RANDOM EVENT CAPTURING MECHANISM FOR APPLICATION SYSTEMS

• US 20150019913A1
• Filed: 07/10/2013
• Published: 01/15/2015
• Est. Priority Date: 07/10/2013
• Status: Active Grant

• Current Assignee: Cellco Partnership, Inc. (Verizon Communications Inc.)
• Original Assignee: Cellco Partnership, Inc. (Verizon Communications Inc.)
• Inventors: SINGH, Shivinder, JOSEPH, Sojan, REDDY, Krishna
• Granted Patent: US 9,176,807 B2
• Time in Patent Office: Days
• US Class Current: 714/37
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0775 Content or structure details of the error report, e.g. specific table structure, specific error fields
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/2257 using expert systems
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/064 involving time analysis
• CPC Class Codes: H04L 41/065 involving logical or physical relationship, e.g. grouping and hierarchies

Abstract

A device may receive a first alert from a first technology layer of an information technology system. The first alert may be associated with an occurrence of a first event within the first technology layer. The device may receive a second alert from a second, different technology layer of the information technology system. The second alert may be associated with an occurrence of a second event within the second technology layer. The device may determine that the first alert is related to the second alert. The device may generate, based on the first alert being related to the second alert, a third alert that includes information associated with the first alert and information associated with the second alert. The device may provide the third alert to at least one of the first technology layer or the second technology layer.

Claims

1. A method comprising:

receiving, by a device, a first alert from a first technology layer of an information technology system,

the first alert being associated with an occurrence of a first event within the first technology layer;

receiving, by the device, a second alert from a second technology layer of the information technology system,

the second alert being associated with an occurrence of a second event within the second technology layer, and

the second technology layer being different from the first technology layer;

determining, by the device, that the first alert is related to the second alert;

generating, by the device and based on the first alert being related to the second alert, a third alert that includes information associated with the first alert and information associated with the second alert; and

providing, by the device, the third alert to at least one of the first technology layer or the second technology layer.

2. The method of claim 1, further comprising:

classifying the first alert based on the first alert being associated with at least one of;

a particular device,

a particular process, or

a particular application; and

classifying the second alert based on the second alert being associated with at least one of;

the particular device,

the particular process, or

the particular application; and

where determining that the first alert is related to the second alert includes;

determining that the first alert is related to the second alert based on classifying the first alert and classifying the second alert.

3. The method of claim 2, wherein determining that the first alert is related to the second alert includes:

determining that the first alert and the second alert have a same classification, and

determining that the first alert is related to the second alert based on the first alert and the second alert having the same classification,

the first alert and the second alert being determined to be related only when the first alert and the second alert have the same classification.

4. The method of claim 2, wherein determining that the first alert is related to the second alert includes:

forming a group of alerts associated with the at least one of;

the particular device,

the particular process, or

the particular application,

the group of alerts including the first alert and the second alert, and

determining that the first alert is related to the second alert based on the first alert and the second alert being included in the group of alerts.

5. The method of claim 1, wherein generating the third alert includes:

determining that the first alert was generated at a first time,

determining that the second alert was generated at a second time,

the second time being subsequent to the first time, and

generating the third alert as a chronological listing of alerts that includes the first alert and the second alert,

the first alert being listed in the chronological listing of alerts prior to the second alert based on the second time being subsequent to the first time.

6. The method of claim 1, further comprising:

receiving a fourth alert,

the fourth alert being related to the second alert; and

where generating the third alert includes;

determining that the fourth alert is related to the second alert,

determining whether the fourth alert is received from the second technology layer, and

selectively including, in the third alert, information associated with the fourth alert based on whether the fourth alert is received from the second technology layer,

the information associated with the fourth alert being included in the third alert when the fourth alert is not received from the second technology layer, and

the information associated with the fourth alert being omitted from the third alert when the fourth alert is received from the second technology layer.

7. The method of claim 1, further comprising:

determining a sequence of events based on the information associated with the first alert and the information associated with the second alert,

the sequence of events including the first event and the second event; and

determining that the occurrence of the second event results from the occurrence of the first event based on the sequence of events.

8. A device comprising:

a processor to;

receive a first alert from a first technology layer of an information technology system,

the first alert being associated with an occurrence of a first event within the first technology layer;

receive a second alert from a second technology layer of the information technology system,

the second alert being associated with an occurrence of a second event within the second technology layer, and

the second technology layer being different from the first technology layer;

determine that the first alert is related to the second alert;

generate, based on the first alert being related to the second alert, a system alert that includes;

alert-related information associated with the first alert, and

alert-related information associated with the second alert; and

provide the system alert to one or more of the first technology layer or the second technology layer.

9. The device of claim 8, where the processor is further to:

determine a classification for the first alert based on the first alert being associated with one or more of;

a particular device,

a particular process, or

a particular application; and

determine a classification for the second alert based on the first alert being associated with one or more of;

the particular device,

the particular process, or

the particular application; and

where, when determining that the first alert is related to the second alert, the processor is to;

determine that the first alert is related to the second alert based on the classification determined for the first alert and the classification determined for the second alert.

