It event data classifier configured to label messages if message identifiers map directly to classification categories or parse for feature extraction if message identifiers do not map directly to classification categories

Abstract

An off-line knowledge acquisition process takes IT resource messages and automatically generates a set of rules used to provide situation categories for the resource messages/events. The off-line knowledge acquisition process generates an event-to-situation mapping file for efficiently mapping situation to events in runtime. Rules are fed back into a knowledge repository and process for reuse. The off-line knowledge acquisition process provides methods to reiterate the process of mining (autonomically and/or by human interaction) to improve the rules and confidence level assigning the situation categories. A runtime categorizer component uses the event-to-situation mapping file to add situation categories to the IT resource events. The runtime categorizer uses a plurality of annotator components each capable of adding a situation annotation to incoming messages based on rules generated by the off-line knowledge acquisition process. An assessment component chooses the best situation category from those annotated by the annotator components.