Event monitoring and correlation system

• US 6,629,106 B1
• Filed: 02/26/1999
• Issued: 09/30/2003
• Est. Priority Date: 02/26/1999
• Status: Expired due to Term

• Current Assignee: CalQLogic, Co.
• Original Assignee: Computing Services Support Solutions, INC
• Inventors: Narayanaswamy, Krishnamurthy, Taylor, Deborah A.
• Primary Examiner(s): Robinson, Greta
• Assistant Examiner(s): RAYYAN, SUSAN F
• Application Number:
  US09/259,813
• Time in Patent Office: 1,677 Days
• Field of Search: 707/3, 707/10, 707/7, 707/104.1, 707/6, 707/102, 709/201
• US Class Current: 1/1
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/3447 Performance evaluation by modeling
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: G06F 2201/835 Timestamp
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: Y10S 707/99945 Object-oriented database structure processing
• CPC Class Codes: Y10S 707/99948 Application of database or data structure, e.g. distributed, multimedia, or image

Abstract

The invention is a common event monitoring, fusion and reasoning framework that integrates horizontally into many different application domain areas. The system includes a monitor for detecting occurrences of predetermined events from a monitored system, providing data in response to the occurrence and processing the data as a data relation in a database. Predetermined events are recorded in a database using an event pattern language that defines and compiles events in terms of first order logic over a universe of events. The language provides common patterns that allow event patterns (i.e., event rules and relations) to be specified by the client dynamically. These specified event patterns are then compiled into the database. The compiled code automatically triggers responses when specific event patterns are stored in the database. After compilation, additional event patterns may be recognized dynamically by formulating queries into the database using a standard query language such as SQL.

Claims

1. An event monitoring and correlation system comprising:

first means for detecting the occurrence of a predetermined event from a first source and providing data in response thereto;

second means for processing event data as a data relation in a database;

said second means includes means for recording a plurality of events as data relations in said database;

said second means for recording a plurality of events as data relations being an event pattern language;

said event pattern language expressing events in terms of first order logic over a universe of events;

said event pattern language including means for identifying at least one commonly occurring pattern; and

said pattern allowing for additional event pattern events to be specified dynamically.

2. The invention of claim 1 wherein said event pattern language is a Formal Language for Expressing Assumptions (FLEA).

3. The invention of claim 1 further including means for compiling event patterns representative of data relations into the database.

4. The invention of claim 3 further including means for automatically triggering responses when specific patterns of events are stored in the database.

5. The invention of claim 3 wherein the event compiler is a SOMOS compiler.

6. The invention of claim 1 further including means for recognizing event patterns in said database by dynamically formulating queries into said database using a standard query language.

7. The invention of claim 6 wherein said standard query language is SQL.

8. An event monitoring and correlation system comprising:

monitor means for detecting the occurrence of a predetermined event from a first source and providing data in response thereto;

second means for processing said event data as a data relation in a database, said second means including;

third means for recording a plurality of events as data relations in said database using an event pattern language that expresses events in first order logic over a universe of events;

fourth means for compiling event patterns representative of data relations into the database;

processor means for comparing said data to said compiled event patterns and providing an output in response the receipt of a predetermined pattern of events;

said event pattern language including means for identifying at least one commonly occurring pattern; and

said pattern allowing for additional event pattern events to be specified dynamically.

9. The invention of claim 8 wherein said event pattern language is a Formal Language for Expressing Assumptions (FLEA).

10. The invention of claim 8 further including means for compiling event patterns representative of data relations into the database.

11. The invention of claim 10 further including means for automatically triggering responses when specific patterns of events are stored in the database.

12. The invention of claim 11 wherein the event compiler is a SOMOS compiler.

13. The invention of claim 8 further including means for recognizing additional event patterns in said database by dynamically formulating queries into said database using a standard query language.

14. The invention of claim 13 wherein said standard query language is SQL.