US 2009/0265288 A1Published application

System and method for correlating events in a pluggable correlation architecture

AssigneeNovell, Inc.

InventorsDipto Chakravarty, Usman Choudhary, John Melvin Antony, Michael Howard Cooper, Jason Lee Arrington, Cheryl Witt

Life of this patent

Estimating the term…

patentgrep

Loading patent…

Abstract

A system for pluggable event correlation may include an input manager that receives a plurality of events and converts the events into a format compatible with one or more of a plurality of correlation engines. The correlation engines may then evaluate the converted events using various rules and generate correlated events when the evaluated events trigger at least one of the rules. An action manager may execute remedial actions when the correlation engines generate the correlated events. Moreover, extensibility may be provided by enabling a user to define rules to be triggered when events occur in a predetermined pattern, and actions to be executed when a predetermined rule triggers a correlated event. Further, to plug a new correlation engine into the system, adapters may be deployed to handle input and output, while the user-defined rules may be validating according to semantic requirements of the new correlation engine.

Claims7

Dependent claims

A method for correlating events in a pluggable event correlation system, comprising:

receiving an event stream that includes a plurality of events, wherein each event in the event stream originates from one of a plurality of event sources;
enriching the events in the event stream by associating the events with classification information;
providing the enriched events to a plurality of input adapters respectively associated with a plurality of correlation engines, wherein each of the input adapters convert the enriched events into a format that the associated correlation engine uses to evaluate events against a plurality of rules;
receiving an output from one or more of the plurality of correlation engines, the output generated by the one or more of the plurality of correlation engines upon determining that one or more of the evaluated events have triggered one or more of the plurality of rules, wherein one or more output adapters respectively associated with the one or more of the plurality of correlation engines convert the output into a correlated event;
and
executing an action associated with the correlated event to remediate a condition associated with the events that triggered the one or more of the plurality of rules.

3 more elements

A pluggable event correlation system, comprising:

a correlation runtime environment that manages correlation of a plurality of events received via an event stream, wherein the correlation runtime environment includes:
an input manager that receives the event stream, wherein the input manager includes at least one adapter that converts the plurality of events in the event stream into a format compatible with one or more of a plurality of correlation engines;
the plurality of correlation engines that receive the event stream from the input manager, the plurality of correlation engines operable to evaluate the events using a plurality of rules and to generate one or more correlated events when one or more of the evaluated events trigger one or more of the plurality of rules;
and
an action manager that identifies one or more actions associated with the generated correlated events and that executes the one or more identified actions;
a configuration module that includes a rule builder and an action builder, wherein a user can define at least one rule through the rule builder that includes an expression to be triggered when events occur in a predetermined pattern, and wherein the user can define at least one action through the action builder to be associated with a predetermined rule triggering generation of a correlated event;
and
a management module that includes an engine manager and a status module, wherein the user can use the engine manager to start and stop operation of one or more of the plurality of correlation engines, validate the at least one rule defined through the rule builder in accordance with semantic requirements of at least one of the plurality of correlation engines, and configure the at least one of the plurality of correlation engines to enforce the validated rule, and wherein the user can use the status module to view statistical information, status information, and health information associated with activity in the correlation runtime environment.

5 more elements

Dependencies are inferred from the claim text.