System and method for circuit and path based event correlation

• US 8,255,525 B2
• Filed: 08/19/2009
• Issued: 08/28/2012
• Est. Priority Date: 08/19/2009
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Martin, Daniel Joseph, McMahon, Philip Brian
• Primary Examiner(s): Chan, Wing
• Assistant Examiner(s): KATSIKIS, KOSTAS J
• Application Number:
  US12/543,834
• Publication Number:
  US 20110047262A1
• Time in Patent Office: 1,105 Days
• Field of Search: 709/224, 714/4.1
• US Class Current: 709/224
• CPC Class Codes: H04L 41/064 involving time analysis
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/0823 Errors, e.g. transmission errors

Abstract

A method, system and computer-usable medium are disclosed for the correlation of network events. A port of a network device is monitored at the physical layer interface for the occurrence of a network event. If detected, a repository of circuit path, network device, and device interface data is queried for information related to the network event and each network device at each hop of the circuit path associated with the event. A user selects time intervals for other network events or alarms occurring before or after the target event. A repository of network event and alarm data is then queried to retrieve all network events or alarms occurring during the selected time interval. Information related to the network events or alarms are then compared to interfaces related to devices that are likewise associated with the circuit path associated with the event.

Claims

1. A computer-implemented method for event correlation, comprising:

performing, via a processor, a lookup of network devices, the lookup being performed on network devices interfacing with network events associated with a network circuit within a predetermined period of time;

matching, via the processor, events based on predetermined criteria to generate a set of matched events;

making, via the processor, at least one member of the set of matched events a child network event;

processing, via the processor, the network events to identify a probable parent network event, wherein the probable parent network event is not a member of the set of matched events,

wherein the parent network event is associated with a network path; and

the child network event is associated with a network circuit.

2. The method of claim 1, wherein the performing a lookup and the matching events are performed by an event correlation module of a network management system.

3. The method of claim 1, wherein the network events occur in a network using the Synchronous Optical Networking (SONET) protocol or the Synchronous Digital Hierarchy protocol.

4. The method of claim 1, wherein information related to the network devices is stored in a repository of path, network device, and device interface data.

5. The method of claim 1, wherein the predetermined period of time is selectable by a user.

6. A system comprising:

a processor;

a data bus coupled to the processor; and

a computer-usable medium embodying computer program code, the computer-usable medium being coupled to the data bus, the computer program code used for performing event correlation and comprising instructions executable by the processor and configured for;

performing a lookup of network devices, the lookup being performed on network devices interfacing with network events associated with a network circuit within a predetermined period of time; and

matching events based on predetermined criteria to generate a set of matched events;

making at least one member of the set of matched events a child network event; and

processing the network events to identify a probable parent network event, wherein the probable parent network event is not a member of the set of matched events,

wherein the parent network event is associated with a network path; and

the child network event is associated with a network circuit.

7. The system of claim 6, wherein the performing a lookup and the matching events are performed by an event correlation module of a network management system.

8. The system of claim 6, wherein the network events occur in a network using the Synchronous Optical Networking (SONET) protocol or the Synchronous Digital Hierarchy protocol.

9. The system of claim 6, wherein information related to the network devices is stored in a repository of path, network device, and device interface data.

10. The system of claim 6, wherein the predetermined period of time is selectable by a user.

11. A non-transitory computer-usable medium embodying computer program code, the computer program code comprising computer executable instructions configured for:

performing a lookup of network devices, the lookup being performed on network devices interfacing which interface with network events associated with a network circuit within a predetermined period of time; and

matching events based on predetermined criteria to generate a set of matched events;

making at least one members of the set of matched events a child network event; and

processing the network events to identify a probable parent network event wherein the probable parent network event is not a member of the set of matched events,

wherein the parent network event is associated with a network path; and

the child network event is associated with a network circuit.

12. The non-transitory computer usable medium of claim 11, wherein the performing a lookup and the matching events are performed by an event correlation module of a network management system.

13. The non-transitory computer usable medium of claim 11, wherein the network events occur in a network using the Synchronous Optical Networking (SONET) protocol or the Synchronous Digital Hierarchy protocol.

14. The non-transitory computer usable medium of claim 11, wherein information related to the network devices is stored in a repository of path, network device, and device interface data.

15. The non-transitory computer usable medium of claim 11, wherein the predetermined period of time is selectable by a user.

16. The non-transitory computer usable medium of claim 11, wherein the computer executable instructions are deployable to a client computer from a server at a remote location.

17. The non-transitory computer usable medium of claim 11, wherein the computer executable instructions are provided by a service provider to a customer on an on-demand basis.