Automated event correlation

• US 8,205,215 B2
• Filed: 05/04/2007
• Issued: 06/19/2012
• Est. Priority Date: 05/04/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Khandrika, Rajasekhar, Bendapudi, Perraju
• Primary Examiner(s): CAO, DIEM K
• Application Number:
  US11/744,786
• Publication Number:
  US 20080276253A1
• Time in Patent Office: 1,873 Days
• Field of Search: 719/318, 714/39, 709/224
• US Class Current: 719/318
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications

Abstract

Events captured at an application are compared to event correlation instances, wherein an event correlation instance represents a relationship between events of components of the application. The event of a plurality of events that is a potential root cause event of the plurality of events is determined. The potential root cause event and component associated with the potential root cause event are outputted.

Claims

1. A method, comprising:

instantiating an event correlation template to create an event correlation instance, the event correlation template including a template schema containing a list of components, dependencies between the components, a list of events in each component, and relationships between the events in each component;

comparing events captured at an application to event correlation instances, the event correlation instance representing a causal relationship between events of components of the application;

generating an event mapping, the event mapping causally linking together at least two of the event correlation instances that match the captured events;

determining which event of a plurality of events is a potential root cause event of the plurality of events, the determining including backtracking through related event instances of the event mapping; and

outputting the potential root cause event and component associated with the potential root cause event.

2. The method of claim 1 wherein comparing events captured at the application to event correlation instances includes flagging event correlation instances that match an event.

3. The method of claim 2 wherein determining which event of the plurality of events is the potential root cause event of the plurality of events includes generating the event mapping using the flagged event correlation instances.

4. The method of claim 1, further comprising:

receiving the events from a central event database, the captured events of the application being stored in the central event database.

5. The method of claim 1, further comprising:

creating the event correlation template in response to user input at an event correlation creation user interface (UI).

6. The method of claim 1, further comprising:

downloading the event correlation template from an Internet site.

7. The method of claim 1, further comprising:

displaying the potential root cause event and associated component in a potential root cause user interface (UI).

8. The method of claim 1 wherein the event correlation template being created by at least one from a set comprising a developer of distributed applications, a third party developer and an experienced system administrator.

9. One or more computer storage media storing computer readable instructions that when executed perform operations comprising:

instantiating an event correlation instance from an event correlation template in response to user input, the event correlation template including a template schema containing a list of components, dependencies between the components, a list of events in each component, and relationships between the events in each component;

comparing events captured at a distributed application to event correlation instances, the event correlation instance representing a causal relationship between events of components of the distributed application;

flagging a first event correlation instance that matches a first event, the first event correlation including a first causal event and a first resulting event;

flagging a second event correlation instance that matches a second event, the second event correlation including a second causal event and a second resulting event;

generating an event mapping, the event mapping causally linking together at least two of the event correlation instances that match the captured events;

determining which event of a plurality of events is a potential root cause event of the plurality of events, the determining including backtracking through a causal linkage between the at least two of the event correlation instances; and

outputting the potential root cause event and component associated with the potential root cause event.

10. The one or more computer storage media of claim 9 wherein generating the event mapping includes:

generating the event mapping using the flagged first and second event correlation instances, the event mapping linking together the first and second event correlation instances, the first resulting event of the first event correlation being the same as the second causal event of the second event correlation instance.

11. The one or more computer storage media of claim 10 wherein determining which event of the plurality of events is the potential root cause event of the plurality of events includes:

backtracking from the second resulting event to the second causal event; and

backtracking from the second causal event to the first causal event, the first causal event being the potential root cause event.

12. The one or more computer storage media of claim 9 wherein the computer readable instructions when executed further perform operations comprising:

creating the event correlation template in response to user input.

13. The one or more computer storage media of claim 9 that when executed perform operations comprising:

downloading the event correlation template from an Internet site.

14. A system, comprising:

one or more processors operatively coupled to one or more memories to provide;

an event correlation database to store event correlation templates and event correlation instances, an event correlation instance being instantiated from event correlation template, the event correlation instance representing a causal relationship between events of components of a distributed application, the event correlation template including a template schema containing a list of components, dependencies between the components, a list of events in each component, and relationships between the events in each component; and

an event correlation engine to compare events having occurred at the distributed application to the event correlation instances stored in the event correlation database and to determine which event, and corresponding component, was a potential root cause event of a plurality of events by backtracking through a causal linkage between at least two event correlation instances.

15. The system of claim 14 wherein to compare events having occurred at the distributed application to the event correlation instances stored in the event correlation database includes:

flagging event correlation instances that match an event.

16. The system of claim 15 wherein to determine which event, and corresponding component, was the potential root cause of a plurality of events includes:

generating an event mapping using the flagged event correlation instances, the event mapping causally linking together related event correlation instances; and

backtracking through the event mapping to find the potential root cause event.

17. The system of claim 14, further comprising:

a central event database to store events captured at the distributed application and to provide the events to the event correlation engine.

18. The system of claim 14, further comprising:

a user interface module creating the event correlation template in response to a user input.

19. The system of claim 14, further comprising:

a potential root cause user interface module displaying the potential root cause event and associated component.