Model-based event processing

• US 8,635,596 B2
• Filed: 04/21/2006
• Issued: 01/21/2014
• Est. Priority Date: 04/21/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Sanghvi, Ashvinkumar J., Rizzi, Lorenzo
• Primary Examiner(s): Dao, Thuy
• Assistant Examiner(s): HAYIM, SAMUEL E
• Application Number:
  US11/379,757
• Publication Number:
  US 20070250525A1
• Time in Patent Office: 2,832 Days
• Field of Search: None
• US Class Current: 717/120
• CPC Class Codes: G06F 11/3447 Performance evaluation by modeling
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications

Abstract

Model-based event processing is described. In an embodiment, a model of a system includes managed entities and relationships between the managed entities. Events associated with the managed entities are identified and determined to be correlated if the managed entities with which the events are associated have a relationship according to the model.

Claims

1. A computer-implemented method comprising:

under control of one or more processors configured with executable instructions,

retrieving an abstract model of a managed computing system, the abstract model including managed entities having information pages containing encoded methods defining at least one of;

installation;

monitoring;

discovery;

or relationships of the managed entities in the managed computing system;

discovering a concrete model of the managed computing system based on the encoded methods in the information pages in the abstract model, the concrete model including discovered types of the managed entities and discovered concrete instances of relationships between the managed entities;

identifying events associated with the managed entities based on the encoded methods in the information pages in the abstract model;

viewing identifier fields of each event of the identified events, each identifier field indicating a relationship of a managed entity of the managed entities to an event of the identified events;

comparing the relationships indicated by the identifier fields of the identified events and the relationships discovered in the concrete model, the comparing comprising;

determining, based on the encoded methods in the information pages in the abstract model, that the managed entities have a direct relationship or an indirect relationship according to the concrete model;

determining that the relationships indicated by the identifier fields of the identified events are associated with the managed entities having the direct relationship or the indirect relationship according in the concrete model; and

determining that the identified events are correlated based on the determined direct relationship or the determined indirect relationship according to the concrete model.

2. A computer-implemented method as recited in claim 1, wherein the concrete model is expressed in a modeling language including at least one of:

an XML Schema;

a System definition Modeling language.

3. A computer-implemented method as recited in claim 1, wherein the managed entities include a domain, a computer, a sub net, a server, an application, an Internet gateway, a database, a disk, a service, a cost center, a data center, a website, a web service, and/or a process.

4. A computer-implemented method as recited in claim 1, wherein identifying the events comprises generating an event record commemorating each identified event, the event record including a reference to the managed entity with which the identified event is associated.

5. A computer-implemented method as recited in claim 1, wherein events include performance counters and metrics regarding a managed entity.

6. A computer-implemented method as recited in claim 1, further comprising issuing a report including information regarding correlated events and/or an alert.

7. A computer-implemented method as recited in claim 1, wherein identifying the events associated with the managed entities includes:

generating an event record for each identified event; and

storing each event record in a database.

8. A computer-implemented method as recited in claim 1, wherein the information pages containing encoded methods defining the relationships of the managed entities in the managed computing system include user defined statements, the user defined statements stating that managed entities in the managed computing system are directly related or indirectly related to other managed entities in the managed computing system.

9. A computer-implemented method comprising:

under control of one or more processors configured with executable instructions,

retrieving an abstract model of a managed computing system, the abstract model including managed entities having information pages containing encoded methods defining at least one of;

installation;

monitoring;

discovery;

or relationships of the managed entities in the managed computing system;

creating a concrete model of the managed computing system comprising;

discovering types of the managed entities based on the encoded methods in the information pages in the abstract model, and

discovering concrete instances of relationships among the managed entities based on the encoded methods in the information pages in the abstract model;

identifying events associated with the managed entities based on the encoded methods in the information pages in the abstract model;

generating information regarding the identified events associated with the managed entities, wherein generating the information comprises generating a record for each identified event including information regarding an identity of the managed entity associated with the identified event;

comparing the identity of each managed entity associated with each identified event and the relationships among the managed entities in the concrete model;

determining, based on the encoded methods in the information pages in the abstract model, that the managed entities associated with the identified events have a direct relationship or an indirect relationship defined by the concrete model; and

identifying as correlated events, identified events associated with managed entities having the direct relationship or the indirect relationship defined by the concrete model.

10. A computer-implemented method as recited in claim 9, wherein records are generated from customized instrumentation associated with each managed entity.

11. A computer-implemented method as recited in claim 9, further comprising issuing a report and/or an alert when correlated events are identified.

12. One or more computer-readable storage media storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to:

retrieve an abstract model of a managed computing system, the abstract model including managed entities having information pages containing encoded methods defining at least one of;

installation;

monitoring;

discovery;

or relationships of the managed entities in the managed computing system;

discover instances of types of the managed entities and relationships between the managed entities described in the encoded methods in the information pages in the abstract model to create a concrete model during a runtime of the managed computing system;

select events associated with the managed entities based on the encoded methods in the information pages in the abstract model;

retrieve records associated with the selected events from an event collection server;

determine associations between the selected events and the managed entities by examining a managed entity identifier in each record associated with each event, wherein a selected event is determined to be associated with a managed entity if the managed entity identifier in a record associated with the selected event matches an identity of the managed entity;

compare the associations indicated by the managed entity identifiers and the relationships between the managed entities discovered in the concrete model, the comparing comprising;

determining, based on the encoded methods in the information pages in the abstract model, that the managed entities have a direct relationship or an indirect relationship according to the concrete model;

determining that the associations indicated by the managed entity identifiers are associated with the managed entities having the direct relationship or the indirect relationship according in the concrete model; and

correlate the selected events associated with the managed entities having a direct relationship or an indirect relationship according to the concrete model.

13. One or more computer-readable storage media as recited in claim 12, further comprising computer-readable instructions that, when executed by the one or more processors, cause the one or more processors to issue a communication when correlated events are identified.