AUTOMATIC CORRELATION OF DYNAMIC SYSTEM EVENTS WITHIN COMPUTING DEVICES

• US 20140172919A1
• Filed: 12/18/2012
• Published: 06/19/2014
• Est. Priority Date: 12/18/2012
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Johnston, Jay Kemper, White, David C. Jr., Dreier, Christopher Blayne
• Granted Patent: US 9,239,887 B2
• Time in Patent Office: Days
• US Class Current: 707/797
• CPC Class Codes: G06F 11/07 Responding to the occurrence of a fault, e.g. fault tolerance
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/0775 Content or structure details of the error report, e.g. specific table structure, specific error fields
• CPC Class Codes: G06F 11/0787 Storage of error reports, e.g. persistent data storage, storage using memory protection
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/366 using diagnostics G06F11/0703 takes precedence
• CPC Class Codes: G06F 16/1734 Details of monitoring file system events, e.g. by the use of hooks, filter drivers, logs
• CPC Class Codes: G06F 16/2246 Trees, e.g. B+trees
• CPC Class Codes: G06F 16/2455 Query execution
• CPC Class Codes: G06F 16/9027 Trees
• CPC Class Codes: G06F 40/137 Hierarchical processing, e.g. outlines
• CPC Class Codes: H04L 41/0636 based on a decision tree analysis
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00

Abstract

Systems and methods are described herein for logging system events within an electronic machine using an event log structured as a collection of tree-like cause and effect graphs. An event to be logged may be received. A new event node may be created within the event log for the received event. One or more existing event nodes within the event log may be identified as having possibly caused the received event. One or more causal links may be created within the event log between the new event node and the one or more identified existing event nodes. The new event node may be stored as an unattached root node in response to not identifying an existing event node that may have caused the received event.

Claims

1. A method, comprising:

providing, using a computing device, an event log structured as a collection of tree-like graphs;

receiving, using the computing device, information regarding a new event to be logged;

creating, using the computing device, a new event node within the event log for the new event;

identifying, using the computing device, any existing event nodes within the event log that each represent a respective past event that may have caused the new event;

creating, using the computing device, a causal link within the event log between the new event node and each of the identified existing event nodes; and

storing, using the computing device, the new event node as an unattached root node in response to not identifying an existing event node representing a past event that may have caused the new event.

2. The method of claim 1, wherein identifying any existing event nodes that each represent a respective past event that may have caused the new event comprises matching a characteristic of the new event node to a characteristic of the existing event nodes.

3. The method of claim 1, wherein identifying any existing event nodes that each represent a respective past event that may have caused the new event comprises computing a correlation metric between the new event node and the existing event nodes.

4. The method of claim 1, wherein identifying any existing event nodes that each represent a respective past event that may have caused the new event comprises searching existing event nodes created within a specified time period.

5. The method of claim 1, further comprising refreshing a last used parameter of each of the identified existing event nodes within the event log when the causal link is created to the new event node.

6. The method of claim 1, further comprising determining a deletion order of event nodes within the event log according to a last used parameter associated with the event nodes.

7. The method of claim 1, further comprising displaying tree-like relationships among the event nodes within the event log.

8. A system, comprising:

a computing device comprising an event logging module and an event log configured to;

receive information regarding a new event to be logged;

create an event node representing the new event within the event log;

storing the event node within the event log in a structure comprising a collection of tree-like graphs where links within the graphs represent causal relationships between events represented by linked nodes; and

providing an output of one or more result tree-like graphs in response to a user search for an event represented by an event node linked within the one or more result tree-like graphs.

9. The system of claim 8, wherein one or more of the links is established where one or more existing event nodes within the event log is identified as possibly having caused the event node by matching a characteristic of the event node to a characteristic of the one or more existing event nodes.

10. The system of claim 8, wherein one or more of the links is established where one or more existing event nodes within the event log is identified as possibly having caused the event node by computing a correlation metric between the event node and the one or more existing event nodes.

11. The system of claim 8, wherein one or more of the links is established where one or more existing event nodes within the event log is identified as possibly having caused the event node by searching existing event nodes created within a specified time period.

12. The system of claim 8, wherein the computing device is further configured to maintain a last used parameter for each of the event nodes within the event log.

13. The system of claim 8, wherein a last used parameter is associated with the event nodes within the event log for determining a deletion order of event nodes.

14. The system of claim 8, wherein the computing device is further configured to graphically display tree-like relationships among the event nodes within the event log.

15. A computer program product, comprising:

a non-transitory computer-readable medium having computer-readable program code embodied therein that, when executed by one or more computing machines, perform a method comprising;

providing an event log structured as a collection of tree-like graphs;

receiving information regarding a new event to be logged;

creating a new event node within the event log for the new event;

identifying any existing event nodes within the event log that each represent a respective past event that may have caused the new event;

creating a causal link within the event log between the new event node and each of the identified existing event nodes; and

storing the new event node as an unattached root node in response to not identifying an existing event node representing a past event that may have caused the new event.

16. The computer program product of claim 15, wherein identifying any existing event nodes that each represent a respective past event that may have caused the new event comprises matching a characteristic of the new event node to a characteristic of the existing event nodes.

17. The computer program product of claim 15, wherein identifying any existing event nodes that each represent a respective past event that may have caused the new event comprises computing a correlation metric between the new event node and the existing event nodes.

18. The computer program product of claim 15, wherein identifying any existing event nodes that each represent a respective past event that may have caused the new event comprises searching existing event nodes created within a specified time period.

19. The computer program product of claim 15, further comprising determining a deletion order of event nodes within the event log according to a last used parameter associated with the event nodes.

20. The computer program product of claim 15, further comprising displaying tree-like relationships among the event nodes within the event log.