Method, apparatus, and program for associating related heterogeneous events in an event handler

• US 7,308,689 B2
• Filed: 12/18/2002
• Issued: 12/11/2007
• Est. Priority Date: 12/18/2002
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Black, Steven, Debar, Herve, Garrison, John Michael, Wespi, Andreas
• Primary Examiner(s): Thomson, William
• Assistant Examiner(s): Ho, Andy
• Application Number:
  US10/324,569
• Publication Number:
  US 20040123304A1
• Time in Patent Office: 1,819 Days
• Field of Search: 719/318
• US Class Current: 719/318
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/06 Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level

Abstract

An event handler is provided that associates events from heterogeneous data sources. In a first phase, incoming events are translated to vectors of event attributes. Based on the data source, implicit information about the event and its attributes may be available. This information is used to normalize the information provided by the event. Normalization actions may include renaming the attributes, deriving new attributes from given attributes, and transforming attribute value ranges. In a second phase, a determination is made as to whether two or more events are considered to be associated based on the vectors. Different vectors of core attributes may be created in order to create associations with different semantics.

Claims

1. A method for managing heterogeneous events in an event handler, comprising:

receiving a plurality of events from a plurality of heterogeneous event generators, wherein each event has a respective set of event attributes;

translating the plurality of events into a plurality of vectors of core attributes;

normalizing values of the core attributes in the plurality of vectors; and

creating an association between a first event and a second event based on the normalized attribute values in the vectors, wherein the step of creating an association comprises;

determining whether the first event and the second event both include a required number of the core attributes; and

determining whether the values of the core attributes for the first event and the second event match.

2. The method of claim 1, wherein the step of normalizing the values of core attributes comprises renaming at least one event attribute.

3. The method of claim 1, wherein the step of normalizing the values of core attributes comprises deriving at least one core attribute from a related event attribute.

4. The method of claim 1, wherein the step of normalizing the values of core attributes comprises transforming a value range of at least one event attribute to comply with a core attribute value range.

5. The method of claim 1, wherein the step of determining whether the first event and the second event both include a required number of core attributes comprises:

determining whether the first event and the second event both include a predetermined number of the core attributes.

6. The method of claim 1, wherein the step of determining whether the first event and the second event both include a required number of core attributes comprises:

determining whether the first event and the second event both include a first predetermined number of a first subset of the core attributes and a second predetermined number of a second subset of the core attributes.

7. The method of claim 1, wherein the step of determining whether the values of the core attributes for the first event and the second event match comprises:

determining whether the values of the core attributes for the first event and the second event are equal.

8. The method of claim 1, wherein the step of determining whether the values of the core attributes for the first event and the second event match comprises:

determining whether the values of the core attributes for the first event and the second event match based on a computed function.

9. The method of claim 8, wherein the computed function comprises one of an approximation function and a phonetic function.

10. An apparatus for managing heterogeneous events in an event handler, comprising:

receipt means for receiving a plurality of events from a plurality of heterogeneous event generators, wherein each event has a respective set of event attributes;

translation means for translating the plurality of events into a plurality of vectors of core attributes;

normalization means for normalizing values of the core attributes in the plurality of vectors; and

creation means for creating an association between a first event and a second event based on the normalized attribute values in the vectors, wherein the creation means comprises;

first determination means for determining whether the first event and the second event both include a required number of the core attributes; and

second determination means for determining whether the values of the core attributes for the first event and the second event match.

11. The apparatus of claim 10, wherein the normalization means comprises means for renaming at least one event attribute.

12. The apparatus of claim 10, wherein the normalization means comprises means for deriving at least one core attribute from a related event attribute.

13. The apparatus of claim 10, wherein the normalization means comprises means for transforming a value range of at least one event attribute to comply with a core attribute value range.

14. The apparatus of claim 10, wherein the first determination means comprises:

means for determining whether the first event and the second event both include a predetermined number of the core attributes.

15. The apparatus of claim 10, wherein the first determination means comprises:

means for determining whether the first event and the second event both include a first predetermined number of a first subset of the core attributes and a second predetermined number of a second subset of the core attributes.

16. The apparatus of claim 10, wherein the second determination means comprises:

means for determining whether the values of the core attributes for the first event and the second event are equal.

17. The apparatus of claim 10, wherein the second determination means comprises:

means for determining whether the values of the core attributes for the first event and the second event match based on a computed function.

18. The apparatus of claim 17, wherein the computed function comprises one of an approximation function and a phonetic function.

19. A computer program product, in a recordable-type computer readable medium, for managing heterogeneous events in an event handler, comprising:

instructions for receiving a plurality of events from a plurality of heterogeneous event generators, wherein each event has a respective set of event attributes;

instructions for translating the plurality of events into a plurality of vectors of core attributes;

instructions for normalizing values of the core attributes in the plurality of vectors and instructions for creating an association between a first event and a second event based on the normalized attribute values in the vectors;

wherein the instructions for creating an association comprises;

instructions for determining whether the first event and the second event both include a required number of the core attributes; and

instructions for determining whether the values of the core attributes for the first event and the second event match.