System event analyzer and outlier visualization

A non-transitory computer-readable medium having instructions stored thereon, the instructions executable by a processor and when executed causing the processor to:

• receive a time-series sequence of event data for each event type in a plurality of event types;
• determine a set of correlations between pairs of the event types in the plurality of event types based on a comparison of the time-series sequence of each event type;
• cluster the event types based on the set of correlations;
• identify subject event data for each event type in the plurality of event types for an evaluation time;
• compare the subject event data for each event type to one or more alert threshold values for each event type;
• determine an alert level for each event data type based on the comparison of the subject event data;
• and
• generate a display including each event data type represented by a node, the event data types at a location in the display based on the clustering and each event data type coded according to the alert level for the event data type.

A method comprising:

• receiving a time-series sequence of event data for each event type in a plurality of event types associated with one or more monitored systems;
• determining a set of correlation scores between pairs of the event types in the plurality of event types based on a comparison of the time-series sequence of each event type;
• identifying subject event data for each event type in the plurality of event types for an evaluation time;
• comparing the subject event data for each event type to one or more alert threshold values for each event type;
• determining an alert level for each event data type based on the comparison of the subject event data;
• determining a system health score for the plurality of event types, the system health score combining the alert levels for each event data type, the alert level for each data type increased based on the correlation scores for the pairs of event types including that data type;
• determining whether the system health score exceeds a notification threshold;
• and
• responsive to determining the system health score exceeds the notification threshold, generating a notification for an operator of the of notifying an operator of the monitored systems.

A non-transitory computer-readable medium having instructions stored thereon, the instructions executable by a processor and when executed causing the processor to:

• receive a time-series sequence of event data for each event type in a plurality of event types associated with one or more monitored systems;
• determine a set of correlation scores between pairs of the event types in the plurality of event types based on a comparison of the time-series sequence of each event type;
• identify subject event data for each event type in the plurality of event types for an evaluation time;
• compare the subject event data for each event type to one or more alert threshold values for each event type;
• determine an alert level for each event data type based on the comparison of the subject event data;
• determine a system health score for the plurality of event types, the system health score combining the alert levels for each event data type, the alert level for each data type increased based on the correlation scores for the pairs of event types including that data type;
• determine whether the system health score exceeds a notification threshold;
• and
• responsive to determining the system health score exceeds the notification threshold, generate a notification for an operator of the of notifying an operator of the monitored systems.