Method and system for clustering event messages and manage event-message clusters

Patent metadata

Field	Value
Publication number	US-11316727-B2
Application number	US-202016827457-A
Country	US
Kind code	B2
Filing date	Mar 23, 2020
Priority date	Jun 24, 2014
Publication date	Apr 26, 2022
Grant date	Apr 26, 2022

Abstract

The current document is directed to methods and systems that process, classify, efficiently store, and display large volumes of event messages generated in modern computing systems. In a disclosed implementation, received event messages are assigned to event-message clusters based on non-parameter tokens identified within the event messages. A parsing function is generated for each cluster that is used to extract data from incoming event messages and to prepare event records from event messages that more efficiently and accessible store event information. The parsing functions also provide an alternative basis for assignment of event messages to clusters. Event types associated with the clusters are used for gathering information from various information sources with which to automatically annotate event messages displayed to system administrators, maintenance personnel, and other users of event messages.

First claim

The invention claimed is:

1. An accumulated-event display system that displays accumulated events, the system comprising:
one or more processors;
one or more memories;
one or more data-storage devices;
a display device; and
computer instructions, stored in one or more of the one or more memories that, when executed by one or more of the one or more processors, control the accumulated-event display system to
to receive a set of accumulated time-stamped events, to each of which event types have been assigned, and store the set of accumulated time-stamped events in one or more of the one or more memories and one or more data-storage devices;
retrieve, from the one or more memories and one or more data-storage devices, a display set of accumulated events having timestamps within a selected time window;
in a first accumulated-event-display mode, display, on the display device, timestamp-ordered representations of the display set of accumulated events, the display scrollable when the events in the display set cannot be displayed simultaneously on the display-device screen; and
in a second accumulated-event-display mode, display, on the display device, representations of the event types assigned to the events within the display set, each event-type representation indicating the number of accumulated events to which the event type is assigned.

2. The accumulated-event display system of claim 1 wherein each event type represents a group of one or more related events.

3. The accumulated-event display system of claim 1 wherein events are issued by event sources within a distributed computer system as event messages and collected into event logs stored as files in data-storage appliances.

4. The accumulated-event display system of claim 1 wherein event types are assigned to events by an event-typing system that clusters events based on distances between metrics computed for events.

5. The accumulated-event display system of claim 4 wherein the event-typing system types events by:
receiving a stream of event messages;
for each received event message,
identifying tokens within the event message,
using regular expressions to identify parameter tokens and non-parameter tokens,
computing a metric for the received event message from the non-parameter tokens,
determining a distance between the metric and the metric associated with each already existing event-type associated event clusters,
selecting the event cluster, if any, for which the determined distance is smallest,
when there are no existing event clusters or when the distance between the metric computed for the received event message and the metric associated with the selected event cluster is greater than or equal to a threshold value, creating a new cluster and adding the received event message to the new cluster, and
when the distance between the metric computed for the received event message and the metric associated with the selected event cluster is less than the threshold value, assigning the event type associated with the selected event cluster to the received event message and adding an event record corresponding to the received event message to the selected cluster.

6. The accumulated-event display system of claim 5 wherein the event-typing system, based on feedback from down-stream analytic systems, merges existing event clusters into a single event cluster and splits existing event clusters into multiple event clusters in order that the set of event clusters represent a partitioning of events into related groups of events.

7. The accumulated-event display system of claim 5 wherein the metric is computed for the received event message by applying multiple functions to the identified non-parameter tokens to produce a feature vector.

8. The accumulated-event display system of claim 7 wherein the distance between the metric computed for the received event message and the metric associated with an already existing event cluster is computed as the number of non-matching feature-vector entries of the feature vectors corresponding to the metric computed for the received event message and the metric associated with an already existing event cluster.

9. The accumulated-event display system of claim 1 wherein the displayed representations of event types are active representations which visually respond to user input.

10. The accumulated-event display system of claim 9 that, in response to an input directed to a particular displayed active representation of an event type,
accesses stored descriptions of information entities associated with event types to select one or more of the stored descriptions of information entities associated with the event type represented by the particular displayed representation, and
displays, on the display screen, an active representation of each of the one or more selected descriptions of information entities, an input to each of which invokes display of a corresponding information entity.

11. The accumulated-event display system of claim 1 wherein, in the second accumulated-event-display mode, the display of the representations of the event types is ordered by the number of accumulated events to which the event types of the display set are assigned.

12. A method that displays accumulated events in a system having one or more processors, one or more memories, one or more data-storage devices, and a display device, the method comprising:
receiving a set of accumulated time-stamped events, to each of which event types have been assigned, and storing the set of accumulated time-stamped events in one or more of the one or more memories and one or more data-storage devices;
displaying, on the display device, timestamp-ordered representations of the accumulated events with timestamps within a selected time window, the display scrollable when the accumulated events with timestamps within the selected time window cannot be displayed simultaneously on the display-device screen; and
when an event-type display mode is selected,
displaying, on the display device, representations of the event types assigned to the accumulated events with timestamps within the selected time window, each event-type representation indicating the number of accumulated events to which the event type is assigned.

13. The method of claim 12 wherein the displayed representations of event types are active representations which visually respond to user input.

14. The method of claim 13 further comprising:
in response to an input directed to a particular displayed active representation of an event type,
accessing stored descriptions of information entities associated with event types to select one or more of the stored descriptions of information entities associated with the event type represented by the particular displayed representation, and
displaying, on the display screen, an active representation of each of the one or more selected descriptions of information entities, an input to each of which invokes display of a corresponding information entity.

15. The method of claim 14 wherein descriptions of information entities associated with event types are stored in an associated-information database that, for each information entity associated with an event type, stores:
an indication of an information source for the information entity;
an indication of the type of information source; and
an indication of the type of information entity.

16. The method of claim 15 wherein types of information sources include:
a remote server that is accessed through a uniform resource locator;
a person or system accessed throu

Assignees

• Vmware Inc

Inventors

• Kushmerick Nicholas
• McLaughlin Matt Roy
• Brown Darren
• Lin Junyuan

Classifications

• H04L67/75

  Indicating network or usage conditions on the user display · CPC title

• H04L67/131

  Protocols for games, networked simulations or virtual reality · CPC title

• H04L41/069

  using logs of notifications; Post-processing of notifications · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• H04L41/22

  comprising specially adapted graphical user interfaces [GUI] · CPC title