System and method for systematic construction of correlation rules for event management

Apparatus for systematically constructing one or more correlation rules for use by an event management system for managing a network with one or more computing devices, the apparatus comprising:

• at least one processor operative to:
• (i) obtain, in association with an event cache, event data representing past events associated with the network of computing devices being managed by the event management system;
• (ii) find at least one pattern in the obtained event data associated with the event cache, the at least one pattern including one or more events in the obtained event data;
• (iii) classify the at least one pattern found;
• (iv) construct at least one correlation rule based on the classified pattern;
• and (v) replace, in association with the event cache, the one or more events included in the at least one pattern with a composite event such that hierarchical patterns may be subsequently found for use in constructing further correlation rules.

An article of manufacture for systematically constructing one or more correlation rules for use by an event management system for managing a network with one or more computing devices, the article comprising a machine readable medium containing one or more programs which when executed implement the steps of:

• obtaining, in association with an event cache, event data representing past events associated with the network of computing devices being managed by the event management system;
• finding at least one pattern in the obtained event data associated with the event cache, the at least one pattern including one or more events in the obtained event data;
• classifying the at least one pattern found;
• constructing at least one correlation rule based on the classified pattern;
• and
• replacing, in association with the event cache, the one or more events included in the at least one pattern with a composite event such that hierarchical patterns may be subsequently found for use in constructing further correlation rules.

Apparatus for systematically constructing one or more correlation rules for use by an event management system for managing a network with one or more computing devices, the apparatus comprising:

• means for obtaining, in association with an event cache, event data representing past events associated with the network of computing devices being managed by the event management system;
• means for finding at least one pattern in the obtained event data associated with the event cache, the at least one pattern including one or more events in the obtained event data;
• means for classifying the at least one pattern found;
• means for constructing at least one correlation rule based on the classified pattern;
• and
• means for replacing, in association with the event cache, the one or more events included in the at least one pattern with a composite event such that hierarchical patterns may be subsequently found for use in constructing further correlation rules.