US 2011/0214020 A1 · ROOT CAUSE PROBLEM IDENTIFICATION THROUGH EVENT CORRELATION

Abstract

Correlating activity events to identify a root cause of a process failure. Activity event data is received from a process executing on a computing device. The activity event data corresponds to a plurality of activity events. Each of the activity events has a correlation identifier, a resolution status, and an occurrence time value associated therewith. Each of the activity events are assigned to one of a plurality of event groups based on the correlation identifier of the activity event. Thereafter, at least one of the event groups is determined to have an activity event with a resolution status indicating failure of the process. One of the activity events within the determined event group is selected as a root cause activity event based on the occurrence time values. In some embodiments, the root cause activity event is identified to a user of the computing device.

Claims20

Dependent claims

A system for automated root cause identification;

said system comprising:
a memory area for storing activity event data, said activity event data being received from at least one executing process, said activity event data corresponding to a plurality of activity events, each of said activity events having an activity type, an activity instance identifier, a correlation identifier, a resolution status, and an occurrence time value associated therewith;
a processor programmed to:
assign each of the plurality of activity events to one of a plurality of event groups based on the correlation identifier and activity type of the activity events;
identify at least one of the plurality of event groups having at least one of the activity events assigned thereto with a resolution status indicating failure of the executing process;
select one of the at least one of the activity events from the identified event group as a root cause activity event based on the occurrence time values;
and
modify the activity event data stored in the memory area to indicate the root cause activity event.

5 more elements

One or more computer-readable media having computer-executable components, said components comprising:

an interface component that when executed by at least one processor causes the at least one processor to receive activity event data, said activity event data corresponding to a plurality of activity events, each of said activity events having a correlation identifier, a resolution status, a process identifier, and an occurrence time value associated therewith, wherein at least two of the activity events have the same correlation identifier and different process identifiers;
a correlation component that when executed by at least one processor causes the at least one processor to assign each of the plurality of activity events to one of a plurality of event groups based on the correlation identifier of the activity event;
a location component that when executed by at least one processor causes the at least one processor to identify at least one of the plurality of event groups having at least one of the activity events assigned thereto with a resolution status indicating failure of a process identified by the process identifier of said at least one of the activity events;
a filter component that when executed by at least one processor causes the at least one processor to select one of the at least one of the activity events from the identified event group as a root cause activity event based on the occurrence time values;
and
a display component that when executed by at least one processor causes the at least one processor to present to a user the activity event data associated with the root cause activity event.

3 more elements

Dependencies are inferred from the claim text.

Root cause problem identification through event correlation

Life of this patent

Root cause problem identification through event correlation

Life of this patent

Abstract

Claims20