System for decomposing clustering events from managed infrastructures

• US 20150310085A1
• Filed: 07/08/2014
• Published: 10/29/2015
• Est. Priority Date: 04/28/2014
• Status: Active Grant

• Current Assignee: Dell Products LP (Dell Technologies Inc.)
• Original Assignee: Moogsoft Inc. (Dell Technologies Inc.)
• Inventors: Tee, Philip
• Granted Patent: US 10,013,476 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/35 Clustering; Classification
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 12/1895 for short real-time information, e.g. alarms, notifications, alerts, updates
• CPC Class Codes: H04L 41/065 involving logical or physical relationship, e.g. grouping and hierarchies
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 51/216 Handling conversation history, e.g. grouping of messages in sessions or threads
• CPC Class Codes: H04L 51/224 providing notification on incoming messages, e.g. pushed notifications of received messages
• CPC Class Codes: H04L 51/42 Mailbox-related aspects, e.g. synchronisation of mailboxes

Abstract

An event clustering system is configured to generate reports. An extraction engine is in communication with an infrastructure. The extraction engine in operation receives data from the infrastructure and produces events. An alert engine receives the events and creates alerts mapped into a matrix, M. A sigalizer engine includes one or more of an NMF engine, a k-means clustering engine and a topology proximity engine. The sigalizer engine determines one or more common steps from events and produces clusters relating to the alerts and or events. A reporting engine is configured to be coupled to the event clustering system.

Claims

1. An event clustering system that generates reports, comprising:

an extraction engine in communication with an infrastructure, the extraction engine in operation receiving data from the infrastructure and produces events;

an alert engine that receives the events and creates alerts mapped into a matrix, M;

a sigalizer engine that includes one or more of an NMF engine, a k-means clustering engine and a topology proximity engine, the sigalizer engine determining one or more common steps from events and produces clusters relating to the alerts and or events; and

a reporting engine configured to be coupled to the event clustering system.

2. The system of claim 1, wherein the reporting engine generates reports from the clustered events and/or messages.

3. The system of claim 1, wherein the report engine is coupled to a situation room of the event clustering system.

4. The system of claim 1, wherein computer-executable instructions implement the reporting engine.

5. The system of claim 4, wherein the instructions include a predefined procedure component, a metadata component, or layer, and an interface component.

6. The system of claim 1, wherein the reporting engine generates a report from the clustered events and/or messages which can be retrieved from a situation room.

7. The system of claim 1, wherein the reporting engine is in communication with one or more dashboards associated with a situation room and retrieves information therefrom in response to a request that is used to generate a report.

8. The system of claim 5, wherein clustered events/messages are in a database.

9. The system of claim 8, wherein the metadata layer is maintained separately or together with the data to be searched in the database.

10. The system of claim 1, wherein queries regarding the clustered events/messages are answered through reports generated from structured query language (SQL) statements.

11. The system of claim 1, wherein the reporting engine includes a metadata layer, an interface and a procedure component.

12. The system of claim 1, wherein the clustered events/messages have several dimensions.

13. The system of claim 12, wherein one of the dimensions is a procedure component.

14. The system of claim 13, wherein the procedure component is a predefined, stored procedure report, with the reporting engine returning a result set that matches a user-specified search.

15. The system of claim 11, wherein metadata in the metadata layer describes clustered events/messages that can be in a database or accessed via a dashboard directly.

16. The system of claim 15, wherein the metadata layer includes entities and SQL views describing at least one of, related dimensions, attributes, measures, and facts relative to the clustered events/messages.

17. The system of claim 15, wherein an attribute is a descriptive characteristic of one or more levels representing logical groupings that enable end users to select information based on like characteristics.

18. The system of claim 15, wherein an attribute is displayed as a column or row in a dimension that characterizes elements of a single level.

19. The system of claim 13, wherein the procedure component accepts inputs from a user according to a query syntax of interface.

20. The system of claim 19, wherein the procedure component takes the inputs and matches them with a metadata layer.

21. The system of claim 20, wherein following the matching a set of SQL statements retrieves information from the clusters.

22. The system of claim 20, wherein in response to the reporting engine receiving a request for information to be retrieved it uses the metadata.

23. The system of claim 22, wherein a procedure component of the reporting engine constructs a query that is run and a report is returned.