Hierarchical connected graph model for implementation of event management design

• US 7,003,779 B2
• Filed: 02/17/2005
• Issued: 02/21/2006
• Est. Priority Date: 12/21/2000
• Status: Expired due to Fees

• Current Assignee: Kyndryl Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Riosa, James A., Naiberg, Andrew D.
• Primary Examiner(s): Bullock, Jr., Lewis A.
• Application Number:
  US11/059,894
• Publication Number:
  US 20050144624A1
• Time in Patent Office: 369 Days
• Field of Search: 719/318, 719/316, 709/223, 709/224
• US Class Current: 719/318
• CPC Class Codes: H04L 41/065 involving logical or physical relationship, e.g. grouping and hierarchies

Abstract

An automated method and system for the implementation of a hierarchical event relationship network for correlation analysis in a distributed computing environment in which events are defined based on a connected graph model. Event handling information for each event type to be monitored is used to customize a plurality of rule templates for each type within an event source, where the event source is a hardware component, an application software component or an operating system platform. A plurality of event relationship network rules are verified to ensure they do not violate an event protocol. A hierarchical class definition and naming structure is generated from the plurality of event relationship network rules for each event source. Event management rules are then generated automatically for each event type from the event relationship network rules and the rule templates. The event management rules are loaded into a rule-based event manager. The performance of the rule-based event manager is then monitored.

Claims

1. A computer-implemented method for the automated generation of a class definition and naming structure from an event relationship network represented by a hierarchical connected graph to perform correlation analysis in a distributed computing environment, comprising the acts of:

automatically assigning events in a subnet to a superclass defined with the same name as the subnet;

assigning a path number to connected events in the same subnet;

determining if a branch point has been reached in the connected graph;

if a branch point has been reached, assigning a new path number to the branch, adding the assigned path number to events that are earlier in the sequence than the branch point, and appending a list of events and assigned path numbers to a path identification slot for each event; and

if a branch point has not been reached, incrementing a sequence number that is assigned to each event and adding the event sequence numbers to a sequence identification list.

2. The method for the automated generation of a class definition and naming structure from an event relationship network of claim 1 further comprising the act of determining if there exists a prior connected subnet for a current subnet.

3. The method for the automated generation of a class definition and naming structure from an event relationship network of claim 2 further comprising the acts of:

determining the subset of connected events on the prior connected subnet that lead to the current subnet;

assigning the subset of events to a subnet ancestor superclass; and

adding the subnet ancestor superclass to an ancestor slot of the current subnet events.

4. The method for the automated generation of a class definition and naming structure from an event relationship network of claim 3 wherein the subnet ancestor class contains events that are primary to another subnet.

5. The method for the automated generation of a class definition and naming structure from an event relationship network of claim 4 wherein each event assigned to a subnet ancestor class is from a distal nodal event to a next most proximal nodal event on an event path.

6. The method for the automated generation of a class definition and naming structure from an event relationship network of claim 5 wherein a nodal event is an event that has a plurality of paths flowing from the event.

7. The method for the automated generation of a class definition and naming structure from an event relationship network of claim 6 wherein the distal nodal event is defined as an event that is farther away from a root cause event than a specified event on the event path.

8. The method for the automated generation of a class definition and naming structure from an event relationship network of claim 6 wherein a proximal nodal event is defined as an event that is closer to a root cause event than a specified event on the event path.

9. The method for the automated generation of a class definition and naming structure from an event relationship network of claim 2 further comprising the act of determining if there is a subsequent connected subnet for a current subnet.

10. The method for the automated generation of a class definition and naming structure from an event relationship network of claim 9 further comprising the acts of:

determining the subset of connected events on the subsequent connected subnet that follow from the current subnet;

assigning the subset of events to a subnet descendant superclass; and

adding the subnet descendant superclass to a descendant slot of the current subnet events.

11. The method for the automated generation of a class definition and naming structure from an event relationship network of claim 10 wherein the subnet descendant class contains events that are in a direct flow from a primary subnet entry point.

12. The method for the automated generation of a class definition and naming structure from an event relationship network of claim 9 further comprising the act of writing a plurality of generated classes to a data file.

13. The method for the automated generation of a class definition and naming structure from an event relationship network of claim 1 further comprising the act of generating a generic correlation template.

14. The method for the automated generation of a class definition and naming structure from an event relationship network of claim 13 further comprising the acts of defining a path identification slot, a sequence identification slot, a descendant class and an ancestor class in a data file immediately descendant from a root cause event.

