US20170185468A1 - Creating A Correlation Rule Defining A Relationship Between Event Types - Google Patents
Creating A Correlation Rule Defining A Relationship Between Event Types Download PDFInfo
- Publication number
- US20170185468A1 US20170185468A1 US15/460,608 US201715460608A US2017185468A1 US 20170185468 A1 US20170185468 A1 US 20170185468A1 US 201715460608 A US201715460608 A US 201715460608A US 2017185468 A1 US2017185468 A1 US 2017185468A1
- Authority
- US
- United States
- Prior art keywords
- event
- determining
- events
- correlation rule
- plural
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/0751—Error or fault detection not based on redundancy
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/0706—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment
- G06F11/0709—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/079—Root cause analysis, i.e. error or fault diagnosis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
- H04L41/064—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis involving time analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/06—Management of faults, events, alarms or notifications
- H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
- H04L41/065—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis involving logical or physical relationship, e.g. grouping and hierarchies
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2201/00—Indexing scheme relating to error detection, to error correction, and to monitoring
- G06F2201/86—Event-based monitoring
Definitions
- An information technology (IT) infrastructure of an enterprise can include a relatively large arrangement of components.
- IT administrators of the enterprise can be tasked with managing the IT infrastructure, including identifying root causes of issues that are detected, among other tasks.
- managing a relatively large IT infrastructure can be complex.
- FIG. 1 illustrates an example correlation rule that is created using an event correlator according to some implementations
- FIG. 2 is a timing diagram illustrating occurrences of events over time, which can be processed using an event correlator according to some implementations;
- FIGS. 3 and 4 are flow diagrams of processes performed by an event correlator according to some implementations.
- FIG. 5 is a block diagram of an example system incorporating an event correlator according to some implementations.
- An information technology (IT) infrastructure includes an arrangement of components, such as hardware components (e.g., computers, storage servers, communications devices, and so forth), software components (e.g., applications, operating systems, drivers, and so forth), database components (e.g., relational database management systems, unstructured database systems, and so forth), and/or other components.
- hardware components e.g., computers, storage servers, communications devices, and so forth
- software components e.g., applications, operating systems, drivers, and so forth
- database components e.g., relational database management systems, unstructured database systems, and so forth
- events can occur, including events relating to problems, failures, issues, or activities relating to components in the IT infrastructure.
- mechanisms or techniques are provided to automatically create correlation rules that define relationships between respective two or more types of events.
- a system can automatically identify a correlation between event types such that the system can determine, for a given event, what other event(s) caused the given event. In this manner, root causes of events relating to problems, failures, issues, or activities can be efficiently and accurately identified.
- a correlation rule can specify a type of a cause event that is the cause of a type of symptom event. More generally, a correlation rule can specify one or multiple types of cause events that are the cause of one or multiple types of symptom events.
- a cause event refers to an event that causes occurrence of another event.
- a symptom event is the event that results from occurrence of another event.
- An “event” can refer to a problem, a failure, an issue, an activity, an operation, an input, an output, or any other occurrence in an IT infrastructure. Events can be categorized into different types. For example, one type of event is a database going down. Another type of event is a mail server starting up. Yet another type of event is an application server exhibiting an error. There are numerous other examples of event types.
- the correlation rule 100 may be displayable in graphical form on a display device, for example.
- the correlation rule 100 includes an cause event type 102 (which in the FIG. 1 example is memory usage level—near capacity) that is the cause of a symptom event type 104 (which in the FIG. 1 example is cache performance—low).
- the cause event type 102 is associated with a computer configuration item (CI)
- the symptom event type 104 is associated with an SQL server configuration item.
- a configuration item defines a configuration of a component, such as a hardware component, a software component, a database component, or any other component of an IT infrastructure.
- a “configuration” can include an attribute associated with the component.
- a configuration item represents a discrete unit of a configuration relating to a component.
- a configuration item can be related to another configuration item (or multiple other configuration items).
- FIG. 1 also shows a graphical representation 106 of a computer CI 108 that is linked by relationship 110 to the SQL server CI 112 .
- the relationship 110 is a container link, which indicates that the computer CI 108 contains the SQL server 112 (in other words, an SQL server is contained in a computer).
- the correlation rule 100 of FIG. 1 provides a correlation between event types 102 and 104 , associates the event types 102 , 104 with respective configuration items 108 , 112 , and identifies a relationship between the respective configuration items 108 , 112 .
- the association of the configuration items (and more specifically configuration item classes such as the computer CI class 108 and the SQL server class 112 ) with respective event types provides a topology constraint that has to be satisfied for corresponding event types to be considered related according to the correlation rule.
- correlation rule Although a specific example of a form of correlation rule is shown in FIG. 1 , note that in other implementations, other forms of correlation rules can be used.
- a particular event such as memory usage level—near capacity represented by 102 in FIG. 1
- a computer as represented by the computer CI in FIG. 1
- a symptom event e.g., cache performance—low represented by 104 in FIG. 1
- SQL server as represented by SQL server CI 112 in FIG. 1
- FIG. 2 illustrates a timeline of events over time.
- four time intervals (t 0 , t 1 , t 2 , and t 3 ) are identified along the horizontal axis of the timeline.
- Events that occur in an IT infrastructure can be grouped into the respective time intervals.
- triangle symbols represent respective events that have occurred over time. In time interval t 0 , two events occurred; in time interval t 1 , three events occurred; in time interval t 2 , five events occurred; and in time interval t 3 , three events occurred.
- a first type of event ( 210 ) is a database down event type
- a second type of event ( 212 ) is a mail server startup event type
- a third type of event ( 214 ) is an application server error event type.
- the number of events and the types of events illustrated in FIG. 2 are provided for purposes of example. In a relatively large IT infrastructure, there can be much larger numbers of events and of event types.
- FIG. 2 depicts partitioning of events into time intervals
- events can be partitioned into other types of partitions different from time intervals.
- Other partitions can include partitions of events occurring on different machines or groups of machines, partitions of events occurring within different divisions or departments of an enterprise, partitions of events occurring within different geographic regions, and so forth.
- a pattern of event types is present, namely a pattern that includes a database down event type and an application server error event type occurring relatively close in time to each other (e.g., within the same time interval).
- Each event is associated with event type information to allow mechanisms according to some implementations to determine the type of each of the events that have occurred. Additionally, an event can also be associated with a timestamp indicating when the event occurred, and information identifying an associated configuration item.
- solid ovals 202 A, 202 B, 202 C, and 202 D represent respective occurrences of a particular pattern of event types (database down event type and application server error event type in the example of FIG. 2 ) that may be related to each other.
- Each occurrence of the pattern of event types is basically a cluster of potentially related event types that occur within a respective time interval.
- FIG. 2 also shows events of the mail server startup event type that are present in time intervals t 1 , t 2 , and t 3 .
