Patent Grant
7757120
The present invention relates generally to self-healing systems. More specifically, the invention relates to a method of ignoring redundant symptoms in self-healing systems which use a correlation engine and an analysis engine to diagnose and resolve fault conditions within the system.
Autonomic computing systems, also known as self-healing systems, are computing systems which incorporate knowledge about how to diagnose and repair faults occurring within themselves. In many such systems, this knowledge may consist of rules which define a variety of observable phenomena within the system. For each such observable phenomenon which is deemed harmful, the rules may further prescribe a specific corrective action. Autonomic systems may also incorporate non-rule-based techniques, including probabilistic algorithms and artificial intelligence.
Self-healing ability is beneficial for many reasons. It is frequently impractical for humans to monitor manually a system at all hours. Even when the resources exist to do so, human involvement inherently incurs the risk of human error. Moreover, some systems are so complex that no single human being understands every part of the system sufficiently to be able to correct all possible fault conditions. By contrast, self-healing methods may detect and correct faults over arbitrarily large systems.
Many autonomic computing systems known in the art incorporate two primary components: a correlation engine and an analysis engine. The correlation engine receives a stream of events, each representing an observable phenomenon which recently occurred within the system. For example, the failure of an attempt to connect to a database may constitute an event. A single event may independently represent a fault condition requiring corrective action. More frequently, however, a fault condition is detected based on multiple related events. Thus, the correlation engine may apply rules to correlate events into sets of events which, as a group, may represent a fault condition. Such sets are known in the art as “correlated event sets.” It is noted that a correlated event set need not represent a fault condition with certainty. For example, the correlated event set may represent a substantial probability of a fault, with further analysis required to positively determine whether or not a fault has occurred. Thus, when a correlated event set is determined, the correlation engine forwards it to the analysis engine.
The analysis engine determines which corrective action, if any, should be taken in response to the correlated event set provided by the correlation engine. For example, in response to a correlated event set specifying that a database connection failed, the analysis engine may determine that the database crashed. It may, as a result, restart the database server.
In modular self-healing systems, the correlation engine and analysis engine are typically independent of each other. Each engine typically does not have any knowledge about the workings of the other engine. Furthermore, the two engines typically have limited communication with each other.
Thus, one exemplary aspect of the present invention is a self-healing system. The system includes an event bus configured to transmit events in the self-healing system. A correlation engine is coupled to the event bus and is configured to correlate events transmitted on the event bus into a correlated event set. The correlated event set indicates a possible fault condition in the system. The correlation engine is further configured to evaluate a plurality of correlation rules that arranged in a hierarchal rule structure to correlate the events.
An analysis engine is also coupled to the event bus and is configured to perform analysis on the correlated event set, determine at least one corrective action to be performed in response to the correlated event set, and send a deactivate event to the correlation engine upon initiation of the corrective action. The deactivate event includes the correlated event set. The correlation engine is further configured to deactivate all correlation rules within the hierarchal rule structure that are used to generate only the correlated event set until one or more reactivation events are received by the correlation engine.
Another exemplary aspect of the invention is method for processing events in a computer system. The method includes a receiving operation for receiving at least one system event. The system event may indicate a possible fault condition in the system and the method uses a hierarchal rule structure to generate a correlated event set. A determining operation determines at least one corrective action to be performed in response to the correlated event set. A deactivating operation deactivates all correlation rules within the hierarchal rule structure that are only used to generate the correlated event set.
Yet a further exemplary embodiment of the invention is a computer program product for processing events in a computer system. The computer program product includes computer usable program code configured to receive at least one system event, utilize a hierarchal rule structure to generate a correlated event set, determine at least one corrective action to be performed in response to the correlated event set, and deactivate all correlation rules within the hierarchal rule structure that are only used to generate the correlated event set.
As will be appreciated by one skilled in the art, the present invention may be embodied as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a “circuit,” “module” or “system.”
Furthermore, the present invention may take the form of a computer program product on a computer-usable storage medium having computer-usable program code embodied in the medium.
