Apparatus and method for analyzing and correlating events in a system using a causality matrix

• US 5,661,668 A
• Filed: 07/12/1996
• Issued: 08/26/1997
• Est. Priority Date: 05/25/1994
• Status: Expired due to Term

• Current Assignee: VMware, Inc. (Broadcom, Inc.)
• Original Assignee: System Management Arts, Inc. (Dell Technologies Inc.)
• Inventors: Kliger, Shmuel, Yemini, Yechiam, Yemini, Shaula
• Primary Examiner(s): Trammell, James P.
• Assistant Examiner(s): Wachsman, Hal D.
• Application Number:
  US08/679,443
• Time in Patent Office: 410 Days
• Field of Search: 364/550, 364/422, 364/191, 364/551.01, 364/551.02, 364/500, 364/424.03, 364/424.04, 364/578-580, 364/554, 341/106, 341/107, 341/109, 341/78, 341/94, 341/51, 370/16, 370/16.1, 370/17, 395/50-52, 395/2, 395/2.1, 395/2.25-2.27, 395/902, 395/904, 395/905, 395/909, 395/911-919, 395/922, 395/924, 395/931, 395/2.56, 395/185.01 , 395/183.01, 395/183.02, 395/183.07, 395/183.13, 395/183.15, 395/183.2, 340/825.79, 340/825.8, 340/825.83, 340/825.16
• US Class Current: 702/186
• CPC Class Codes: G06F 11/2257 using expert systems
• CPC Class Codes: G06F 11/2273 Test methods
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 2201/86 Event-based monitoring

Abstract

An apparatus and method is provided for efficiently determining the source of problems in a complex system based on observable events. The problem identification process is split into two separate activities of (1) generating efficient codes for problem identification and (2) decoding the problems at runtime. Various embodiments of the invention contemplate creating a causality matrix which relates observable symptoms to likely problems in the system, reducing the causality matrix into a minimal codebook by eliminating redundant or unnecessary information, monitoring the observable symptoms, and decoding problems by comparing the observable symptoms against the minimal codebook using various best-fit approaches. The minimal codebook also identifies those observable symptoms for which the greatest benefit will be gained if they were monitored as compared to others. By defining a distance measure between symptoms and codes in the codebook, the invention can tolerate a loss of symptoms or spurious symptoms without failure. Changing the radius of the codebook allows the ambiguity of problem identification to be adjusted easily. The invention also allows probabilistic and temporal correlations to be monitored.

Claims

1. A computer-implemented method for use in analyzing events in a system having a plurality of components arranged in a particular configuration, each component belonging to one of a plurality of component classes, the method comprising the steps of:

(1) creating a first representation which defines a set of events which may occur for each class of components in the system independently of the particular configuration of the system;

(2) creating a second representation which defines propagations of events across one or more of the component classes in the system independently of the particular configuration of the system;

(3) creating a configuration specification for the system which defines instances of components specific to the configuration of the system;

(4) converting the first and second representations into a causality mapping based on the configuration specification, wherein the causality mapping comprises a mapping between events in the system and likely causes thereof; and

(5) storing the causality mapping resulting from step (4) in a computer storage device.

2. The method of claim 1, wherein step (4) comprises the steps of:

(a) determining a set of events that can occur for the specific configuration of the system by taking a union of all events which can occur for each instance of each component across all classes of components in the specific configuration; and

(b) determining a causality closure of each event determined in step (a) by taking a union of all observable events which each event may cause.

3. The method of claim 2, wherein step (b) comprises the steps of, for each event:

(i) determining whether the event is observable or not observable and, if it is determined that the event is observable, outputting as the causality closure a set consisting of the event;

(ii) determining whether the event can cause a set of symptoms and, if it is determined that the event can cause a set of symptoms, outputting as the causality closure a union of the causality closures for each symptom in the set of symptoms; and

(iii) determining whether the event can propagate across object classes and, if it is determined that the event can propagate, for each object instance in the configuration specification which can generate that event, outputting a union of the causality closures for each object instance to which the event can propagate.

4. The method of claim 2, wherein the first representation comprises a compilable statement which defines an event which can be generated by each instance of a component in one class of components in the system.

5. The method of claim 2, wherein the second representation comprises a compilable statement which defines one or more events which can propagate to an instance of a component in one of the classes of components.

6. The method of claim 1, further comprising the step of:

(6) reducing the causality mapping into a codebook comprising fewer values than the causality mapping by eliminating redundant data from the causality mapping.

7. The method of claim 6, further comprising the steps of:

(7) monitoring a plurality of symptom data values representing symptoms generated by the system over time;

(8) determining a mismatch measure between each of a plurality of groups of values in the codebook through the use of a computer, and selecting a likely problem corresponding to one of the plurality of groups having the smallest mismatch measure; and

(9) reporting the one selected likely problem from the codebook.

