Cross-cutting event correlation

• US 9,210,057 B2
• Filed: 10/11/2014
• Issued: 12/08/2015
• Est. Priority Date: 03/31/2006
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Biazetti, Ana C., Daniels, Fonda J., Hayes, Kent F. Jr., McMahan, Paul F., Nastacio, Denilson
• Primary Examiner(s): Whipple, Brian P
• Application Number:
  US14/512,397
• Publication Number:
  US 20150032776A1
• Time in Patent Office: 423 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 11/3452 Performance evaluation by statistical analysis
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: G06F 16/2468 Fuzzy queries
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: G06F 2201/865 Monitoring of software
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: H04L 41/065 involving logical or physical relationship, e.g. grouping and hierarchies
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network

Abstract

Embodiments of the present invention provide a method, system and computer program product for cross-cutting event correlation in an enterprise computing monitoring and management system. An enterprise computing monitoring and management system can include a hierarchy of nodes, where several of the nodes are each coupled to a corresponding embedded correlation engine and an event bus. The system further can include a root node among the nodes. The root node can be coupled to the event bus and to centralized correlation logic programmed to identify a high correspondence between events from a particular event source among the nodes and a particular set of correlation rules in that correlation engine. The identification of such correspondence can be used to move to the set of correlation rules to an embedded correlation engine closer to the particular event source.

Claims

1. An enterprise computing monitoring and management data processing system comprising:

a hierarchy of physical network nodes, each physical network node in the hierarchy of physical network nodes being coupled to a corresponding embedded correlation engine and an event bus;

a physical network root node among the hierarchy of physical network nodes, the physical network root node being coupled to the event bus and to cross-cutting correlation logic, the cross-cutting correlation logic comprising program code enabled to identify a high frequency of events from a particular event source among the hierarchy of physical network nodes and to move a corresponding correlation rule to an embedded correlation engine closer to the particular event source.

2. The system of claim 1, wherein the hierarchy of physical network nodes comprise:

at least one gateway; and

,

a plurality of endpoints coupled to the at least one gateway.

3. The system of claim 1, further comprising a cross-cutting correlation rules run-time structure configured for access by a correlation engine, the run-time structure representation comprising a plurality of correlation rules, each of the correlation rules referencing at least one event set, the at least one event set referencing at least one event source for an event and a frequency of occurrence of the event for the event source.

4. The system of claim 1, wherein the program code of the cross-cutting correlation logic is further enabled to monitor a set of attributes for each of the events handled in different embedded correlation engines in the hierarchy, to identify patterns among the events, and to trigger actions upon identifying the patterns.

5. The system of claim 4, wherein the attribute source comprises a combination with other event attributes to determine an affinity between events from a given event source using a cross-cutting correlation rule in a correlation engine.

6. The system of claim 5, wherein at least one of the patterns matches events demonstrating particular event attributes arising from a particular event source with a particular frequency.

7. The system of claim 6, wherein the program code of the cross-cutting correlation logic is yet further enabled to query a database of correlation rules using an identified one of the patterns to locate a correlation rule enabled to match the attributes of the identified patterns, and to copy the located correlation rule to a correlation engine for an event source for the identified patterns.

8. A computer program product comprising a non-transitory computer usable storage medium embodying computer usable program code for cross-cutting event correlation, the computer program product including:

computer usable program code for receiving events originating from a plurality of different event sources;

computer usable program code for detecting a high frequency of occurrence of a received event in a particular event source; and

,

computer usable program code for moving a corresponding correlation rule closer to the particular event source.

9. The computer program product of claim 8, further comprising:

computer usable program code for monitoring a set of attributes for each of the events handled in different embedded correlation engines for the different event sources;

computer usable program code for identifying patterns for the set of attributes among the events; and

,

computer usable program code for triggering actions upon identifying the patterns.

10. The computer program product of claim 9, wherein the computer usable program code for monitoring a set of attributes for each of the events handled in different embedded correlation engines for the different event sources, comprises computer usable program code for monitoring a severity, source and situation for each of the events handled in different embedded correlation engines for the different event sources.

11. The computer program product of claim 10, wherein the computer usable program code for identifying patterns for the set of attributes among the events, comprises computer usable program code for identifying patterns of events demonstrating a particular degree of severity arising from a particular event source with a particular frequency.

12. The computer program product of claim 9, further comprising:

computer usable program code for querying a database of correlation rules using an identified one of the patterns to locate a correlation rule enabled to match the attributes of the identified one of the patterns; and

,

computer usable program code for copying the located correlation rule to a correlation engine for an event source for the identified one of the patterns.