# US 2014/0156830 A1 · Correlating computing network events

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2014/0156830 A1
- Document ID: US20140156830A1
- Status: Published application
- Kind: A1
- Application number: 13/775,205
- Filed: 2013-02-24
- Published: 2014-06-05
- Earliest claimed: 2012-12-04
- Assignees: International Business Machines Corporation
- Applicants: International Business Machines Corporation
- Inventors: Edith H. Stern; Kristian J. Stewart
- Web page: https://patentgrep.com/patent/US20140156830A1

## CPC

- H04L 67/75: Indicating network or usage conditions on the user display
- H04L 41/0613: {based on the type or category of the network elements}
- H04L 41/0631: using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
- H04L 41/065: {involving logical or physical relationship, e.g. grouping and hierarchies}
- H04L 41/0668: by dynamic selection of recovery network elements, e.g. replacement by the most appropriate element after failure
- H04L 41/0686: Additional information in the notification, e.g. enhancement of specific meta-data
- H04L 41/0806: for initial configuration or provisioning, e.g. plug-and-play
- H04L 41/0843: {based on generic templates}
- H04L 41/22: comprising specially adapted graphical user interfaces [GUI]
- H04L 69/40: for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection (management of faults, events, alarms or notifications in data switching networks H04L41/06)
- H04L 67/1001: for accessing one among a plurality of replicated servers
- H04L 69/329: in the application layer [OSI layer 7]
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

According to one aspect of the present disclosure, a method and technique for correlating computing network events is disclosed. The method includes: receiving a plurality of events at an event manager residing on a host computing system; identifying a first resource associated with a first event; identifying a second resource associated with a second event; determining whether the first resource is associated with a deployment pattern; determining whether the second resource is associated with a deployment pattern; and responsive to determining that the first and second resources are each associated with a deployment pattern, correlating the first and second events responsive to the first and second resources being associated with a common deployment pattern.

## Claims

### Claim 1

A method, comprising:
receiving a plurality of events at an event manager residing on a host computing system;
identifying a first resource associated with a first event;
identifying a second resource associated with a second event;
determining whether the first resource is associated with a deployment pattern;
determining whether the second resource is associated with a deployment pattern; and
responsive to determining that the first and second resources are each associated with a deployment pattern, correlating the first and second events responsive to the first and second resources being associated with a common deployment pattern.

### Claim 2 (depends on 1)

The method of claim 1, further comprising providing an indication of the correlated events.

### Claim 3 (depends on 1)

The method of claim 1, further comprising:
responsive to a request to deploy resources, identifying a deployment pattern corresponding to the request;
identifying target resources for the deployment based on the identified deployment pattern;
deploying the targeted resources; and
storing an association of the deployed resources with the respective deployment pattern.

### Claim 4 (depends on 2)

The method of claim 2, wherein providing the indication comprises condensing a plurality of indications of correlated events to a single indication.

### Claim 5 (depends on 2)

The method of claim 2, wherein providing the indication comprises providing a visual indication of the correlated events.

### Claim 6

A method, comprising:
identifying computing resources to be deployed;
receiving an identification of a correlation pattern comprising a set of the resources to be deployed;
assigning a correlation identifier to the correlation pattern; and
configuring each resource of the correlation pattern to include the correlation identifier with an event generated by the respective resource.

### Claim 7 (depends on 6)

The method of claim 6, further comprising:
receiving a plurality of events from deployed resources;
identifying a correlation identifier associated with each of the plurality of received events; and
correlating the events having a common correlation identifier.

### Claim 8 (depends on 7)

The method of claim 7, further comprising providing an indication of the correlated events.

### Claim 9 (depends on 6)

The method of claim 6, further comprising associating the correlation pattern with a deployed application.

### Claim 10 (depends on 6)

The method of claim 6, further comprising providing the correlation identifier to the respective resources of the correlation pattern upon deployment of the respective resources.