# US 2019/0317834 A1 · Using and Updating Topological Relationships Amongst a Set of Nodes in Event Clustering > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0317834 A1 - Document ID: US20190317834A1 - Status: Published application - Kind: A1 - Application number: 15/950,987 - Filed: 2018-04-11 - Published: 2019-10-17 - Earliest claimed: 2018-04-11 - Assignees: Oracle International Corporation - Applicants: Oracle International Corporation - Inventors: Mohammad Sadegh Ebrahimi; Raghu Hanumanth Reddy Patti; Dustin Garvey - Web page: https://patentgrep.com/patent/US20190317834A1 ## CPC - G06F 9/542: {Event management; Broadcasting; Multicasting; Notifications} - G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)} - G06F 11/3409: {for performance assessment} - G06F 17/18: for evaluating statistical data {, e.g. average values, frequency distributions, probability functions, regression analysis (forecasting specially adapted for a specific administrative, business or logistic context G06Q10/04)} - G06F 2201/86: Event-based monitoring - G06F 2209/544: Remote - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Using and updating topological relationships amongst a set of nodes in event clustering is disclosed. A current event occurs on a current node. A first cluster of related events includes a first event, occurring on a first node, that is time-correlated with the current event. The first cluster does not include any event that is topologically-correlated with the current event based on the existing set of topological relationships. A level of interdependence is determined between (a) occurrence of events on the current node and (b) occurrence of events on the first node. Based on the level of interdependence, the current event is added to the first cluster. Further, an event-based topological relationship between the first node and the second node is added to the set of topological relationships. Subsequently, clustering for new events may be determined based on the event-based topological relationship between the first node and the second node. ## Claims ### Claim 1 A non-transitory computer readable medium comprising instructions which, when executed by one or more hardware processors, cause performance of operations comprising: identifying a plurality of events that occur on a set of nodes in a computing environment; determining a first cluster of related events, from the plurality of events, based on an existing set of topological relationships associated with the set of nodes; determining that there is event co-occurrence between (a) one or more events of the first cluster of related events and (b) a first event that is not within the first cluster of related events; based at least on the event co-occurrence between (a) the one or more events of the first cluster of related events and (b) the first event: determining an event-based topological relationship between (a) a first node, of the set of nodes, that is associated with at least one event of the first cluster of related events and (b) a second node, of the set of nodes, that is associated with the first event but not associated with any event of the first cluster of related events; identifying a second event that is associated with the first node; identifying a third event, not already within the plurality of events, that is associated with the second node; and based at least on the event-based topological relationship: clustering the second event and the third event into a second cluster of related events. ### Claim 2 (depends on 1) The medium of claim 1, wherein: the operations further comprise: determining a level of interdependence between occurrence of events on the first node and occurrence of events on the second node; determining that the level of interdependence is above a threshold value; and determining the event-based topological relationship between the first node and the second node is further based on determining that the level of interdependence is above the threshold value. ### Claim 3 (depends on 2) The medium of claim 2, wherein determining the level of interdependence comprises: determining a first probability of a cluster having a fourth event on the second node; determining a second probability of a cluster having both (a) a fifth on the second node and (b) a sixth event on the first node that is within a threshold duration of time from the fifth event on the second node; and dividing the second probability by the first probability to obtain the level of interdependence. ### Claim 4 (depends on 1) The medium of claim 1, wherein: the operations further comprise: determining that the one or more events of the first cluster of related events and the first event satisfy a statistical criteria; and determining the event-based topological relationship between the first node and the second node is further based on determining that the one or more events of the first cluster of related events and the first event satisfy the statistical criteria. ### Claim 5 (depends on 1) The medium of claim 1, wherein the operations further comprise: adding the event-based topological relationship between the first node and the second node to the existing set of topological relationships. ### Claim 6 (depends on 1) The medium of claim 1, wherein the existing set of topological relationships includes: a topological relationship that is determined based on one or more configuration files associated with one or more of the set of nodes. ### Claim 7 (depends on 1) The medium of claim 1, wherein the existing set of topological relationships includes: a topological relationship that is specified via user input. ### Claim 8 (depends on 1) The medium of claim 1, wherein identifying the first cluster of related events based on the existing set of topological relationships associated with the set of nodes comprises: determining that a fourth event and a fifth event occur within a threshold duration of time of each other; determining that a third node, on which the fourth event occurs, and a fourth node, on which the fifth event occurs, are within a threshold number of hops from each other based on the existing set of topological relationships; and determining that the fourth event and the fifth event are within the first cluster of related events. ### Claim 9 (depends on 1) The medium