Method and apparatus for system management using codebook correlation with symptom exclusion
View Patent ↗A method and apparatus are provided for correlating events in a system. Problems and other events can, e.g., be detected in a system that generates symptoms or observable events. A computer-accessible codebook is provided that includes a mapping between each of a plurality of groups of possible symptoms and one of a plurality of likely exceptional events (e.g., problems) in the system. The system is monitored and one or more known symptoms generated by the system are detected. A mismatch measure is determined between each of the plurality of groups of possible symptoms in the mapping and the one or more known symptoms using a computer, while disregarding symptoms in the groups of possible symptoms not determined to be known. One or more of the plurality of likely problems is selected corresponding to one of the plurality of groups having the smallest mismatch measure.
1. A method for detecting problems in a system that generates a plurality of symptoms, the method comprising the steps of: (a) providing a matrix of values, each value corresponding to an element in a mapping between one of a plurality of symptoms and one of a plurality of likely events in said system, wherein selected ones of the symptoms are in a known state; (b) associating a high loss probability with symptoms not in a known state; (c) receiving a plurality of symptom generated by said system; (d) decreasing the loss probability of symptoms that have been received; (e) determining a mismatch measure between each of a plurality of groups of said values in said codebook and said plurality of known symptom data values, said mismatch measure taking into account the loss probability of symptoms; (f) selecting one of said plurality of likely events corresponding to one of said plurality of groups having the smallest mismatch measure; and wherein the said plurality of likely events are stored in a memory.
2. A apparatus for detecting events in a system, the apparatus comprising: a processor in communication with a memory storage device, said processor executing code for accessing a mapping between each of a plurality of groups of possible observable events and one of a plurality of likely corresponding events in said system wherein selected ones of the observable events are determined to be in known state; detecting one or more observable events generated by said system and determining the detected observable events to be in a known state; determining a mismatch measure between each of the plurality of groups of possible observable events in said mapping and said one or more observable events determined to be in a known state; selecting one or more of said plurality of likely events corresponding to one of said plurality of groups having the smallest mismatch measure; and wherein the said plurality of likely events are stored in a memory.
3. The apparatus of claim 2 wherein said mismatch measure comprises a Hamming distance.
4. A computer-readable medium containing code for instructing a processor to determine at least one likely event in a system that generates at least one of a plurality of symptoms, the code instructing the processor to execute the steps of: (a) accessing a matrix of values, each value corresponding to an element in mapping between one of a plurality of symptoms and one of a plurality of likely events in said system, wherein each of the values represents whether the symptom is determined to be in a known state or not determined to be in a known state; (b) monitoring generation of a plurality of symptoms; (c) adjusting the value of corresponding symptoms that have been generated; and wherein the said plurality of likely events are stored in a memory.
5. The computer-readable medium as recited in claim 4 , wherein the value associated with symptoms not determined to be in a known state is higher than the value associated with symptoms determined to be in a known state.
6. The computer-readable medium as recited in claim 4 , wherein the code further providing instruction to the processor to execute the step of adjusting the value by decrementing said value.
7. The computer-readable medium as recited in claim 4 , wherein the code further providing instruction to the processor for executing the steps of:
determining a mismatch measure between each of a plurality of groups of said values in said matrix and said plurality of symptom data values, said mismatch measure taking into account the value associated with the symptoms; and
selecting one of said plurality of likely events corresponding to one of said plurality of groups having the smallest mismatch measure.