- the mail server startup events have been determined not to be related to the other event types shown in FIG. 2 , and thus are not identified as being part of clusters of related event types.
- the mail server startup event type can be identified as noise, for various reasons.
- the event correlator may determine that the mail server startup event type occurs so frequently (occurs in more than some predefined percentage of time intervals) that the mail server startup event type is considered noise and thus should not be correlated to other event types.
- the event correlator can thus detect that the relationship of noisy event types (event types that occur more frequently than some predefined threshold) and other event types are trivial and thus should not be considered to be correlated.
- the event correlator may determine that prior occurrences of the mail server startup event type were not correlated to either the database down event type or the application server error event type, because a deeper analysis of information associated with these event types indicates that there exists no relationship between the mail server startup event type and the other event types.
- FIG. 3 is a flow diagram of a process according to some implementations for creating a correlation rule.
- the process of FIG. 3 can be performed by an event correlator, discussed further below.
- Events are received (at 302 ) over time, such as the events depicted in the timeline of FIG. 2 .
- the received events can be part of an archive or other collection of events that have occurred.
- the event correlator identifies (at 304 ) multiple occurrences (clusters) of a pattern of event types in the received events.
- the event correlator can invoke a clustering technique to cluster sets of events that are likely to be related because they frequently occur together or occur within a particular timeframe.
- the type property of the events can be used to group the events into multiple clusters of event types (e.g., clusters 202 A- 202 D in multiple time intervals as shown in FIG. 2 ).
- the event correlator then analyzes (at 306 ) Information associated with configuration items related to the events of the pattern of event types.
- a correlation rule is then created (at 308 ) defining a relationship between the event types in response to the analyzing determining a relationship between the corresponding configuration items.
- FIG. 4 illustrates further details of the analyzing performed at 306 .
- the event correlator determines (at 402 ) that multiple occurrences of a pattern of event types, which in the example of FIG. 2 includes a pattern of a database down event type and an application server error event type, satisfies a predefined criterion.
- a predefined criterion A single occurrence or a relatively small number of occurrences of a particular pattern of event types is unlikely to signify that there is a relationship between the event types.
- the “predefined criterion” includes the number of occurrences of the pattern or the rate of occurrence of the pattern exceeding the predefined threshold.
- the “predefined criterion” can be another criterion.
- the correlation rule creating task ( 308 ) of FIG. 3 is performed in response to the event correlator determining that the multiple occurrences of the pattern satisfy the predefined criterion. If the multiple occurrences of the pattern do not satisfy the predefined criterion, then the event correlator would not perform the correlation rule creating task ( 308 ) of FIG. 3 .
- the event correlator For each cluster of event types, the event correlator identifies (at 404 ) a set (e.g., pair) of specific events relating to the cluster of event types. Note that it is the specific events that are associated with configuration items, such that the identifying of the sets of specific events allows for information of the associated configuration items to be accessed (at 406 ).
- each “database down” event can be associated with an instance of a database CI
- each “application server error” event can be associated with an instance of an application server CI.
- the event correlator next determines (at 408 ) whether the configuration items to which the specific events are associated are actually related. For example, a shortest-path search can be performed for the configuration items of the specific events in each event pair (of specific events). The shortest-path search algorithm disqualifies the respective event pair if there is no path between the associated configuration items within a predefined number (zero or greater) of hops. In other examples, other techniques for determining whether relationships exist between configuration items can be used.
- the information repository can be a topology database that identifies topological relationships among configuration items.
- the topology database can be in the form of a graph having nodes corresponding to respective configuration items, and links that define relationships between the configuration items.
- the nodes of the topological graph can be directly linked, or indirectly linked through other nodes. Two nodes that are directly linked to each other means that the respective configuration items are connected to each other over a path of one hop.
- a configuration item is linked to itself by zero hops.
- a first node is connected to a second node through a third node, then the respective configuration items associated with the first and second nodes are considered to be connected to each other over a path having one hop. More generally, a pair of configuration items are connected to each other over n hops (n ⁇ 1) if there are n ⁇ 1 nodes between the nodes corresponding to the pair of configuration items.
- the information repository can include a semantic database, which contains information defining relationships between configuration items.
- Time interval t 2 in FIG. 2 illustrates another particular issue that can be addressed as part of the analysis ( 306 ). If multiple instances of an analyzed pattern of event types occur in a short time interval (such as within t 2 ), it is not clear which of the associated events are related. Such issue can be addressed by creating candidate pairs for all possible event combinations, with those candidates disqualified if the respective configuration items are not related. In the example of FIG. 2 , dashed ovals 204 A and 204 B of the “database down” and “application server error” event pairs are disqualified because the associated configuration items are not related.
- Each pair of events has been identified (each pair including a database down event and an application server error event). Each pair of events is related to a particular instance of a database CI and application server CI, and a path between the two CI instances.
- Each instance of a configuration item has a class property, which defines the class of the configuration item.
- a correlation rule created using techniques according to some embodiments relates classes of configuration items, rather than specific instances of configuration items.
- the topology of the relationship between the configuration items associated with the related event types is also determined.
- the related event types may be associated with configuration items having a containment relationship (one configuration item contains another), or alternatively, it is determined that one configuration item is related to another configuration item through an intermediate object.
- Such determination can allow the created correlation rule to specify the topological relationship between the configuration item classes.
- the completed correlation rule includes information identifying the correlated event types and information describing the related configuration item classes (along with their topological relationship), such as in the form of graph 106 shown in FIG. 1 .
- Inclusion of the information relating to the related configuration item classes allows for topology constraints to be included in the correlation rule.
- Such topology constraints of a correlation rule can be validated by looking at configuration item types and relationships between configuration item types when determining whether event types are related.
- Techniques or mechanisms according to some implementations can also address user concerns about losing control of a system.
- the rule generation can be embedded in a rule-authoring tool.
- proposed correlation rules can be presented to a user, who can choose to accept the correlation rule as is, reject the proposed correlation rule, or modify and/or annotate the proposed correlation rule.
- FIG. 5 is a block diagram of an example system 500 that includes an event correlator 502 according to some implementations, where the event correlator 502 is configured to automatically create correlation rules 504 based on information captured in an event archive 506 and CI information 514 in a database 512 (e.g., configuration management database or CMDB).
- the event archive 506 includes events 508 that have occurred over the life (or some predefined time interval) of an IT infrastructure.
- the CMDB 512 contains configuration items that represent respective components of an IT infrastructure.
- the events 508 contained in the event archive 506 can include various types of information, such as a problem description or other description associated with each event, information relating to users, a timestamp, a type property, and information regarding an associated CI.
- the type property associated with information relating to an event provides information regarding the type of event.
- the event archive 506 , database 512 , and any correlation rules 504 created by the event correlator 502 are stored in storage media 510 , which can be implemented with one or multiple storage devices such as a disk-based storage device, integrated circuit storage device, and/or other type of storage device.
