WO2013189753A1

WO2013189753A1 - Leveraging priority to handle time based event correlation

Info

Publication number: WO2013189753A1
Application number: PCT/EP2013/061689
Authority: WO
Inventors: Pawan BHANDARI
Original assignee: Alcatel Lucent
Priority date: 2012-06-21
Filing date: 2013-06-06
Publication date: 2013-12-27

Abstract

The embodiments herein relate to computer and telecommunication networks and, more particularly, to priority based handling of events to achieve correlation. In this mechanism, when multiple events are received in a single time cycle, an event collector module (ECM) in the system initially converts received events to a common format. Further the events are sent to an Event Database (ED). The ED analyzes the events and collects various parameters specific to each of the received events, including priority value of the event. Further, an Event Handler (EH) fetches events from the ED on priority basis such that event with highest priority is fetched first. Further the EH processes the fetched event to identify cause of the event and decides the action to be performed corresponding to the event. A processing module in the system performs the action on corresponding resource, as instructed by the EH.

Description

Leveraging Priority to Handle Time Based Event Correlation

TECHNICAL FIELD

[001] The embodiments herein relate to computer and telecommunication networks and, more particularly, to priority based handling of events in computer and telecommunication networks to achieve correlation.

BACKGROUND

[002] In any computer or telecommunication network or in any real time systems, a processing module may have to receive and process events occurring in the system/network. This may happen with in centrally located or in distributed system. An event may refer to state of the system and may be generated as a result of fault occurrence in the system or as a result of user triggered actions. The system has to process the events to achieve desired goals and to keep system stability under control.

[003] In certain cases, it may happen that the system may simultaneously receive multiple events. In such scenarios, the system should be able to decide which event is to be processed/executed first. If not, the system may process the received events randomly and this may affect stability of the system.

[004] For example, one of the existing systems for correlation uses a time based event correlation method. In this method, the system comprises a correlation timer and the system receives events from multiple resources until expiry of the timer. Once the timer is expired, the system starts processing of received events. Disadvantage of this system is that it fails when multiple events of a similar nature are received in a single timer window. In this scenario, the system may execute received events randomly and may lead to instability of the system.

SUMMARY

[005] In view of the foregoing, an embodiment herein provides a method for achieving priority based correlation in a system, said method further comprising assigning a priority value to received events, on receiving said events from resources, by an Event Correlation Management Module (ECMM); processing events according to order of priority by said ECMM, if more than one event is present; and deciding action to be performed corresponding to said processed high priority event by said ECMM.

[006] Also, provided herein is a device for achieving priority based correlation, wherein said device comprising an integrated circuit further comprising at least one processor; at least one memory having a computer program code within said circuit; said at least one memory and said computer program code configured to with said at least one processor cause the device to assigning a priority value to received events, on receiving said events from resources; processing events according to order of priority, if more than one event is present; and deciding action to be performed corresponding to said processed high priority event.

[007] These and other aspects of the embodiments herein will be better appreciated and understood when considered in conjunction with the following description and the accompanying drawings.

BRIEF DESCRIPTION OF THE FIGURES [008] The embodiments herein will be better understood from the following detailed description with reference to the drawings, in which:

[009] FIG. 1 illustrates a block diagram of proposed correlation system, as disclosed in the embodiments herein;

[0010] FIG. 2 illustrates a block diagram that shows various components of proposed Event Correlation Management Module (ECMM), as disclosed in the embodiments herein;

[0011] FIG. 3 is a flow diagram which shows various steps involved in the process of correlating events, as disclosed in the embodiments herein;

[0012] FIG. 4 illustrates a block diagram which shows an exemplary implementation of the proposed correlation system, as disclosed in the embodiments herein; and

[0013] FIG. 5 illustrates a computing environment implementing the application, according to embodiments disclosed herein.

DETAILED DESCRIPTION OF EMBODIMENTS

[0014] The embodiments herein and the various features and advantageous details thereof are explained more fully with reference to the non-limiting embodiments that are illustrated in the accompanying drawings and detailed in the following description. Descriptions of well-known components and processing techniques are omitted so as to not unnecessarily obscure the embodiments herein. The examples used herein are intended merely to facilitate an understanding of ways in which the embodiments herein may be practiced and to further enable those of skill in the art to practice the embodiments herein. Accordingly, the examples should not be construed as limiting the scope of the embodiments herein.

[0015] The embodiments herein disclose a process of correlating events in a system by assigning priority to the events. Referring now to the drawings, and more particularly to FIGS. 1 through 5, where similar reference characters denote corresponding features consistently throughout the figures, there are shown embodiments.

