtain a set of related information associated with the event; and

at least one processor to adjust a time interval associated with at least one discrete phase of the plurality of discrete phases based on real-time status of the IT environment, said adjusting affecting the obtained set of related information.

16. The system of claim 15, wherein the obtained set of related information is used to manage availability of the IT environment within a specified goal.

17. The system of claim 15, wherein one or more relationships are used to obtain the set of related information.

18. An article of manufacture comprising:

at least one computer usable medium having computer readable program code logic to facilitate event correlation, said computer readable program code logic when executing performing the following;

executing a plurality of discrete phases of processing, in response to an occurrence of an event in an Information Technology (IT) environment, to obtain a set of related information associated with the event; and

adjusting a time interval associated with at least one discrete phase of the plurality of discrete phases based on real-time status of the IT environment, said adjusting affecting the obtained set of related information.

19. The article of manufacture of claim 18, further comprising using the obtained set of related information to manage availability of the IT environment within a specified goal.

20. The article of manufacture of claim 18, wherein the adjusting provides a delay to enable additional information relating to the event to be included in the set of related information.