System and method for dynamic generation and clean-up of event correlation circuit

• US 6,789,257 B1
• Filed: 04/13/2000
• Issued: 09/07/2004
• Est. Priority Date: 04/13/2000
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: MacPhail, Margaret Gardner
• Primary Examiner(s): BULLOCK JR, LEWIS ALEXANDER
• Application Number:
  US09/548,642
• Time in Patent Office: 1,608 Days
• Field of Search: 709/315, 709/316, 709/318, 709/223, 719/315, 719/316, 719/318
• US Class Current: 719/316
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0718 in an object-oriented system
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks

Abstract

A system and method for dynamically creating and cleaning up correlation circuits connecting effect events, such as a system failure, with their corresponding cause events. Object instances are created to act upon cause and effect events. A particular object instance can be both a cause event for another object as well as an effect event for another causal event and adapted to monitor network devices. When a cause event occurs in the system, it publishes messages to other objects subscribed to it. A correlation circuit is dynamically created by linking effects with their causes, those causes with their causes, until a root cause is located. Correlation circuits dynamically change depending upon the events occurring in the system.

Claims

1. A method for dynamically generating correlation circuits, said method comprising:

subscribing a source object to a plurality of target objects, wherein the source and target objects are adapted to monitor network devices in an enterprise computing system with the source object representing a cause of a problem and the target objects representing one or more predicted effects of the problem, and wherein the subscribing further includes;

sending a message from the source object to the plurality of target objects;

receiving replies from one or more of the plurality of target objects in response to the sending;

creating a correlation circuit, the correlation circuit including the source object and the plurality of target objects from which a reply was received;

sensing an error condition with one of the network devices that corresponds to the source object; and

transmitting error data corresponding to the error condition along the correlation circuit to the plurality of target objects in response to the sensing of the error condition.

2. The method of claim 1 further comprising:

monitoring the source and target objects by a subscription broker;

reading subscription information accessible by the subscription broker; and

correlating the source object to at least one target object based on the subscription information.

3. The method of claim 1 wherein the source and target objects exist in an object space, the object space stored across a plurality of computer systems, the plurality of computer systems being interconnected through a computer network.

4. The method of claim 1 further comprising:

terminating one of the target objects; and

removing the terminated object from the correlation circuit in response to the terminating.

5. The method of claim 4 further comprising:

displaying the correlation circuit on a display device.

6. The method of claim 1 further comprising:

associating the source object with a causal event; and

associating the target objects with one or more predicted effects.

7. The method of claim 6 further comprising:

detecting one of the predicted effects; and

locating the source object correlated with the target object that was associated with the detected predicted effect.

8. The method of claim 6 further comprising:

receiving a first user selection of the causal event and the network device associated with the source object, wherein the association of the source object with the causal event is based upon the first user selection; and

receiving second user selections of the predicted effects and the network devices associated with the target objects, wherein the association of the target objects with the predicted effects is based upon the second user selections.

9. An information handling system for dynamically generating correlation circuits, said method comprising:

a computer, the computer including;

one or more processing units;

a memory operatively coupled to the one or more processing units;

a plurality of objects stored in the memory, wherein the source and target objects are adapted to monitor network devices in an enterprise computing system;

a correlation circuit stored in the memory, wherein the correlation circuit is formed with a subscription between a source object and a plurality of target objects, wherein the source object representing a cause of a problem and the target objects representing one or more predicted effects of the problem;

a message sent from the source object to the plurality of target objects;

one or more replies received by the source objects from one or more of the target objects in response to the message;

means for sensine an error condition with one of the network devices that corresponds to the source object; and

means for transmitting error data corresponding to the error condition along the correlation circuit to the plurality of target objects in response to the sensing of the error condition.

10. The information handling system of claim 9 further comprising:

a subscription broker that monitors the source and target objects;

subscription information received by the subscription broker; and

wherein the correlation circuit is between the source object and at least one target object based on the subscription information.

11. The information handling system of claim 9, further comprising;

the computer system including a plurality of computer systems, each with one or more processing units and a memory operatively coupled to the one or more processing units;

a computer network connecting the plurality of computer systems;

an object space, the object space stored in the memory of the plurality of computer systems, and wherein the object space includes the source and target objects.

12. The information handling system of claim 9, further comprising:

a first object;

a termination of one of the target objects; and

a modified correlation circuit, the modified correlation circuit created by removing the terminated object from the correlation Circuit.

13. The information handling system of claim 9, further comprising:

a display device, the display device displaying the correlation circuit to a user.

14. The information handling system of claim 9 further comprising:

means for associating the source object with a causal event; and

means for associating the target objects with one or more predicted effects.

15. The information handling system of claim 14 further comprising:

means for detecting one of the predicted effects; and

means for locating the source object correlated with the target object that was associated with the detected predicted effect.

16. The information handling system of claim 14 further comprising:

means for receiving a first user selection of the causal event and the network device associated with the source object, wherein the association of the source object with the causal event is based upon the first user selection; and

means for receiving second user selections of the predicted effects and the network devices associated with the target objects, wherein the association of the target objects with the predicted effects is based upon the second user selections.

17. A computer program product stored on a computer operable medium for dynamically generating correlation circuits, said computer program product comprising:

means for subscribing a source object to a plurality of target objects, wherein the source and target objects are adapted to monitor network devices in an enterprise computing system with the source object representing a cause of a problem and the target objects representing one or more predicted effects of the problem, and wherein the subscribing further includes;

means for sending a message from the source object to the plurality of target objects;

means for receiving replies from one or more of the plurality of target objects in response to the sending;

means for creating a correlation circuit, the correlation circuit including the source object and the plurality of target objects from which a reply was received;

sensing an error condition with one of the network devices that corresponds to the source object; and

transmitting error data corresponding to the error condition along the correlation circuit to the plurality of target objects in response to the sensing of the error condition.

18. The computer program product of claim 17 further comprising:

means for monitoring the source and target objects by a subscription broker;

means for reading subscription information accessible by the subscription broker; and

means for correlating the source object to at least one target object based on the subscription information.

19. The computer program product of claim 17, further comprising:

means for storing the source and target objects exist in an object space; and

means for storing the object space across a plurality of network-connected computer systems.

20. The computer program product of claim 17 further comprising:

means for terminating one of the target objects; and

means for removing the terminated object from the correlation circuit.

21. The computer program product of claim 20 further comprising:

means for displaying the correlation circuit on a display device.

22. The computer program product of claim 17 further comprising:

means for associating the source object with a causal event; and

means for associating the target objects with one or more predicted effects.

23. The computer program product of claim 22 further comprising:

means for detecting one of the predicted effects; and

means for locating the source object correlated with the target object that was associated with the detected predicted effect.

24. The computer program product of claim 22 further comprising:

means for receiving a first user selection of the causal event and the network device associated with the source object, wherein the association of the source object with the causal event is based upon the first user selection; and

means for receiving second user selections of the predicted effects and the network devices associated with the target objects, wherein the association of the target objects with the predicted effects is based upon the second user selections.