METHOD AND SYSTEM FOR TIME-BASED CORRELATION OF EVENTS

• US 20130139179A1
• Filed: 11/28/2011
• Published: 05/30/2013
• Est. Priority Date: 11/28/2011
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Inventors: Roll, Stuart L.
• Granted Patent: US 8,966,501 B2
• Time in Patent Office: Days
• US Class Current: 719/318
• CPC Class Codes: G05B 23/0264 Control of logging system, e.g. decision on which data to store; time-stamping measurements
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0748 in a remote unit communicating with a single-box computer node experiencing an error/fault remote testing G06F11/2294
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/3419 by assessing time
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: G06F 2201/88 Monitoring involving counting

Abstract

A method includes receiving event information corresponding to an event associated with the operation of a system. The method also includes identifying related event information corresponding to a plurality of events that occurred before the event, wherein the event is related to the plurality of events. The method also includes storing the event information and the related event information as a group of events. The method further includes determining whether the group of events occurred within a first specified amount of time by identifying a time window ending at the occurrence of the event and beginning the first specified amount of time before the occurrence of the event and determining whether each event of the group of events occurred during the identified time window. The method further includes identifying an incident associated with the group of events upon determining that the group of events occurred within the first specified amount of time.

Claims

1. A method, comprising:

receiving, from an interface, event information corresponding to an event associated with the operation of a system;

identifying, at a processor, related event information corresponding to a plurality of events that occurred before the event, wherein the event is related to the plurality of events;

storing, in a memory, the event information and the related event information as a group of events;

determining, at the processor, whether the group of events occurred within a first specified amount of time, by;

identifying a time window ending at the occurrence of the event and beginning the first specified amount of time before the occurrence of the event;

determining whether each event of the group of events occurred during the identified time window; and

identifying, at the processor, an incident associated with the group of events upon determining that the group of events occurred within the first specified amount of time.

2. The method of claim 1, further comprising deleting, from the group of events, each event of the group of events that did not occur during the identified time window.

3. The method of claim 2, further comprising:

identifying a maximum number of events allowed to be stored in the group of events;

determining whether the group of events comprises the maximum number of events.

4. The method of claim 1, wherein identifying an incident associated with the group of events comprises evaluating a rule to identify the incident.

5. The method of claim 4, wherein evaluating a rule to identify the incident comprises evaluating a plurality of sub-rules associated with the rule.

6. The method of claim 1, further comprising:

receiving additional event information corresponding to one or more additional events associated with the operation of the system; and

determining that the one or more additional events are associated with the identified incident.

7. The method of claim 6, wherein determining that the one or more additional events are associated with the identified incident comprises determining that the one or more additional events occurred within a second specified amount of time after identifying the incident.

8. The method of claim 7, wherein determining that the one or more additional events are associated with the identified incident further comprises determining that an amount of time that lapses between each of the one or more additional events is less than a third specified amount of time.

9. The method of claim 1, wherein identifying related event information corresponding to a plurality of events that occurred before the event comprises evaluating a filter to determine that the event is related to the plurality of events.

10. A system, comprising:

an interface operable to receive event information corresponding to an event;

a processor coupled to the interface and operable to identify related event information corresponding to a plurality of events that occurred before the event, wherein the event is related to the plurality of events;

a memory coupled to the processor and operable to store the event information and the related event information as a group of events; and

wherein the processor is further operable to;

determine whether the group of events occurred within a first specified amount of time, by;

identifying a time window ending at the occurrence of the event and beginning the first specified amount of time before the occurrence of the event;

determining whether each event of the group of events occurred during the identified time window; and

identify an incident associated with the group of events upon determining that the group of events occurred within the first specified amount of time.

11. The system of claim 10, wherein the processor is further operable to delete, from the group of events, each event of the group of events that did not occur during the identified time window.

12. The system of claim 11, wherein the processor is further operable to:

identify a maximum number of events allowed to be stored in the group of events;

determine whether the group of events comprises the maximum number of events.

13. The system of claim 10, wherein the processor operable to identify an incident associated with the group of events comprises the processor operable to evaluate a rule to identify the incident.

14. The system of claim 13, wherein the processor operable to evaluate a rule to identify the incident comprises the processor operable to evaluate a plurality of sub-rules associated with the rule.

15. The system of claim 10, wherein:

the interface is further operable to receive additional event information corresponding to one or more additional events; and

the processor is further operable to determine that the one or more additional events are associated with the identified incident.

16. The system of claim 15, wherein the processor operable to determine that the one or more additional events are associated with the identified incident comprises the processor operable to determine that the one or more additional events occurred within a second specified amount of time after identifying the incident.

17. The system of claim 16, wherein the processor operable to determine that the one or more additional events are associated with the identified incident comprises the processor operable to determine that an amount of time that lapses between each of the one or more additional events is less than a third specified amount of time.

18. The system of claim 10, wherein the processor operable to identify related event information corresponding to a plurality of events that occurred before the event comprises the processor operable to evaluate a filter to determine that the event is related to the plurality of events.

19. Logic embodied in non-transitory computer readable media, the logic, when executed by a processor, operable to:

receive event information corresponding to an event associated with the operation of a system;

identify related event information corresponding to a plurality of events that occurred before the event, wherein the event is related to the plurality of events;

store the event information and the related event information as a group of events;

determine whether the group of events occurred within a first specified amount of time, by;

identifying a time window ending at the occurrence of the event and beginning the first specified amount of time before the occurrence of the event;

determining whether each event of the group of events occurred during the identified time window; and

identify an incident associated with the group of events upon determining that the group of events occurred within the first specified amount of time.

20. The computer readable media of claim 19, wherein the logic is further operable to delete, from the group of events, each event of the group of events that did not occur during the identified time window.

21. The computer readable media of claim 20, wherein the logic is further operable to:

identify a maximum number of events allowed to be stored in the group of events;

determine whether the group of events comprises the maximum number of events.

22. The computer readable media of claim 19, wherein the logic operable to identify an incident associated with the group of events comprises logic operable to evaluate a rule to identify the incident.

23. The computer readable media of claim 22, wherein the logic operable to evaluate a rule to identify the incident comprises logic operable to evaluate a plurality of sub-rules associated with the rule.

24. The computer readable media of claim 19, wherein the logic is further operable to:

receive additional event information corresponding to one or more additional events associated with the operation of the system; and

determine that the one or more additional events are associated with the identified incident.

25. The computer readable media of claim 24, wherein the logic operable to determine that the one or more additional events are associated with the identified incident comprises logic operable to determine that the one or more additional events occurred within a second specified amount of time after identifying the incident.

26. The computer readable media of claim 25, wherein the logic operable to determine that the one or more additional events are associated with the identified incident comprises logic operable to determine that an amount of time that lapses between each of the one or more additional events is less than a third specified amount of time.

27. The computer readable media of claim 19, wherein the logic operable to identify related event information corresponding to a plurality of events that occurred before the event comprises logic operable to evaluate a filter to determine that the event is related to the plurality of events.