Hierarchical connected graph model for implementation of event management design

• US 6,931,644 B2
• Filed: 12/21/2000
• Issued: 08/16/2005
• Est. Priority Date: 12/21/2000
• Status: Expired due to Term

• Current Assignee: Kyndryl Incorporated (Kyndryl Holdings, Inc.)
• Original Assignee: International Business Machines Corporation
• Inventors: Riosa, James A., Naiberg, Andrew D.
• Primary Examiner(s): BULLOCK JR, LEWIS ALEXANDER
• Application Number:
  US09/747,439
• Publication Number:
  US 20020120734A1
• Time in Patent Office: 1,699 Days
• Field of Search: 719/318, 709/223, 709/224
• US Class Current: 719/318
• CPC Class Codes: H04L 41/065 involving logical or physical relationship, e.g. grouping and hierarchies

Abstract

An automated method and system for the implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment in which events are defined based on a connected graph model. Event handling information for each event type to be monitored is used to customize a plurality of rule templates for each type within an event source, where the event source is a hardware component, an application software component or an operating system platform. A plurality of event relationship network rules are verified to ensure they do not violate an event protocol. A hierarchical class definition and naming structure is generated from the plurality of event relationship network rules for each event source. Event management rules are then generated automatically for each event type from the event relationship network rules and the rule templates. The event management rules are loaded into a rule-based event manager. The performance of the rule-based event manager is then monitored.

Claims

1. A method for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment, comprising the acts of:

inputting event handling information for each event type to be monitored;

customizing a plurality of rule templates for each event type within an event source;

verifying that the plurality of event relationship network rules do not violate an event protocol;

generating a hierarchical class definition structure and naming structure from the plurality of event relationship network rules for each event source; and

generating a plurality of event management rules for each event type automatically from the event relationship network rules and the rule templates.

2. The method for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 1 further comprising the acts of loading the plurality of event management rules into a rule-based event manager.

3. The method for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 2 further comprising the act of monitoring performance of the rule-based event manager in the distributed computing environment.

4. The method for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 1 wherein the event sources include one or more of a hardware device, an operating system, and a software application.

5. The method for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 1 wherein the event relationship network includes a series of drawing pages that depict subsets of correlation relationships.

6. The method for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 5 wherein each page of the event relationship network is a subnet comprising a set of events.

7. The method for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 6 wherein each subnet can link to other subnets and span the number of pages required to represent the set of correlational relationships.

8. The method for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 7 wherein each subnet comprises any one of an autonomous subnet, a primary subnet, a primary/secondary subnet and a secondary subnet.

9. The method for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 1 wherein the events are defined based on a connected graph model.

10. The method for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 1 wherein the act of generating a hierarchical class definition structure comprises the act of automatically building Basic Recording of Objects in C (BAROC) files.

11. The method for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 10 wherein each event is redefined using a path identification number and a sequence identification number.

12. The method for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 9 wherein a position of any event on a logical connected graph of events is determine by a path identification and a sequence identification.

13. The method for the automated implementation of a hierarchical event relation ship network for correlation analysis in a distributed computing environment of claim 12 wherein the path identification is a list of integers that represent the set of all paths that flow through an event.

14. The method for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 12 wherein the sequence identification is a single integer that represents a relative position of an event on a path.

15. The method for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 11 wherein if the event sequence number is less than that of a known event in a path, then the event is a current primary event and a previous primary event is removed from further correlation analysis.

16. The method for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 11 wherein if the event sequence number is greater than that of a known event in a path, then the event is a secondary event and is removed from further correlational analysis.

17. The method for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 1 further comprising a plurality of rule sets to handle each event.

18. The method for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 17 wherein the plurality of rule sets includes duplicate detection and trouble ticketing, autonomous events, primary events, primary/secondary events, secondary events and clearing events.

19. The method for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 18 wherein an autonomous event is an isolated event that is not a proximate cause for any other event.

20. The method for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 19 wherein an autonomous event is handled by a single rule defined by a policy.

21. The method for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 18 wherein a primary event is an event that is a root cause event that has no precedent event and can have any number of ancillary resulting events.

22. The method for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 18 wherein a primary/secondary event is one that can be a causal event or the result of another event distal to a root cause event.