15. The method for the automated generation of a class definition and naming structure from an event relationship network of claim 14 wherein the path identification slot is propagated with a list of path numbers that an event is relevant to in the event relationship network.

16. The method for the automated generation of a class definition and naming structure from an event relationship network of claim 15 wherein the propagation of path identification numbers includes the acts of:

starting at a root node of the event relationship network, proceeding to a nodal event and defining a path leading in to the nodal event a path identification number of one;

at the nodal event, continuing the inherited path leading in as one path leading out from the nodal event and assigning each remaining path leading out from the nodal event an ascending sequence of path identification numbers;

proceeding to a next nodal event on any path leading out and repeating the acts performed at the nodal event of assigning each remaining path leading out from the nodal event an ascending sequence of path identification numbers; and

propagating the path identification numbers backwards to ensure that events on a path precedent to the nodal event are contained in the list for the path identification slot.

17. The method for the automated generation of a class definition and naming structure from an event relationship network of claim 14 wherein the sequence identification slot is filled with a sequence number for the path.

18. The method for the automated generation of a class definition and naming structure from an event relationship network of claim 17 wherein the propagation of sequence identification numbers includes the acts of:

starting at a root node of the event relationship network, assigning the sequence numbers down a complete path;

for each nodal event, continuing to assign sequence numbers for each node down any path by increasing a current sequence identification number of each nodal event; and

if an event is fed by more than one incoming path, assigning the event a sequence number that is the highest of each incoming path and increasing the sequence identification numbers of any events that follow a current nodal event in the logical sequence.

19. The method for the automated generation of a class definition and naming structure from an event relationship network of claim 14 wherein for any event on a subnet which includes a primary subnet and that lies in a logical flow connected to the primary subnet, populating the ancestor class slot with a list of all subnet ancestor class names which are primary to the event and lie on the logical flow.

20. The method for the automated generation of a class definition and naming structure from an event relationship network of claim 14 wherein for any event on a subnet which includes a secondary subnet and that lies in a logical flow connected to the secondary event, populating the descendant class slot with a list of all subnet descendant class names which are secondary to the event and lie on the logical flow.

21. The method for the automated generation of a class definition and naming structure from an event relationship network of claim 13 wherein the act of generating a generic correlation template comprises the acts of:

for an event of a class within a subnet ancestor class;

making a current event on the subnet a secondary event; and

removing the current event from correlation analysis;

for an event of a class within a subnet descendant class;

making the current event on the subnet a primary event; and

removing the current event from correlation analysis;

for an older event on the subnet in which the path identification of the current event intersects the path identification of the older event;

making the current event on the subnet a primary event and removing it from correlation analysis, if the sequence identification of the current event is less than the sequence identification of the older event; and

making the current event on the subnet a secondary event and removing it from correlation analysis, if the sequence identification of the current event is greater than the sequence identification of the older event.

22. A computer readable medium containing a computer program product for the automated generation of a class definition and naming structure from an event relationship network represented by a hierarchical connected graph to perform correlation analysis in a distributed computing environment, the computer program product comprising:

program instructions that automatically assign events in a subnet to a superclass defined with the same name as the subnet;

program instructions that assign a path number to connected events in the same subnet;

program instructions that determine if a branch point has been reached in the connected graph;

program instructions that assign a new path number to the branch, add the assigned path number to events that are earlier in the sequence than the branch point, and append a list of events and assigned path numbers to a path identification slot for each event, if a branch point has been reached; and

program instructions that increment a sequence number that is assigned to each event and add the event sequence numbers to a sequence identification list, if a branch point has not been reached.

23. The computer program product for the automated generation of a class definition and naming structure from an event relationship network of claim 22 further comprising program instructions that determine if there exists a prior connected subnet for a current subnet.

24. The computer program product for the automated generation of a class definition and naming structure from an event relationship network of claim 23 further comprising:

program instructions that determine the subset of connected events on the prior connected subnet that lead to the current subnet;

program instructions that assign the subset of events to a subnet ancestor superclass; and

program instructions that add the subnet ancestor superclass to an ancestor slot of the current subnet events.

25. The computer program product for the automated generation of a class definition and naming structure from an event relationship network of claim 24 wherein the subnet ancestor class contains events that are primary to another subnet.

26. The computer program product for the automated generation of a class definition and naming structure from an event relationship network of claim 23 further comprising program instructions that determine if there is a subsequent connected subnet for a current subnet.

