CORRELATING COMPUTING NETWORK EVENTS

• US 20160344585A1
• Filed: 08/02/2016
• Published: 11/24/2016
• Est. Priority Date: 12/04/2012
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Stern, Edith H., Stewart, Kristian J.
• Granted Patent: US 10,491,453 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 41/0613 based on the type or category of the network elements
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/065 involving logical or physical relationship, e.g. grouping and hierarchies
• CPC Class Codes: H04L 41/0668 by dynamic selection of recovery network elements, e.g. replacement by the most appropriate element after failure
• CPC Class Codes: H04L 41/0686 Additional information in the notification, e.g. enhancement of specific meta-data
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/0843 based on generic templates
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 65/40 Support for services or applications
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/75 Indicating network or usage conditions on the user display
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 69/40 for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A system and technique for correlating computing network events includes an event manager executable by a processor to identify computing resources to be deployed. An identification of a correlation pattern comprising a set of the resources to be deployed is received. A correlation identifier is assigned to the correlation pattern. Each resource of the correlation pattern is configured to include the correlation identifier with an event generated by the respective resource.

Claims

1. A system, comprising:

a processor; and

an event manager executable by the processor to;

identify computing resources to be deployed;

receive an identification of a correlation pattern comprising a set of the resources to be deployed;

assign a correlation identifier to the correlation pattern; and

configure each resource of the correlation pattern to include the correlation identifier with an event generated by the respective resource.

2. The system of claim 1, wherein the event manager is further operable to:

receive a plurality of events from deployed resources;

identify a correlation identifier associated with each of the plurality of received events; and

correlate the events having a common correlation identifier.

3. The system of claim 2, wherein the event manager is further operable to provide an indication of the correlated events.

4. The system of claim 2, wherein the event manager is further operable to condense a plurality of indications of correlated events to a single indication.

5. The system of claim 1, wherein the event manager is further operable to associate the correlation pattern with a deployed application.

6. The system of claim 1, wherein the event manager is further operable to provide the correlation identifier to the respective resources of the correlation pattern upon deployment of the respective resources.

7. A computer program product for correlating computing network events, the computer program product comprising:

a non-transitory computer readable medium having computer readable program code embodied therewith, the computer readable program code comprising computer readable program code configured to;

identify computing resources to be deployed;

receive an identification of a correlation pattern comprising a set of the resources to be deployed;

assign a correlation identifier to the correlation pattern; and

configure each resource of the correlation pattern to include the correlation identifier with an event generated by the respective resource.

8. The computer program product of claim 7, wherein the computer readable program code is configured to:

receive a plurality of events from deployed resources;

identify a correlation identifier associated with each of the plurality of received events; and

correlate the events having a common correlation identifier.

9. The computer program product of claim 8, wherein the computer readable program code is configured to provide an indication of the correlated events.

10. The computer program product of claim 8, wherein the computer readable program code is configured to condense a plurality of indications of correlated events to a single indication.

11. The computer program product of claim 7, wherein the computer readable program code is configured to associate the correlation pattern with a deployed application.

12. The computer program product of claim 7, wherein the computer readable program code is configured to provide the correlation identifier to the respective resources of the correlation pattern upon deployment of the respective resources.

13. A method, comprising:

receiving an alert of a first event;

identifying a first resource associated with the first event;

receiving an alert of a second event;

identifying a second resource associated with the second event;

searching a database of stored resource sets for the first and second resources, each resource set indicating resources deployed in a computing environment according to a deployment template, the deployment template defining resources provisioned for a computing service;

determining whether the first and second resources belong to a common resource set; and

responsive to determining that the first and second resources belong to the common resource set, correlating the first and second events.

14. The method of claim 13, further comprising providing an indication of the correlated events.

15. The method of claim 14, further comprising condensing a plurality of indications of correlated events to a single indication.

16. The method of claim 14, further comprising providing a visual indication of the correlated events.

17. The method of claim 13, further comprising:

responsive to receiving a request to deploy the first or second resource, identifying the deployment template corresponding to the request;

identifying a target resource for the deployment based on the identified deployment template; and

deploying the target resource.

18. The method of claim 17, further comprising storing an association of the deployed first or second resource with the deployment template.