Any suitable computer usable or computer readable medium may be utilized. The computer-usable or computer-readable medium may be, for example but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, device, or propagation medium. More specific examples (a non-exhaustive list) of the computer-readable medium would include the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a transmission media such as those supporting the Internet or an intranet, or a magnetic storage device. Note that the computer-usable or computer-readable medium could even be paper or another suitable medium upon which the program is printed, as the program can be electronically captured, via, for instance, optical scanning of the paper or other medium, then compiled, interpreted, or otherwise processed in a suitable manner, if necessary, and then stored in a computer memory. In the context of this document, a computer-usable or computer-readable medium may be any medium that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. The computer-usable medium may include a propagated data signal with the computer-usable program code embodied therewith, either in baseband or as part of a carrier wave. The computer usable program code may be transmitted using any appropriate medium, including but not limited to the Internet, wireline, optical fiber cable, RF, etc.
Computer program code for carrying out operations of the present invention may be written in an object oriented programming language such as Java, Smalltalk, C++ or the like. However, the computer program code for carrying out operations of the present invention may also be written in conventional procedural programming languages, such as the “C” programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider).
The present invention is described below with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function/act specified in the flowchart and/or block diagram block or blocks.
The computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.
The following description details how the present invention is employed to ignore redundant symptoms in modular self-healing systems. Concepts of the invention are illustratively described in a self-healing system architecture that uses a correlation engine and an analysis engine to diagnose and resolve fault conditions within the system. Nevertheless, it is understood that the inventive concepts described herein may be applied in other system architectures. Throughout the description of the invention reference is made to
The components 104, 106, 108 of the self-healing system 102 may, from time to time, report data about their state. They may do so by sending information to “listeners”, components which monitor the state of other system components. Additionally, a listener may request state data from another component. In an embodiment of the present invention, listeners are implemented as web services. When the state data represents a noteworthy phenomenon, an event 110 may be transmitted via an event bus 112. In one embodiment of the present invention, the event 110 is transmitted directly to a correlation engine 114.
In an embodiment of the present invention, events are processed using the Common Event Infrastructure (CEI) developed by International Business Machines Corporation located in Armonk, N.Y. The CEI is an implementation of a consistent, unified set of application protocol interfaces (APIs) and infrastructure for the creation, transmission, persistence and distribution of a wide range of business, system and network events. Events 110 may be implemented as Common Base Events, the core element of the CEI. In a further embodiment of the present invention, Generic Log Adapters, a feature of the CEI, may be used to convert log files generated by the listener web services into Common Base Events.
The correlation engine 114 may receive events 110 by listening to an event bus 112. The correlation engine 114 may utilize rule-based algorithms to correlate the incoming events into sets of events which, as a group, may represent a possible fault condition. These sets of events are referred to herein as a correlated event set 122. In one embodiment of the invention, correlation rules 117 utilized by the correlation engine 114 are stored in a knowledge base 115 in eXtensible Markup Language (XML) form. The correlation rules 117 are loaded by the correlation engine 114 and converted into internal data structures.
As discussed in more detail below, the correlation rules 117 can describe a complex sequence of events. For example, the correlation rules 117 may report two events occurring in sequence within a given time cap between them. In addition, correlation rules may feed other correlation rules to create a hierarchal rule structure.
The analysis engine 116 receives correlated event sets 122 (directly or indirectly) from the correlation engine 114 by listening to the event bus 112. It is noted that an analysis engine may be referred to in the art as a symptom service. It is emphasized that the analysis engine 116 is typically unaware of the implementation details of the correlation engine 114. For example, the analysis engine 116 may be unaware of what rules were responsible for generating the correlated event set 122.
The analysis engine 116 may incorporate logic to analyze the correlated event set 122. Such logic may be stored in the knowledge base 115 and accessed by the analysis engine 116 by looking up the correlated event set. The analysis engine 116 may use any other mode of analysis to determine the implications of the correlated event set 122. For example, the analysis engine 116 may utilize embedded knowledge to determine whether or not the correlated event set indicates a fault condition.
The analysis engine 116 typically identifies one or more corrective actions to be taken to attempt to correct the fault condition. The analysis engine 116 may also consult a policy engine 118 to determine whether a given fault should be corrected. The policy engine 118 may be part of the analysis engine, may be located elsewhere in the self-healing system 102 or may be external to the system entirely. It is noted that the analysis engine 116 may not take any corrective action in response to the fault condition.
Consider, for example, a website which, because of a failure, becomes unavailable at 3 AM. A correlated event set is transmitted to the analysis engine 116 by the correlation engine 114 to advise it of the downtime. However, the policy engine 118 determines that the website is not required to be available between 1 AM and 5 AM. Such a business rule may be due to scheduled downtime or may simply reflect the fact that corrective action is not worth the resources required to make the website available at such hours. Even though the analysis engine 116 determines that the website has a fault, it takes no corrective action due to the policy.