27. The computer program product for the automated generation of a class definition and naming structure from an event relationship network of claim 26 further comprising:

program instructions that determine the subset of connected events on the subsequent connected subnet that follow from the current subnet;

program instructions that assign the subset of events to a subnet descendant superclass; and

program instructions that add the subnet descendant superclass to a descendant slot of the current subnet events.

28. The computer program product for the automated generation of a class definition and naming structure from an event relationship network of claim 26 further comprising program instructions that write a plurality of generated classes to a data file.

29. The computer program product for the automated generation of a class definition and naming structure from an event relationship network of claim 22 further comprising program instructions that generate a generic correlation template.

30. The computer program product for the automated generation of a class definition and naming structure from an event relationship network of claim 29 further comprising program instructions that define a path identification slot, a sequence identification slot, a descendant class and an ancestor class in a data file immediately descendant from a root cause event.

31. The computer program product for the automated generation of a class definition and naming structure from an event relationship network of claim 30 further comprising program instructions that propagate the path identification slot with a list of path numbers that an event is relevant to in the event relationship network.

32. The computer program product for the automated generation of a class definition and naming structure from an event relationship network of claim 31 wherein the program instructions that propagate path identification numbers includes:

program instructions that, starting at a root node of the event relationship network, proceed to a nodal event and define a path leading in to the nodal event with a path identification number of one;

program instructions that, for the nodal event, continue the inherited path leading in as one path leading out from the nodal event and assign each remaining path leading out from the nodal event an ascending sequence of path identification numbers;

program instructions that proceed to a next nodal event on any path leading out from the nodal event and assign each remaining path leading out from the next nodal event an ascending sequence of path identification numbers; and

program instructions that propagate the path identification numbers backwards to ensure that events on a path precedent to the nodal event are contained in the list for the path identification slot.

33. The computer program product for the automated generation of a class definition and naming structure from an event relationship network of claim 30 wherein for any event on a subnet which includes a primary subnet and that lies in a logical flow connected to the primary subnet, program instructions that populate the ancestor class slot with a list of all subnet ancestor class names which are primary to the event and lie on the logical flow.

34. The computer program product for the automated generation of a class definition and naming structure from an event relationship network of claim 33 wherein the program instructions that propagate sequence identification numbers includes:

program instructions that, starting at a root node of the event relationship network, assign the sequence numbers down a complete path;

program instructions that, for each nodal event, continue to assign sequence numbers for each node down any path by increasing a current sequence identification number of each nodal event; and

if an event is fed by more than one incoming path, program instructions that assign the event a sequence number that is the highest of each incoming path and increase the sequence identification numbers of any events that follow a current nodal event in the logical sequence.

35. The computer program product for the automated generation of a class definition and naming structure from an event relationship network of claim 30 wherein for any event on a subnet which includes a secondary subnet and that lies in a logical flow connected to the secondary event, program instructions that populate the descendant class slot with a list of all subnet descendant class names which are secondary to the event and lie on the logical flow.

36. The computer program product for the automated generation of a class definition and naming structure from an event relationship network of claim 29 wherein the program instructions that generate a generic correlation template comprise:

for an event of a class within a subnet ancestor class;

program instructions that make a current event on the subnet a secondary event; and

program instructions that remove the current event from correlation analysis;

for an event of a class within a subnet descendant class;

program instructions that make the current event on the subnet a primary event; and

program instructions that remove the current event from correlation analysis;

for an older event on the subnet in which the path identification of the current event intersects the path identification of the older event;

program instructions that make the current event on the subnet a primary event and remove it from correlation analysis, if the sequence identification of the current event is less than the sequence identification of the older event; and

program instructions that make the current event on the subnet a secondary event and remove it from correlation analysis, if the sequence identification of the current event is greater than the sequence identification of the older event.

37. A computer-implemented system for the automated generation of a class definition and naming structure from an event relationship network represented by a hierarchical connected graph to perform correlation analysis in a distributed computing environment, comprising:

a component that automatically assigns events in a subnet to a superclass defined with the same name as the subnet;

a component that assigns a path number to connected events in the same subnet;

a component that determines if a branch point has been reached in the connected graph;

a component that assigns a new path number to the branch, adds the assigned path number to events that are earlier in the sequence than the branch point, and appends a list of events and assigned path numbers to a path identification slot for each event, if a branch point has been reached; and

a component that increments a sequence number that is assigned to each event and adds the event sequence numbers to a sequence identification list, if a branch point has not been reached.

