Domain event correlation
View Patent ↗A system is provided for dynamically identifying and correlating network domain events. The system includes a network domain and a plurality of managed objects in the network domain. A management server is in communication with the managed objects. The management server can receive domain events from at least one of the managed objects. A management module on the management server maintains a topology of managed objects in the network domain. A rule knowledge base is in communication with the management server. The rule knowledge base includes correlation rules for identifying and correlating domain events. A correlation module utilizes a processor to correlate the domain events with the topology using the correlation rules to identify an interaction between the managed objects and the domain events.
1. A system for dynamically identifying and correlating network domain events, comprising:
a plurality of managed objects in a network domain;
a management server in communication with the managed objects, the management server being configured to receive domain events from at least one of the managed objects;
a management module on the management server configured to maintain a topology of managed objects in the network domain;
a rule knowledge base in communication with the management server, the rule knowledge base comprising correlation rules for identifying and correlating domain events;
a correlation module configured to utilize a processor to correlate the domain events with the topology using the correlation rules to identify an interaction between the managed objects and the domain events; and
a hypothesis module configured to create a hypothesis regarding a cause of a first domain event based on a corresponding correlation rule and generate a time window based on the hypothesis, wherein the time window is used to monitor future domain events that occur within the time window.
2. A system in accordance with claim 1 , further comprising a cause identification module configured to determine causes of the domain events based on the interaction between the managed objects and the domain events.
3. A system in accordance with claim 2 , wherein the cause identification module is further configured to correlate a plurality of domain event causes to identify a root cause.
4. A system in accordance with claim 1 , further comprising a timing module configured to associate a plurality of domain events when the plurality of domain events occurs within a predetermined time frame.
5. A system in accordance with claim 4 , wherein the hypothesis module is configured to:
create an initial time window when the first domain event matching a correlation rule is received by the management server and to add a second domain event to the hypothesis when:
the second domain event matches the correlation rule;
the second domain event is received by the management server within the initial time window; and
the topology between the first domain event and the second domain event matches;
extend the initial time window to create an extended time window when the second domain event is added to the hypothesis; and
close the hypothesis if the second domain event is not received by the management server before the initial time window has elapsed.
6. A system in accordance with claim 1 , further comprising a conversion module on the management module, the conversion module being configured to convert domain events of various formats into a uniform event indicator format.
7. A system in accordance with claim 6 , wherein the conversion module further comprises an event resolution module configured to analyze domain event properties and compare the domain event properties with uniform event indicators in an event conversion database to find a best-matching uniform event indicator when a perfect-matching uniform event indicator is not available.
8. A system in accordance with claim 1 , wherein the network domain comprises a plurality of connected network domains.
9. A system in accordance with claim 8 , wherein the topology and the rule knowledge base encompass the plurality of connected network domains.
10. A system in accordance with claim 1 , wherein the management module comprises a Configuration Management Database (CMDB).
11. A system in accordance with claim 1 , wherein the correlation module is configured to correlate domain events based on domain event occurrence information.
12. A system in accordance with claim 1 , further comprising a correlation rule automation module configured to analyze domain event logs to detect clusters of domain events which repeatedly occur together to automate definition of the correlation rules.
13. A method for identifying and correlating domain events, comprising:
maintaining a topology of managed objects in a network domain using a management module;
receiving a first domain event at a management server from a managed object;
identifying the first domain event using a processor;
identifying a cause of the first domain event using correlation rules from a rule knowledge base to correlate the first domain event and a second domain event with the topology to determine the cause that matches the first domain event, the second domain event, and the topology; and
create a hypothesis regarding the cause of the first domain event based on a corresponding correlation rule and create a time window based on the hypothesis, wherein the time window is used to monitor future domain events that occur within the time window.
14. A method in accordance with claim 13 , further comprising associating the first domain event with the second domain event when the first domain event and the second domain event occur within a predetermined time frame.
15. A method in accordance with claim 13 , further comprising building an interdependent source graph of the topology related to the first domain event and the second domain event.
16. A method in accordance with claim 15 , further comprising navigating the interdependent source graph to locate a root cause underlying the cause of the first domain event and the second domain event.
17. A method in accordance with claim 13 , wherein identifying the cause of the first domain event and the second domain event further comprises performing cross-domain event correlation across multiple domains using the topology and the correlation rules to identify a specific cause of a domain event in a specific network domain.
18. A method in accordance with claim 17 , further comprising amending correlation rules for cross-domain event correlation by amending correlation rules for the specific network domain.
19. A method in accordance with claim 13 , further comprising:
creating an initial time window when the first domain event matching a correlation rule is received by the management server and to add the second domain event to the hypothesis when:
the second domain event matches the correlation rule;
the second domain event is received by the management server within the initial time window; and
the topology between the first domain event and the second domain event matches;
extending the initial time window to create an extended time window when the second domain event is added to the hypothesis; and
closing the hypothesis if the second domain event is not received by the management server before the initial time window has elapsed.
20. A system for dynamically identifying and correlating network domain events across a plurality of network domains, comprising:
a plurality of network domains;
a plurality of managed objects in the plurality of network domains;
a management server in communication with the managed objects, the management server being configured to receive domain events from at least one of the managed objects;
a conversion module on the management module, the conversion module being configured to convert domain events of various formats into a uniform event type indicator;
a management module on the management server configured to create a topology model of managed objects in the plurality of network domains;
a rule knowledge base in communication with the management server, the rule knowledge base comprising correlation rules for identifying and correlating domain events;
a correlation module configured to utilize a processor to correlate the domain events with the topology using the correlation rules to identify an interaction between the managed objects and the domain events;
a cause identification module configured to determine a cause of the domain events based on the interaction between the managed objects and the domain events; and
a hypothesis module configured to create a hypothesis regarding the cause of a first domain event based on a corresponding correlation rule and generate a time window based on the hypothesis, wherein the time window is used to monitor future domain events that occur within the time window.