If the correlated event set 122 is determined to represent a fault condition, and if it is not contrary to policy to correct the fault condition, the identified corrective action(s) to correct the fault condition are initiated by the analysis engine 116. In an embodiment of the present invention, the analysis engine 116 itself effects the corrective actions. In another embodiment of the present invention, the analysis engine 116 passes the corrective actions to another system component, such as an autonomic manager 120, which in turn effects the corrective actions.
It is emphasized that a corrective action may not, and may not be expected to, immediately resolve the fault condition. For example, if it is determined that a server must be rebooted, the reboot process may take several seconds or even minutes. Also, a corrective action may involve modifying a configuration setting by a fixed amount or percentage, waiting to see if the fault condition still exists, and iteratively repeating such modification until the fault condition is resolved. In such cases, a time lag after the corrective action may be inherently necessary to evaluate whether the fault condition was in fact resolved.
During any gap in time between commencing a corrective action and successfully resolving the fault condition, incoming events signifying the problem may still be present. Thus, the correlation engine 114 may still continue to process the incoming events and report the correlated event set being resolved by the analysis engine 116. Because the correlated event set may be reported multiple times per second, and because the time required to correct the fault condition may be substantial, it is possible in practice for a correlated event set representing a single fault condition to be repeated thousands of times.
To prevent this behavior, when the analysis engine 116 begins responding to a correlated event set 122, it may send a request to discontinue reporting that correlated event set until further notice by sending a deactivation event 124 to the correlation engine 114. The deactivation event 124 may include the correlated event set 122 in its entirety. It may also incorporate the correlated event set 122 by reference, such as by specifying a unique identifier. In an embodiment of the present invention, this request is a Common Base Event as defined by the Common Event Infrastructure.
The correlation engine 114 receives the deactivation event 124. It may respond by performing internal configuration measures to block the reporting of the correlated event set 122 referred to by the deactivation event 124. In a rule-based correlation engine 114, these measures may include deactivating the rules that directly drive the correlated event set. As used herein, deactivated rules are rules that are not evaluated by the correlation engine 114. The measures may furthermore include deactivating any rules which, while not directly triggering the correlated event set 122, can have no indirect effect other than to trigger the correlated event set 122. Repeated instances of the same fault condition are not unnecessarily processed by the correlation engine 114.
A new rule called, for example, “Ractivate”, may be created. In an embodiment of the present invention, the rule is created by the correlation engine 114 itself. In another embodiment of the present invention, the rule is created by a bridge class that connects the correlation engine 114 to another module in the system 102, such as the analysis engine 116 or the autonomic manager 120. When invoked by one or more reactivation events, the rule “Ractivate” causes the deactivated rules related to this correlated event set to return to their active state. As used herein, active rules are rules that are evaluated by the correlation engine 114.
In a particular embodiment of the invention, the analysis engine 116 is configured to send a reactivation event set 126 to the correlation engine (either directly or indirectly). The reactivation event set 126 indicates one or more events required to be received by the correlation engine 114 in order to reactivate the deactivated correlation rules. When the correlation engine 114 receives this set of events, the rule Ractivate is triggered, causing the rules deactivated as described above to be reactivated. Thus, if a distinct instance of the same fault condition occurs, it will be received as a separate fault and corrected again.
The exemplary autonomic system incorporates an application server 104. The application server 104 may become unavailable for a variety of reasons. One possibility is that the server 104 may have crashed, requiring a reboot in order to operate again. Another possibility is that the application server 104 is working properly, but a network connection failure prevents contacting the application server 104. It is emphasized that because there are multiple possible causes, unavailability of the application server 104 in and of itself is insufficient to diagnose the problem. If the application server 104 becomes unavailable, an event “A” 212 may be sent to the correlation engine 114. A match rule “R1” 202 is triggered if and only if event A 212 has been observed.
The exemplary autonomic system is also connected to a network. The network device 106 may become unavailable, again for a variety of reasons. Most networks incorporate methods to confirm the availability of the network itself, independently of any individual system accessible via the network. If usage of such a method yields a determination that the network connection is unavailable, an event “N” 214 is sent to the correlation engine 114. Another match rule, “R2” 204, is triggered if and only if event N has been observed.
