Apparatus and method for event correlation and problem reporting

A computer readable media containing code thereon, said code providing instructions to a computer system to determine the effects of one or more events in a system of managed components by executing the steps of:

• creating one or more configuration non-specific representations of types of managed components;
• creating one or more configuration non-specific representations of one or more events of said types of managed components;
• creating configuration non-specific representations of relations along which the one or more events and/or effects of said events propagate amongst the types of managed components producing a data structure for determining the effects of an event by combining one or more of said configuration non-specific representations based on information of specific instances of managed components in the system of managed components;
• and
• utilizing said data structure to determine the corresponding effects on one or more managed components caused by the one or more events.

A computer readable media containing code thereon for determining the effects of one or more events in a system of managed components, said code providing instructions to a computer system for executing the steps of:

• creating one or more configuration non-specific representations of types of managed components;
• creating one or more configuration non-specific representations of events of said types of managed components;
• and
• creating configuration non-specific representations of relations along which the events and/or effects of said events propagate amongst the types of managed components;
• partitioning a system domain into a plurality of smaller domains, each said smaller domain containing a subset of instances of managed components of the system;
• for each smaller domain, producing a data structure for determining the effects of one or more events by combining a plurality of said configuration non-specific representations based on information of specific instances of managed components in the smaller domains;
• determining corresponding effects on one or more managed components caused by the one or more events for selected ones of the smaller domains utilizing corresponding data structures;
• and
• combining the determined effects in each of the selected smaller domains into one or more effects in said system.

A computer readable media containing code thereon for determining, in a distributed system, problems among a plurality of problems which generate a plurality of symptoms, said problems and symptoms being mapped in a matrix of values, said code providing instructions to a computer system for executing the steps of:

• monitoring a plurality of symptom data values representing said plurality of symptoms;
• determining a mismatch measure between each of a plurality of groups of said values in said matrix and said plurality of symptom data values;
• and
• selecting one of said plurality of problems corresponding to one of said plurality of groups having the smallest mismatch measure.

A computer readable media containing code thereon for analyzing events in a system of managed components, said code providing instructions to a computer system for executing the steps of:

• (1) partitioning a system domain representative of the system of managed components into a plurality of subdomains, each of said subdomains generating domain events, each domain event comprising one of the events in the system of managed components;
• (2) providing a matrix of values for each subdomain, wherein each value corresponds to a mapping between one of said domain events and one of a plurality of likely other events in said system of managed components;
• (3) monitoring each subdomain for event data values representing said domain events generated by said subdomain;
• (4) determining for selected ones of said subdomains a mismatch measure between each of said matrix of values and said event data values for said subdomain and selecting the event having the smallest mismatch measure as the most likely cause event;
• and
• (5) combining said selected mostly likely cause event in each of said selected subdomains to determine one or more likely cause events in said system of managed components.