Root cause analysis for complex event processing

• US 8,386,848 B2
• Filed: 05/11/2009
• Issued: 02/26/2013
• Est. Priority Date: 05/11/2009
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Grell, Stephan, Nano, Olivier
• Primary Examiner(s): Baderman, Scott
• Assistant Examiner(s): Leibovich, Yair
• Application Number:
  US12/463,506
• Publication Number:
  US 20100287361A1
• Time in Patent Office: 1,387 Days
• Field of Search: 714/25, 712/233, 712/220
• US Class Current: 714/25
• CPC Class Codes: G05B 23/0278 Qualitative, e.g. if-then rules; Fuzzy logic; Lookup tables; Symptomatic search; FMEA
• CPC Class Codes: G06N 5/045 Explanation of inference; Explainable artificial intelligence [XAI]; Interpretable artificial intelligence

Abstract

Root cause analysis for complex event processing is described. In embodiments, root cause analysis at a complex event processor is automatically performed by selecting an output event from an operator and correlating the output event to an input event using event type and lifetime data for the input event and the output event stored in a data store. Embodiments describe how the lifetime data can comprise a start time and an end time for the event, and the correlation can be based on a comparison of the start and end times between the input and output events. Embodiments describe how the correlation algorithm used is selected in dependence on the event type. In embodiments, a complex event processing engine comprises a logging unit arranged to store in the data store an indicator of an event type and lifetime data for each output event from an operator.

Claims

1. A method of root cause analysis executed on a processor, comprising:

the processor selecting an output event in a complex event processing engine, the output event being output from an operator having an input event;

reading an event type, payload data, and lifetime data for each of the input event and the output event from a data store in communication with the processor, the payload data including an event message that is modifiable by the operator; and

the processor correlating the input event and the output event, based at least on the event type, on the payload data, and on a determination that the lifetime data for the input event and the output event are correlated.

2. A method according to claim 1, further comprising the step of, if the input event and the output event are correlated, adding the input event to a tree data structure, such that the input event is linked to the output event.

3. A method according to claim 1, wherein the lifetime data comprises a start time for the input event and the output event, and the step of correlating comprises comparing the start time of the input event with the start time of the output event.

4. A method according to claim 1, wherein the lifetime data comprises an end time for the input event and the output event, and the step of correlating comprises comparing the end time of the input event with the end time of the output event.

5. A method according to claim 1, further comprising the step of reading the payload data for the input event and the output event from the data store, and wherein the step of correlating comprises comparing the payload data for the output event and the input event.

6. A method according to claim 1, further comprising the step of reading an event identifier for the input event and the output event from the data store, and wherein the step of correlating comprises comparing the event identifier for the output event with the event identifier for the input event.

7. A method according to claim 1, wherein the step of correlating comprises selecting and executing one of a plurality of correlation algorithms in dependence on the event type.

8. A method according to claim 1, wherein the step of correlating comprises selecting and executing one of a plurality of correlation algorithms in dependence on an operator type for the operator.

9. A method according to claim 2, further comprising the step of using the tree data structure to control at least one subsequent operation of the complex event processing engine, such that the complex event processing engine only stores log data for events in the tree data structure.

10. A method according to claim 1, wherein the root cause analysis is a fault tree analysis.

11. A complex event processing engine, comprising:

a log data store;

at least one operator arranged to process an input event and output an output event; and

at least one logging unit connected to the output of the at least one operator and arranged to store in the log data store an indicator of an event type, payload data, and lifetime data for each output event from the at least one operator, wherein the payload data is modifiable by the at least one operator, and wherein the complex event processing engine adds the input event to a tree structure based on a determination of whether the input event and the output event have matching lifetime data and whether the input event and the output event have matching payload data.

12. A complex event processing engine according to claim 11, wherein the lifetime data comprises a start time for the output event.

13. A complex event processing engine according to claim 11, wherein the lifetime data comprises an end time for the output event.

14. A complex event processing engine according to claim 11, wherein the lifetime data further comprises a modified end time for the output event.

15. A complex event processing engine according to claim 11, wherein the event type is at least one of:

an insert event;

an update event or a concurrent time increment event.

16. A complex event processing engine according to claim 11, wherein the operator is a modification operator arranged to modify the input event to generate the output event.

17. A complex event processing engine according to claim 11, wherein the operator is a new event operator arranged to create the output event using the input event.

18. A complex event processing engine according to claim 11, wherein the logging unit is further arranged to store for each output event at least one of:

an identity of the operator;

a log time; and

an event identifier.

19. A complex event processing engine according to claim 11, wherein the logging unit is further arranged to determine whether to store data for the output event based on stored results of a root cause analysis previously performed on the complex event processing engine.

20. A method of root cause analysis executed on a processor, comprising:

the processor selecting an output event in a complex event processing engine, the output event being output from an operator having an input event;

reading an event type, payload data, and lifetime data for each of the input event and the output event from a data store in communication with the processor;

the processor determining whether the input event and the output event are correlated, using the event type and the lifetime data, including determining that the lifetime data for the input event and the output event do not match and that the payload data for the input event and the output event match;

adding the input event to a tree data structure such that the input event is linked to the output event, based on the determination that the input event and the output event are correlated; and

displaying the tree in a user interface on a display.