38. The system for the automated generation of a class definition and naming structure from an event relationship network of claim 37 further comprising a component that determines if there exists a prior connected subnet for a current subnet.

39. The method for the automated generation of a class definition and naming structure from an event relationship network of claim 38 further comprising:

a component that determines the subset of connected events on the prior connected subnet that lead to the current subnet;

a component that assigns the subset of events to a subnet ancestor superclass; and

a component that adds the subnet ancestor superclass to an ancestor slot of the current subnet events.

40. The system for the automated generation of a class definition and naming structure from an event relationship network of claim 38 further comprising a component that determines if there is a subsequent connected subnet for a current subnet.

41. The system for the automated generation of a class definition and naming structure from an event relationship network of claim 40 further comprising:

a component that determines the subset of connected events on the subsequent connected subnet that follow from the current subnet;

a component that assigns the subset of events to a subnet descendant superclass; and

a component that adds the subnet descendant superclass to a descendant slot of the current subnet events.

42. The system for the automated generation of a class definition and naming structure from an event relationship network of claim 40 further comprising a component that writes a plurality of generated classes to a data file.

43. The system for the automated generation of a class definition and naming structure from an event relationship network of claim 37 further comprising a component that generates a generic correlation template.

44. The system for the automated generation of a class definition and naming structure from an event relationship network of claim 43 further comprising a component that defines a path identification slot, a sequence identification slot, a descendant class and an ancestor class in a data file immediately descendant from a root cause event.

45. The system for the automated generation of a class definition and naming structure from an event relationship network of claim 44 further comprising a component that propagates the path identification slot with a list of path numbers that an event is relevant to in the event relationship network.

46. The system for the automated generation of a class definition and naming structure from an event relationship network of claim 45 wherein the component that propagates a of path identification numbers includes:

a component that, starting at a root node of the event relationship network, proceeds to a nodal event and defines a path leading in to the nodal event with a path identification number of one;

a component that, at the nodal event, continues the inherited path leading in as one path leading out from the nodal event and assigns each remaining path leading out from the nodal event an ascending sequence of path identification numbers;

a component that proceeds to a next nodal event on any path leading out and assigns each remaining path leading out from the next nodal event an ascending sequence of path identification numbers; and

a component that propagates the path identification numbers backwards to ensure that events on a path precedent to the nodal event are contained in the list for the path identification slot.

47. The system for the automated generation of a class definition and naming structure from an event relationship network of claim 44 further comprising a component that fills the sequence identification slot with a sequence number for the path.

48. The system for the automated generation of a class definition and naming structure from an event relationship network of claim 47 wherein the component that propagates sequence identification numbers includes:

a component that, starting at a root node of the event relationship network, assigns the sequence numbers down a complete path;

a component that, for each nodal event, continues to assign sequence numbers for each node down any path by increasing a current sequence identification number of each nodal event; and

a component that, if an event is fed by more than one incoming path, assigns the event a sequence number that is the highest of each incoming path and increases the sequence identification numbers of any events that follow a current nodal event in the logical sequence.

49. The system for the automated generation of a class definition and naming structure from an event relationship network of claim 44 further comprising a component that, for any event on a subnet which includes a primary subnet and that lies in a logical flow connected to the primary subnet, populates the ancestor class slot with a list of all subnet ancestor class names which are primary to the event and lie on the logical flow.

50. The system for the automated generation of a class definition and naming structure from an event relationship network of claim 44 further comprising a component that, for any event on a subnet which includes a secondary subnet and that lies in a logical flow connected to the secondary event, populates the descendant class slot with a list of all subnet descendant class names which are secondary to the event and lie on the logical flow.

51. The system for the automated generation of a class definition and naming structure from an event relationship network of claim 43 wherein the component that generates a generic correlation template comprises:

for an event of a class within a subnet ancestor class;

a component that makes a current event on the subnet a secondary event; and

a component that removes the current event from correlation analysis;

for an event of a class within a subnet descendant class;

a component that makes the current event on the subnet a primary event; and

a component that removes the current event from correlation analysis;

for an older event on the subnet in which the path identification of the current event intersects the path identification of the older event;

a component that makes the current event on the subnet a primary event and removes it from correlation analysis, if the sequence identification of the current event is less than the sequence identification of the older event; and

a component that makes the current event on the subnet a secondary event and removes it from correlation analysis, if the sequence identification of the current event is greater than the sequence identification of the older event.