The application server 104 and the network device 106 both being unavailable leads to the inference that the network connection to the application server 104 is broken. Therefore, passthrough rule “R3” 206 is triggered if and only if both rule R1202 and rule R2204 are triggered. Being a passthrough rule, rule R3 packages events A 212 and N 214 into a correlated event set 210. The correlation engine 114 forwards this correlated event set 210 to the analysis engine via an event.
The analysis engine receives the correlated event set 210 containing the events {A, N}. Upon determining the most likely cause of the system fault, it commences a corrective action by, for example, resetting the network connection to the application server. Once a corrective action is initiated for the correlated event set 210, the analysis engine does not need to see further repetitions of the correlated event set 210. However, the analysis engine cannot itself disable the correlated event set 210 because it is unaware of the artifacts used by the correlation engine 114 to correlate incoming events. Instead, the analysis engine sends a deactivation event 216 to the correlation engine 114. The deactivation event 216 contains the correlated event set {A, N}. It also specifies a second event, “Z”, which when transmitted will signal that the fault condition indicated by the correlated event set has been resolved.
The correlation engine 114 responds to the deactivation event 216 by deactivating all correlation rules within the hierarchal rule structure that are only used to generate the correlated event set {A, N}. Deactivating a rule may be effected by any method which causes that rule not to be processed. Rule R3206 directly drives the correlated event set. Therefore, the correlation engine deactivates rule R3. Rule R1202 is also only used to generate the correlated event set {A, N}, because the only rule it influences is being ignored. Therefore, the correlation engine also deactivates rule R1202. Similarly, rule R2204 is only used to generate the correlated event set {A, N}, because it too can only influence a deactivated rule. Therefore, the correlation engine 114 also deactivates rule R2204. Rules R1202, R2204 and R3206 are deactivated by this process. As a result, the correlated event set will not be redundantly reported and rules solely devoted to generating the correlated event set will not be unnecessarily evaluated at the correlation engine 114.
In an embodiment of the present invention, generation of events which trigger only deactivated rules are disabled entirely. The correlation engine 114 is therefore configured to disable transmission of a component event from the system component 104, 106 upon a determination that the component event is only processed by disabled rules. In this example, transmission of event A 212 would be disabled because it can only influence the deactivated rule R1202. Likewise, transmission of event N 214 would be ceased because it can only influence the deactivated rule R2204.
The correlation engine 114 also creates an activation rule “R4” 208. Rule R4 awaits for the specified event Z, triggering if and only if that event is observed. When triggered, Rule R4 is programmed to reactivate the deactivated rules R1202, R2204 and R3206. If the events A 212 and N 214 are disabled as described above, they too resume being transmitted. It is noted that event set {Z} represents a simple reactivation event set. The reactivation event set indicates one or more reactivation events required to be received by the correlation engine to reactivate the deactivated correlation rules.
In one embodiment of the invention, the events defined in the reactivation event set originate from system components, such as the application server 104 and the network device 106. In another embodiment of the invention, when the network connection has been successfully restored, the analysis engine sends event Z to the correlation engine 114. This causes rule R4 to become True. As a result, rules R1202, R2204 and R3206 and possibly the events A and N are reactivated. Thus, if the network connection to the application server fails again, the new, separate fault condition will again be reported as a correlated event set.
Turning now to
The database 108 and the network device 106 both being unavailable leads to the inference that the network connection to the database 108 is broken. Therefore, passthrough rule “R6” 306 is triggered if and only if both rule R2204 and rule R5304 are triggered. Being a passthrough rule, rule R6306 packages events N 214 and D 302 into a correlated event set. It transmits this correlated event set directly or indirectly to the analysis engine via an event 308.
Consider again the original example in which the application server 104 is unavailable due to a network connection failure. As before, the correlation engine 114 determines the correlated event set {A, N} and transmits it to the analysis engine. The analysis engine again receives this correlated event set and commences the appropriate corrective action. As before, it sends an event 216 to the correlation engine 114, containing the correlated event set {A, N} and specifying the reactivating event set {Z} that will indicate successful restarting of the network connection.