- the system 500 also includes one or multiple processors 516 .
- the event correlator 502 is executable on the processor(s) 516 .
- the system 500 includes a network interface 518 to allow the system 500 to communicate over a data network with remote systems, such as systems that produced the events for storing in the event archive 506 .
- event archive 506 and CMDB 512 are stored in the storage media of the system 500 , it is noted that in alternative examples, the event archive 506 and/or CMDB 512 can be stored on a remote storage subsystem (or multiple remote storage subsystems).
- correlation rules 504 By being able to automatically create correlation rules 504 , domain expertise expected of IT administrators or other users can be reduced for the purpose of identifying root causes of events. By being able to automatically create correlation rules 504 that can assist in automatically determining causes of symptom events, improved efficiency and reduced cost in managing IT infrastructure can be accomplished.
- Machine-readable instructions of the event correlator 502 are loaded for execution on the processor(s) 516 .
- a processor can include a microprocessor, microcontroller, processor module or subsystem, programmable integrated circuit, programmable gate array, or another control or computing device.
- Data and instructions are stored in respective storage devices, which are implemented as one or more computer-readable or machine-readable storage media.
- the storage media include different forms of memory including semiconductor memory devices such as dynamic or static random access memories (DRAMs or SRAMs), erasable and programmable read-only memories (EPROMs), electrically erasable and programmable read-only memories (EEPROMs) and flash memories; magnetic disks such as fixed, floppy and removable disks; other magnetic media including tape; optical media such as compact disks (CDs) or digital video disks (DVDs); or other types of storage devices.
- DRAMs or SRAMs dynamic or static random access memories
- EPROMs erasable and programmable read-only memories
- EEPROMs electrically erasable and programmable read-only memories
- flash memories such as fixed, floppy and removable disks
- magnetic media such as fixed, floppy and removable disks
- optical media such as compact disks (CDs) or digital video disks (DVDs); or other
- the instructions discussed above can be provided on one computer-readable or machine-readable storage medium, or alternatively, can be provided on multiple computer-readable or machine-readable storage media distributed in a large system having possibly plural nodes.
- Such computer-readable or machine-readable storage medium or media is (are) considered to be part of an article (or article of manufacture).
- An article or article of manufacture can refer to any manufactured single component or multiple components.
- the storage medium or media can be located either in the machine running the machine-readable instructions, or located at a remote site from which machine-readable instructions can be downloaded over a network for execution.
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Quality & Reliability (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Health & Medical Sciences (AREA)
- Biomedical Technology (AREA)
- Debugging And Monitoring (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
Description
- This is a continuation of U.S. application Ser. No. 14/008,940, filed Sep. 30, 2013, which is a national stage application under 35 U.S.C. §371 of PCT/US2011/031056, filed Apr. 4, 2011, which are both hereby incorporated by reference in their entirety.
- An information technology (IT) infrastructure of an enterprise (e.g., a company, an educational organization, a government agency, etc.) can include a relatively large arrangement of components. IT administrators of the enterprise can be tasked with managing the IT infrastructure, including identifying root causes of issues that are detected, among other tasks. However, managing a relatively large IT infrastructure can be complex.
- Some embodiments are described with respect to the following figures:
-
FIG. 1 illustrates an example correlation rule that is created using an event correlator according to some implementations; -
FIG. 2 is a timing diagram illustrating occurrences of events over time, which can be processed using an event correlator according to some implementations; -
FIGS. 3 and 4 are flow diagrams of processes performed by an event correlator according to some implementations; and -
FIG. 5 is a block diagram of an example system incorporating an event correlator according to some implementations. - An information technology (IT) infrastructure includes an arrangement of components, such as hardware components (e.g., computers, storage servers, communications devices, and so forth), software components (e.g., applications, operating systems, drivers, and so forth), database components (e.g., relational database management systems, unstructured database systems, and so forth), and/or other components. As part of the overall operation of the IT infrastructure, various events can occur, including events relating to problems, failures, issues, or activities relating to components in the IT infrastructure.
- Traditionally, when presented with events relating to problems, failures, issues, or activities, IT administrators are assigned the task of identifying or determining the root causes of such events. However, for a relatively large IT infrastructure, manual determination of root causes of events can be time consuming and error prone.
- In accordance with some implementations, mechanisms or techniques are provided to automatically create correlation rules that define relationships between respective two or more types of events. Using correlation rules, a system can automatically identify a correlation between event types such that the system can determine, for a given event, what other event(s) caused the given event. In this manner, root causes of events relating to problems, failures, issues, or activities can be efficiently and accurately identified.
- A correlation rule can specify a type of a cause event that is the cause of a type of symptom event. More generally, a correlation rule can specify one or multiple types of cause events that are the cause of one or multiple types of symptom events. A cause event refers to an event that causes occurrence of another event. A symptom event is the event that results from occurrence of another event. An “event” can refer to a problem, a failure, an issue, an activity, an operation, an input, an output, or any other occurrence in an IT infrastructure. Events can be categorized into different types. For example, one type of event is a database going down. Another type of event is a mail server starting up. Yet another type of event is an application server exhibiting an error. There are numerous other examples of event types.
