Performing efficient insertions in wavefront table based causal graphs

• US 7,487,241 B2
• Filed: 08/03/2006
• Issued: 02/03/2009
• Est. Priority Date: 08/05/2005
• Status: Expired due to Fees

• Current Assignee: Vantos, Inc. (GoSecure, Inc.)
• Original Assignee: Vantos, Inc. (GoSecure, Inc.)
• Inventors: Hines, Ken
• Primary Examiner(s): Coulter; Kenneth R
• Application Number:
  US11/499,619
• Publication Number:
  US 20070032987A1
• Time in Patent Office: 915 Days
• Field of Search: 709/223, 709/224
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis

Abstract

A causal relationship between two events occurs when a first event meaningfully precedes a second event and is identified by a causality module. The causality module analyzes multiple events to determine whether the events are causally related. Reductions in both required storage space and search operations are obtained by tracing interrelated causal chains of events. Further improvement is achieved by reducing re-computation of wavefront tables through annotating causality chain with information that facilitates determination of validity of a wavefront table.

Claims

1. A method to be performed on a computing device, comprising:

receiving data associated with a plurality of events; and

determining causality of one of the events by referencing causal chains of predecessor events stored in entries of a wavefront table associated with the one of the events, with each wavefront table having one or more entries identifying one or more predecessor events of an event in terms of one or more causal chain membership and locations within, and each causal chain having an associated count identifying the highest valid table entry for the causal chain.

2. The method of claim 1, further comprising organizing the events into the causal chains, computing the wavefront table, and assigning the count to each causal chain.

3. The method of claim 2, further comprising, before using the wavefront table, determining whether entries of the wavefront table are valid by comparing the entries of the wavefront table with the counts of the causal chains.

4. The method of claim 3, further comprising considering the wavefront table invalid if any entry of the wavefront table is greater than any count of any of the causal chains.

5. The method of claim 4 further comprising re-computing the wavefront table on determining at least one entry of the wavefront table is invalid.

6. The method of claim 5 further comprising re-computing wavefront table(s) for successor event(s) of the one of the events.

7. The method of claim 5 further comprising re-computing wavefront table(s) for successor event(s) with the same count for the causal chain as the one of the events.

8. A device comprising:

a communication interface to receive data associated with a plurality of events; and

a causality module coupled to the communication interface configured to determine causality of one of the events by referencing causal chains of events stored in entries of a wavefront table associated with the one of the events, with each wavefront table having one or more entries identifying one or more predecessor events of an event in terms of one or more causal chain membership and locations within, and each causal chain having an associated count identifying the highest valid table entry for the causal chain.

9. The device as recited in claim 8, wherein the causality module is configured to organize the events into the causal chains, to compute the wavefront table, and to assign the count to each causal chain.

10. The device as recited in claim 8, wherein the causality module is configured to determine whether entries of the wavefront table are valid by comparing the entries of the wavefront table with the counts of the causal chains.

11. The device as recited in claim 10, wherein the causality module is configured to consider the wavefront table invalid if any entry of the wavefront table is greater than any count of any of the causal chains.

12. The device as recited in claim 11, wherein the causality module is configured to re-compute the wavefront table on determining at least one entry of the wavefront table is invalid.

13. The device as recited in claim 12, wherein the causality module is configured to re-compute a wavefront table for any successor event of the one of the events.

14. The device as recited in claim 12, wherein the causality module is configured to re-compute a wavefront table for any event having the same count for the causal chain as the one of the events.

15. The device as recited in claim 14, wherein the causality module is configured to revise the count to identify the next highest valid table entry for the causal chain after re-computing all wavefront tables associated with events having the same count as the one of the events.

16. An article of manufacture comprising:

a storage medium; and

a plurality of programming instructions stored on the storage medium and configured to program a system to

receive data associated with a plurality of events, and

determine causality of one of the events by referencing causal chains of predecessor events stored in entries of a wavefront table associated with the one of the events, with each wavefront table having one or more entries identifying one or more predecessor events of an event in terms of one or more causal chain membership and locations within, and each causal chain having an associated count identifying the highest valid table entry for the causal chain.

17. The article of claim 16, wherein the programming instructions are further configured to organize the events into the causal chains, to compute the wavefront tables, and to assign the count to each causal chain.

18. The article of claim 16, wherein the programming instructions are further configured to determine whether entries of the wavefront table are valid by comparing the entries of the wavefront table with the counts of the causal chains.

19. The article of claim 18, wherein the programming instructions are further configured to consider the wavefront table invalid if any entry of the wavefront table is greater than any count of any of the causal chains.

20. The article of claim 19, wherein the programming instructions are further configured to re-compute the wavefront table on determining that at least one entry of the wavefront table is invalid.