8. The method of claim 6, wherein step (6) comprises the steps of:

(a) selecting a desired degree of distinction between groups of values in the codebook, each group corresponding to a different likely problem; and

(b) generating an optimal codebook by selecting minimal groups of values such that selected groups of values corresponding to any two likely problems satisfy the desired degree of distinction.

9. The method of claim 1, wherein the first and second representations comprise compilable statements.

10. The method of claim 1, wherein the first representation comprises a graph having nodes which define events which can be generated by each instance of a component in one class of components in the system;

and

wherein the second representation comprises edges of the graph which define one or more events which can propagate to an instance of a component in one of the classes of components.

11. The method of claim 1, wherein causality mapping comprises a matrix having the rows and columns which represent events which can be generated by components in the system and having cells which indicate causal relationships between the respective row and column events.

12. The method of claim 1, wherein the causality mapping comprises a set of lists of events which can be generated by components in the system, each list representing events that can be caused by a given event in a given component.

13. The method of claim 1, wherein the causality mapping comprises a graph whose nodes represent events which can be generated by components in the system and whose edges indicate causal relationships between the respective node events.

14. The computer-implemented method of claim 1, wherein step (4) comprises the step of converting the first and second representations into a causality mapping which comprises a mapping between events and likely problems in the system.

15. Apparatus for use in analyzing events in a system having a plurality of components arranged in a particular configuration, each component belonging to one of a plurality of component classes, the apparatus comprising:

means for converting

(a) first representations which define a set of events which may occur for each class of components in the system independently of the particular configuration of the system,

(b) second representations which define a propagation of events across one or more of the component classes in the system independently of the particular configuration of the system, and

(c) a configuration specification for the system which defines instances of components specific to the configuration of the system

into a causality mapping comprising a mapping between events in the system and likely causes thereof; and

means for storing the causality mapping.

16. The apparatus of claim 15, wherein said means for converting comprises a compiler which compiles a plurality of compilable statements into an event model data structure and a propagation model data structure.

17. The apparatus of claim 15, wherein the first and second representations comprise compilable statements.

18. The apparatus of claim 15, wherein the means for converting converts the first and second representations into a causality mapping which comprises a mapping between events and likely problems in the system.

19. A computer-implemented method for use in analyzing events in a system having a plurality of components arranged in a particular configuration, each component belonging to one of a plurality of component classes, the method comprising the steps of:

(1) defining a set of events which can occur for each class of components in the system independently of the particular configuration of the system;

(2) defining propagations of events across one or more of the component classes in the system independently of the particular configuration of the system;

(3) defining a configuration specification for the system which defines instances of components specific to the configuration of the system;

(4) in a computer, using the configuration specification to convert the defined set of events and the defined propagations of events into a causality representation comprising a mapping between events in the system and likely causes thereof; and

(5) storing the causality representation in a computer storage device.

20. The computer-implemented method of claim 19, wherein the steps (1) and (2) each comprise the step of using compilable statements.

21. The computer-implemented method of claim 19, wherein steps (1) and (2) each comprise the step of using graphical representations.

22. The computer-implemented method of claim 19, wherein steps (1) to (4) are performed for a satellite system.

23. The computer-implemented method of claim 19, wherein steps (1) to (4) are performed for a telecommunication system.

24. The computer-implemented method of claim 19, wherein steps (1) to (4) are performed for a computer network system.

25. The computer-implemented method of claim 19, wherein steps (1) to (4) are performed for an organic system.

26. The computer-implemented method of claim 19, wherein steps (1) to (4) are performed for a human body system.

27. The computer-implemented method of claim 19, wherein steps (1) to (4) are performed for a financial market system.

28. The computer-implemented method of claim 19, wherein steps (1) to (4) are performed for a weapons system.

29. A machine programmed with a computer program which receives (i) a set of events which can occur for each of a plurality of classes of components in a system independently of any particular configuration of the system, (ii) a set of propagations of events across one or more component classes in the system independent of any particular configuration of the system, and (iii) a configuration specification which defines a particular system configuration, wherein the computer program converts the set of events and the set of propagations of events into a causality mapping on the basis of the particular system configuration, wherein the causality mapping comprises a mapping between events in the system and likely causes thereof.

30. The machine according to claim 29, wherein the computer program converts the set of events and the propagations of events into the causality mapping by compiling statements prepared according to a predetermined syntax.

31. A computer-implemented method for use in analyzing events in a system having a plurality of components arranged in a particular configuration, each component belonging to one of a plurality of component classes, the method comprising the steps of:

(1) defining a set of events which can occur for each class of components in the system independently of the particular configuration of the system;

(2) defining propagations of events across one or more of the component classes in the system independently of the particular configuration of the system;

(3) providing a configuration specification for the system which defines instances of components specific to the configuration of the system;

(4) in a computer, using the configuration specification provided in step (3) to convert the set of events defined in step (1) and the propagations of events defined in step (2) into a causality representation comprising a mapping between a first group of events in the system and a second group of events in the system, wherein each event in the second group is caused by one or more events in the first group; and

(5) storing the causality representation in a computer storage device.