- An example of a
correlation rule 100 is depicted inFIG. 1 . Thecorrelation rule 100 may be displayable in graphical form on a display device, for example. Thecorrelation rule 100 includes an cause event type 102 (which in theFIG. 1 example is memory usage level—near capacity) that is the cause of a symptom event type 104 (which in theFIG. 1 example is cache performance—low). In theFIG. 1 example, thecause event type 102 is associated with a computer configuration item (CI), while thesymptom event type 104 is associated with an SQL server configuration item. A configuration item defines a configuration of a component, such as a hardware component, a software component, a database component, or any other component of an IT infrastructure. A “configuration” can include an attribute associated with the component. Generally, a configuration item represents a discrete unit of a configuration relating to a component. A configuration item can be related to another configuration item (or multiple other configuration items). -
FIG. 1 also shows agraphical representation 106 of acomputer CI 108 that is linked byrelationship 110 to the SQLserver CI 112. In the example ofFIG. 1 , therelationship 110 is a container link, which indicates that thecomputer CI 108 contains the SQL server 112 (in other words, an SQL server is contained in a computer). Thecorrelation rule 100 ofFIG. 1 provides a correlation betweenevent types event types respective configuration items respective configuration items computer CI class 108 and the SQL server class 112) with respective event types provides a topology constraint that has to be satisfied for corresponding event types to be considered related according to the correlation rule. - Although a specific example of a form of correlation rule is shown in
FIG. 1 , note that in other implementations, other forms of correlation rules can be used. - Based on information in the
correlation rule 100, a particular event (such as memory usage level—near capacity represented by 102 inFIG. 1 ) that occurs on a computer (as represented by the computer CI inFIG. 1 ) is likely the cause of a symptom event (e.g., cache performance—low represented by 104 inFIG. 1 ) that occurs with an SQL server (as represented by SQL server CI 112 inFIG. 1 ). - In accordance with some implementations, to automatically create correlation rules, a stream of events that have occurred can be analyzed. For example,
FIG. 2 illustrates a timeline of events over time. In the example ofFIG. 2 , four time intervals (t0, t1, t2, and t3) are identified along the horizontal axis of the timeline. Events that occur in an IT infrastructure can be grouped into the respective time intervals. For example, as shown inFIG. 2 , triangle symbols represent respective events that have occurred over time. In time interval t0, two events occurred; in time interval t1, three events occurred; in time interval t2, five events occurred; and in time interval t3, three events occurred. The triangle symbols have different fill patterns to represent different types of events, as represented by thelegends - The number of events and the types of events illustrated in
FIG. 2 are provided for purposes of example. In a relatively large IT infrastructure, there can be much larger numbers of events and of event types. - Although
FIG. 2 depicts partitioning of events into time intervals, in other implementations, events can be partitioned into other types of partitions different from time intervals. Other partitions can include partitions of events occurring on different machines or groups of machines, partitions of events occurring within different divisions or departments of an enterprise, partitions of events occurring within different geographic regions, and so forth. - As shown in
FIG. 2 , a pattern of event types is present, namely a pattern that includes a database down event type and an application server error event type occurring relatively close in time to each other (e.g., within the same time interval). Each event is associated with event type information to allow mechanisms according to some implementations to determine the type of each of the events that have occurred. Additionally, an event can also be associated with a timestamp indicating when the event occurred, and information identifying an associated configuration item. - As depicted in
FIG. 2 ,solid ovals FIG. 2 ) that may be related to each other. Each occurrence of the pattern of event types is basically a cluster of potentially related event types that occur within a respective time interval. - Note that
FIG. 2 also shows events of the mail server startup event type that are present in time intervals t1, t2, and t3. In the example ofFIG. 2 , the mail server startup events have been determined not to be related to the other event types shown inFIG. 2 , and thus are not identified as being part of clusters of related event types. For example, the mail server startup event type can be identified as noise, for various reasons. The event correlator may determine that the mail server startup event type occurs so frequently (occurs in more than some predefined percentage of time intervals) that the mail server startup event type is considered noise and thus should not be correlated to other event types. The event correlator can thus detect that the relationship of noisy event types (event types that occur more frequently than some predefined threshold) and other event types are trivial and thus should not be considered to be correlated. Alternatively, or additionally, the event correlator may determine that prior occurrences of the mail server startup event type were not correlated to either the database down event type or the application server error event type, because a deeper analysis of information associated with these event types indicates that there exists no relationship between the mail server startup event type and the other event types. - Although just one pattern of event types (represented by the
clusters 202A-202D) is shown inFIG. 2 , note that there can be multiple patterns of event types in other examples. -
FIG. 3 is a flow diagram of a process according to some implementations for creating a correlation rule. The process ofFIG. 3 can be performed by an event correlator, discussed further below. Events are received (at 302) over time, such as the events depicted in the timeline ofFIG. 2 . The received events can be part of an archive or other collection of events that have occurred. - The event correlator according to some implementations identifies (at 304) multiple occurrences (clusters) of a pattern of event types in the received events. The event correlator can invoke a clustering technique to cluster sets of events that are likely to be related because they frequently occur together or occur within a particular timeframe. The type property of the events can be used to group the events into multiple clusters of event types (e.g.,
clusters 202A-202D in multiple time intervals as shown inFIG. 2 ). - The event correlator then analyzes (at 306) Information associated with configuration items related to the events of the pattern of event types. A correlation rule is then created (at 308) defining a relationship between the event types in response to the analyzing determining a relationship between the corresponding configuration items.
-
FIG. 4 illustrates further details of the analyzing performed at 306. InFIG. 4 , the event correlator determines (at 402) that multiple occurrences of a pattern of event types, which in the example ofFIG. 2 includes a pattern of a database down event type and an application server error event type, satisfies a predefined criterion. A single occurrence or a relatively small number of occurrences of a particular pattern of event types is unlikely to signify that there is a relationship between the event types. However, if the number of the multiple occurrences of the pattern of event types or a rate of occurrence of the pattern of event types exceeds a predefined threshold, then that can be an indication that the event types of the pattern are related to each other. In such example, the “predefined criterion” includes the number of occurrences of the pattern or the rate of occurrence of the pattern exceeding the predefined threshold. In other examples, the “predefined criterion” can be another criterion. - The correlation rule creating task (308) of
FIG. 3 is performed in response to the event correlator determining that the multiple occurrences of the pattern satisfy the predefined criterion. If the multiple occurrences of the pattern do not satisfy the predefined criterion, then the event correlator would not perform the correlation rule creating task (308) ofFIG. 3 . - For each cluster of event types, the event correlator identifies (at 404) a set (e.g., pair) of specific events relating to the cluster of event types. Note that it is the specific events that are associated with configuration items, such that the identifying of the sets of specific events allows for information of the associated configuration items to be accessed (at 406). In the example of
FIG. 2 involving “database down” events and “application server error” events, each “database down” event can be associated with an instance of a database CI, and each “application server error” event can be associated with an instance of an application server CI. - The event correlator next determines (at 408) whether the configuration items to which the specific events are associated are actually related. For example, a shortest-path search can be performed for the configuration items of the specific events in each event pair (of specific events). The shortest-path search algorithm disqualifies the respective event pair if there is no path between the associated configuration items within a predefined number (zero or greater) of hops. In other examples, other techniques for determining whether relationships exist between configuration items can be used.
- More generally, whether a relationship between configuration items exists can be determined (validated) based on accessing an information repository that describes relationships between configuration items. For example, the information repository can be a topology database that identifies topological relationships among configuration items. The topology database can be in the form of a graph having nodes corresponding to respective configuration items, and links that define relationships between the configuration items. The nodes of the topological graph can be directly linked, or indirectly linked through other nodes. Two nodes that are directly linked to each other means that the respective configuration items are connected to each other over a path of one hop. A configuration item is linked to itself by zero hops. If a first node is connected to a second node through a third node, then the respective configuration items associated with the first and second nodes are considered to be connected to each other over a path having one hop. More generally, a pair of configuration items are connected to each other over n hops (n≧1) if there are n−1 nodes between the nodes corresponding to the pair of configuration items.
- In other implementations, the information repository can include a semantic database, which contains information defining relationships between configuration items.
- Time interval t2 in
FIG. 2 illustrates another particular issue that can be addressed as part of the analysis (306). If multiple instances of an analyzed pattern of event types occur in a short time interval (such as within t2), it is not clear which of the associated events are related. Such issue can be addressed by creating candidate pairs for all possible event combinations, with those candidates disqualified if the respective configuration items are not related. In the example ofFIG. 2 , dashedovals - In the example of
FIG. 2 , four pairs of specific events have been identified (each pair including a database down event and an application server error event). Each pair of events is related to a particular instance of a database CI and application server CI, and a path between the two CI instances. - Next, distinct CI instance pairs are abstracted (at 410) (with their path relationships) to the CI class level. Each instance of a configuration item has a class property, which defines the class of the configuration item. A correlation rule created using techniques according to some embodiments relates classes of configuration items, rather than specific instances of configuration items.
