Correlating computing network events

• US 9,344,465 B2
• Filed: 12/04/2012
• Issued: 05/17/2016
• Est. Priority Date: 12/04/2012
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Stern, Edith H., Stewart, Kristian J.
• Primary Examiner(s): Lee, Thomas
• Assistant Examiner(s): Derose, Volvick
• Application Number:
  US13/693,462
• Publication Number:
  US 20140156846A1
• Time in Patent Office: 1,260 Days
• Field of Search: 714/25, 709/226
• US Class Current: 1/1
• CPC Class Codes: H04L 41/0613 based on the type or category of the network elements
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/065 involving logical or physical relationship, e.g. grouping and hierarchies
• CPC Class Codes: H04L 41/0668 by dynamic selection of recovery network elements, e.g. replacement by the most appropriate element after failure
• CPC Class Codes: H04L 41/0686 Additional information in the notification, e.g. enhancement of specific meta-data
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/0843 based on generic templates
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 65/40 Support for services or applications
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/75 Indicating network or usage conditions on the user display
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 69/40 for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

According to one aspect of the present disclosure a system and technique for correlating computing network events is disclosed. The system includes a processor, and an event manager executable by the processor to: identify a first resource associated with a first event; identify a second resource associated with a second event; determine whether the first resource is associated with a deployment pattern; determine whether the second resource is associated with a deployment pattern; and responsive to determining that the first and second resources are each associated with a deployment pattern, correlate the first and second events responsive to the first and second resources being associated with a common deployment pattern.

Claims

1. A system, comprising:

a processor; and

an event manager executable by the processor to;

identify a first resource associated with a first event;

identify a second resource associated with a second event;

determine whether the first resource is associated with a first deployment pattern, the first deployment defined by a first template of resources provisioned for a first computing service;

determine whether the second resource is associated with a second deployment pattern, the second deployment pattern defined by a second template of resources provisioned for a second computing service; and

responsive to determining that the first and second resources are each associated with the respective first and second deployment patterns, correlate the first and second events responsive to the first and second resources being associated with a common deployment pattern.

2. The system of claim 1, wherein the event manager is operable to provide an indication of the correlated events.

3. The system of claim 2, wherein the event manager is operable to condense a plurality of indications of correlated events to a single indication.

4. The system of claim 2, wherein the event manager is operable to provide a visual indication of the correlated events.

5. The system of claim 1, further comprising a deployment engine executable to:

responsive to receiving a request to deploy the first or second resource, identify the respective first or second deployment pattern corresponding to the request;

identify a target resource for the deployment based on the identified deployment pattern; and

deploy the target resource.

6. The system of claim 5, wherein the event manager is operable to store an association of the deployed first or second resource with the respective first or second deployment pattern.

7. A computer program product for correlating computing network events, the computer program product comprising:

a non-transitory computer readable medium having computer readable program code embodied therewith, the computer readable program code comprising computer readable program code configured to;

identify a first resource associated with a first event;

identify a second resource associated with a second event;

determine whether the first resource is associated with a first deployment pattern, the first deployment defined by a first template of resources provisioned for a first computing service;

determine whether the second resource is associated with a second deployment pattern, the second deployment pattern defined by a second template of resources provisioned for a second computing service; and

responsive to determining that the first and second resources are each associated with the respective first and second deployment patterns, correlate the first and second events responsive to the first and second resources being associated with a common deployment pattern.

8. The computer program product of claim 7, wherein the computer readable program code is configured to provide an indication of the correlated events.

9. The computer program product of claim 8, wherein the computer readable program code is configured to condense a plurality of indications of correlated events to a single indication.

10. The computer program product of claim 8, wherein the computer readable program code is configured to provide a visual indication of the correlated events.

11. The computer program product of claim 7, wherein the computer readable program code is configured to:

responsive to receiving a request to deploy the first or second resource, identify the respective first or second deployment pattern corresponding to the request;

identify a target resource for the deployment based on the identified deployment pattern; and

deploy the target resource.

12. The computer program product of claim 11, wherein the computer readable program code is configured to store an association of the deployed first or second resource with the respective first or second deployment pattern.