System and methods for decomposing events from managed infrastructures that includes a floating point unit

• US 10,700,920 B2
• Filed: 07/19/2016
• Issued: 06/30/2020
• Est. Priority Date: 04/29/2013
• Status: Active Grant

• Current Assignee: Dell Products LP (Dell Technologies Inc.)
• Original Assignee: Moogsoft Inc. (Dell Technologies Inc.)
• Inventors: Tee, Philip
• Primary Examiner(s): Vincent, David R
• Application Number:
  US15/213,862
• Publication Number:
  US 20160330066A1
• Time in Patent Office: 1,442 Days
• Field of Search: 706 15, 706 45
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: H04L 41/0604 using filtering, e.g. reduction of information by using priority, element types, position or time
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 51/216 Handling conversation history, e.g. grouping of messages in sessions or threads
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 67/55 Push-based network services

Abstract

An event clustering system and associated methods include a feedback signalizer functor that responds to user interactions with already formed situations. The system and method then learns how to replicate the same situation when new alerts reoccur, or, creates similar situations. The feedback signalizer functor is a supervised machine learning approach to train a signalizer functor to reproduce a situation at varying degrees of precision.

Claims

1. An event clustering system, comprising:

an extraction engine in communication with a managed infrastructure;

a signalizer engine that includes one or more of an NMF engine, a k-means clustering engine and a topology proximity engine, the signalizer engine determining one or more common characteristics or features from events, the signalizer engine using the common features of events to produce clusters of events relating to the failure or errors in the managed infrastructure, where membership in a cluster indicates a common factor of the events that is a failure or an actionable problem in the physical hardware managed infrastructure directed to supporting the flow and processing of information;

a floating point unit (FPU) that performs floating point calculations;

wherein in response to production of the clusters one or more physical changes in a managed infrastructure hardware is made, where the hardware supports the flow and processing of information.

2. The system of claim 1, wherein the FPU is included in a processor of the system.

3. The system of claim 1, wherein the FPU is a stand-alone unit apart for a processor of the system.

4. The system of claim 1, wherein the FPU executes floating point arithmetic logic instructions by retrieving them from a memory of the system.

5. The system of claim 2, wherein the FPU executes floating point arithmetic logic instructions by retrieving them from a memory of the system that are then stored in a system memory.

6. The system of claim 1, wherein the FPU includes one or more of a:

floating point adder, multiplier and comparator.

7. The system of claim 1, wherein the FPU performs one or more of:

exponent subtraction;

subtraction of the exponents to form an absolute difference IE_a−

E_bl=d;

alignment;

significand addition;

addition or subtraction according to an effective operation that is a function of an opcode and the signs of operands;

conversion that converts a significand result, when negative, to a signmagnitude representation;

leading-one detection;

normalization; and

rounding.

8. The system of claim 1, further comprising:

a control unit of a processor that carries out stored program instructions relative to the FPU.

9. The system of claim 8, wherein the control unit communicates with the ALU and memory.

10. The system of claim 1, wherein input signals are propagated through the FPU and a resulting performed operation is a FPU output.

11. The system of claim 10, wherein the FPU output includes a data word and status information of the event.

12. The system of claim 1, wherein the status information is a rating of a significance of the event.

13. The system of claim 1, wherein the extraction engine is configured to receive messages from the managed infrastructure and produce events that relate to the managed infrastructure.

14. The system of claim 2, wherein the extraction engine converts the events into words and subsets used to group the events into clusters that relate to failures or errors in the managed infrastructure.

15. The system of claim 1, wherein managed infrastructure hardware includes at least one of:

computers, network devices, appliances, mobile devices, applications, connections of any of the preceding, and text or numerical values from which those text or numerical values which indicate a state of any hardware of the managed infrastructure.

16. The system of claim 1, wherein the managed infrastructure generates data that includes attributes.

17. The system of claim 5, wherein, the data that includes attributes is selected from at least one of:

time, source a description of the event, and textural or numerical values indicating a state of the managed infrastructure.

18. The system of claim 1, wherein physical changes made to the managed infrastructure hardware that create physical and virtual links between the managed infrastructure and a system server.

19. The system of claim 7, wherein physical changes made to the managed infrastructure includes changes to links from the server to a system high speed storage.

20. The system of claim 5, wherein managed infrastructure generated data is selected from at least one of, time, source a description of:

an event, textural or numerical values indicating a state of the managed infrastructure.

21. The system of claim 1, wherein the extraction engine communicates with the managed infrastructure across an IP network at a high speed connection and with low latency.

22. The system of claim 10, wherein the high speed connection is in the gigabits and low latency is in the microseconds.

23. The system of claim 10, wherein the high speed connection is at least 1 gigabit, and low latency is at least 10 microseconds.

24. The system of claim 1, wherein the extraction engine includes one or more of:

a central processor, a main memory, an input/output controller, an interface, a display, and a storage device.

25. The system of claim 14, wherein the storage device is configured to communicate through a system bus or similar architecture.

26. The system of claim 1, wherein the system includes a software system that can be included in memory.

27. The system of claim 1, wherein the software system includes one or more of an operating system and a shell or interface.

28. The system of claim 14, wherein application software of the system is transferred from the storage device.

29. The system of claim 1, wherein the extraction engine breaks event messages into subsets of messages that relate to failures or errors in managed infrastructure.

30. The system of claim 1, wherein the extraction engine breaks events into subsets of messages relative to failure or errors in a managed infrastructure via a message input mechanism.

31. The system of claim 21, wherein the extraction engine breaks the events into subsets of messages and parses machine elements from the managed infrastructure.

32. The system of claim 22, wherein the machine elements are machine messages.

33. The system of claim 1, wherein the extraction engine receives managed infrastructure data and produces events as well as populates an entropy database.

34. The system of claim 1, wherein the extraction engine populates the entropy database with a dictionary of event entropy that can be included in an entropy database.

35. The system of claim 25, wherein the extraction engine populates the entropy database with the use of a token counter.

36. The system of claim 26, wherein the entropy database is generated with word and subtexts.

37. The system of claim 26, wherein the entropy database is generated using Shannon Entropy.

38. The system of claim 23, wherein the entropy database is configured to normalize events across data and/or datasets from the managed infrastructure.

39. The system of claim 28, wherein normalized entropy for events is mapped from a common, 0.0 and a non-common, 1.0.

40. The system of claim 23, wherein entropy is assigned to alerts.

41. The system of claim 23, wherein entropy for each event is retrieved from an entropy dictionary.

42. The system of claim 31, wherein entropy for each event is retrieved from an entropy dictionary as it enters the system.

43. The system of claim 23, wherein the entropy database is generated with word and/or subtexts.

44. The system of claim 1, wherein a network is created that includes a plurality of nodes in a graph.

45. The system of claim 34, wherein a non-directed graph is used to calculate graph entropy for each node in the graph.

46. The system of claim 34, wherein the graph is a non-directed graph that calculates graph entropy for each node in the graph.

47. The system of claim 37, wherein graph entropy is calculated using the following:

(i) source data is used to calculate graph data;

(ii) non-directed graph is used to calculate a number of links and a clustering coefficient of a node; and

(iii) a number of links and clustering coefficient of the node together with the total number of links in the graph is then used to calculate an entropy value for each node.

48. The system of claim 37, wherein an N event value is attached to every event of the entropy graph of a source node.

49. The system of claim 1, wherein entropy values are used as a cutoff to ignore events from unimportant nodes to classify events.

50. The system of claim 1, wherein embedded agents in hardware components gather attributes to managed infrastructure health to generate data that includes attributes 54.