Network incident identification based on characterizing relationships between interfaces and events as graphical component relationships

A server comprising:

• a memory device;
• and
• one or more processors connected to the memory device, wherein the one or more processors being configured to:
• receive a plurality of log messages from a plurality of network components of one or more networks in response to a network incident;
• derive, from the plurality of log messages received in response to the network incident, a plurality of relationships between interfaces and events contained in the plurality of log messages, wherein each of the plurality of log messages comprises a description of an event and at least one interface identifier;
• characterize the plurality of relationships between the interfaces and the events as a plurality of graphical component relationships, wherein the one or more processors being operative to characterize the plurality of relationships as the plurality of graphical component relationships comprises the one or more processors being operative to:
• assign the at least one identifier from each of the plurality of log messages as a graph vertex, and
• assign the event description from each of the plurality of log messages as a graph edge connected to the graph vertex;
• determine one or more groups of connected components from the plurality of graphical component relationships and network component connection data which indicate interface relationships of the plurality of network components;
• and
• identify the network incident based on at least one of the determined one or more groups of connected components, the network incident being associated with at least one identified set of events that has the closest or substantial match with at least one predetermined set of events associated with the network incident.

A computer program product that stores a set of instructions which when executed perform a method comprising:

• receiving a plurality of log messages from a plurality of network components of one or more networks in response to a network incident;
• deriving, from the plurality of log messages received in response to the network incident, a plurality of relationships between interfaces and events contained in the plurality of log messages, wherein each of the plurality of log messages comprises a description of an event and at least one interface identifier;
• characterizing the plurality of relationships between the interfaces and the events as a plurality of graphical component relationships, wherein characterizing the plurality of relationships as the plurality of graphical component relationships comprises:
• assigning the at least one identifier from each of the plurality of log messages as a graph vertex, and
• assigning the event description from each of the plurality of log messages as a graph edge connected to the graph vertex;
• determining one or more groups of connected components from the plurality of graphical component relationships and network component connection data, wherein the network component connection data indicates interface relationships of the plurality of network components in the one or more networks;
• and
• identifying the network incident based on at least one of the determined one or more groups of connected components, the network incident being associated with at least one identified set of events that has the closest or substantial match with at least one predetermined set of events associated with the network incident.