The correlation engine 114 again responds to the event 216 by deactivating the rules which drive the correlated event set {A, N}. As before, it deactivates rule R3206 because it directly drives this correlated event set. Rule R1202 still has no other possible effect, because the only rule it influences is still being ignored. Therefore, the correlation engine again deactivates rule R1202. However, rule R2204 now drives not only the deactivated rule R3206 but also the active rule R6306. Deactivating rule R2204 would be harmful because it would prevent rule R6306 from being triggered, thus preventing database unavailability due to a network connection failure from being recognized and from being reported as the correlated event set {N, D}. Therefore, the correlation engine 114 does not deactivate rule R2204. Only rules R1202 and R3206 are deactivated by this process.
The correlation engine 114 again creates an activation rule “R4” 208. Rule R4 awaits the specified reactivation event set {Z}, triggering if and only if that event is observed. When triggered, rule R4208 is programmed to reactivate the deactivated rules, which this time comprise only rules R1202 and R3206. Rule R4208 may contain a list of those rules which were actually deactivated as a result of the deactivation event 216. Such a list facilitates rapid reactivation of the appropriate rules.
Turning now to
At monitoring operation 402, the system monitors multiple sources of data in order to maintain an awareness of the system state. When a noteworthy phenomenon is observed, it is reported as an event. It is contemplated that the failure of a component to report state data as expected and/or to respond to a request for state data (e.g., a “ping” request) may cause a listener to emit an event indicating that component is unavailable. In an embodiment of the present invention, the event is a Common Base Event as defined in the Common Event Infrastructure. After an event is generated during monitoring operation 402, flow passes to receiving operation 404.
At receiving operation 404, the observed event is received by the correlation engine 114. In one embodiment of the invention, the event is transmitted to the autonomic manager, which in turn retransmits the event to the correlation engine. This retransmission may be accomplished, for example, via a bridge class. It is emphasized that a wide variety of techniques may be used to report system state information to the correlation engine without departing from the scope and spirit of the present invention. After receiving operation 404 is completed, control passes to correlating operation 406.
At correlating operation 406, the correlation engine processes the incoming event using rule-based algorithms to correlate the incoming events into sets of events which, as a group, may represent a possible fault condition, as discussed above. The correlation engine may use other algorithms and/or methods known to those skilled in the art to correlate incoming events. Sets of events correlated (regardless of the algorithms used for correlation) are known in the art as “correlated event sets.” After correlating operation 406 is completed, control passes to determining operation 408.
At determining operation 408, the correlation engine determines whether an end rule has been triggered. Recall that an end rule is any rule which determines that a potential problem exists and thus sends a correlated event set describing that problem. It is noted that a correlated event set may consist of only a single event. It is further noted that the correlation engine need not be absolutely certain that a given set of concurrently observed events represent a fault condition to package those events into a correlated event set. For example, if events “A”, “B” and “C” observed concurrently give rise to the substantial probability but not the certainty of a fault condition, the correlation engine may deem {A, B, C} to be a correlated event set. If no end rule is triggered, the correlation engine has finished processing the current event. The correlation engine may wait for further events in this case.
If an end rule was triggered, processing continues with transmitting operation 410. At transmitting operation 410, the correlation engine forwards the correlated event set “S” to the appropriate party. The correlation engine may accomplish this goal by encapsulating the correlated event set “S” within an event (such as a Common Base Event) and placing the event on an event bus. Alternatively, the event may incorporate the correlated event set by reference using a unique identifier.
In one embodiment of the present invention, the correlation engine transmits an event encapsulating a correlated event set either to an autonomic manager or to a bridge class which connects to an autonomic manager. The autonomic manager then forwards the correlated event set to the analysis engine. It is contemplated that the correlated event set “S” will ultimately arrive at the analysis engine, regardless of any intermediate steps required or deemed appropriate in the context of a given autonomic system. After transmitting operation 410 is completed, control passes to analyzing operation 412.
At analyzing operation 412, the analysis engine receives the correlated event set “S”. It analyzes “S” in an attempt to determine whether it represents a fault condition. If so, it determines an appropriate corrective action for that fault condition. The analysis engine may look up “S” in a knowledge base in order to perform the analysis. Such a knowledge base may be either internal or external to the analysis engine. The analysis engine may use any other method suitable for analyzing the correlated event set. The analysis engine may additionally consult a policy engine to ascertain whether it is necessary and appropriate to resolve the given fault condition. After analyzing operation 412 is completed, process flow continues to determining operation 414.