[0016] FIG. 1 illustrates a block diagram of proposed correlation system, as disclosed in the embodiments herein. The system comprises User Interface (UI) 101 , plurality of application/resource 102 and Event Correlation Management Module (ECMM) 103. The ECMM 103 is used for achieving event correlation in the system. An event in the system may be user triggered or resource triggered or both. The user triggered event refers to an event that is triggered as a result of user action i.e. when the user tries to invoke any application or resources and so on. The resource triggered event is an event that may be a result of any fault occurred in the system. A user can access the system applications 102 using the User Interface (UI) module 101. The UI 101 may be a keypad and/or touch screen or any such module that permits the user to communicate with the system.

[0017] The ECMM 103 receives events generated by various resources 102 in the system. In certain cases, the ECMM 103 may receive only one event in a set time period / time cycle. In this case, the ECMM 103 can directly process the received event at expiry of the set time period / time cycle. In some other cases, the ECMM 103 may receive multiple events from multiple resources in a single time cycle. In this case, the ECMM 103 checks priority of the received events and selects event with highest priority for processing first. Other events with less priority may be processed in following time cycles. These events can also be omitted if they become obsolete.

[0018] This mechanism helps to make sure that most important event is processed first. Further it also helps to maintain system stability by avoiding random processing of received events.

[0019] FIG. 2 illustrates a block diagram that shows various components of proposed Event Correlation Management Module (ECMM), as disclosed in the embodiments herein. The ECMM 103 comprises an Event Collector Module (ECM) 201 , Event Database (ED) 202, Event handler (EH) 203 and a processing module 204. The ECM 201 collects/receives events from various resources present in the system. The ECM 201 may be connected to the system resources through wired/wireless connection. Each event may represent system condition and may also indicate what step is to be taken to overcome any issue being represented by that event. Further, the events received from various sources may be of different formats. In order to process the received events, the ECS 101 initially converts the received events to a common format. In an embodiment, the common format to which the events are converted may be pre-set during initial configuration of the system. Example for the common format may be normal message type, shared memory format and so on.

[0020] The events which are in the common format are then sent to the ED 202 from the ECM 201. ED 202 is a database where the events in common format are stored/kept for further processing. Further, the ED 202 processes the received events and fetches information such as priority, time, source of generation and so on, specific to each event. In an embodiment, the ED 202 may obtain the event specific information by analyzing signature/properties of each event. In another embodiment, the ED 202 may maintain a database/Look Up Table (LUT) that maps event type against corresponding priority value. The ED 202 can refer to this LUT to identify priority of any received event. The priority value for each event type also may be assigned by an authorized person such as an administrator, at the time of configuring the system for the first time.

[0021 ] Once the event specific information is fetched from the received events by the ED 202, the EH 203 fetches events from the ED 202 for further processing. In an embodiment, incase of occurrence of multiple events in a time cycle, the system consider priority of the events such that the event with highest priority value is selected for processing in that time cycle. The event with less priority may not be considered for processing in the same time cycle and may be processed in any of the successive time cycles. In the processing stage, the EH 203 tries to correlate events to identify root cause of issue or source of the problem. Further, by analyzing the event, the EH 203 decides corresponding action to be taken.

[0022] Further, the EH 203 instructs the processing module 204 to take necessary action as per the decided solution. In an embodiment, the processing module 204 may comprise a software program that can receive commands from the EH 203 and can issue command to the corresponding resource. For example, if the EH 203 instructs to shutdown a particular resource, the processing module 204 may issue command (s) to shutdown that particular resource.

[0023] FIG. 3 is a flow diagram which shows various steps involved in the process of correlating events, as disclosed in the embodiments herein. The ECM 201 in the system receives (301) events from associated resources. The system maintains a correlation timer with a set time period. The ECM 201 uses the time period in the correlation timer as time cycles to receive events from associated resources. That means, every time, the ECM 201 waits for particular time cycles (equal to set time period in the correlation timer) to receive events. The ECM 201 checks (302) if the correlation timer has expired or not. If the correlation timer has not expired, the ECM 201 continues to receive events from resources, if any.

[0024] Once the timer expires, the system checks (303) if correlation is required or not. In an embodiment, correlation may be required only if multiple events are received in a single time cycle. If correlation is not required, then the ECM 201 converts the event into a common format that can be recognized by the system. This is because, events from different resources may be in different formats and the system may require converting the received events to a common format to process them further. Once the event is converted to the common format, then it is stored in ED 202. Later, from the ED 202, the EH 203 fetches the event for further processing.

