METHODS FOR DECOMPOSING EVENTS FROM MANAGED INFRASTRUCTURES

• US 20170060663A1
• Filed: 11/14/2016
• Published: 03/02/2017
• Est. Priority Date: 04/29/2013
• Status: Active Grant

• Current Assignee: Dell Products LP (Dell Technologies Inc.)
• Original Assignee: Moogsoft Inc. (Dell Technologies Inc.)
• Inventors: Tee, Philip, Harper, Robert Duncan, Silvey, Charles Mike
• Granted Patent: US 10,474,520 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/0775 Content or structure details of the error report, e.g. specific table structure, specific error fields
• CPC Class Codes: G06F 11/0778 Dumping, i.e. gathering error/state information after a fault for later diagnosis
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/30 Monitoring
• CPC Class Codes: G06F 11/328 Computer systems status display G06F11/327 takes precedence
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/9024 Graphs; Linked lists G06F16/9027 takes precedence
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/0823 Errors, e.g. transmission errors
• CPC Class Codes: H04L 51/063 Content adaptation, e.g. replacement of unsuitable content
• CPC Class Codes: H04L 67/75 Indicating network or usage conditions on the user display

Abstract

A method is provided for clustering events. Messages are received at an extraction engine from managed infrastructure that includes managed infrastructure physical hardware that supports the flow and processing of information. Events are produced that relate to the managed infrastructure. The events are converted into words and subsets used to group the events that relate to failures or errors in the managed infrastructure, including the managed infrastructure physical hardware. One or more common characteristics of events are determined and clusters of events are produced relating to the failure or errors in the managed infrastructure. A source address is used for each event as is a graph topology of the managed infrastructure to assign a graph coordinate to the event. Membership in a cluster indicates a common factor of the events that is a failure or an actionable problem in the physical hardware managed infrastructure directed to supporting the flow and processing of information. In response to production of the clusters one or more physical changes are made in the managed infrastructure hardware.

Claims

1. A method for clustering events, comprising:

receiving messages at an extraction engine from managed infrastructure that includes managed infrastructure physical hardware that supports the flow and processing of information;

producing events that relate to the managed infrastructure and converting the events into words and subsets used to group the events that relate to failures or errors in the managed infrastructure, including the managed infrastructure physical hardware;

determining one or more common characteristics of events and producing clusters of events relating to the failure or errors in the managed infrastructure;

using a source address for each event and a graph topology of the managed infrastructure to assign a graph coordinate to the event;

where membership in a cluster indicates a common factor of the events that is a failure or an actionable problem in the physical hardware managed infrastructure directed to supporting the flow and processing of information; and

in response to production of the clusters making one or more physical changes in the managed infrastructure hardware.

2. The method of claim 1, wherein the managed infrastructure is from a business organization.

3. The method of claim 1, wherein the managed infrastructure includes, computers, network devices, appliances, mobile devices, text or numerical values from which those text or numerical values indicate a state of any hardware or software component of the managed infrastructure.

4. The method of claim 1, wherein the managed infrastructure generates data that include attributes selected from at least one of, time, source a description of the event, textural or numerical values from which those text or numerical values indicate a state of any hardware or software component of the managed infrastructure.

5. The method of claim 1, further comprising:

a publication message bus.

6. The method of claim 1, further comprising:

a data bus web server coupled to one or more user interfaces.

7. The method of claim 1, wherein a plurality of link access modules are in communication with a data bus.

8. The method of claim 1, further comprising:

a database.

9. The method of claim 1, wherein the extraction engine reformats data from the events to create reformatted data.

10. The method of claim 9, wherein the reformatted data is received at a system bus.

11. The method of claim 1, wherein a dictionary is generated with the word and subtexts using Shannon Entropy, −

ln(1/NGen) and normalizes the words and subtexts.

12. The method of claim 11, wherein normalized words and subtexts are mapped from a common 0.0 to a non-common 1.0.

13. The method of claim 1, further comprising:

an entropy database that in operation normalizes entropy for events.

14. The method of claim 13, wherein normalized entropy for events is mapped to a common, 0.0 and a non-common, 1.0.

15. The method of claim 1, wherein entropy is assigned to alerts.

16. The method of claim 15, wherein alerts are run in parallel with activities of the extraction engine.

17. The method of claim 15, wherein the alerts are passed to a sigalizer engine.

18. The method of claim 17, wherein the sigalizer engine generates clusters of alerts.

19. The method of claim 1, further comprising:

determining hop and a proximity of the source of the event.

20. The method of claim 1, further comprising:

calculating one or more distances between tile vectors.