International Business Machines Corporation

Micromuse Inc.

Kristian Jon Stewart

Edith H Stern

Jonathan Ian Settle

Zhenni Yan

Matthew Edward Duggan

David R Franklin

Chris Appleton

John Michael Lake

Anthony T Brew

John E Dinger

Andrew Jonathan Bennett

Mudhakar Srivatsa

Dakshi Agrawal

Vasileios Pappas

Murtaza Zafer

Nicholas S Banyard

Yasser Abduallah

Haydn Richard Davis

Adam Geoffrey Kerrison

John Dinger

David Richard Franklin

Method and system are provided for scoring events as likely cause events in a resource network. The method processes incoming events relating to resources in a resource network to correlate related events as a related group and maps the events of the related group onto nodes of a sub-topology representing resources of the resource network and having edges representing relationships between the resources. The method scores each event by discovering one or more paths between the node event and other node events of the related group, with the scoring based on a combination of an event classification weight and a discovered path score of aggregated relationship scores of edges of a discovered path.

Scoring events as likely cause events in a resource network

A method and system are provided for identification of constituent events in an event storm in operations management. The method includes: detecting an event storm by detecting an anomaly from a dynamic baseline range of expected event rates in a sample time period; and, when an event storm is detected, for each of a group of events grouped by an event category and occurring in a sample time period of an event storm, identifying the group of events as constituting part of the event storm if the rate of the event occurrences of the group in the sample time period is outside a threshold deviation from an average for that group.

Identification of constituent events in an event storm in operations management

A system and technique for correlating computing network events includes receiving a deployment request for a computing service and identify a deployment template corresponding to the requested computing service where the deployment template indicates resources needed for providing the computing service. Available resources are identified and targeted based on the deployment template. The targeted resources are deployed and the deployment template is associated in a memory with an identification of a resource set indicating each of the deployed resource elements. Responsive to receiving an event including a resource identifier, an event manager identifies the resource set having the deployed resource corresponding to the resource identifier and correlates the event with at least one other active event corresponding to the resource set.

Correlating computing network events

A method for correlating computing network events includes identifying computing resources to be deployed. An identification of a correlation pattern comprising a set of the resources to be deployed is received and a correlation identifier is assigned to the correlation pattern. Each resource of the correlation pattern is configured to include the correlation identifier with an event generated by the respective resource. The resources are then deployed in a computing environment.

A system and technique for correlating computing network events includes an event manager executable by a processor to identify computing resources to be deployed. An identification of a correlation pattern comprising a set of the resources to be deployed is received. A correlation identifier is assigned to the correlation pattern. Each resource of the correlation pattern is configured to include the correlation identifier with an event generated by the respective resource.

Embodiments of the invention provide a method, system and computer program product for log file reduction according to problem space topology. A method for log file reduction according to problem space topology can include receiving a fault report for a fault in a solution executing in memory of one or more computers of a computer data processing system. The method further can include extracting references to at least two resources of the computer data processing system from the fault report. The method yet further can include filtering a set of all log files for the computer data processing system to only a subset of log files related to the at least two resources. Finally, the method can include displaying the subset of log files in a log file analyzer.

Log file reduction according to problem-space network topology

According to one aspect of the present disclosure, a method and technique for correlating computing network events is disclosed. The method includes: receiving a plurality of events at an event manager residing on a host computing system; identifying a first resource associated with a first event; identifying a second resource associated with a second event; determining whether the first resource is associated with a deployment pattern; determining whether the second resource is associated with a deployment pattern; and responsive to determining that the first and second resources are each associated with a deployment pattern, correlating the first and second events responsive to the first and second resources being associated with a common deployment pattern.

Search query expansion tool is provided. A processor generates a collection of events for a search result, wherein events included in the collection of events are within a temporal proximity to the search result. A processor determines a content of the collection of events. A processor determines a search suggestion based, at least in part, on the content of the collection of events.

Temporal proximity query expansion

According to one aspect of the present disclosure a system and technique for correlating computing network events is disclosed. The system includes a processor, and an event manager executable by the processor to: identify a first resource associated with a first event; identify a second resource associated with a second event; determine whether the first resource is associated with a deployment pattern; determine whether the second resource is associated with a deployment pattern; and responsive to determining that the first and second resources are each associated with a deployment pattern, correlate the first and second events responsive to the first and second resources being associated with a common deployment pattern.

An apparatus for predicting a network event flood comprises an event rate detector for detecting rates of event emissions from one or more devices; an aggregator for producing an aggregate rate and an aggregate rate trend of the rates of event emissions from a plurality of the devices; a level generator for generating a plurality of levels comprising maximum acceptable event rate values of a plurality of the aggregate rate trends over plural time periods; a storage component for storing the plurality of levels; a comparator for comparing a current aggregate rate trend with at least a selected one of the levels; and a signaller for signalling a predicted event flood responsive to the comparator detecting that the current aggregate rate trend will exceed the at least a selected one of the levels at a first point in time.

Network event management

Network management data is managed by determining that a first version and a second version of a set of network management data have been created. The set of network management data is associated with a plurality of managed entities in a network. First and second network graphs are created based on the first version and second version of the set of network management data, respectively. The first and second network graphs include a first and second set of entities in the plurality of managed entities, respectively. A similarity metric is assigned between at least one or more entities in the first and second set of entities. At least a first entity in the first set of entities and at least a second entity in the second set of entities are determined to be identical entities based on the similarity metric being one of equal to and above a first given threshold.

Growing community of inventors

Surrey, United Kingdom

Kristian Jon Stewart