Modularity and similarity graphics system with monitoring policy

Patent metadata

Field	Value
Publication number	US-10873508-B2
Application number	US-201715811688-A
Country	US
Kind code	B2
Filing date	Nov 14, 2017
Priority date	Jan 27, 2015
Publication date	Dec 22, 2020
Grant date	Dec 22, 2020

Abstract

A system is provided for clustering events. A first engine is configured to receive message data from a managed infrastructure that includes managed infrastructure physical hardware that supports the flow and processing of information, The at least one engine is configured to determine common characteristics of events and produce clusters of events relating to the failure of errors in the managed infrastructure. Membership in a cluster indicates a common factor of the events that is a failure or an actionable problem in a physical hardware of the managed infrastructure directed to supporting the flow and processing of information. The first engine is configured to create one or more situations that is a collection of one or more events or alerts representative of the actionable problem in the managed infrastructure. A second engine is configured to determine one or more common steps from events and produces clusters relating to events. The second engine determines one or more common characteristics of events and producing clusters of events relating to the failure or errors in the managed infrastructure. A statistical analytical engine is included.

First claim

What is claimed is:

1. A system for clustering a plurality of events, comprising:
a processor, a memory and in input/output controller, the processor configured to provide operation of a first engine, a second engine and an operating system:
a first engine, that is an extraction engine, receives message data from managed infrastructure that includes managed infrastructure physical hardware which supports the flow and processing of information, the first engine creates one or more situations that is a collection of at least one of the plurality of events of the actionable problem in the managed infrastructure;
the second engine coupled to the first engine determining one or more common steps from the one or more events and produces clusters relating to the one or more events;
the operating system being separate from the first engine but coupled to the first engine, to provide at least one of: a textual, and numeric values that when they are similar relative to one or more analyzed monitored events, and it is determined that a collection of events share an attribute, one or more output of clusters is created;
wherein in response to the output of clusters, one or more physical changes are made to the managed infrastructure physical hardware; wherein the textual and numeric values indicate a state of a hardware component of the managed infrastructure;
wherein the system optimizes the plurality of events and alerts for greater accuracy; and
wherein the second engine uses a source address for each of an event of the plurality of events.

2. The system of claim 1 , wherein the system uses graph theory optimize the one or more events and alerts.

3. The system of claim 1 , wherein the system is configured to optimize nodes of a graph.

4. The system of claim 2 where the graph theory is used to provide attributes of events.

5. The system of claim 2 , wherein graph theory is used to represent relationships between managed infrastructure elements.

6. The system of claim 1 , wherein the system is configured to create a graph with an edge and a plurality of nodes.

7. The system of claim 6 , wherein each of a node represents an event and the edge represents if there is a relationship between events.

8. The system of claim 7 , wherein at least one relationship between events is a determination if all of the events arrive at about the same time.

9. The system of claim 7 , wherein at east one relationship between events is a determination if all of the events arrive at about the same time and if the events are coupled to a same IP service.

10. The system of claim 7 , wherein each node can be related to each other node.

11. The system of claim 6 , wherein the edge can be a 1 or a 0 value.

12. The system of claim 11 , wherein the 1 or 0 values is indication of an existence of a relationship.

13. The system of claim 6 , wherein the edge can have a value between 0 and 1.

14. The system of claim 13 , wherein a closer the value is to 0 represents a weaker relationship and the closer the value is to 1 represents a greater relationship.

15. The system of claim 1 , wherein events are used with graph theory to group together events that are similar to each other.

16. The system of claim 1 , wherein graph theory is used to provide that maximal connectivity is utilized.

Assignees

• Moogsoft Inc

Inventors

• Tee Philip
• Harper Robert

Classifications

• H04L41/142 Primary

  using statistical or mathematical methods · CPC title

• H04L41/065 Primary

  involving logical or physical relationship, e.g. grouping and hierarchies · CPC title

• H04L67/01

  Protocols · CPC title

• H04L41/064

  involving time analysis · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title