Event monitoring and correlation system
First Claim
1. An event monitoring and correlation system comprising:
- first means for detecting the occurrence of a predetermined event from a first source and providing data in response thereto;
second means for processing event data as a data relation in a database;
said second means includes means for recording a plurality of events as data relations in said database;
said second means for recording a plurality of events as data relations being an event pattern language;
said event pattern language expressing events in terms of first order logic over a universe of events;
said event pattern language including means for identifying at least one commonly occurring pattern; and
said pattern allowing for additional event pattern events to be specified dynamically.
2 Assignments
0 Petitions
Accused Products
Abstract
The invention is a common event monitoring, fusion and reasoning framework that integrates horizontally into many different application domain areas. The system includes a monitor for detecting occurrences of predetermined events from a monitored system, providing data in response to the occurrence and processing the data as a data relation in a database. Predetermined events are recorded in a database using an event pattern language that defines and compiles events in terms of first order logic over a universe of events. The language provides common patterns that allow event patterns (i.e., event rules and relations) to be specified by the client dynamically. These specified event patterns are then compiled into the database. The compiled code automatically triggers responses when specific event patterns are stored in the database. After compilation, additional event patterns may be recognized dynamically by formulating queries into the database using a standard query language such as SQL.
-
Citations
14 Claims
-
1. An event monitoring and correlation system comprising:
-
first means for detecting the occurrence of a predetermined event from a first source and providing data in response thereto;
second means for processing event data as a data relation in a database;
said second means includes means for recording a plurality of events as data relations in said database;
said second means for recording a plurality of events as data relations being an event pattern language;
said event pattern language expressing events in terms of first order logic over a universe of events;
said event pattern language including means for identifying at least one commonly occurring pattern; and
said pattern allowing for additional event pattern events to be specified dynamically. - View Dependent Claims (2, 3, 4, 5, 6, 7)
-
-
8. An event monitoring and correlation system comprising:
-
monitor means for detecting the occurrence of a predetermined event from a first source and providing data in response thereto;
second means for processing said event data as a data relation in a database, said second means including;
third means for recording a plurality of events as data relations in said database using an event pattern language that expresses events in first order logic over a universe of events;
fourth means for compiling event patterns representative of data relations into the database;
processor means for comparing said data to said compiled event patterns and providing an output in response the receipt of a predetermined pattern of events;
said event pattern language including means for identifying at least one commonly occurring pattern; and
said pattern allowing for additional event pattern events to be specified dynamically. - View Dependent Claims (9, 10, 11, 12, 13, 14)
-
Specification