Cross-cutting event correlation

• US 8,892,703 B2
• Filed: 03/31/2006
• Issued: 11/18/2014
• Est. Priority Date: 03/31/2006
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Biazetti, Ana C., Daniels, Fonda J., Hayes, Kent F. Jr., McMahan, Paul F., Nastacio, Denilson
• Primary Examiner(s): Whipple, Brian P
• Application Number:
  US11/395,736
• Publication Number:
  US 20070233836A1
• Time in Patent Office: 3,154 Days
• Field of Search: 709/220, 709/223, 709/224, 370/256
• US Class Current: 709/223
• CPC Class Codes: G06F 11/3452 Performance evaluation by statistical analysis
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: G06F 16/2468 Fuzzy queries
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: G06F 2201/865 Monitoring of software
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: H04L 41/065 involving logical or physical relationship, e.g. grouping and hierarchies
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network

Abstract

Embodiments of the present invention provide a method, system and computer program product for cross-cutting event correlation in an enterprise computing monitoring and management system. An enterprise computing monitoring and management system can include a hierarchy of nodes, where several of the nodes are each coupled to a corresponding embedded correlation engine and an event bus. The system further can include a root node among the nodes. The root node can be coupled to the event bus and to centralized correlation logic programmed to identify a high correspondence between events from a particular event source among the nodes and a particular set of correlation rules in that correlation engine. The identification of such correspondence can be used to move to the set of correlation rules to an embedded correlation engine closer to the particular event source.

Claims

1. A cross-cutting event correlation method comprising:

receiving in centralized correlation logic executing in memory by a processor of a computer, events originating from a plurality of different event sources;

detecting a high frequency of occurrence of a received event in a particular event source; and

,

in response to detecting the high frequency of occurrence of the received event in the particular event source, moving a corresponding correlation rule closer to the particular event source.

2. The method of claim 1, further comprising:

monitoring a set of attributes for each of the events handled in different embedded correlation engines for the different event sources;

identifying patterns for the set of attributes among the events; and

,

triggering actions upon identifying the patterns.

3. The method of claim 2, wherein monitoring a set of attributes for each of the events handled in different embedded correlation engines for the different event sources, comprises monitoring a severity and situation category for each of the events handled in different embedded correlation engines for the different event sources.

4. The method of claim 3, wherein identifying patterns for the set of attributes among the events, comprises identifying patterns of events demonstrating a particular degree of severity arising from a particular event source with a particular frequency.

5. The method of claim 2, further comprising:

querying a database of correlation rules using an identified one of the patterns to locate a correlation rule enabled to match the attributes of the identified one of the patterns; and

,

copying the located correlation rule to a correlation engine for an event source for the identified one of the patterns.