CREATING A CORRELATION RULE DEFINING A RELATIONSHIP BETWEEN EVENT TYPES

• US 20140025998A1
• Filed: 04/04/2011
• Published: 01/23/2014
• Est. Priority Date: 04/04/2011
• Status: Active Grant

• Current Assignee: Micro Focus LLC (Open Text Corporation)
• Original Assignee: entIT Software LLC (Open Text Corporation)
• Inventors: Schimmelpfeng, Joern, Bosler, Martin, Vosseler, Frank
• Granted Patent: US 9,612,892 B2
• Time in Patent Office: Days
• US Class Current: 714/39
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: H04L 41/064 involving time analysis
• CPC Class Codes: H04L 41/065 involving logical or physical relationship, e.g. grouping and hierarchies

Abstract

Plural clusters or occurrences of a pattern of event types are identified (304). Based on configuration items relating to events associated with the event types, a correlation rule is created (308) to define a relationship between the event types.

Claims

1. A method comprising:

receiving, by a system having a processor, a plurality of events;

identifying, by the system, plural occurrences of a pattern of event types in the received events;

analyzing, by the system, information of configuration items related to the events associated with the pattern of event types; and

creating, by the system, a correlation rule defining a relationship between the event types in response to the analyzing determining a relationship between the corresponding configuration items.

2. The method of claim 1, further comprising:

determining whether the plural occurrences of the pattern of event types satisfies a predefined criterion,

wherein the creating is performed in response to the plural occurrences of the pattern satisfying the predefined criterion.

3. The method of claim 2, wherein the plural occurrences of the pattern satisfying the predefined criterion comprises a number or rate of occurrence of the plural occurrences of the pattern exceeding a predefined threshold.

4. The method of claim 1, wherein identifying the plural occurrences of the pattern of the event types comprises identifying plural clusters of the event types.

5. The method of claim 4, wherein identifying the plural clusters of the event types comprises identifying the plural clusters of the event types in respective time intervals.

6. The method of claim 1, further comprising:

for each of the occurrences of the pattern of event types, identifying a corresponding set of respective specific events; and

accessing the information of configuration items related to the specific events in each of the sets to perform the analyzing.

7. The method of claim 6, wherein analyzing the information of the configuration items comprises determining, for the configuration items associated with each of the sets of specific events, if a path exists between the configuration items, and wherein the analyzing indicates that a relationship exists between the corresponding configuration items if the path exists.

8. The method of claim 7, wherein the analyzing indicates that no relationship exists between the corresponding configuration items if the path does not exist.

9. The method of claim 7, wherein determining if the path exists between the configuration items comprises determining if a path of within a predefined number of hops exists between the configuration items.

10. (canceled)

11. A system comprising:

a storage media to store a collection of events that have occurred within an infrastructure; and

at least one processor to;

identify plural clusters of a particular pattern of event types relating to at least a subset of the events;

access configuration items of specific ones of the events associated with each of the plural clusters; and

determine whether a relationship exists between the event types based on the accessed configuration items; and

create a correlation rule to define a relationship between the event types according to the determining.

12. The system of claim 11, wherein the at least one processor is configured to access a topology or semantic database to validate that the relationship exists between the event types.

13. The system of claim 12, wherein the relationship exists if a path of within a predefined number of loops exists between the accessed configuration items.

14. The system of claim 11, wherein the at least one processor is to further:

identify classes of the accessed configuration items,

wherein the correlation rule relates the classes of the accessed configuration items and relates the event types, and wherein the classes of the accessed configuration items provide a topology constraint to be validated for determining whether event types are related.

15. The system of claim 11, wherein the at least one processor is to determine that noisy event types are not correlated to other event types.

16. An article comprising at least one non-transitory machine-readable storage medium storing instructions that upon execution cause a system having a processor to perform a method, the method comprising:

receiving a plurality of events;

identifying plural occurrences of a pattern of event types in the received events;

analyzing information of configuration items related to the events associated with the pattern of event types; and

creating, a correlation rule defining a relationship between the event types in response to the analyzing determining a relationship between the corresponding configuration items.

17. The article of claim 16, further comprising:

determining whether the plural occurrences of the pattern of event types satisfies a predefined criterion,

wherein the creating is performed in response to the plural occurrences of the pattern satisfying the predefined criterion.

18. The article of claim 17, wherein the plural occurrences of the pattern satisfying the predefined criterion comprises a number or rate of occurrence of the plural occurrences of the pattern exceeding a predefined threshold.

19. The article of claim 16, wherein identifying the plural occurrences of the pattern of the event types comprises identifying plural clusters of the event types.

20. The article of claim 19, wherein identifying the plural clusters of the event types comprises identifying the plural clusters of the event types in respective time intervals.

21. The article of claim 16, further comprising:

for each of the occurrences of the pattern of event types, identifying a corresponding set of respective specific events; and

accessing the information of configuration items related to the specific events in each of the sets to perform the analyzing.