System for decomposing events from managed infrastructures that includes a reference tool signalizer

Patent metadata

Field	Value
Publication number	US-10891345-B2
Application number	US-201715854091-A
Country	US
Kind code	B2
Filing date	Dec 26, 2017
Priority date	Apr 29, 2013
Publication date	Jan 12, 2021
Grant date	Jan 12, 2021

Abstract

A system is provided for clustering events. At least one engine is configured to receive message data from managed infrastructure that includes managed infrastructure physical hardware that supports the flow and processing of information. The at least one engine is configured to determine common characteristics of events and produce clusters of events relating to the failure of errors in the managed infrastructure. Membership in a cluster indicates a common factor of the events that is a failure or an actionable problem in the physical hardware managed infrastructure directed to supporting the flow and processing of information. The at least one engine is configured to create one or more situations that is a collection of one or more events or alerts representative of the actionable problem in the managed infrastructure. A situation room includes a collaborative interface (UI) for decomposing events from managed infrastructures. In response to the production of the clusters one or more physical changes is made in managed infrastructure hardware. A reference tool provides for a decomposition of events.

First claim

What is claim is:

1. A system for clustering events, comprising:
at least one engine configured to receive message data from managed infrastructure that includes managed infrastructure physical hardware that supports the flow and processing of information, the at least one engine configured to determine common characteristics of events and produce clusters of events relating to the failure of errors in the managed infrastructure, where membership in a cluster indicates a common factor of the events that is a failure or an actionable problem in the physical hardware managed infrastructure directed to supporting the flow and processing of information, the at least one engine is configured to create one or more situations that is a collection of one or more events or alerts representative of the actionable problem in the managed infrastructure, the at least one engine including a processor; a memory; and an input/output controller, a display, a storage device, a software system stored in the memory that directs operation of a relevant engine and an operating system;
the operating system included with the at least one engine and operating to provide at least one of: a textual, and numeric values, and if they are similar relative to the analyzed monitored events, and it is determined that a collection of events share an attribute, one or more output of clusters is created, and in response to production of the clusters one or more physical changes in a managed infrastructure physical hardware is made, membership in a cluster indicates a common factor of the events that is a failure or an actionable problem in the physical hardware managed infrastructure directed to supporting the flow and processing of information;
a situation room with a collaborative interface (UI) for decomposing events from managed infrastructures, in response to the production of the clusters one or more physical changes is made in a managed infrastructure hardware;
a reference tool that provides for a decomposition of events where the reference tool is a signalizer algorithmic decomposition of events implemented in code, the algorithmic decomposition of events being available in one or more files of settings that creates situations in a deterministic way; and
wherein textual and numeric values indicate a state of a hardware component of the managed infrastructure to make a change to a managed infrastructure physical hardware component.

2. The system of claim 1 , wherein the reference tool is modifiable.

3. The system of claim 1 , wherein the reference tool includes one or more filters and determines one or more algorithms to use for a set of events.

4. The system of claim 1 , further comprising:
reference tool recipes, where a recipe is a subset of monitored events that are analyzed using a specific feature detection algorithm.

5. The system of claim 1 , wherein a recipe captures parameters that govern the behavior of a feature detection algorithm.

6. The system of claim 4 , wherein at least a portion of the recipes create situations using qualifying factors.

7. The system of aim 6 , wherein at least a portion of the qualifying factors are selected from one or more of: event filtering; rate calculations, and; flexible similarity comparisons.

8. The system of claim 4 , wherein at least a portion of the reference tool recipes have a deterministic behavior.

9. The system of claim 1 , wherein at least one factor is selected from at least one of: a frequency of an alert; a temporal proximity of an alert; a temporal proximity of an event; a trigger; a creation of a recipe; an editing of a recipe; a determination of which of an alert and is clustered into a situation, and; a determination of which of an event is clustered into a situation.

10. The system of claim 1 , wherein the reference tool is a reference tool signalizer.

11. The system of claim 10 , wherein the reference tool signalizer is a signalizer algorithmic decomposition of events implemented in code.

12. The system of claim 11 , wherein the algorithmic decomposition of events is available in one or more files of settings that creates situations in a deterministic way using recipes.

13. The system of claim 12 , wherein the reference tools are collections of recipes with further settings.

14. The system of claim 13 , wherein the reference tool signalizer includes one or more of: a default configuration, and; configuring a reference tool recipe.

15. The system of claim 14 , where configuration of a reference tool recipe includes one or more of a recipe; creation; editing; duplication; deletion; and matching list items.

16. The system of claim 15 , wherein matching list items includes custom information.

17. The system of claim 1 , wherein the reference tool is configured by editing a default reference tool.

18. The system of claim 1 , wherein a user can edit a reference tool recipe.

19. The system of claim 1 , wherein a user can create a reference tool recipe.

20. The system of claim 1 , wherein a user can create a new reference tool with settings that are the same as an existing reference tool.

21. The system of claim 1 , wherein a user can delete a reference tool.

Assignees

• Moogsoft Inc

Inventors

• Tee Philip

Classifications

• G06F16/906 Primary

  Clustering; Classification · CPC title

• H04L41/0894

  Policy-based network configuration management · CPC title

• H04L41/0893

  Assignment of logical groups to network elements · CPC title

• G06F16/9535 Primary

  Search customisation based on user profiles and personalisation · CPC title

• H04L41/0604 Primary

  using filtering, e.g. reduction of information by using priority, element types, position or time · CPC title