of claim 1, wherein the operations further comprise: based at least on the event co-occurrence between (a) the one or more events of the first cluster of related events and (b) the first event: adding the first event to the first cluster of related events. ### Claim 10 (depends on 1) The medium of claim 1, wherein the first cluster of related events and the second cluster of related events are different. ### Claim 11 (depends on 1) The medium of claim 1, wherein the first cluster of related events is same as the second cluster of related events. ### Claim 12 (depends on 1) The medium of claim 1, wherein the operations further comprise: presenting, at a user interface, information associated with the second cluster of related events, wherein the information associated with the second cluster of related events indicates that the second cluster of related events includes the second event and the third event. ### Claim 13 (depends on 1) The medium of claim 1, wherein the operations further comprise: responsive to determining that the second cluster of related events includes the second event and the third event: selecting the second event for analysis without selecting the third event for analysis. ### Claim 14 (depends on 1) The medium of claim 1, wherein the operations further comprise: determining that the third event, within the second cluster of related events, has been resolved; responsive to determining that the third event has been resolved: indicating that the second event, within the second cluster of related events, is also resolved. ### Claim 15 A method, comprising: identifying a plurality of events that occur on a set of nodes in a computing environment; determining a first cluster of related events, from the plurality of events, based on an existing set of topological relationships associated with the set of nodes; determining that there is event co-occurrence between (a) one or more events of the first cluster of related events and (b) a first event that is not within the first cluster of related events; based at least on the event co-occurrence between (a) the one or more events of the first cluster of related events and (b) the first event: determining an event-based topological relationship between (a) a first node, of the set of nodes, that is associated with at least one event of the first cluster of related events and (b) a second node, of the set of nodes, that is associated with the first event but not associated with any event of the first cluster of related events; identifying a second event that is associated with the first node; identifying a third event, not already within the plurality of events, that is associated with the second node; and based at least on the event-based topological relationship: clustering the second event and the third event into a second cluster of related events; wherein the method is performed by at least one device including a hardware processor. ### Claim 16 (depends on 15) The method of claim 15, further comprising: determining a level of interdependence between occurrence of events on the first node and occurrence of events on the second node; determining that the level of interdependence is above a threshold value; wherein determining the event-based topological relationship between the first node and the second node is further based on determining that the level of interdependence is above the threshold value. ### Claim 17 (depends on 16) The method of claim 16, wherein determining the level of interdependence comprises: determining a first probability of a cluster having a fourth event on the second node; determining a second probability of a cluster having both (a) a fifth on the second node and (b) a sixth event on the first node that is within a threshold duration of time from the fifth event on the second node; and dividing the second probability by the first probability to obtain the level of interdependence. ### Claim 18 A system, comprising: at least one device including a hardware processor; and the system being configured to perform operations comprising: identifying a plurality of events that occur on a set of nodes in a computing environment; determining a first cluster of related events, from the plurality of events, based on an existing set of topological relationships associated with the set of nodes; determining that there is event co-occurrence between (a) one or more events of the first cluster of related events and (b) a first event that is not within the first cluster of related events; based at least on the event co-occurrence between (a) the one or more events of the first cluster of related events and (b) the first event: determining an event-based topological relationship between (a) a first node, of the set of nodes, that is associated with at least one event of the first cluster of related events and (b) a second node, of the set of nodes, that is associated with the first event but not associated with any event of the first cluster of related events; identifying a second event that is associated with the first node; identifying a third event, not already within the plurality of events, that is associated with the second node; and based at least on the event-based topological relationship: clustering the second event and the third event into a second cluster of related events. ### Claim 19 (depends on 18) The system of claim 18, wherein: the operations further comprise: determining a level of interdependence between occurrence of events on the first node and occurrence of events on the second node; determining that the level of interdependence is above a threshold value; and determining the event-based topological relationship between the first node and the second node is further based on determining that the level of interdependence is above the threshold value. ### Claim 20 (depends on 19) The system of claim 19, wherein determining the level of interdependence comprises: determining a first probability of a cluster having a fourth event on the second node; determining a second probability of a cluster having both (a) a fifth on the second node and (b) a sixth event on the first node that is within a threshold duration of time from the fifth event on the second node; and dividing the second probability by the first probability to obtain the level of interdependence