[0025] If correlation is required i.e. if the ECM 201 received multiple events in a single time cycle, then the ECM initially converts (304.b) the received events to a common format. The common format to which the events are converted may be pre-set by an authorized person such as an administrator, at the time of initial configuration of the system. Further, the events in common format are stored in an Event Database (ED) 202. The ED 202 then analyzes each of the stored events and collects (305) event specific parameters such as priority, time, source of generation and so on. In an embodiment, the ED 202 may analyze signature and/or properties of the received event to collect event specific parameters. In another embodiment, the ED 202 may maintain a database/Look Up Table (LUT) that maps event type against corresponding priority value.

[0026] Further, the Event Handler (EH) 203 fetches the event from the ED 202. In an embodiment, as per proposed correlation mechanism, the ED 203 fetches/selects (306) only high priority event for further processing and drops the less priority event (s) temporarily for processing in a later stage i.e. after processing the high priority event. For example, the EH 203 may consider the less priority event in next time cycle for processing. If the system receives another high priority event in next time cycle, it will process the received high priority event in that cycle and may consider the less priority event in next time cycle and so on.

[0027] Once the EH 203 select the event from the ED 202, next step is processing (307) of the selected event. In this step, the EH 203 tries to identify root cause of the issue or source of problem which created the event. Upon identifying source of the problem, the EH 203 instructs (308) the processing module 204 on what action is to be taken corresponding to the received event. Further, as per instruction received from the EH 203, the processing module 204 issues commands to corresponding resource to perform specific action (s). In an embodiment, the processing module 204 may comprise a software program that can receive instruction from the EH 203 and can issue commands to corresponding resource (s). The various actions in method 300 may be performed in the order presented, in a different order or simultaneously. Further, in some embodiments, some actions listed in FIG. 3 may be omitted.

[0028] FIG. 4 illustrates a block diagram which shows an exemplary implementation of the proposed correlation system, as disclosed in the embodiments herein. In this example, the ECM 201 receives two events i.e. Loss Power (Event 1) and lock (Event 2) from two different resources in a single time cycle. Since Event 1 and Event 2 are from different resources, they may be in different formats. In order to process the events further, the received events have to be converted to a common format which can be recognized by the system. The ECM 201 performs this task. Further, the events are sent to ED 202. ED 202 stores the received events in suitable locations in suitable mode; for example in memory in the form of a list.

[0029] Further the ED 202 collects event specific parameters such as priority, time, source of generation and so on, related to the received events. In an embodiment, the ED 202 may analyze signature or properties associated with each event to collect the event specific parameters.

[0030] Now the EH 203 fetches events from the ED 202 for further processing. In this example, 2 events have occurred in the considered time cycle. So the system has to decide which event is to be processed further. In the proposed correlation mechanism, the system considers priority of the received events to decide which event is to be processed first. Here, Event 1 (Loss Power) has higher priority over Event 2 (Lock). So the EH 203 picks Event 1 from the ED 202 for processing first. Now in the processing stage, the EH 203 tries to find out root cause and source of Event 1.

[0031] Once the root cause and source of Event 1 has been identified, the EH 203 decides what action is to be performed so as to maintain system stability with respect to Event 1. For example, let the action corresponding to Event 1 (Loss power) be Resource Power Off. Now the EH 203 instructs the processing module 204 to perform Resource Power Off. As soon as the processing module 204 receives instruction from the EH 203, it issues a Power Off command to the corresponding resource.

[0032] In this case, the system may consider Event 2 for processing in the next time cycle. If the system receives any other high priority event in the next cycle, the system processes the newly received high priority event first and considers the less priority event in the next time cycle and so on.

[0033] FIG. 5 illustrates a computing environment implementing the application, according to embodiments disclosed herein. As depicted the computing environment comprises at least one processing unit that is equipped with a control unit and an Arithmetic Logic Unit (ALU), a memory, a storage unit, plurality of networking devices, and a plurality Input output (I/O) devices. The processing unit is responsible for processing the instructions of the algorithm. The processing unit receives commands from the control unit in order to perform its processing. Further, any logical and arithmetic operations involved in the execution of the instructions are computed with the help of the ALU.

[0034] The overall computing environment can be composed of multiple homogeneous and/or heterogeneous cores, multiple CPUs of different kinds, special media and other accelerators. The processing unit is responsible for processing the instructions of the algorithm. The processing unit receives commands from the control unit in order to perform its processing. Further, any logical and arithmetic operations involved in the execution of the instructions are computed with the help of the ALU. Further, the plurality of process units may be located on a single chip or over multiple chips.

