Root Cause Analysis for Complex Event Processing

• US 20100287361A1
• Filed: 05/11/2009
• Published: 11/11/2010
• Est. Priority Date: 05/11/2009
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Grell, Stephan, Nano, Olivier
• Granted Patent: US 8,386,848 B2
• Time in Patent Office: Days
• US Class Current: 712/233
• CPC Class Codes: G05B 23/0278 Qualitative, e.g. if-then rules; Fuzzy logic; Lookup tables; Symptomatic search; FMEA
• CPC Class Codes: G06N 5/045 Explanation of inference; Explainable artificial intelligence [XAI]; Interpretable artificial intelligence

Abstract

Root cause analysis for complex event processing is described. In embodiments, root cause analysis at a complex event processor is automatically performed by selecting an output event from an operator and correlating the output event to an input event using event type and lifetime data for the input event and the output event stored in a data store. Embodiments describe how the lifetime data can comprise a start time and an end time for the event, and the correlation can be based on a comparison of the start and end times between the input and output events. Embodiments describe how the correlation algorithm used is selected in dependence on the event type. In embodiments, a complex event processing engine comprises a logging unit arranged to store in the data store an indicator of an event type and lifetime data for each output event from an operator.

Claims

1. A method of root cause analysis at a complex event processing engine executed on a processor, comprising:

the processor selecting an output event in the complex event processing engine, the output event being output from an operator having an input event;

reading an event type and lifetime data for each of the input event and the output event from a data store in communication with the processor; and

the processor correlating the input event and the output event using the event type and lifetime data.

2. A method according to claim 1, further comprising the step of, if the input event and the output event are correlated, adding the input event to a tree data structure, such that the input event is linked to the output event.

3. A method according to claim 1, wherein the lifetime data comprises a start time for the input event and the output event, and the step of correlating comprises comparing the start time of the input event with the start time of the output event.

4. A method according to claim 1, wherein the lifetime data comprises an end time for the input event and the output event, and the step of correlating comprises comparing the end time of the input event with the end time of the output event.

5. A method according to claim 1, further comprising the step of reading payload data for the input event and the output event from the data store, and wherein the step of correlating comprises comparing the payload data for the output event with the payload data for the input event.

6. A method according to claim 1, further comprising the step of reading an event identifier for the input event and the output event from the data store, and wherein the step of correlating comprises comparing the event identifier for the output event with the event identifier for the input event.

7. A method according to claim 1, wherein the step of correlating comprises selecting and executing one of a plurality of correlation algorithms in dependence on the event type.

8. A method according to claim 7, wherein the step of correlating comprises selecting and executing one of the plurality of correlation algorithms in dependence on an operator type for the operator.

9. A method according to claim 2, further comprising the step of using the tree data structure to control the subsequent operation of the complex event processing engine, such that the complex event processing engine only stores log data for events in the tree data structure.

10. A method according to claim 1, wherein the root cause analysis is a fault tree analysis.

11. A complex event processing engine, comprising:

a log data store;

an operator arranged to process an input event and output an output event; and

a logging unit connected to the output of the operator and arranged to store in the data store an indicator of an event type and lifetime data for each output event from the operator.

12. A complex event processing engine according to claim 11, wherein the lifetime data comprises a start time for the output event.

13. A complex event processing engine according to claim 11, wherein the lifetime data comprises an end time for the output event.

14. A complex event processing engine according to claim 11, wherein the lifetime data further comprises a modified end time for the output event.

15. A complex event processing engine according to claim 11, wherein the event type is at least one of:

an insert event;

an update event or a concurrent time increment event.

16. A complex event processing engine according to claim 11, wherein the operator is a modification operator arranged to modify the input event to generate the output event.

17. A complex event processing engine according to claim 11, wherein the operator is a new event operator arranged to create the output event using the input event.

18. A complex event processing engine according to claim 11, wherein the logging unit is further arranged to store for each output event at least one of:

an identity of the operator;

a log time;

an event payload; and

an event identifier.

19. A complex event processing engine according to claim 11, wherein the logging unit is further arranged to determine whether to store data for the output event based on stored results of a root cause analysis previously performed on the complex event processing engine.

20. A method of root cause analysis at a complex event processing engine executed on a processor, comprising:

the processor selecting an output event in the complex event processing engine, the output event being output from an operator having an input event;

reading an event type and lifetime data for each of the input event and the output event from a data store in communication with the processor;

the processor correlating the input event and the output event using the event type and lifetime data;

if the input event and the output event are correlated, adding the input event to a tree data structure, such that the input event is linked to the output event; and

displaying the tree in a user interface on a display.