Situation dashboard system and method from event clustering

• US 9,607,075 B2
• Filed: 04/28/2014
• Issued: 03/28/2017
• Est. Priority Date: 04/29/2013
• Status: Active Grant

• Current Assignee: Dell Products LP (Dell Technologies Inc.)
• Original Assignee: Moogsoft Inc. (Dell Technologies Inc.)
• Inventors: Tee, Philip, Harper, Robert Duncan, Silvey, Charles Mike, Leonard, Andrew John, Townsend, Jeffrey Ellison
• Primary Examiner(s): Reyes, Mariela
• Assistant Examiner(s): Vu, Thong
• Application Number:
  US14/262,884
• Publication Number:
  US 20140324867A1
• Time in Patent Office: 1,065 Days
• Field of Search: 707/737, 707/720, 707/678, 707/803, 382/103, 705/7.29, 714/47.2
• US Class Current: 1/1
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/0769 Readable error formats, e.g. cross-platform generic formats, human understandable formats
• CPC Class Codes: G06F 11/0772 Means for error signaling, e.g. using interrupts, exception flags, dedicated error registers
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/358 Browsing; Visualisation therefor
• CPC Class Codes: G06F 16/904 Browsing; Visualisation therefor for navigating the web G06F16/954; browsing optimisation for the web G06F16/957
• CPC Class Codes: G06F 3/0481 based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance
• CPC Class Codes: G06Q 10/00 Administration; Management
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/065 involving logical or physical relationship, e.g. grouping and hierarchies
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 51/216 Handling conversation history, e.g. grouping of messages in sessions or threads
• CPC Class Codes: H04L 51/224 providing notification on incoming messages, e.g. pushed notifications of received messages

Abstract

A computer-implemented method is provided that is stored on computer readable non-transitory media. One or more data fields are accessed within a file. Accessed data field, are mapped mapping on a display computer system. The accessed one or more data fields are from one or more data sources that relate to situations from clustering messages received from managed infrastructure. The mapping being performed based on a input of the situation summaries using a graphical user interface. Displayed on the display computer system are one or more dashboards of situations relative to summaries from clustering messages received from managed infrastructure. The one or more dashboards include at least one of actions that a user can take relative to clustered messages.

Claims

1. A computer-implemented method stored on computer readable non-transitory media, comprising:

receiving messages at an extraction engine to communicate with a managed infrastructure that includes physical hardware, and receiving messages from the managed infrastructure;

providing a sigalizer engine that determines one or more common characteristics of events and producing clusters of events relating to the failure or errors in the managed infrastructure, the signalizer engine determining one or more common characteristics of events and producing clusters of events relating to the failure or errors in the managed infrastructure, the signalizer engine using a source address for each of an event and a topology of the managed infrastructure which represents a node to node connectivity at the signalizer engine with an assignment of a graph coordinate to the event with an optional subset of attributes being extracted for each event, the signalizer engine inputting a list of devices and a list a connections between components or nodes in the managed infrastructure;

where membership in a cluster indicates a common factor of the events that is a failure or an actionable problem in a physical hardware in the managed infrastructure directed to supporting the flow and processing of information;

and

displaying on a display computer system a dashboard of situations relative to summaries from clustered messages received from managed infrastructure, wherein the dashboard includes at least one of actions that a user can take relative to clustered messages.

2. The method of claim 1, wherein the dashboard processes the situations from clustered messages received from managed infrastructure and displays a visual representation in a graph or chart form.

3. The method of claim 1, further comprising:

converting the data from the situations from clustered messages received from managed infrastructure that are compatible with a format of the file using the external connection adapter.

4. The method of claim 1, wherein the file is a web format file that exposes the one or more data fields of the situations from clustered messages received from infrastructure.

5. The method of claim 1, a graphical user interface is used for receiving textual programming code from a user.

6. The system of claim 1, wherein the entropy for events creates normalized entropy for events mapped to a common, 0.0 and a non-common, 1.0.

7. The system of claim 1, wherein the situations are generated in response to outputs from a sigalizer engine.

8. The system of claim 7, wherein the sigalizer engine generates clusters of alerts.

9. The system of claim 8, wherein membership in a cluster indicates a common underlying failure or fault in the infrastructure.

10. A user interface system comprising:

an extraction engine to communicate with a managed infrastructure that includes physical hardware, and receiving messages from the managed infrastructure;

a sigalizer engine that determines one or more common characteristics of events and producing clusters of events relating to the failure or errors in the managed infrastructure, the sigalizer engine determining one or more common characteristics of events and producing clusters of events relating to the failure or errors in the managed infrastructure, the signalizer engine using a source address for each of an event and a topology of the managed infrastructure which represents a node to node connectivity at the signalizer engine with an assignment of a graph coordinate to the event with an optional subset of attributes being extracted for each event, the signalizer engine inputting a list of devices and a list a connections between components or nodes in the managed infrastructure;

an external connection adapter configured to provide access to one or more data fields within a file;

a display computer system configured to map using a graphical user interface the one or more data fields relating to situations from clustered messages received from managed infrastructure to data from one or more data sources; and

the display computer system configured to generate a dashboard display from a configuration in the file that includes situations from clustered messages received from managed infrastructure.

11. The system of claim 10, wherein the graphical user interface is free of receiving textual programming code from the user.

12. The system of claim 10, wherein the situations are produced after determining one or more common steps from events and the production of clusters relating to the alerts and or events.

13. The system of claim 12, wherein common steps are in response to data that include attributes selected from at least one of, time, source a description of the event, textural or numerical values from which those text or numerical values indicate a state of any hardware or software component of an infrastructure.

15. The system of claim 10, wherein the situations are in response to subsets of messages or events that are grouped into clusters.

16. The system of claim 10, wherein the situations are in response to extracted text components from events that are convert into word and subtext.

17. The system of claim 10, wherein the situations are in response to utilization of a generated dictionary with the word and subtexts using Shannon Entropy.

18. The system of claim 17, wherein normalized words and subtexts are mapped from a common 0.0 to a non-common 1.0.

19. The system of claim 18, wherein the situations are in response to utilization of an entropy database that in operation normalizes entropy for events.

14. The system 10, wherein the situations are in response to event or subsets of events that relate to failures or errors in an infrastructure.