- As part of the abstraction, the topology of the relationship between the configuration items associated with the related event types is also determined. For example, the related event types may be associated with configuration items having a containment relationship (one configuration item contains another), or alternatively, it is determined that one configuration item is related to another configuration item through an intermediate object. Such determination can allow the created correlation rule to specify the topological relationship between the configuration item classes. The completed correlation rule includes information identifying the correlated event types and information describing the related configuration item classes (along with their topological relationship), such as in the form of
graph 106 shown inFIG. 1 . Inclusion of the information relating to the related configuration item classes allows for topology constraints to be included in the correlation rule. Such topology constraints of a correlation rule can be validated by looking at configuration item types and relationships between configuration item types when determining whether event types are related. - Techniques or mechanisms according to some implementations can also address user concerns about losing control of a system. To gain acceptance by IT personnel, the rule generation can be embedded in a rule-authoring tool. Instead of automatically injecting correlation rules without review by users, proposed correlation rules can be presented to a user, who can choose to accept the correlation rule as is, reject the proposed correlation rule, or modify and/or annotate the proposed correlation rule.
-
FIG. 5 is a block diagram of anexample system 500 that includes anevent correlator 502 according to some implementations, where theevent correlator 502 is configured to automatically createcorrelation rules 504 based on information captured in anevent archive 506 andCI information 514 in a database 512 (e.g., configuration management database or CMDB). Theevent archive 506 includesevents 508 that have occurred over the life (or some predefined time interval) of an IT infrastructure. TheCMDB 512 contains configuration items that represent respective components of an IT infrastructure. - The
events 508 contained in theevent archive 506 can include various types of information, such as a problem description or other description associated with each event, information relating to users, a timestamp, a type property, and information regarding an associated CI. The type property associated with information relating to an event provides information regarding the type of event. - The
event archive 506,database 512, and anycorrelation rules 504 created by theevent correlator 502, are stored instorage media 510, which can be implemented with one or multiple storage devices such as a disk-based storage device, integrated circuit storage device, and/or other type of storage device. - The
system 500 also includes one ormultiple processors 516. Theevent correlator 502 is executable on the processor(s) 516. Moreover, thesystem 500 includes anetwork interface 518 to allow thesystem 500 to communicate over a data network with remote systems, such as systems that produced the events for storing in theevent archive 506. - Although the
event archive 506 andCMDB 512 are stored in the storage media of thesystem 500, it is noted that in alternative examples, theevent archive 506 and/orCMDB 512 can be stored on a remote storage subsystem (or multiple remote storage subsystems). - By being able to automatically create
correlation rules 504, domain expertise expected of IT administrators or other users can be reduced for the purpose of identifying root causes of events. By being able to automatically createcorrelation rules 504 that can assist in automatically determining causes of symptom events, improved efficiency and reduced cost in managing IT infrastructure can be accomplished. - Machine-readable instructions of the
event correlator 502 are loaded for execution on the processor(s) 516. A processor can include a microprocessor, microcontroller, processor module or subsystem, programmable integrated circuit, programmable gate array, or another control or computing device. - Data and instructions are stored in respective storage devices, which are implemented as one or more computer-readable or machine-readable storage media. The storage media include different forms of memory including semiconductor memory devices such as dynamic or static random access memories (DRAMs or SRAMs), erasable and programmable read-only memories (EPROMs), electrically erasable and programmable read-only memories (EEPROMs) and flash memories; magnetic disks such as fixed, floppy and removable disks; other magnetic media including tape; optical media such as compact disks (CDs) or digital video disks (DVDs); or other types of storage devices. Note that the instructions discussed above can be provided on one computer-readable or machine-readable storage medium, or alternatively, can be provided on multiple computer-readable or machine-readable storage media distributed in a large system having possibly plural nodes. Such computer-readable or machine-readable storage medium or media is (are) considered to be part of an article (or article of manufacture). An article or article of manufacture can refer to any manufactured single component or multiple components. The storage medium or media can be located either in the machine running the machine-readable instructions, or located at a remote site from which machine-readable instructions can be downloaded over a network for execution.
- In the foregoing description, numerous details are set forth to provide an understanding of the subject disclosed herein. However, implementations may be practiced without some or all of these details. Other implementations may include modifications and variations from the details discussed above. It is intended that the appended claims cover such modifications and variations.
Claims (20)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US15/460,608 US20170185468A1 (en) | 2011-04-04 | 2017-03-16 | Creating A Correlation Rule Defining A Relationship Between Event Types |
Applications Claiming Priority (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
PCT/US2011/031056 WO2012138319A1 (en) | 2011-04-04 | 2011-04-04 | Creating a correlation rule defining a relationship between event types |
US201314008940A | 2013-09-30 | 2013-09-30 | |
US15/460,608 US20170185468A1 (en) | 2011-04-04 | 2017-03-16 | Creating A Correlation Rule Defining A Relationship Between Event Types |
