Ignoring redundant symptoms in modular self-healing systems
First Claim
Patent Images
1. A self-healing system comprising:
- an event bus configured to transmit events in the self-healing system;
a correlation engine coupled to the event bus, the correlation engine configured to correlate events transmitted on the event bus from different components of the self-healing system, wherein the correlation engine correlates the events into a correlated event set, the correlated event set indicating a possible fault condition in the system, the correlation engine further configured to evaluate a plurality of correlation rules, the plurality of correlation rules being arranged in a hierarchal rule structure to correlate the events;
an analysis engine coupled to the event bus, the analysis engine configured to perform analysis on the correlated event set that is received from the correlation engine, determine at least one corrective action to be performed in response to the correlated event set, and send a deactivation event to the correlation engine upon initiation of the corrective action, the deactivation event including the correlated event set; and
wherein the correlation engine is further configured to deactivate all correlation rules within the hierarchal rule structure that are used to generate only the correlated event set, and wherein the correlation engine deactivates the correlation rules while recursively traversing the hierarchal rule structure from child rule to parent rule; and
wherein the first, second and third program instructions are stored on the computer readable storage media for execution by the CPU via the computer readable memory.
5 Assignments
0 Petitions
Accused Products
Abstract
Techniques for processing events in a self-healing system. In one embodiment, the system receives system events, one or more of which may indicate a possible fault condition in the system. A hierarchal rule structure is used to generate a correlated event set. A determining operation determines at least one corrective action to be performed in response to the correlated event set. A deactivating operation deactivates all correlation rules within the hierarchal rule structure that are only used to generate the correlated event set. Repeated instances of the same fault condition are prevented from being processed by the self-healing system.
-
Citations
24 Claims
-
1. A self-healing system comprising:
-
an event bus configured to transmit events in the self-healing system; a correlation engine coupled to the event bus, the correlation engine configured to correlate events transmitted on the event bus from different components of the self-healing system, wherein the correlation engine correlates the events into a correlated event set, the correlated event set indicating a possible fault condition in the system, the correlation engine further configured to evaluate a plurality of correlation rules, the plurality of correlation rules being arranged in a hierarchal rule structure to correlate the events; an analysis engine coupled to the event bus, the analysis engine configured to perform analysis on the correlated event set that is received from the correlation engine, determine at least one corrective action to be performed in response to the correlated event set, and send a deactivation event to the correlation engine upon initiation of the corrective action, the deactivation event including the correlated event set; and wherein the correlation engine is further configured to deactivate all correlation rules within the hierarchal rule structure that are used to generate only the correlated event set, and wherein the correlation engine deactivates the correlation rules while recursively traversing the hierarchal rule structure from child rule to parent rule; and wherein the first, second and third program instructions are stored on the computer readable storage media for execution by the CPU via the computer readable memory. - View Dependent Claims (2, 3, 4, 5, 6, 7)
-
-
8. A method for processing events in a computer system, the method comprising:
-
receiving at least one system event, the at least one system event indicating a possible fault condition in the system; utilizing a hierarchal rule structure to generate a correlated event set; determining at least one corrective action to be performed in response to the correlated event set; deactivating all correlation rules within the hierarchal rule structure that are only used to generate the correlated event set; determining at least one target event which, if detected, increases the likelihood of a fault condition; and rearranging the hierarchal rule structure such that a target rule set of at least one target rule for evaluating the target event is given processing priority. - View Dependent Claims (9, 10, 11, 12)
-
-
13. A method for processing events in a computer system, the method comprising:
-
receiving at least one system event, the at least one system event indicating a possible fault condition in the system; utilizing a hierarchal rule structure to generate a correlated event set; determining at least one corrective action to he performed in response to the correlated event set; deactivating all correlation rules within the hierarchal rule structure that are only used to generate the correlated event set; and deactivating the correlation rules while recursively traversing the hierarchal rule structure from child rule to parent rule. - View Dependent Claims (14, 15, 16, 17)
-
-
18. A computer program product for processing events in a computer system, the computer program product comprising:
-
a computer usable storage medium having computer usable program code embodied therewith, the computer usable program code comprising; computer usable program code configured to receive at least one system event, the at least one system event indicating a possible fault condition in the system; computer usable program code configured to utilize a hierarchal rule structure to generate a correlated event set; computer usable program code configured to determine at least one corrective action to be performed in response to the correlated event set; computer usable program code configured to deactivate all correlation rules within the hierarchal rule structure that are only used to generate the correlated event set; computer usable program code configured to determine at least one target event which, if detected, increases the likelihood of a fault condition; and computer usable program code configured to rearrange the hierarchal rule structure such that a target rule set of at least one target rule for evaluating the target event is given processing priority. - View Dependent Claims (19, 20, 21, 22, 23, 24)
-
Specification