At determining operation 414, the analysis engine determines whether a fault condition must be corrected. If the correlated event set “S” does not indicate a fault condition, the analysis engine has finished processing the correlated event set. Likewise, if a fault condition was found but the policy engine determined that it is unnecessary or inappropriate to resolve that condition, the analysis engine has finished processing the correlated event set. In this case, the analysis engine may wait for further correlated event sets.
In another embodiment of the invention, the analysis engine is configured to notify the correlation engine of at least one target event which, if detected by the correlation engine, increases the likelihood of a fault condition in the system. In this scenario, the analysis engine determines, at determining operation 420 that a system fault is likely to occur given the events contained in the correlated event set, but no corrective action is needed yet. To help efficiently deal with the system fault if it should occur, the analysis engine sends a request to the correlation engine containing one or more target events that would trigger the expected corrective action.
The correlation engine, at rearranging operation 422, searches for rules in the hierarchal rule structure that will produce the target events and trigger the expected corrective action. The correlation engine is rearranges the hierarchal rule structure such that a target rule set of one or more target rules for evaluating the target event is given processing priority. For example, the order in which rules are iteratively evaluated at the correlation engine may be modified so that the target rules are evaluated first. Other methods known in the art for prioritizing rules may be utilized by the present invention.
If, on the other hand, corrective action is necessary, processing continues with returning operation 416. The analysis engine returns the correlated event set “S”, a fix “F” which is intended to resolve the fault condition, and an event “Efix” which will indicate that the fault condition is resolved. The analysis engine may package this data into an event and send the event to an autonomic manager. The autonomic manager may then provide the correlated event set “S” and the event “Efix” to the correlation engine for processing according to the flowchart shown in
At resolving operation 418, the fix “F” is applied in order to attempt to resolve the fault condition. The autonomic manager may apply the fix. Alternatively, any other system component deemed appropriate to the task may apply the fix. It is contemplated that step 418 may be performed concurrently, or approximately concurrently, with forwarding the correlated event set “S” back to the correlation engine for deactivation.
Turning now to
At receiving operation 502, the correlation engine receives a correlated event set “S” which the analysis engine does not wish to see again until further notice. To comply with this wish, the correlation engine deactivates the rules driving S. The correlation engine determines which end rules cause S to be transmitted. Each such rule is added to a set, called “C”. It is noted that only rules which directly result in S (and only in ‘S’) are included in C. The set C is added to a stack which presently contains no other elements. Furthermore, a list of deactivated rules, “L”, is created with no elements. Other initialization operations may be performed as required by a given embodiment of the present invention.
At determining operation 504, the correlation engine determines if any elements remain on the stack. If not, processing proceeds to adding operation 522, which will finalize the algorithm. If at least one element remains, processing continues with popping operation 506. It is noted that the loop beginning with popping operation 506 will execute at least once, as receiving operation 502 initializes the stack with one element.
At popping operation 506, an element is popped from the stack. This element shall be referred to as C for the remainder of the loop. It is noted that elements of the stack represent sets of rules. After popping operation 506 is completed, control passes to determining operation 508.
At determining operation 508, the correlation engine determines whether any rules remain in C. If no rules remain, processing returns to determining operation 504.
If at least one rule remains in C, at selecting operation 510, the correlation engine selects one of the remaining rules from C. The selected rule will be referred to as “R”. Once selecting operation 510 is completed, control passes to determining operation 512.
At determining operation 512, the correlation engine determines whether the rule R is an end rule. If R is not an end rule, processing proceeds to step 516. If R is in fact an end rule, processing continues with step 514.
At determining operation 514, the correlation engine determines whether triggering the end rule R results in the correlated event set S. If it does not, processing returns to determining operation 508. If it does, processing proceeds to deactivating operation 518.
At determining operation 516, the correlation engine determines whether triggering R, which is not an end rule, can only invoke the rule “Rprime”—Rprime is defined in step 520. It is noted that this operation will only occur on the second and subsequent iterations through the loop, as the first iteration concerns only the end rules.
At deactivating operation 518, the correlation engine deactivates the rule R. It adds R to the list L of deactivated rules.
At assigning operation 520, the present rule R is defined as “Rprime” The correlation engine determines which rules may trigger Rprime. Any such rules are added to a new set, “C”, which is pushed onto the stack. This will cause this set to be recursively processed via the present method. After doing so, processing returns to determining operation 508.
