System And Method For Circuit And Path Based Event Correlation

• US 20110047262A1
• Filed: 08/19/2009
• Published: 02/24/2011
• Est. Priority Date: 08/19/2009
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: McMahon, Philip Brian, Martin, Daniel Joseph
• Granted Patent: US 8,255,525 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/064 involving time analysis
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/0823 Errors, e.g. transmission errors

Abstract

A method, system and computer-usable medium are disclosed for the correlation of network events. A port of a network device is monitored at the physical layer interface for the occurrence of a network event. If detected, a repository of circuit path, network device, and device interface data is queried for information related to the network event and each network device at each hop of the circuit path associated with the event. A user selects time intervals for other network events or alarms occurring before or after the target event. A repository of network event and alarm data is then queried to retrieve all network events or alarms occurring during the selected time interval. Information related to the network events or alarms are then compared to interfaces related to devices that are likewise associated with the circuit path associated with the event. If the event information does not match the interface, then it is associated as a child event of a network circuit event. Otherwise it is associated as a parent event of a network path query event.

Claims

1. A computer-implemented method for event correlation, comprising processing logic used for:

performing a lookup of network devices which interface with network events associated with a network circuit within a predetermined period of time;

matching events based on predetermined criteria to generate a set of matched events;

making members of the set of matched events a child network event; and

processing the network events to identify a probable parent network event, wherein the probable parent network event is not a member of the set of matched events.

2. The method of claim 1, wherein the performing a lookup and the matching events are performed by an event correlation module of a network management system.

3. The method of claim 1, wherein the network events occur in a network using the Synchronous Optical Networking (SONET) protocol or the Synchronous Digital Hierarchy protocol.

4. The method of claim 1, wherein information related to the network devices is stored in a repository of path, network device, and device interface data.

5. The method of claim 1, wherein:

the parent network event is associated with a network path; and

the child network event is associated with a network circuit.

7. A system comprising:

a processor;

a data bus coupled to the processor; and

a computer-usable medium embodying computer program code, the computer-usable medium being coupled to the data bus, the computer program code used for performing event correlation and comprising instructions executable by the processor and configured for;

performing a lookup of network devices which interface with network events associated with a network circuit within a predetermined period of time; and

matching events based on predetermined criteria to generate a set of matched events;

making members of the set of matched events a child network event, and

processing the network events to identify a probable parent network event, wherein the probable parent network event is not a member of the set of matched events.

6. The method of claim 8, wherein the predetermined period of time is selectable by a user.

8. The system of claim 7, wherein the performing a lookup and the matching events are performed by an event correlation module of a network management system.

9. The system of claim 7, wherein the network events occur in a network using the Synchronous Optical Networking (SONET) protocol or the Synchronous Digital Hierarchy protocol.

10. The system of claim 7, wherein information related to the network devices is stored in a repository of path, network device, and device interface data.

11. The system of claim 7, wherein:

the parent network event is associated with a network path; and

the child network event is associated with a network circuit.

12. The system of claim 7, wherein the predetermined period of time is selectable by a user.

13. A computer-usable medium embodying computer program code, the computer program code comprising computer executable instructions configured for:

performing a lookup of network devices which interface with network events associated with a network circuit within a predetermined period of time; and

matching events based on predetermined criteria to generate a set of matched events;

making members of the set of matched events a child network event; and

processing the network events to identify a probable parent network event wherein the probable parent network event is not a member of the set of matched events.

14. The computer usable medium of claim 13, wherein the performing a lookup and the matching events are performed by an event correlation module of a network management system.

15. The computer usable medium of claim 13, wherein the network events occur in a network using the Synchronous Optical Networking (SONET) protocol or the Synchronous Digital Hierarchy protocol.

16. The computer usable medium of claim 13, wherein information related to the network devices is stored in a repository of path, network device, and device interface data.

17. The computer usable medium of claim 13, wherein:

the parent network event is associated with a network path; and

the child network event is associated with a network circuit.

18. The computer usable medium of claim 13, wherein the predetermined period of time is selectable by a user.

19. The computer usable medium of claim 13, wherein the computer executable instructions are deployable to a client computer from a server at a remote location.

20. The computer usable medium of claim 13, wherein the computer executable instructions are provided by a service provider to a customer on an on-demand basis.