Method and apparatus for system management using codebook correlation with symptom exclusion

A method for detecting events in a system, the method comprising the steps of:

• (a) providing a mapping between each of a plurality of groups of possible observable events and one of a plurality of likely corresponding events in said system, wherein each of the observable events is either determined to be in a known state or not determined to be in a known state;
• (b) detecting one or more observable events generated by said system, wherein the detected observable events are determined to be in a known state;
• (c) determining a mismatch measure between each of the plurality of groups of possible observable events in said mapping and said one or more known observable events, wherein observable events in the groups of possible observable events not determined to be in a known state are disregarded;
• and
• (d) selecting one or more of said plurality of likely events corresponding to one of said plurality of groups having the smallest mismatch measure.