Method and apparatus for system management using codebook correlation with symptom exclusion

A apparatus for detecting events in a system, the apparatus comprising:

• a processor in communication with a memory storage device, said processor executing code for accessing a mapping between each of a plurality of groups of possible observable events and one of a plurality of likely corresponding events in said system wherein selected ones of the observable events are determined to be in known state;
• detecting one or more observable events generated by said system and determining the detected observable events to be in a known state;
• determining a mismatch measure between each of the plurality of groups of possible observable events in said mapping and said one or more observable events determined to be in a known state;
• selecting one or more of said plurality of likely events corresponding to one of said plurality of groups having the smallest mismatch measure;
• and wherein the said plurality of likely events are stored in a memory.

A computer-readable medium containing code for instructing a processor to determine at least one likely event in a system that generates at least one of a plurality of symptoms, the code instructing the processor to execute the steps of:

• (a) accessing a matrix of values, each value corresponding to an element in mapping between one of a plurality of symptoms and one of a plurality of likely events in said system, wherein each of the values represents whether the symptom is determined to be in a known state or not determined to be in a known state;
• (b) monitoring generation of a plurality of symptoms;
• (c) adjusting the value of corresponding symptoms that have been generated;
• and wherein the said plurality of likely events are stored in a memory.