Automatic correlation of dynamic system events within computing devices

Patent metadata

Field	Value
Publication number	US-9558196-B2
Application number	US-201514958134-A
Country	US
Kind code	B2
Filing date	Dec 3, 2015
Priority date	Dec 18, 2012
Publication date	Jan 31, 2017
Grant date	Jan 31, 2017

Abstract

Systems and methods are described herein for logging system events within an electronic machine using an event log structured as a collection of tree-like cause and effect graphs. An event to be logged may be received. A new event node may be created within the event log for the received event. One or more existing event nodes within the event log may be identified as having possibly caused the received event. One or more causal links may be created within the event log between the new event node and the one or more identified existing event nodes. The new event node may be stored as an unattached root node in response to not identifying an existing event node that may have caused the received event.

First claim

What is claimed is:

1. A method, comprising:
providing, using one or more computing devices, an event log structured as a collection of tree-like graphs;
receiving, using the one or more computing devices, information regarding a new event to be logged;
creating, using the one or more computing devices, a new event node within the event log for the new event;
identifying, using the one or more computing devices, any existing event nodes within the event log that each represent a respective past event that may have caused the new event;
for each new event identified as possibly caused by an existing event, creating, using the one or more computing devices, a causal link within the event log between the new event node and each of the identified existing event nodes;
for each new event not identified as possibly caused by at least one existing event, storing, using the one or more computing devices, the new event node as an unattached root node in response to not identifying an existing event node representing a past event that may have caused the new event;
determining, using the one or more computing devices, a deletion order of event nodes within the event log according to a last used parameter associated with the event nodes; and
deleting, using the one or more computing devices, event nodes in the determined deletion order.

2. The method of claim 1 , wherein identifying any existing event nodes that each represent a respective past event that may have caused the new event comprises matching a characteristic of the new event node to a characteristic of the existing event nodes.

3. The method of claim 1 , wherein identifying any existing event nodes that each represent a respective past event that may have caused the new event comprises computing a correlation metric between the new event node and the existing event nodes.

4. The method of claim 1 , wherein identifying any existing event nodes that each represent a respective past event that may have caused the new event comprises searching existing event nodes created within a specified time period.

5. The method of claim 1 , further comprising refreshing a last used parameter of each of the identified existing event nodes within the event log when the causal link is created to the new event node.

6. The method of claim 1 , further comprising displaying tree-like relationships among the event nodes within the event log.

7. The method of claim 1 , wherein the correlation metric is a function of at least one of a probability of correlation, a link likelihood, and a graph weight.

8. A system, comprising:
a storage device; and
a processor communicatively coupled to the storage device, wherein the processor executes application code instructions that are stored in the storage device to cause the system to:
receive information regarding a new event to be logged;
create an event node representing the new event within the event log, the event log structured as a collection of tree-like graphs;
identify any existing event nodes within the event log that each represent a respective past event that possibly caused the new event, wherein identifying any existing event nodes that each represent a respective past event that may have caused the new event comprises:
computing a correlation metric between the new event node and the existing event nodes, and
displaying an indication of the correlation metric between the new event node and at least one existing event node identified as representing a past event that possibly caused the new event;

for each new event identified as possibly caused by an existing event, create a causal link within the event log between the new event node and each of the identified existing event nodes;
for each new event not identified as possibly cause by at least one existing event, store the event node as an unattached root node within the event log in a structure comprising a collection of tree-like graphs where links within the graphs represent causal relationships between events represented by linked nodes; and
providing an output of one or more result tree-like graphs in response to a user search for an event represented by an event node linked within the one or more result tree-like graphs.

9. The system of claim 8 , wherein one or more of the links is established where one or more existing event nodes within the event log is identified as possibly having caused the event node by matching a characteristic of the event node to a characteristic of the one or more existing event nodes.

10. The system of claim 8 , wherein one or more of the links is established where one or more existing event nodes within the event log is identified as possibly having caused the event node by searching existing event nodes created within a specified time period.

11. The system of claim 8 , wherein the computing device is further configured to maintain a last used parameter for each of the event nodes within the event log.

12. The system of claim 8 , wherein a last used parameter is associated with the event nodes within the event log for determining a deletion order of event nodes.

13. The system of claim 8 , wherein the computing device is further configured to graphically display tree-like relationships among the event nodes within the event log.

14. The system of claim 8 , wherein the correlation metric is a function of at least one of a probability of correlation, a link likelihood, and a graph weight.

15. A computer program product, comprising:
a non-transitory computer-readable medium having computer-readable program code embodied therein that, when executed by one or more computing machines, perform a method comprising:
providing an event log structured as a collection of tree-like graphs;
receiving information regarding a new event to be logged;
creating a new event node within the event log for the new event;
identifying any existing event nodes within the event log that each represent a respective past event that may have caused the new event, wherein identifying any existing event nodes that each represent a respective past event that may have caused the new event comprises:
computing a correlation metric between the new event node and the existing event nodes, and
displaying an indication of the correlation metric between the new event node and at least one existing event node identified as representing a past event that possibly caused the new event;

for each new event identified as possibly caused by an existing event, creating a causal link within the event log between the new event node and each of the identified existing event nodes; and
for each new event not identified as possibly cause by at least one existing event, storing the new event node as an unattached root node in response to not identifying an existing event node representing a past event that may have caused the new event.

16. The computer program product of claim 15 , wherein identifying any existing event nodes that each represent a respective past event that may have caused the new event comprises matching a characteristic of the new event node to a characteristic of the existing event nodes.

17. The computer program product of claim 15 , wherein identifying any existing event nodes that each represent a respective past event that may have caused the new event comprises searching existing event nodes created within a specified time period.

18. The computer program product of claim 15 , further comprising determining a deletion order of event nodes within the event log according to a last used

Assignees

• Cisco Tech Inc

Inventors

• Johnston Jay Kemper
• White Jr David C
• Dreier Christopher Blayne

Classifications

• G06F40/137

  Hierarchical processing, e.g. outlines · CPC title

• G06F16/2455

  Query execution · CPC title

• G06F16/9027

  Trees · CPC title

• H04L41/0636

  based on a decision tree analysis · CPC title

• G06F16/2246

  Trees, e.g. B+trees · CPC title