Related Parent Applications (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US14/008,940 Continuation US9612892B2 (en) | 2011-04-04 | 2011-04-04 | Creating a correlation rule defining a relationship between event types |
PCT/US2011/031056 Continuation WO2012138319A1 (en) | 2011-04-04 | 2011-04-04 | Creating a correlation rule defining a relationship between event types |
Publications (1)
Publication Number | Publication Date |
---|---|
US20170185468A1 true US20170185468A1 (en) | 2017-06-29 |
Family
ID=46969462
Family Applications (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US14/008,940 Active 2031-07-24 US9612892B2 (en) | 2011-04-04 | 2011-04-04 | Creating a correlation rule defining a relationship between event types |
US15/460,608 Abandoned US20170185468A1 (en) | 2011-04-04 | 2017-03-16 | Creating A Correlation Rule Defining A Relationship Between Event Types |
Family Applications Before (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US14/008,940 Active 2031-07-24 US9612892B2 (en) | 2011-04-04 | 2011-04-04 | Creating a correlation rule defining a relationship between event types |
Country Status (4)
Country | Link |
---|---|
US (2) | US9612892B2 (en) |
EP (1) | EP2695057A4 (en) |
CN (1) | CN103562863A (en) |
WO (1) | WO2012138319A1 (en) |
Cited By (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20170315855A1 (en) * | 2016-05-02 | 2017-11-02 | Agt International Gmbh | Method of detecting anomalies on appliances and system thereof |
US10621027B2 (en) | 2017-08-18 | 2020-04-14 | TmaxSoft Co., Ltd. | IT system fault analysis technique based on configuration management database |
US10860410B2 (en) | 2017-09-13 | 2020-12-08 | TmaxSoft Co., Ltd. | Technique for processing fault event of IT system |
Families Citing this family (86)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US8677377B2 (en) | 2005-09-08 | 2014-03-18 | Apple Inc. | Method and apparatus for building an intelligent automated assistant |
US9318108B2 (en) | 2010-01-18 | 2016-04-19 | Apple Inc. | Intelligent automated assistant |
US8977255B2 (en) | 2007-04-03 | 2015-03-10 | Apple Inc. | Method and system for operating a multi-function portable electronic device using voice-activation |
US8676904B2 (en) | 2008-10-02 | 2014-03-18 | Apple Inc. | Electronic devices with voice command and contextual data processing capabilities |
US10706373B2 (en) | 2011-06-03 | 2020-07-07 | Apple Inc. | Performing actions associated with task items that represent tasks to perform |
US10276170B2 (en) | 2010-01-18 | 2019-04-30 | Apple Inc. | Intelligent automated assistant |
US11068954B2 (en) | 2015-11-20 | 2021-07-20 | Voicemonk Inc | System for virtual agents to help customers and businesses |
US10417037B2 (en) | 2012-05-15 | 2019-09-17 | Apple Inc. | Systems and methods for integrating third party services with a digital assistant |
US9298538B2 (en) * | 2012-08-16 | 2016-03-29 | Vmware, Inc. | Methods and systems for abnormality analysis of streamed log data |
KR20240132105A (en) | 2013-02-07 | 2024-09-02 | 애플 인크. | Voice trigger for a digital assistant |
US10652394B2 (en) | 2013-03-14 | 2020-05-12 | Apple Inc. | System and method for processing voicemail |
US10748529B1 (en) | 2013-03-15 | 2020-08-18 | Apple Inc. | Voice activated device for use with a voice-based digital assistant |
US9172621B1 (en) * | 2013-04-01 | 2015-10-27 | Amazon Technologies, Inc. | Unified account metadata management |
US10176167B2 (en) | 2013-06-09 | 2019-01-08 | Apple Inc. | System and method for inferring user intent from speech inputs |
KR101772152B1 (en) | 2013-06-09 | 2017-08-28 | 애플 인크. | Device, method, and graphical user interface for enabling conversation persistence across two or more instances of a digital assistant |
DE112014003653B4 (en) | 2013-08-06 | 2024-04-18 | Apple Inc. | Automatically activate intelligent responses based on activities from remote devices |
US9715875B2 (en) | 2014-05-30 | 2017-07-25 | Apple Inc. | Reducing the need for manual start/end-pointing and trigger phrases |
US10170123B2 (en) | 2014-05-30 | 2019-01-01 | Apple Inc. | Intelligent assistant for home automation |
CN110797019B (en) | 2014-05-30 | 2023-08-29 | 苹果公司 | Multi-command single speech input method |
US9338493B2 (en) | 2014-06-30 | 2016-05-10 | Apple Inc. | Intelligent automated assistant for TV user interactions |
US10552746B2 (en) | 2014-09-25 | 2020-02-04 | International Business Machines Corporation | Identification of time lagged indicators for events with a window period |
US9886953B2 (en) | 2015-03-08 | 2018-02-06 | Apple Inc. | Virtual assistant activation |
US9721566B2 (en) | 2015-03-08 | 2017-08-01 | Apple Inc. | Competing devices responding to voice triggers |
US10460227B2 (en) | 2015-05-15 | 2019-10-29 | Apple Inc. | Virtual assistant in a communication session |
US10200824B2 (en) | 2015-05-27 | 2019-02-05 | Apple Inc. | Systems and methods for proactively identifying and surfacing relevant content on a touch-sensitive device |
US20160378747A1 (en) | 2015-06-29 | 2016-12-29 | Apple Inc. | Virtual assistant for media playback |
US10331312B2 (en) | 2015-09-08 | 2019-06-25 | Apple Inc. | Intelligent automated assistant in a media environment |
US10747498B2 (en) | 2015-09-08 | 2020-08-18 | Apple Inc. | Zero latency digital assistant |
US10740384B2 (en) | 2015-09-08 | 2020-08-11 | Apple Inc. | Intelligent automated assistant for media search and playback |
US10671428B2 (en) | 2015-09-08 | 2020-06-02 | Apple Inc. | Distributed personal assistant |
US11587559B2 (en) | 2015-09-30 | 2023-02-21 | Apple Inc. | Intelligent device identification |
US10691473B2 (en) | 2015-11-06 | 2020-06-23 | Apple Inc. | Intelligent automated assistant in a messaging environment |
US10956666B2 (en) | 2015-11-09 | 2021-03-23 | Apple Inc. | Unconventional virtual assistant interactions |
WO2017082782A1 (en) | 2015-11-10 | 2017-05-18 | Telefonaktiebolaget Lm Ericsson (Publ) | Managing network alarms |
US10223066B2 (en) | 2015-12-23 | 2019-03-05 | Apple Inc. | Proactive assistance based on dialog communication between devices |
JP2017182441A (en) * | 2016-03-30 | 2017-10-05 | 富士通株式会社 | Operation actual condition processing device, method, and program |
US10469309B1 (en) * | 2016-04-28 | 2019-11-05 | Servicenow, Inc. | Management of computing system alerts |
US10586535B2 (en) | 2016-06-10 | 2020-03-10 | Apple Inc. | Intelligent digital assistant in a multi-tasking environment |
DK201670540A1 (en) | 2016-06-11 | 2018-01-08 | Apple Inc | Application integration with a digital assistant |
DK179049B1 (en) * | 2016-06-11 | 2017-09-18 | Apple Inc | Data driven natural language event detection and classification |
DK179415B1 (en) | 2016-06-11 | 2018-06-14 | Apple Inc | Intelligent device arbitration and control |
