Event enrichment using data correlation
View Patent ↗Systems and methods for enriching events using data correlation are described herein. At least some embodiments include a method for enriching events reflecting the state of a plurality of computer systems, the method including storing a plurality of event messages and system metric data that includes service metric data, determining a degree of correlation between a system metric and at least one of a plurality of service metrics, and enriching an event message of the plurality of event messages based at least in part on the degree of correlation. At least one system metric data value triggers the event message. The degree of correlation is based at least in part on the system metric data and the service metric data.
1. A method for enriching events reflecting the state of a plurality of computer systems, the method comprising:
storing, by a management station, a plurality of event messages and system metric data comprising service metric data, wherein at least one system metric data value triggers an event message of the plurality of event messages;
determining, by the management station, a degree of correlation between a system metric associated with a system component that triggered the event message and at least one of a plurality of service metrics by calculating a correlation coefficient between the system metric associated with the system component that triggered the event message and at least one of the plurality of service metrics, said degree of correlation based at least in part on the system metric data and the service metric data, wherein the service metrics correspond to service level objectives defined within service level agreements; and
enriching, by the management station, the event message based at least in part on the degree of correlation and including the calculated correlation coefficient, information for one or more correlated service metrics and a priority value in the event message.
2. The method of claim 1 , further comprising:
receiving, by the management station, the system metric data and externally generated event messages; and
producing, by the management station, internally generated event messages based at least in part on the system metric data, the plurality of event messages comprising the externally generated event messages or the internally generated event messages.
3. The method of claim 1 , further comprising defining, by the management station, a plurality of service metrics for the computer systems based on service level objectives within service level agreements.
4. The method of claim 1 , wherein enriching the event message comprises modifying existing information within the event message.
5. The method of claim 4 , wherein modifying the existing information comprises modifying the priority value based at least in part on the degree of correlation using the calculated correlation coefficient.
6. The method of claim 1 , further comprising identifying subsets of the system and service metric data, used in determining the degree of correlation, within a window of time comprising a time at which an event described by the event message occurred.
7. The method of claim 1 , wherein the service metric data comprises service metric data associated with each of the plurality of service metrics.
8. The method of claim 1 , further comprising;
implementing, by the management station, a service model; and
identifying, by the management station, the at least one of the plurality of service metrics based at least in part on the service model.
9. A computer-readable storage device comprising computer-readable instructions stored thereon that can be executed on a processing device to cause the processing device to perform the actions of:
storing, by a management station, a plurality of event messages and system metric data comprising service metric data, wherein at least one system metric data value triggers an event message of the plurality of event messages;
determining, by the management station, a degree of correlation between a system metric associated with a system component that triggered the event message and at least one of a plurality of service metrics by calculating a correlation coefficient between the system metric associated with the system component that triggered the event message and at least one of the plurality of service metrics, said degree of correlation based at least in part on the system metric data and the service metric data, wherein the service metrics correspond to service level objectives defined within service level agreements; and
enriching, by the management station, the event message based at least in part on the degree of correlation and including the calculated correlation coefficient, information for one or more correlated service metrics and a priority value in the event message.
10. A networked computer system, comprising:
a communication network; and
a plurality of computer systems each coupled to the communication network, at least one computer system of the plurality of computer systems comprising:
a storage device that stores a plurality of event messages and system metric data that comprises service metric data, wherein at least one system metric data value triggers an event message of the plurality of event messages; and
a processing unit, coupled to the storage device, that determines a degree of correlation between a system metric associated with a system component that triggered the event message and at least one of a plurality of service metrics by calculating a correlation coefficient between the system metric associated with the system component that triggered the event message and at least one of the plurality of service metrics, said degree of correlation based at least in part on the system metric data and the service metric data, wherein the service metrics correspond to service level objectives defined within service level agreements;
wherein the processing unit enriches the event message based at least in part on the degree of correlation and including the calculated correlation coefficient, information for one or more correlated service metrics and a priority value in the event message.
11. The networked computer system of claim 10 , the at least one computer system further comprising:
a communication interface, coupled to the processing unit, that receives the system metric data and externally generated event messages from at least one other of the plurality of computer systems;
wherein the processing unit further produces internally generated event messages based at least in part on the system metric data; and
wherein the plurality of event messages comprises the externally generated event messages or the internally generated event messages.
12. The computer system of claim 10 , wherein the processing unit enriches the event message by modifying existing information within the event message.
13. The computer system of claim 12 , wherein modifying the existing information comprises modifying the priority value based at least in part on the degree of correlation using the calculated correlation coefficient.
14. The computer system of claim 10 , wherein the processing unit identifies subsets of the system and service metric data, used to determine at least in part the degree of correlation, within a window of time comprising a time at which an event described by the event message occurred.
15. The computer system of claim 10 , wherein the service metric data comprises service metric data associated with each of the plurality of service metrics.
16. The computer system of claim 10 , wherein the processing unit further implements a service model and wherein the processing unit identifies the at least one service metric based at least in part on the service model.
17. The computer system of claim 10 , wherein the processing unit determines the degree of correlation by calculating a Pearson product-moment correlation coefficient.