10. The device of claim 9, where, when determining that the first alert is related to the second alert, the processor is to:

determine that the first alert and the second alert are associated with a particular classification, and

determine that the first alert is related to the second alert based on the first alert and the second alert being associated with the particular classification,

the first alert and the second alert being related only when the first alert and the second alert are associated with a same classification.

11. The device of claim 8, where, when determining that the first alert is related to the second alert, the processor is to:

determine that the first alert is associated with one or more of;

a particular device,

a particular process, or

a particular application,

determine that the second alert is associated with the one or more of the particular device, the particular process, or the particular application,

form a group of alerts associated with the one or more of the particular device, the particular process, or the particular application,

the group of alerts including the first alert and the second alert, and

determine that the first alert is related to the second alert based on the first alert and the second alert being included in the group of alerts.

12. The device of claim 8, where, when generating the system alert, the processor is to:

determine a time at which the first alert was generated,

determine a time at which the second alert was generated, and

generate, based on the time at which the first alert was generated and the time at which the second alert was generated, the system alert as a chronological listing of alerts,

the chronological listing of alerts including the first alert and the second alert.

13. The device of claim 8, where the processor is further to:

receive a fourth alert,

the fourth alert being related to the second alert; and

where, when generating the system alert, the processor is to;

determine that the fourth alert is related to the second alert,

determine whether the fourth alert is received from the second technology layer, and

selectively include, in the system alert, alert-related information associated with the fourth alert based on whether the fourth alert is received from the second technology layer,

the system alert including the alert-related information associated with the fourth alert when the fourth alert is not received from the second technology layer, and

the system alert omitting the alert-related information associated with the fourth alert when the fourth alert is received from the second technology layer.

14. The device of claim 8, where the processor is further to:

determine a sequence of events based on the alert-related information associated with the first alert and the alert-related information associated with the second alert,

the sequence events including the first event and the second event; and

determine, based on the sequence of events, that the occurrence of the second event results from the occurrence of the first event.

15. A computer-readable medium storing instructions, the instructions comprising:

one or more instructions that, when executed by one or more processors, cause the one or more processors to;

receive a first alert associated with an occurrence of a first event,

the first event occurring within an information technology system;

receive a second alert from a particular technology layer of the information technology system,

the second alert being associated with an occurrence of a second event within the particular technology layer;

determine that the first alert is related to the second alert;

determine whether the first event occurred within the particular technology layer or within another, different technology layer;

generate, based on the first alert being related to the second alert, a system alert that includes;

alert-related information associated with the first alert, and

alert-related information associated with the second alert;

provide the system alert to the particular technology layer; and

selectively provide the system alert to the other technology layer based on whether the first event occurred within the particular technology layer or within the other technology layer,

the system alert being provided to the other technology layer when the first event occurred within the other technology layer, and

the system alert not being provided to the other technology layer when the first event occurred within the particular technology layer.

16. The computer-readable medium of claim 15, where the instructions further comprise:

one or more instructions that, when executed by the one or more processors, cause the one or more processors to;

determine a classification for the first alert based on the first alert being associated with;

a particular device,

a particular process, or

a particular application; and

determine a classification for the second alert based on the second alert being associated with;

the particular device,

the particular process, or

the particular application; and

where the one or more instructions to determine that the first alert is related to the second alert further cause the one or more processors to;

determine that the first alert is related to the second alert based on the classification determined for the first alert and the classification determined for the second alert.

17. The computer-readable medium of claim 15, where the one or more instructions to determine that the first alert is related to the second alert further cause the one or more processors to:

determine that the first alert and the second alert are associated with a particular classification, and

determine that the first alert is related to the second alert based on the first alert and the second alert being associated with the particular classification,

the first alert and the second alert being related only when the first alert and the second alert are associated with a same classification.

18. The computer-readable medium of claim 15, where the one or more instructions to determine that the first alert is related to the second alert further cause the one or more processors to:

determine that the first alert is associated with a particular application provided by the information technology system,

determine that the second alert is associated with the particular application,

form a group of alerts associated with the particular application,

the first alert and the second alert being included in the group of alerts, and

determine that the first alert is related to the second alert based on the first alert and the second alert being included in the group of alerts.

19. The computer-readable medium of claim 15, where the one or more instructions to generate the system alert further cause the one or more processors to:

determine a time at which the first alert was generated,

determine a time at which the second alert was generated,

generate, based on the time at which the first alert was generated and the time at which the second alert was generated, a chronological listing of alerts, and

generate the system alert based on the chronological listing of alerts,

the chronological listing of alerts including the first alert and the second alert.

20. The computer-readable medium of claim 15, where the instructions further comprise:

one or more instructions that, when executed by the one or more processors, cause the one or more processors to;

determine a sequence of events based on the alert-related information associated with the first alert and the alert-related information associated with the second alert; and

determine, based on the sequence of events, that the first event is a root cause of the second event.