Method and apparatus for event correlation based on causality equivalence

Patent metadata

Field	Value
Publication number	US-9053000-B1
Application number	US-201213628706-A
Country	US
Kind code	B1
Filing date	Sep 27, 2012
Priority date	Sep 27, 2012
Publication date	Jun 9, 2015
Grant date	Jun 9, 2015

Abstract

Methods and apparatus to provide event correlation based on causality equivalence. In one embodiment, a raw notification and a causality notification are generated for a raw event. The causality notification corresponds to a causality equivalence class in a plurality of causality equivalence classes.

First claim

What is claimed is:

1. A method, comprising:
receiving a raw event;
generating, using a computer processor, a raw notification and a causality notification for the raw event;
mapping the raw event to the causality notification which corresponds to a causality equivalence class in a plurality of causality equivalence classes;
creating a name for the causality notification including a type, instance, and event;
creating a two-way relationship between the raw notification and the causality notification;
updating a status attribute of a topology object corresponding to the raw event;
examining the causality notification to identify other related causality notifications;
updating a relationship of the causality notification to the other related causality notifications; and
retrieving a causality notification based on the name of the causality notification.

2. The method according to the claim 1 , further including using a hash map to lookup the object corresponding to the raw event.

3. The method according to claim 2 , wherein the hash map looks up the object by name.

4. The method according to claim 1 , wherein raw event is generated by a blade.

5. The method according to claim 4 , wherein the plurality of causality equivalence classes for the blade includes down and unreachable.

6. The method according to claim 1 , wherein the name of the causality notification includes names for type, instance, and event.

7. The method according to claim 1 , further including retrieving the causality notifications by time stamp.

8. A system, comprising;
a notification manager to manage a raw notification for a raw event and a causality notification for the raw event, wherein the causality notification corresponds to a causality equivalence class in a plurality of causality equivalence classes;
correlation engine for maintaining a status of topology objects and for computing relationships among notifications generated on the state of the topology objects;
an event processor to generate from the raw event the raw notification and the causality notification and to update the status of the topology objects in the correlation engine; and
a causality processor to retrieve further causality notifications caused by the causality notification generated by the raw event and to update causality relationships between the further causality notifications and the causality notification generated by the raw event.

9. The system according to claim 8 , wherein the notification manager includes a hash map to look up the raw notification and the causality notification.

10. The system according to claim 9 , wherein the hash map looks up the object by name.

11. The system according to claim 8 , wherein raw event is generated by a blade.

12. The system according to claim 11 , wherein the plurality of causality equivalence classes for the blade includes down and unreachable.

13. The system according to claim 8 , wherein the name of the causality notification includes names for type, instance, and event.

14. An article, comprising:
a non-transitory computer-readable medium comprising stored instructions that enable a machine to perform:
receiving a raw event;
generating, using a computer processor, a raw notification and a causality notification for the raw event;
mapping the raw event to the causality notification which corresponds to a causality equivalence class in a plurality of causality equivalence classes;
creating a name for the causality notification including a type, instance, and event;
creating a two-way relationship between the raw notification and the causality notification;
updating a status attribute of a topology object corresponding to the raw event;
examining the causality notification to identify other related causality notifications;
updating a relationship of the causality notification to the other related causality notifications; and
retrieving a causality notification based on the name of the causality notification.

15. The article according to claim 14 , further including instructions for using a hash map to lookup the object corresponding to the raw event.

16. The article according to claim 14 , wherein raw event is generated by a blade.

17. The article according to claim 16 , wherein the plurality of causality equivalence classes for the blade includes down and unreachable.

18. The article according to claim 14 , wherein the name of the causality notification includes names for type, instance, and event.

19. The article according to claim 14 , further including instructions for retrieving the causality notifications by time stamp.

Assignees

• Emc Corp

Inventors

• Lam Cheuk
• Singh Sathyanarayana
• Patil Prasanna S
• Ou Chao-Wei
• Moran David W
• Song Steve J

Classifications

• G06F11/006 Primary

  Identification (G06F11/2289 takes precedence) · CPC title

• G06F11/079 Primary

  Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36) · CPC title

• G06F11/0709

  in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems · CPC title