US11204787B2 (en) | 2017-01-09 | 2021-12-21 | Apple Inc. | Application integration with a digital assistant |
CN108322320B (en) * | 2017-01-18 | 2020-04-28 | 华为技术有限公司 | Service survivability analysis method and device |
US10078927B2 (en) * | 2017-01-23 | 2018-09-18 | Honeywell International Inc. | Systems and methods for time-bound homogenous consecutive events triggering a procedure in an access control host system |
DK201770383A1 (en) | 2017-05-09 | 2018-12-14 | Apple Inc. | User interface for correcting recognition errors |
US10726832B2 (en) | 2017-05-11 | 2020-07-28 | Apple Inc. | Maintaining privacy of personal information |
DK180048B1 (en) | 2017-05-11 | 2020-02-04 | Apple Inc. | MAINTAINING THE DATA PROTECTION OF PERSONAL INFORMATION |
DK179496B1 (en) | 2017-05-12 | 2019-01-15 | Apple Inc. | USER-SPECIFIC Acoustic Models |
DK201770428A1 (en) | 2017-05-12 | 2019-02-18 | Apple Inc. | Low-latency intelligent automated assistant |
DK179745B1 (en) | 2017-05-12 | 2019-05-01 | Apple Inc. | SYNCHRONIZATION AND TASK DELEGATION OF A DIGITAL ASSISTANT |
DK201770411A1 (en) | 2017-05-15 | 2018-12-20 | Apple Inc. | Multi-modal interfaces |
US20180336275A1 (en) | 2017-05-16 | 2018-11-22 | Apple Inc. | Intelligent automated assistant for media exploration |
US20180336892A1 (en) | 2017-05-16 | 2018-11-22 | Apple Inc. | Detecting a trigger of a digital assistant |
DK179549B1 (en) | 2017-05-16 | 2019-02-12 | Apple Inc. | Far-field extension for digital assistant services |
CN107832446B (en) * | 2017-11-22 | 2020-07-14 | 联动优势科技有限公司 | Configuration item information searching method and computing device |
US10818288B2 (en) | 2018-03-26 | 2020-10-27 | Apple Inc. | Natural assistant interaction |
EP3553616A1 (en) * | 2018-04-11 | 2019-10-16 | Siemens Aktiengesellschaft | Determination of the causes of anomaly events |
US11145294B2 (en) | 2018-05-07 | 2021-10-12 | Apple Inc. | Intelligent automated assistant for delivering content from user experiences |
US10928918B2 (en) | 2018-05-07 | 2021-02-23 | Apple Inc. | Raise to speak |
DK201870355A1 (en) | 2018-06-01 | 2019-12-16 | Apple Inc. | Virtual assistant operation in multi-device environments |
DK180639B1 (en) | 2018-06-01 | 2021-11-04 | Apple Inc | DISABILITY OF ATTENTION-ATTENTIVE VIRTUAL ASSISTANT |
US10892996B2 (en) | 2018-06-01 | 2021-01-12 | Apple Inc. | Variable latency device coordination |
DK179822B1 (en) | 2018-06-01 | 2019-07-12 | Apple Inc. | Voice interaction at a primary device to access call functionality of a companion device |
US11462215B2 (en) | 2018-09-28 | 2022-10-04 | Apple Inc. | Multi-modal inputs for voice commands |
US11475898B2 (en) | 2018-10-26 | 2022-10-18 | Apple Inc. | Low-latency multi-speaker speech recognition |
US11638059B2 (en) | 2019-01-04 | 2023-04-25 | Apple Inc. | Content playback on multiple devices |
US11348573B2 (en) | 2019-03-18 | 2022-05-31 | Apple Inc. | Multimodality in digital assistant systems |
US11307752B2 (en) | 2019-05-06 | 2022-04-19 | Apple Inc. | User configurable task triggers |
US11423908B2 (en) | 2019-05-06 | 2022-08-23 | Apple Inc. | Interpreting spoken requests |
US11475884B2 (en) | 2019-05-06 | 2022-10-18 | Apple Inc. | Reducing digital assistant latency when a language is incorrectly determined |
DK201970509A1 (en) | 2019-05-06 | 2021-01-15 | Apple Inc | Spoken notifications |
US11140099B2 (en) | 2019-05-21 | 2021-10-05 | Apple Inc. | Providing message response suggestions |
DK201970511A1 (en) | 2019-05-31 | 2021-02-15 | Apple Inc | Voice identification in digital assistant systems |
US11289073B2 (en) | 2019-05-31 | 2022-03-29 | Apple Inc. | Device text to speech |
US11496600B2 (en) | 2019-05-31 | 2022-11-08 | Apple Inc. | Remote execution of machine-learned models |
DK180129B1 (en) | 2019-05-31 | 2020-06-02 | Apple Inc. | User activity shortcut suggestions |
US11360641B2 (en) | 2019-06-01 | 2022-06-14 | Apple Inc. | Increasing the relevance of new available information |
US11227599B2 (en) | 2019-06-01 | 2022-01-18 | Apple Inc. | Methods and user interfaces for voice-based control of electronic devices |
US10805144B1 (en) * | 2019-06-18 | 2020-10-13 | Cisco Technology, Inc. | Monitoring interactions between entities in a network by an agent for particular types of interactions and indexing and establishing relationships of the components of each interaction |
WO2021056255A1 (en) | 2019-09-25 | 2021-04-01 | Apple Inc. | Text detection using global geometry estimators |
CN110868472B (en) * | 2019-11-20 | 2022-06-07 | 厦门梓蔓生物科技有限公司 | Project integration system based on Internet of things PaaS cloud platform and integration method thereof |
US11038934B1 (en) | 2020-05-11 | 2021-06-15 | Apple Inc. | Digital assistant hardware abstraction |
US11061543B1 (en) | 2020-05-11 | 2021-07-13 | Apple Inc. | Providing relevant data items based on context |
US11755276B2 (en) | 2020-05-12 | 2023-09-12 | Apple Inc. | Reducing description length based on confidence |
US11490204B2 (en) | 2020-07-20 | 2022-11-01 | Apple Inc. | Multi-device audio adjustment coordination |
US11438683B2 (en) | 2020-07-21 | 2022-09-06 | Apple Inc. | User identification using headphones |
Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20050091356A1 (en) * | 2003-10-24 | 2005-04-28 | Matthew Izzo | Method and machine-readable medium for using matrices to automatically analyze network events and objects |
US20050222810A1 (en) * | 2004-04-03 | 2005-10-06 | Altusys Corp | Method and Apparatus for Coordination of a Situation Manager and Event Correlation in Situation-Based Management |
Family Cites Families (26)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5528516A (en) | 1994-05-25 | 1996-06-18 | System Management Arts, Inc. | Apparatus and method for event correlation and problem reporting |
US5483637A (en) * | 1994-06-27 | 1996-01-09 | International Business Machines Corporation | Expert based system and method for managing error events in a local area network |
US6154849A (en) * | 1998-06-30 | 2000-11-28 | Sun Microsystems, Inc. | Method and apparatus for resource dependency relaxation |
US6446136B1 (en) | 1998-12-31 | 2002-09-03 | Computer Associates Think, Inc. | System and method for dynamic correlation of events |
GB0127551D0 (en) | 2001-11-16 | 2002-01-09 | Abb Ab | Analysing events |
US7089250B2 (en) * | 2003-10-08 | 2006-08-08 | International Business Machines Corporation | Method and system for associating events |
US7631222B2 (en) * | 2004-08-23 | 2009-12-08 | Cisco Technology, Inc. | Method and apparatus for correlating events in a network |
US7730494B1 (en) | 2005-04-20 | 2010-06-01 | At&T Corp. | Methods and apparatus for service and network management event correlation |
