Statistical pattern correlation of events in cloud deployments using codebook approach

Patent metadata

Field	Value
Publication number	US-10505826-B2
Application number	US-201514844900-A
Country	US
Kind code	B2
Filing date	Sep 3, 2015
Priority date	Sep 26, 2014
Publication date	Dec 10, 2019
Grant date	Dec 10, 2019

Abstract

Correlations between patterns of events generated by various separate components within a cloud deployment are statistically determined. The determinations of the correlations can be based on dependencies between the components as indicated by a system topology graph including the components. The patterns correlated can be patterns of events from event streams generated by monitoring systems that monitor the components. The events in the event streams can represent changes over time in component state, behavior, or problem occurrence. Because the quantity of components within such a cloud deployment can be enormous, the quantity of events generated by the monitoring systems over a significant period of time can be voluminous.

First claim

What is claimed is:

1. A method comprising:
generating, by a computing device, a first sequence of events based on a first set of state information associated with a first software application on a cloud computing infrastructure;
generating, by the computing device, a second sequence of events based on a second set of state information associated with a second software application on the cloud computing infrastructure;
determining, by the computing device, a plurality of correlation coefficients from different alignments of the first sequence of events with the second sequence of events based upon i) entropies derived from probabilities that any code in the first sequence of events and the second sequence of events will be a first value or a second value and ii) a joint entropy of the first sequence of events and the second sequence of events derived from probabilities that pairs of codes will have certain combinations of the first value and the second value;
selecting, by the computing device, one or more particular correlation coefficients from the plurality of correlation coefficients;
storing, by the computing device, the one or more particular correlation coefficients in association with the second set of state information and the first set of state information;
accessing, by the computing device, the one or more particular correlation coefficients to quantify a possible relationship between the second set of state information and the first set of state information; and
provisioning, by an order provisioning module provided by the computing device, computing resources and services of the cloud computing infrastructure based on the possible quantified relationship between the second set of state information and the first set of state information in response to a request from a client device.

2. The method of claim 1 , further comprising:
receiving user input that selects a particular event;
selecting, as the first set of state information, from a plurality of event streams, a particular event stream that contains the particular event;
determining an event type of the particular event, wherein multiple different events having different severity levels possess the event type;
for each particular time unit of a sequence of time units, associating the particular time unit with a primary code value that is based on whether the first set of state information contains an event that both (a) has a timestamp that falls within the particular time unit and (b) has the event type; and
generating the first sequence of events based on primary code values associated with time units in the sequence of time units.

3. The method of claim 2 , further comprising:
for each particular time unit of the sequence of time units, associating the particular time unit with a secondary code value that is based on whether the second sequence of events contains an event that has a timestamp that falls within the particular time unit; and
generating the second sequence of events based on secondary code values associated with time units in the sequence of time units.

4. The method of claim 1 , wherein determining the plurality of correlation coefficients based on different alignments of the first sequence of events with the second sequence of events comprises:
in each iteration of a plurality of iterations, shifting an alignment of the first sequence of events relative to the second sequence of events to cause different aligned pairs of codes from the first and second sequence of events to be formed;
in each iteration of the plurality of iterations, determining the joint entropy based on probabilities of occurrences of different pairs of values in the aligned pairs of codes formed in that iteration; and
in each iteration of the plurality of iterations, generating a separate correlation coefficient based on the joint entropy determined during that iteration.

5. The method of claim 4 , further comprising:
causing display, by the computing device, of the one or more particular correlation coefficients in response to a request to quantify the possible relationship between the second set of state information and the first set of state information;
wherein selecting the one or more particular correlation coefficients from the plurality of correlation coefficients comprises selecting, as a particular correlation coefficient, a maximum correlation coefficient that was generated in the plurality of iterations.

6. The method of claim 1 , further comprising:
selecting, based on a system topology that includes the first software application upon whose monitoring the generation of the first set of state information was based, and from a plurality of components within the system topology, the second software application that has a topological relationship with the first software application; and
selecting, from a plurality of event streams, as the second set of state information, an event stream that was generated based upon a monitoring of the second software application.

7. The method of claim 6 , wherein selecting the second software application comprises:
following, in a directed graph representing the system topology, one or more directed edges from a node representing the primary component to a plurality of other nodes in the directed graph; and
selecting, from among nodes in the directed graph, all particular nodes that can be reached by following the one or more directed edges;
wherein the second software application is a component represented by one of the particular nodes.

8. A system comprising:
one or more processors; and
a memory storing instructions executable by the one or more processors to cause the one or more processors to perform operations comprising:
generating a first sequence of events based on a first set of state information associated with a first software application on a cloud computing infrastructure;
generating a second sequence of events based on a second set of state information associated with a second software application on the cloud computing infrastructure;
determining a plurality of correlation coefficients from different alignments of the first sequence of events with the second sequence of events based upon i) entropies derived from probabilities that any code in the first sequence of events and the second sequence of events will be a first value or a second value and ii) a joint entropy of the first sequence of events and the second sequence of events derived from probabilities that pairs of codes will have certain combinations of the first value and the second value;
selecting one or more particular correlation coefficients from the plurality of correlation coefficients;
storing the one or more particular correlation coefficients in association with the second set of state information and the first set of state information;
accessing the one or more particular correlation coefficients to quantify a possible relationship between the second set of state information and the first set of state information; and
provisioning, by an order provisioning module, computing resources and services of the cloud computing infrastructure based on the possible quantified relationship between the second set of state information and the first set of state information in response to a request from a client device.

9. The system of claim 8 , wherein the operations further comprise:
receiving user input that selects a particular event;
selecting, as the first set of state information, from a plurality of event streams, a particular event stream that contains the particular event;
determining an event type of the particular event, wherein multiple different events having different severity levels possess the event t

Assignees

• Oracle Int Corp

Inventors

• Poola Thyagaraju
• Volchegursky Vladimir
• Goswami Manas
• Bacon Janet Kay
• Karpuram Venkata Ramana

Classifications

• H04L43/045 Primary

  for graphical visualisation of monitoring data · CPC title

• H04L41/22

  comprising specially adapted graphical user interfaces [GUI] · CPC title

• H04L43/067

  using time frame reporting · CPC title

• H04L43/04

  Processing captured monitoring data, e.g. for logfile generation · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title