[0035] The algorithm comprising of instructions and codes required for the implementation are stored in either the memory unit or the storage or both. At the time of execution, the instructions may be fetched from the corresponding memory and/or storage, and executed by the processing unit.

[0036] In case of any hardware implementations various networking devices or external I/O devices may be connected to the computing environment to support the implementation through the networking unit and the I/O device unit.

[0037] The embodiments disclosed herein can be implemented through at least one software program running on at least one hardware device and performing network management functions to control the network elements. The network elements shown in Fig. 1 include blocks which can be at least one of a hardware device, or a combination of hardware device and software module.

[0038] The embodiment disclosed herein specifies a system for correlating events in a system. The mechanism allows correlating events on a priority bases, providing a system thereof. Therefore, it is understood that the scope of the protection is extended to such a program and in addition to a computer readable means having a message therein, such computer readable storage means contain program code means for implementation of one or more steps of the method, when the program runs on a server or mobile device or any suitable programmable device. The method is implemented in a preferred embodiment through or together with a software program written in e.g. Very high speed integrated circuit Hardware Description Language (VHDL) another programming language, or implemented by one or more VHDL or several software modules being executed on at least one hardware device. The hardware device can be any kind of device which can be programmed including e.g. any kind of computer like a server or a personal computer, or the like, or any combination thereof, e.g. one processor and two FPGAs. The device may also include means which could be e.g. hardware means like e.g. an ASIC, or a combination of hardware and software means, e.g. an ASIC and an FPGA, or at least one microprocessor and at least one memory with software modules located therein. Thus, the means are at least one hardware means and/or at least one software means. The method embodiments described herein could be implemented in pure hardware or partly in hardware and partly in software. The device may also include only software means. Alternatively, the invention may be implemented on different hardware devices, e.g. using a plurality of CPUs.

[0039] The foregoing description of the specific embodiments will so fully reveal the general nature of the embodiments herein that others can, by applying current knowledge, readily modify and/or adapt for various applications such specific embodiments without departing from the generic concept, and, therefore, such adaptations and modifications should and are intended to be comprehended within the meaning and range of equivalents of the disclosed embodiments. It is to be understood that the phraseology or terminology employed herein is for the purpose of description and not of limitation. Therefore, while the embodiments herein have been described in terms of preferred embodiments, those skilled in the art will recognize that the embodiments herein can be practiced with modification within the spirit and scope of the claims as described herein.

Claims

What is claimed is:

1) A method for achieving priority based correlation in a system, said method further comprising:

assigning a priority value to received events, on receiving said events from resources, by an Event Correlation Management Module (ECMM);

processing events according to order of priority by said ECMM, if more than one event is present; and

deciding action to be performed corresponding to said processed high priority event by said ECMM.

2) The method as claimed in claim 1 , wherein said received events are transformed to a common format by said ECMM.

3) The method as claimed in claim 2, wherein said common format is pre-set during initial system configuration.

4) The method as claimed in claim 1, wherein said assigning priority further comprises: comparing said received event with a database by said ECMM;

identifying priority value corresponding to said received event by said ECMM; and assigning said identified priority value to said event by said ECMM.

5) The method as claimed in claiml , wherein said assigning priority further comprises: analyzing signature of said received event by said ECMM; and

extracting priority value of said received event from said signature by said ECMM. 6) The method as claimed in claim 1, wherein said event is at least one of a user triggered event and or a resource triggered event. 7) The method as claimed in claim 1 , wherein said events are received from said resources in set time cycles by said ECMM.

8) The method as claimed in claim 1, wherein said decided action corresponding to said processed event is triggered on corresponding resource by said ECMM.

9) A device for achieving priority based correlation, wherein said device comprising: an integrated circuit further comprising at least one processor;

at least one memory having a computer program code within said circuit;

said at least one memory and said computer program code configured to with said at least one processor cause the device to:

assigning a priority value to received events, on receiving said events from resources; processing events according to order of priority, if more than one event is present; and deciding action to be performed corresponding to said processed high priority event. 10) The device, as claimed in claim 9, wherein said device is configured for transforming said received events to a common format.

1 1) The device, as claimed in claim 9, wherein said device is configured for assigning priority by:

comparing said received event with a database;

identifying priority value corresponding to said received event; and

assigning said identified priority value to said event.

12) The device, as claimed in claim 9, wherein said device is configured for assigning priority by:

analyzing signature of said received event; and

extracting priority value of said received event from said signature. 13) The device, as claimed in claim 9, wherein said device is configured for receiving said events from said resources in set time cycles.