×

System and method for correlating events in a pluggable correlation architecture

  • US 8,185,488 B2
  • Filed: 04/17/2008
  • Issued: 05/22/2012
  • Est. Priority Date: 04/17/2008
  • Status: Expired due to Fees
First Claim
Patent Images

1. A method for correlating events in a pluggable event correlation system, comprising:

  • deploying a plurality of correlation engines into a correlation runtime environment having an extensible service-oriented architecture that includes an exposed application program interface to configure the correlation runtime environment with different semantic formats used in the plurality of correlation engines;

    receiving an event stream that includes having a plurality of events that originate from a plurality of event sources;

    converting the plurality of events in the event stream into the different semantic formats used in the plurality of correlation engines using a plurality of input adapters defined with the exposed application program interface;

    correlating, the plurality of events against a plurality of rules using the plurality of correlation engines deployed into the correlation runtime environment, wherein the plurality of correlation engines evaluate the plurality of events in the different semantic formats used therein to correlate the plurality of events against the plurality of rules;

    converting outputs that one or more of the plurality of correlation engines generated to indicate that one or more of the evaluated plurality of events have triggered one or more of the plurality of rules, wherein one or more output adapters defined with the exposed application program interface convert the outputs from the different semantic formats used in the one or more of the plurality of correlation engines into one or more correlated events associated with the correlation runtime environment; and

    executing one or more actions that the correlation runtime environment associates with the one or more correlated events to remediate a condition that caused the one or more of the plurality of correlation engines to indicate that the one or more of the plurality of rules have been triggered, wherein the one or more actions have a different format than the semantic formats used in the plurality of correlation engines.

View all claims
  • 11 Assignments
Timeline View
Assignment View
    ×
    ×