AUTOMATIC EVENT CORRELATION IN COMPUTING ENVIRONMENTS

• US 20140040916A1
• Filed: 07/31/2012
• Published: 02/06/2014
• Est. Priority Date: 07/31/2012
• Status: Active Grant

• Current Assignee: Micro Focus LLC (Open Text Corporation)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Balakrishnan, Sandhya
• Granted Patent: US 8,930,964 B2
• Time in Patent Office: Days
• US Class Current: 719/313
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications

Abstract

Systems and methods of automatic event correlation for computing environments are disclosed. An example method may include parsing an event message to identify an event, and marking the event message when the event is related to a previous event. The method may also include adding the marked event message to a trail of events. The method may also include parsing the trail of events. The method may also include changing the marked event message when parsing the trail of events confirms a condition in the computing environment.

Claims

1. A method of automatic event correlation in a computing environment, comprising:

parsing an event message to identify an event, and marking the event message when the event is related to a previous event;

adding the marked event message to a trail of events;

parsing the trail of events; and

changing the marked event message when parsing the trail of events confirms a condition in the computing environment.

2. The method of claim 1, wherein marking the event message comprises coloring the event message when a pattern is identified.

3. The method of claim 2, wherein marking the event message comprises changing color of the event message when the pattern is a consequence of another event.

4. The method of claim 1, wherein marking the event message is with a unique identifier to distinguish correlations from one another.

5. The method of claim 1, further comprising clustering high relational events in the trail of events.

6. The method of claim 1, further comprising temporally parsing event messages, wherein each parsing of the event message is during a predetermined time window.

7. The method of claim 1, further comprising:

updating a dictionary based on parsing the event message; and

accessing the dictionary in a subsequent parsing of event messages.

8. The method of claim 1, further comprising mapping events using a topological classification to correlate events.

9. The method of claim 1, wherein the event message includes information of a configuration item or an event object.

10. The method of claim 1, wherein the condition indicates an anomaly in the computing environment.

11. A system of automatic event correlation in a computing environment, the system comprising program code stored on a computer readable medium and executable by a processor to:

parse an event message to identify an event, and mark the event message if the event is related to a previous event, and add the marked event message to a trail of events;

parse the trail of events; and

change the marked event message when parsing the trail of events confirms a condition in the computing environment.

12. The system of claim 11, wherein the program code is further executable to:

color the event message when a pattern is identified; and

change the color of the event message when the pattern is a consequence of another event.

13. The system of claim 11, wherein the event message has an event object and corresponding event state.

14. The system of claim 11, further comprising a correlation repository to learn events and automate event correlation.

15. The system of claim 14, wherein the program code is further executable to push correlated events into the correlation repository for future use to adapt and learn continuously.

16. The system of claim 11, wherein the program code is further executable to cluster high relational events.

17. The system of claim 11, wherein the program code is further executable to update a dictionary based on parsing event messages.

18. The system of claim 17, wherein the program code is further executable to access the dictionary to determine event relations.

19. The system of claim 11, further comprising mapping events using a topological classification of event correlations.

20. The system of claim 11, wherein the condition predicts an anomaly.