System and method for using root cause analysis to generate a representation of resource dependencies

• US 7,552,447 B2
• Filed: 05/26/2004
• Issued: 06/23/2009
• Est. Priority Date: 05/26/2004
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Uthe, Robert Thomas
• Primary Examiner(s): Lee; Thomas
• Assistant Examiner(s): WU, QING YUAN
• Application Number:
  US10/854,042
• Publication Number:
  US 20050278273A1
• Time in Patent Office: 1,854 Days
• Field of Search: 719/318, 714/100, 714 25- 26, 714 47- 48, 706/47, 709/224, 715/853, 717104-105
• US Class Current: 719/318
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis

Abstract

A system and method for using event management root cause analysis to depict resource dependencies are provided. With the system and method, since the root cause analysis of known event management systems provides a mechanism for defining interactions of enterprise components for root cause analysis purposes, this information is used as a basis for obtaining enterprise component relationship information that may be used by other management applications. That is, the system and method monitor the application of correlation rules to event notifications from various enterprise components and determine relationships of the various enterprise components based on the results of the application of the correlation rules. These relationships may then be stored in a data structure representing the system environment and may be used by other management systems or displayed to the user in a graphical format that graphically represents the system environment.

Claims

1. A method in a data processing system, for determining system resource dependencies, comprising:

receiving a first event notification from a first system resource;

performing root cause analysis on the first event notification from the first system resource, wherein performing root cause analysis on the first event notification includes applying one or more correlation rules to information in the first event notification;

identifying one or more dependency relationships between the first system resource and a plurality of other system resources based on the application of the one or more correlation rules to the information in the first event notification, wherein identifying one or more dependency relationships is recursively performed until a predetermined level of dependency corresponding to the plurality of other system resources is achieved, wherein a second system resource is one of the plurality of other system resources, the identifying step further comprising;

determining whether a first event that caused the first event notification is a symptom of a second event that caused a second event notification received from the second system resource;

responsive to determining that the first event that caused the first event notification is a symptom of the second event that caused the second event notification received from the second system resource, generating a first dependency relationship representation in a dependency data structure, wherein the first dependency relationship representation identifies the first system resource as being dependent upon the second system resource;

otherwise, determining whether the first event that caused the first event notification is a root cause of the second event that caused the second event notification received from the second system resource; and

responsive to determining that the first event that caused the first event notification is a root cause of the second event that caused the second event notification received from the second system resource, generating a second dependency relationship representation in the dependency data structure, wherein the second dependency relationship representation identifies the second system resource as being dependent upon the first system resource;

generating an output based on the identified one or more dependency relationships between the first system resource and the plurality of other system resources, wherein the output is a graphical representation of the identified one or more dependency relationships between the first system resource and the plurality of other system resources; and

adding the first system resource to at least one service description based on the identified one or more dependency relationships between the first system resource and the plurality of other system resources.

2. A computer program product comprising a computer recordable-type medium having computer instructions executable by a processor for determining system resource dependencies, the computer program product comprising:

first instructions for receiving a first event notification from a first system resource;

second instructions for performing root cause analysis on the first event notification from the first system resource, wherein performing root cause analysis on the first event notification includes applying one or more correlation rules to information in the first event notification;

third instructions identifying one or more dependency relationships between the first system resource and a plurality of other system resources based on the application of the one or more correlation rules to the information in the first event notification, wherein identifying one or more dependency relationships is recursively performed until a predetermined level of dependency corresponding to the plurality of other system resources is achieved, wherein a second system resource is one of the plurality of other system resources, the third instructions further comprising;

fourth instructions for determining whether a first event that caused the first event notification is a symptom of a second event that caused a second event notification received from the second system resource;

fifth instructions for responsive to determining that the first event that caused the first event notification is a symptom of the second event that caused the second event notification received from the second system resource, generating a first dependency relationship representation in a dependency data structure, wherein the first dependency relationship representation identifies the first system resource as being dependent upon the second system resource;

sixth instructions for determining whether the first event that caused the first event notification is a root cause of the second event that caused the second event notification received from the second system resource; and

seventh instructions for responsive to determining that the first event that caused the first event notification is a root cause of the second event that caused the second event notification received from the second system resource, generating a second dependency relationship representation in the dependency data structure, wherein the second dependency relationship representation identifies the second system resource as being dependent upon the first system resource;

eighth instructions for generating an output based on the identified one or more dependency relationships between the first system resource and the plurality of other system resources, wherein the output is a graphical representation of the identified one or more dependency relationships between the first system resource and the plurality of other system resources; and

ninth instructions for adding the first system resource to at least one service description based on the identified one or more dependency relationships between the first system resource and the plurality of other system resources.

3. A data processing system for determining system resource dependencies, the data processing system comprising:

means for receiving a first event notification from a first system resource;

means for performing root cause analysis on the first event notification from the first system resource, wherein performing root cause analysis on the first event notification includes applying one or more correlation rules to information in the first event notification;

means for identifying one or more dependency relationships between the first system resource and a plurality of other system resources based on the application of the one or more correlation rules to the information in the first event notification, wherein identifying one or more dependency relationships is recursively performed until a predetermined level of dependency corresponding to the plurality of other system resources is achieved, wherein a second system resource is one of the plurality of other system resources, the identifying means further comprising;

means for determining whether a first event that caused the first event notification is a symptom of a second event that caused a second event notification received from the second system resource;

means for generating a first dependency relationship representation in a dependency data structure, wherein the first dependency relationship representation identifies the first system resource as being dependent upon the second system resource, responsive to determining that the first event that caused the first event notification is a symptom of the second event that caused the second event notification received from the second system resource;

means for determining whether the first event that caused the first event notification is a root cause of the second event that caused the second event notification received from the second system resource; and

means for generating a second dependency relationship representation in the dependency data structure, wherein the second dependency relationship representation identifies the second system resource as being dependent upon the first system resource, responsive to determining that the first event that caused the first event notification is a root cause of the second event that caused the second event notification received from the second system resource;

means for generating an output based on the identified one or more dependency relationships between the first system resource and the plurality of other system resources, wherein the output is a graphical representation of the identified one or more dependency relationships between the first system resource and the plurality of other system resources; and

means for adding the first system resource to at least one service description based on the identified one or more dependency relationships between the first system resource and the plurality of other system resources.