23. The method for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 18 wherein a secondary event is an event that can result only from another event that is distal to a root cause event.

24. The method for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 18 wherein a clearing event is an event that signals a return to a steady state condition by clearing at least one event.

25. The method for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 1 wherein the act of customizing a plurality of rule templates comprises adding, modifying and deleting rule actions and commands to perform the event management behavior specified by an end user.

26. A computer readable medium containing a computer program product for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment, the computer program product comprising:

program instructions that enable inputting event handling information for each event type to be monitored;

program instructions that customize a plurality of rule templates for each event type within an event source;

program instructions that verify that the plurality of event relationship network rules do not violate an event protocol;

program instructions that generate a hierarchical class definition structure and naming structure from the plurality of event relationship network rules for each event source; and

program instructions that generate a plurality of event management rules for each event type automatically from the event relationship network rules and the rule templates.

27. The computer program product for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 26 further comprising program instructions that load the plurality of event management rules into a rule-based event manager.

28. The computer program product for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 27 further comprising program instructions that monitor performance of the rule-based event manager in the distributed computing environment.

29. The computer program product for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 26 further comprising program instructions that define events based on a connected graph model.

30. The computer program product for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 26 wherein the program instructions that generate a hierarchical class definition structure comprise program instructions that automatically build Basic Recording of Objects in C (BAROC) files.

31. The computer program product for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 30 further comprising program instructions that redefine each event using a path identification number and a sequence identification number.

32. The computer program product for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 31 further comprising program instructions that determine a position of any event on a logical connected graph of events by a path identification and a sequence identification.

33. The computer program product for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 31 further comprising program instructions that determine if the event sequence number is less than that of a known event in a path, and if so, identify the event as a current primary event and remove a previous primary event from further correlation analysis.

34. The computer program product for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 31 further comprising program instructions that determine if the event sequence number is greater than that of a known event in a path, and if so, identify the event as a secondary event and remove the event from further correlational analysis.

35. The computer program product for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 26 further comprising program instructions that define a plurality of rule sets to handle each event.

36. The computer program product for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 35 wherein the plurality of defined rule sets includes duplicate detection and trouble ticketing, autonomous events, primary events, primary/secondary events, secondary events and clearing events.

37. The computer program product for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 26 wherein the program instructions that customize a plurality of rule templates further comprise program instructions that add, modify and delete rule actions and commands to perform the event management behavior specified by an end user.

38. A system for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment, comprising:

an input component that receives event handling information for each event type to be monitored;

a customization component that customizes a plurality of rule templates for each event type within an event source;

a verification component that verifies the plurality of event relationship network rules do not violate an event protocol;

a class generation component that generates a hierarchical class definition structure and naming structure from the plurality of event relationship network rules for each event source; and

a rule generation component that generates a plurality of event management rules for each event type automatically from the event relationship network rules and the rule templates.

39. The system for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 38 further comprising a component that loads the plurality of event management rules into a rule-based event manager.

40. The system for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 39 further comprising a component that monitors performance of the rule-based event manager in the distributed computing environment.

41. The method for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 38 wherein the event sources include one or more of a hardware device, an operating system, and a software application.

42. The system for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 38 wherein the events are defined based on a connected graph model.

43. The system for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 42 further comprising a component that determines a position of any event on a logical connected graph of events by a path identification number and a sequence identification number.

44. The system for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 43 further comprising a component that determines if the event sequence number is less than that of a known event in a path, and if it is, identifies the event as a current primary event and removes a previous primary event from further correlation analysis.

45. The system for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 43 further comprising a component that determines if the event sequence number is greater than that of a known event in a path, and if it is, identifies the event as a secondary event and removes the event from further correlational analysis.

46. The system for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 38 wherein the class generation component comprises a component that automatically builds Basic Recording of Objects in C (BAROC) files.

47. The system for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 38 further comprising a component that applies a plurality of rule sets to handle each event.

48. The system for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 47 wherein the plurality of rule sets includes duplicate detection and trouble ticketing, autonomous events, primary events, primary/secondary events, secondary events and clearing events.

49. The system for the automated implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment of claim 38 wherein the customization component comprises a component that adds, modifies and deletes rule actions and commands to perform the event management behavior specified by an end user.