MANAGEMENT OF EVENTS IN EVENT MANAGEMENT SYSTEMS

• US 20190317835A1
• Filed: 04/12/2018
• Published: 10/17/2019
• Est. Priority Date: 04/12/2018
• Status: Active Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: French, Paul B., Breiter, Gerd, Stewart, Kristian J., Lee, John
• Application Number:
  US15/951,247
• Publication Number:
  US 20190317835A1
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/211 Schema design and management
• CPC Class Codes: G06F 16/2477 Temporal data queries
• CPC Class Codes: G06F 16/258 Data format conversion from or to a database
• CPC Class Codes: G06F 16/288 Entity relationship models
• CPC Class Codes: G06F 16/84 Mapping; Conversion
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications

Abstract

A system, method and computer program product are provided for improved management of events. A plurality of events is received from an event source. Each event comprises event data relating to a monitored system associated with the event source. A set of data fields in the event data of the plurality of events is identified. One or more relationships between at least one data field in the set of data fields and at least one other data field in the set of data fields are determined. A mapping of the event data of the plurality of events to a predefined common format is determined, based on the one or more relationships.

Claims

1. A method comprising:

receiving a plurality of events from an event source, each event comprising event data relating to a monitored system associated with the event source;

identifying a set of data fields in the event data of the plurality of events;

determining one or more relationships between at least one data field in the set of data fields and at least one other data field in the set of data fields, and

determining a mapping of the event data of the plurality of events to a predefined common format, based on the one or more relationships.

2. The method of claim 1, further comprising:

identifying an anchor field in the identified set of data fields, wherein the anchor field has a high frequency of occurrence in the plurality of events and has a relatively small number of distinct values greater than one, and

analyzing the events to determine relationships between the anchor field and at least one other data field in the set of data fields.

3. The method of claim 2, wherein analyzing the events identifies one or more sub-anchor fields of the anchor field, wherein each sub-anchor field is present in all the events in the plurality of events when the anchor field has a particular value.

4. The method of claim 3, wherein determining one or more relationships between at least one data field in the set of data fields and at least one other data field in the set of data fields comprises:

determining a condition that defines the relationship between each sub-anchor field and the anchor field in the set of data fields.

5. The method of claim 2, wherein analyzing the events is performed iteratively until all relationships between each data field and the other data fields in the set of data fields are determined.

6. The method of claim 1, further comprising:

comparing at least one data field in the set of data fields for the plurality of events with data fields in a set of data fields for events provided by another event source to determine one or more relationships between data fields for the plurality of events and data fields for events provided by the other event source.

7. The method of claim 6, wherein the comparing determines one or more relationships selected from the group consisting of:

an exact match between the names or values of fields and their relationships;

a similarity between the names or values of fields and their relationships, and

a cognitive match between names or values of fields and their relationships, including a match in meaning of the names or values or the phonetic or translated equivalents thereof.

8. The method of claim 1, further comprising:

determining one or more relationships between at least one data field in the set of data fields and at least one data field of the predefined common format, and

comparing determined relationships between at least one data field in the set of data fields and at least one data field of the predefined common format with known relationships between data fields of events provided by another event source and the data fields of the predefined common format.

9. The method of claim 1, wherein determining a mapping of the event data of the plurality of events to a predefined common format, based on the determined one or more relationships, comprises:

determining a mapping rule, for mapping data of a data field to a corresponding data field of the predefined common format.

10. The method of claim 1, further comprising:

deploying a normalizer in an event management system, wherein the normalizer is configured to implement the determined mapping of the event data of the plurality of events to the predefined common format for events received by the event management system from the event source.

11. The method of claim 10, further comprising:

determining an event model of events received from the event source, and

deploying a validator in the event management system, wherein the validator is configured to validate events received by the event management system from the event source, wherein;

if a received event from the event source is validated, the validator forwards the event data for the received event to the normalizer, or

if a received event from the event source is not validated, the validator stores the event data in memory and issues a notification indicating that the event model and/or normalizer requires updating.

12. The method of claim 10, further comprising:

receiving at least one new event from the event source;

identifying new fields in the set of data fields in the event data, based on the at least one new event from the event source;

analyzing the at least one new event, to determine one or more relationships selected from the group consisting of;

relationships between at least one data field and at least one other data field in the new event, and relationships between at least one data field in the new event and at least one data field of the predefined common format, and

updating the determined mapping of the event data of events from the event source to the predefined common format, based on the analysis.

13. An apparatus comprising:

an event learning system comprising a processor and memory, wherein the processor is configured to;

receive a plurality of events from an event source, each event comprising event data relating to a monitored system associated with the event source;

identify a set of data fields in the event data of the plurality of events;

determine one or more relationships between at least one data field in the set of data fields and at least one other data field in the set of data fields, and

determine a mapping of the event data of the plurality of events to a predefined common format, based on the determined one or more relationships.

14. The apparatus of claim 13, wherein the processor is further configured to:

identify an anchor field in the identified set of data fields, wherein the anchor field has a high frequency of occurrence in the plurality of events and has a relatively small number of distinct values greater than one, and

analyze the events to determine relationships between the anchor field and at least one other data field in the set of data fields.

15. The apparatus of claim 14, wherein analyzing the events identifies one or more sub-anchor fields of the anchor field, wherein each sub-anchor field is present in all the events in the plurality of events when the anchor field has a particular value, wherein the processor is further configured to:

determine a condition that defines the relationship between each sub-anchor field and the anchor field in the set of data fields.

16. The apparatus of claim 14, wherein the processor is further configured to:

analyze the events iteratively until all relationships between each data field and the other data fields in the set of data fields are determined.

17. The apparatus of claim 13, wherein the processor is further configured to:

compare at least one data field in the set of data fields for the plurality of events with data fields in a set of data fields for events provided by another event source to determine one or more relationships between data fields for the plurality of events and data fields for events for events provided by the other event source.

18. The apparatus of claim 17, wherein the processor is configured to determine one or more relationships between data fields for the plurality of events and data fields for events provided by the other event source selected from the group consisting of:

an exact match between the names or values of fields and their relationships;

a similarity between the names or values of fields and their relationships, and

a cognitive match between names or values of fields and their relationships, including a match in meaning of the names or values or the phonetic or translated equivalents thereof.

19. The apparatus of claim 13, wherein the processor is further configured to:

determine one or more relationships between at least one data field in the set of data fields and at least one data field of the predefined common format, and

compare determined relationships between at least one data field in the set of data fields and at least one data field of the predefined common format with known relationships between data fields of events provided by another event source and the data fields of the predefined common format.

20. A computer program product comprising a computer readable storage medium having program instructions embodied therewith, wherein the program instructions are executable by a processor to cause the processor to:

receive a plurality of events from an event source, each event comprising event data relating to a monitored system associated with the event source;

identify a set of data fields in the event data of the plurality of events;

determine one or more relationships between at least one data field in the set of data fields and at least one other data field in the set of data fields, and

determine a mapping of the event data of the plurality of events to a predefined common format, based on the determined one or more relationships.