Apparatus and method for event correlation and problem reporting

A method for detecting problems in a system which generates a plurality of symptoms, the method comprising the steps of:

• (1) generating a causality matrix comprising a first matrix of values each corresponding to a mapping between one of said plurality of symptoms and one of a plurality of likely problems in said system;
• (2) reducing said causality matrix into a codebook comprising a second matrix of values fewer in number than said first matrix of values by eliminating duplicative sets of values from said first matrix of values;
• (3) monitoring a plurality of symptom data values representing said plurality of symptoms generated by said system over time;
• (4) determining a mismatch measure between each of a plurality of groups of said values in said codebook and said plurality of symptom data values through the use of a computer, and selecting one of said plurality of likely problems corresponding to one of said plurality of groups having the smallest mismatch measure;
• and
• (5) reporting said one selected likely problem from said codebook.

A method of generating a codebook for use in a process of detecting problems in a system which generates a plurality of symptoms, the method comprising the steps of:

• (1) preparing a causality matrix comprising a matrix of values each corresponding to a mapping between one of said plurality of symptoms and one of a plurality of likely problems in said system;
• (2) making said causality matrix well-formed by deleting redundant sets of values from said matrix of values;
• (3) selecting a desired degree of distinction between groups of said plurality of symptoms, each group corresponding to a different likely problem;
• (4) generating, through the use of a computer, an optimal codebook from said well-formed causality matrix by selecting minimal groups of symptoms from said well-formed causality matrix such that selected groups of symptoms corresponding to any two likely problems satisfy the desired degree of distinction;
• and
• (5) storing said optimal codebook in a computer storage device.

A method of generating a codebook for use in a process of detecting problems in a system which generates a plurality of symptoms, the method comprising steps of:

• (1) preparing a causality graph comprising a plurality of nodes each corresponding to a problem or a symptom, and a plurality of directed edges each pointing from one of the plurality of nodes to another of the plurality of nodes, and corresponding to a causal relation between two or more of said plurality of nodes;
• (2) making said causality graph well-formed by deleting redundant nodes;
• (3) selecting a desired degree of distinction between groups of said plurality of symptoms, each group corresponding to a different likely problem;
• (4) generating, through the use of a computer, an optimal codebook from said well-formed causality graph by selecting a minimal set of symptom nodes such that the minimal set of symptom nodes caused by any two problem nodes satisfy the desired degree of distinction;
• and
• (5) storing said optimal codebook in a computer storage device.

Apparatus for detecting problems in a system which generates a plurality of symptoms, the apparatus comprising:

• a storage device for storing a codebook comprising a matrix of values each corresponding to a mapping between one of said plurality of symptoms and one of a plurality of likely problems in said system;
• monitoring means for monitoring a plurality of symptom data values representing said plurality of symptoms generated by said system over time;
• means for determining a mismatch measure between each of a plurality of groups of said values in said codebook and said plurality of symptom data values, and selecting one of said plurality of likely problems corresponding to one of said plurality of groups having the smallest mismatch measure;
• and
• generating means for generating a report comprising said one selected likely problem.

Apparatus for detecting problems in a system which generates a plurality of symptoms, the apparatus comprising:

• generating means for generating a causality matrix comprising a first matrix of values each corresponding to a mapping between one of said plurality of symptoms and one of a plurality of likely problems in said system;
• reducing means for reducing said causality matrix into a computer-accessible codebook comprising a second matrix of values fewer in number than said first matrix of values by eliminating duplicative sets of values from said first matrix;
• monitoring means for monitoring, through the use of a computer, a plurality of symptom data values representing said plurality of symptoms generated by said system over time;
• means for determining a mismatch measure between each of a plurality of groups of said values in said codebook and said plurality of symptom data values, and selecting one of said plurality of likely problems corresponding to one of said plurality of groups having the smallest mismatch measure;
• and
• a report generator for reporting said one selected likely problem.

Apparatus for generating a codebook for use in detecting problems in a system which generates a plurality of symptoms, the apparatus comprising:

• preparing means for preparing a causality matrix comprising a matrix of values each corresponding to a mapping between one of said plurality of symptoms and one of a plurality of likely problems in said system;
• means for making said causality matrix well-formed by deleting redundant sets of values from said matrix of values;
• inputting means for inputting a desired degree of distinction between groups of said plurality of symptoms, each group corresponding to a different likely problem;
• generating means for generating a computer-accessible optimal codebook from said well-formed causality matrix by selecting minimal groups of symptoms from said well-formed causality matrix such that selected groups of symptoms corresponding to any two likely problems satisfy the desired degree of distinction;
• and
• a storage device for storing said computer-accessible optimal codebook.

Apparatus for generating a codebook for use in detecting problems in a system which generates a plurality of symptoms, the apparatus comprising:

• preparing means for preparing a causality graph comprising a plurality of nodes each corresponding to a problem or a symptom, and a plurality of directed edges each pointing from one of the plurality of nodes to another of the plurality of nodes and corresponding to a causal relation between two or more of said plurality of nodes;
• means for making said causality graph well-formed by deleting redundant nodes;
• specifying means for specifying a desired degree of distinction between groups of said plurality of symptoms, each group corresponding to a different likely problem;
• generating means for generating, through the use of a computer, an optimal codebook from said well-formed causality graph by selecting a minimal group of symptom nodes such that selected groups satisfy the degree of distinction;
• and
• a computer storage device for storing said optimal codebook.

A method of preparing a data structure for use in detecting or isolating problems in a system having a plurality of components of various classes, said system generating a plurality of observable events, the method comprising the steps of:

• (1) preparing compilable statements which define, for each class of component in said system,
• (a) the relationships the component can participate in with respect to other classes of components;
• (b) problems associated with the component and events caused therefrom;
• (c) a causal propagation of the problems and the events to other components along the relationships;
• (2) preparing a configuration specification which defines component instances in the system, their classes and their relationships to other components;
• (3) translating, through the use of a computer, the compilable statements and the configuration specification into the data structure by determining a causality closure of the events in the system;
• and
• (4) storing the data structure in a computer storage device.