US8661113B2 (en) | 2006-05-09 | 2014-02-25 | International Business Machines Corporation | Cross-cutting detection of event patterns |
US20080103847A1 (en) | 2006-10-31 | 2008-05-01 | Mehmet Sayal | Data Prediction for business process metrics |
TWI337715B (en) | 2006-11-08 | 2011-02-21 | Inst Information Industry | Method and system for complex event processing |
US8655623B2 (en) * | 2007-02-13 | 2014-02-18 | International Business Machines Corporation | Diagnostic system and method |
US7889666B1 (en) | 2007-12-26 | 2011-02-15 | At&T Intellectual Property Ii, L.P. | Scalable and robust troubleshooting framework for VPN backbones |
US20090177692A1 (en) | 2008-01-04 | 2009-07-09 | Byran Christopher Chagoly | Dynamic correlation of service oriented architecture resource relationship and metrics to isolate problem sources |
US20090183030A1 (en) * | 2008-01-14 | 2009-07-16 | Bethke Bob | Episodic cause analysis |
US20100070981A1 (en) | 2008-09-16 | 2010-03-18 | Computer Associates Think, Inc. | System and Method for Performing Complex Event Processing |
US20100131315A1 (en) | 2008-11-25 | 2010-05-27 | International Business Machines Corporation | Resolving incident reports |
US8069374B2 (en) * | 2009-02-27 | 2011-11-29 | Microsoft Corporation | Fingerprinting event logs for system management troubleshooting |
US9917741B2 (en) * | 2009-08-27 | 2018-03-13 | Entit Software Llc | Method and system for processing network activity data |
US8464279B2 (en) * | 2009-12-18 | 2013-06-11 | Hewlett-Packard Development Company, L.P. | Domain event correlation |
JP5564941B2 (en) * | 2009-12-28 | 2014-08-06 | 富士通株式会社 | Fault location estimation system, fault location estimation apparatus, and fault location estimation method |
JP5428934B2 (en) * | 2010-02-22 | 2014-02-26 | 富士通株式会社 | Failure pattern generation program and failure pattern generation device |
WO2011111599A1 (en) * | 2010-03-11 | 2011-09-15 | 日本電気株式会社 | Fault analysis rule extraction device, fault analysis rule extraction method, and storage medium |
US9213590B2 (en) * | 2012-06-27 | 2015-12-15 | Brocade Communications Systems, Inc. | Network monitoring and diagnostics |
US9229898B2 (en) * | 2012-07-30 | 2016-01-05 | Hewlett Packard Enterprise Development Lp | Causation isolation using a configuration item metric identified based on event classification |
US9632858B2 (en) * | 2013-07-28 | 2017-04-25 | OpsClarity Inc. | Organizing network performance metrics into historical anomaly dependency data |
-
2011
- 2011-04-04 WO PCT/US2011/031056 patent/WO2012138319A1/en active Application Filing
- 2011-04-04 US US14/008,940 patent/US9612892B2/en active Active
- 2011-04-04 CN CN201180071393.XA patent/CN103562863A/en active Pending
- 2011-04-04 EP EP11863207.4A patent/EP2695057A4/en not_active Withdrawn
-
2017
- 2017-03-16 US US15/460,608 patent/US20170185468A1/en not_active Abandoned
Patent Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20050091356A1 (en) * | 2003-10-24 | 2005-04-28 | Matthew Izzo | Method and machine-readable medium for using matrices to automatically analyze network events and objects |
US20050222810A1 (en) * | 2004-04-03 | 2005-10-06 | Altusys Corp | Method and Apparatus for Coordination of a Situation Manager and Event Correlation in Situation-Based Management |
Cited By (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20170315855A1 (en) * | 2016-05-02 | 2017-11-02 | Agt International Gmbh | Method of detecting anomalies on appliances and system thereof |
US10621027B2 (en) | 2017-08-18 | 2020-04-14 | TmaxSoft Co., Ltd. | IT system fault analysis technique based on configuration management database |
US10860410B2 (en) | 2017-09-13 | 2020-12-08 | TmaxSoft Co., Ltd. | Technique for processing fault event of IT system |
Also Published As
Publication number | Publication date |
---|---|
WO2012138319A1 (en) | 2012-10-11 |
US20140025998A1 (en) | 2014-01-23 |
US9612892B2 (en) | 2017-04-04 |
EP2695057A1 (en) | 2014-02-12 |
CN103562863A (en) | 2014-02-05 |
EP2695057A4 (en) | 2015-07-01 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US20170185468A1 (en) | Creating A Correlation Rule Defining A Relationship Between Event Types | |
US11061756B2 (en) | Enabling symptom verification | |
AU2016204068B2 (en) | Data acceleration | |
US9317829B2 (en) | Diagnosing incidents for information technology service management | |
US8230269B2 (en) | Monitoring data categorization and module-based health correlations | |
US20210035026A1 (en) | Diagnosing & triaging performance issues in large-scale services | |
US10692007B2 (en) | Behavioral rules discovery for intelligent computing environment administration | |
US20140074764A1 (en) | Simplifying a graph of correlation rules while preserving semantic coverage | |
US20110320228A1 (en) | Automated Generation of Markov Chains for Use in Information Technology | |
US10769641B2 (en) | Service request management in cloud computing systems | |
US20210366268A1 (en) | Automatic tuning of incident noise | |
US7542998B1 (en) | Cause to effect methodology for monitoring database performance | |
US8285752B1 (en) | System and method for maintaining a plurality of summary levels in a single table | |
US20130173777A1 (en) | Mining Execution Pattern For System Performance Diagnostics | |
Roschke et al. | An alert correlation platform for memory‐supported techniques | |
US8631391B2 (en) | Method and a system for process discovery | |
US12047223B2 (en) | Monitoring service health statuses to raise alerts | |
US11929867B1 (en) | Degradation engine execution triggering alerts for outages | |
US10949785B2 (en) | Product portfolio rationalization | |
CN114595118A (en) | Data monitoring method and device, storage medium and electronic equipment | |
CN113158229A (en) | Data auditing method based on knowledge graph | |
An et al. | An Online Fault Management Method for Live Media Applications |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP, TEXAS Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:HEWLETT-PACKARD DEVELOPMENT COMPANY, L.P.;REEL/FRAME:042033/0001 Effective date: 20151027 Owner name: HEWLETT-PACKARD DEVELOPMENT COMPANY, L.P., TEXAS Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:SCHIMMELPFENG, JOERN;VOSSELER, FRANK;BOSLER, MARTIN;REEL/FRAME:042032/0591 Effective date: 20110331 |
|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION |
|
AS | Assignment |
Owner name: ENTIT SOFTWARE LLC, CALIFORNIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP;REEL/FRAME:048261/0084 Effective date: 20180901 |
|
AS | Assignment |
Owner name: MICRO FOCUS LLC, CALIFORNIA Free format text: CHANGE OF NAME;ASSIGNOR:ENTIT SOFTWARE LLC;REEL/FRAME:052010/0029 Effective date: 20190528 |