Browse Prior Art Database

Enhanced Correlation Results through the Exploitation of Special Event Data Modelling

IP.com Disclosure Number: IPCOM000129039D
Original Publication Date: 2005-Sep-27
Included in the Prior Art Database: 2005-Sep-27
Document File: 4 page(s) / 80K

Publishing Venue

IBM

Abstract

Disclosed is a method for creation and exploitation of a specific correlation model represented through special fields in the Common Base Event (CBE) model in order to enhance and support all types of correlations that can be performed in a system as well as the visualization of correlation results. Our proposition is to create and leverage a CBE special data fields known as "AssociatedEvents". This data fields allow the CBE to be associated through a set of "AssociationEngines" to different sets of CBEs. The main intent of this method is to provide a way to enhance the efficiency of the correlation process and its resulting representation and to allow the visualization of correlation results in a way that could be easily accessed by consumers of event information like operations staff.

This text was extracted from a PDF file.
At least one non-text object (such as an image or picture) has been suppressed.
This is the abbreviated version, containing approximately 38% of the total text.

Page 1 of 4

Enhanced Correlation Results through the Exploitation of Special Event Data Modelling

In a typical event management solution, a variety of event sources produce large amount of event data that is sent to central locations, where the events are managed to determine problems, etc. The intent of the event management solution is to provide information that allow operations staff to manage the customers IT environments in order to keep the systems that support customers' business healthy. The determination of root causes and other type of associations between events is key to the success of the operations staff to quickly turn around problems impacting the IT environment and the critical business processes behind it. As customers' environments may produce large amount of event data that must be prompted analyzed and managed to allow quick problem resolution, the lack of features like correlation and automated actions would impact the overall efficiency of the operations. Without efficient correlation and a good indication of its results, the operations staff would have to analyze large amount of data manually and would be required to have skills that are not usually available for such type of operations.

Usually current event management solutions do not provide efficient mechanisms that could be used to enhance the execution of correlation and the visualization of correlation results. When they do provide such mechanisms, they are not comprehensive enough to cover all the needs required by the various type of correlation and visualization that could be present in a complex system.

The overall solution involved in the invention is described as follows:

WEB Browser WEB Browser

Event

Console

3

3

1. Raw events (e.g., CBEs) coming from event sources are emitted into a event communication infrastructure (e.g., CEI)

Event Infrastructure

Correlation Engine

2

1 1

Event Source

Event Source

1

[This page contains 2 pictures or other non-text objects]

Page 2 of 4

2. These events are then delivered to Correlation Engines (e.g, ACT) which correlate the events together and use the correlation model (AssociatedEvents fields of CBE) to represent the association among these events.
3. This representation is later used by Solutions Consoles (e.g., Event Console) to convey in a visual effective way the type of association resulting from the correlation to the end user operator. It indicates important association between events present in the system and provide a straight forward way to indicate the key events in the system so that operations staff can act quickly on those that are more important.

The AssociatedEvent field is defined as a list of AssociatedEvent.

Every AssociatedEvent is composed by an AssociationEngine and ResultEvents.

Each AssociationEngine defines the type of association between the original CBE and the ResultEvents. It is composed by id, name and type. Some examples of type of association are:
* Contain / Multi-part
* Cleared by /Clearin...