When the stack is empty, processing finishes with adding operation 522. The correlation engine creates a new rule, “Ractivate”, and adds it to the ruleset. The list of deactivated rules, L, is incorporated into Ractivate. Ractivate may be configured to trigger upon receiving the event Efix as specified in returning operation 416 of
With reference to
The computer system 602 includes a processing unit 604, a system memory 606, and a system bus 608 that couples the system memory 606 to the processing unit 604. The system memory 606 includes read only memory (ROM) 608 and random access memory (RAM) 610. A basic input/output system (BIOS) 612, containing the basic routines that help to transfer information between elements within the computer 602, such as during start-up, is stored in ROM 608.
The computer system 602 further includes a hard disk drive 614, a magnetic disk drive 616 (to read from and write to a removable magnetic disk 618), and an optical disk drive 620 (for reading a CD-ROM disk 622 or to read from and write to other optical media). The hard disk drive 614, magnetic disk drive 616, and optical disk drive 620 are connected to the system bus 608 by a hard disk interface 624, a magnetic disk interface 626, and an optical disk interface 628, respectively. The drives and their associated computer-readable media provide nonvolatile storage for the computer system 602. Although computer-readable media refers to a hard disk, removable magnetic media and removable optical media, it should be appreciated by those skilled in the art that other types of media that are readable by a computer, such as flash memory cards, may also be used in the illustrative computer system 602.
A number of program modules may be stored in the drives and RAM 610, including a correlation engine 630, an analysis engine 632, a rule data structure utilized by the correlation engine 634, and other program modules and data (not shown). As discussed above, the computer system 602 is configured to ignore redundant symptoms of fault conditions after corrective action has been initiated.
A user may enter commands and information into the computer system 602 through a keyboard 636 and pointing device, such as a mouse 638. Other input devices (not shown) may include a microphone, modem, joystick, game pad, satellite dish, scanner, or the like. These and other input devices are often connected to the processing unit through a serial port interface 640 that is coupled to the system bus 608.
A display device 642 is also connected to the system bus 608 via an interface, such as a video adapter 644. In addition to the display device, the computer system 602 may include other peripheral output devices (not shown), such as speakers and printers.
The computer system 602 operates in a networked environment using logical connections to one or more remote devices. The remote device may be a server, a router, a peer device or other common network node. When used in a networking environment, the computer system 602 is typically connected to the network 648 through a network interface 646. In a network environment, program modules depicted relative to the computer system 602, or portions thereof, may be stored in one or more remote memory storage devices.
The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.
The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, the singular forms “a”, “an” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “comprises” and/or “comprising,” when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof.
The corresponding structures, materials, acts, and equivalents of all means or step plus function elements in the claims below are intended to include any structure, material, or act for performing the function in combination with other claimed elements as specifically claimed. The description of the present invention has been presented for purposes of illustration and description, but is not intended to be exhaustive or limited to the invention in the form disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the invention. The embodiment was chosen and described in order to best explain the principles of the invention and the practical application, and to enable others of ordinary skill in the art to understand the invention for various embodiments with various modifications as are suited to the particular use contemplated.
Having thus described the invention of the present application in detail and by reference to embodiments thereof, it will be apparent that modifications and variations are possible without departing from the scope of the invention defined in the appended claims.
| Number | Name | Date | Kind |
|---|---|---|---|
| 5483637 | Winokur et al. | Jan 1996 | A |
| 5528516 | Yemini et al. | Jun 1996 | A |
| 5539877 | Winokur et al. | Jul 1996 | A |
| 5790779 | Ben-Natan et al. | Aug 1998 | A |
| 6006016 | Faigon et al. | Dec 1999 | A |
| 6061723 | Walker et al. | May 2000 | A |
| 6832341 | Vijayan | Dec 2004 | B1 |
| 7043659 | Klein et al. | May 2006 | B1 |
| 7293201 | Ansari | Nov 2007 | B2 |
| 7529974 | Thibaux et al. | May 2009 | B2 |
| 20020007468 | Kampe et al. | Jan 2002 | A1 |
| 20020116248 | Amit et al. | Aug 2002 | A1 |
| 20020144177 | Kondo et al. | Oct 2002 | A1 |
| 20020184065 | Menard et al. | Dec 2002 | A1 |
| 20080168308 | Eberbach et al. | Jul 2008 | A1 |
| Number | Date | Country | |
|---|---|---|---|
| 20070299943 A1 | Dec 2007 | US |
