Method and apparatus for exercising and debugging correlations for network system
View Patent ↗A selected time interval of previously stored events generated by a number of computer network devices are replayed and cross-correlated according to rules. Meta-events are generated when the events satisfy conditions associated with one or more of the rules. The rules used during replay may differ from prior rules used at a time when the events occurred within a computer network that included the computer network devices. In this way, new rules can be tested against true event data streams to determine whether or not the rules should be used in a live environment (i.e., the efficacy of the rules can be tested and/or debugged against actual event data).
1. A method, comprising:
a first device, including a first hardware processor, receiving events, wherein one or more of the events originated in an event log that was generated by a computer network device;
the first device normalizing the events to a common event schema;
the first device transmitting the normalized events to a second device including a second hardware processor;
the second device receiving the normalized events and correlating the normalized events according to a first rule;
the first device storing the normalized events to a computer-readable storage device;
the first device retrieving one or more of the normalized events from the computer-readable storage device;
the first device transmitting the retrieved normalized events to the second device; and
the second device receiving the retrieved normalized events and correlating the retrieved normalized events according to a second rule, wherein the second rule differs from the first rule,
wherein the second rule is applied to live events reported by one or more computer network devices.
2. The method of claim 1 , further comprising displaying a meta-event.
3. The method of claim 2 , wherein the meta-event represents an instance for which various ones or more of the retrieved normalized events satisfy a condition associated with the second rule.
4. The method of claim 1 , wherein prior to being normalized, one or more of the events was gathered from one or more of routers, e-mail logs, anti-virus products, firewalls, network intrusion detection systems, access control servers, virtual private network systems, network device event logs, and network device Syslogs.
5. The method of claim 1 , wherein the first device stores a software agent that is associated with the computer network device.
6. The method of claim 1 , wherein the first device transmits the retrieved normalized events in response to user selection.
7. The method of claim 6 , wherein the user selection is made through a graphical user interface having elements defining modes of re-transmission.
8. The method of claim 7 , wherein the modes of re-transmission include “play”, “fast forward” and “reverse”.
9. The method of claim 6 , wherein the user selection indicates a time interval.
10. The method of claim 1 , wherein the transmission of the retrieved normalized events to the second device is performed faster than the initial transmission of the normalized events to the second device.
11. A system, comprising:
a first device comprising a first hardware processor configured to:
receive events, wherein one or more of the events originated in an event log that was generated by a computer network device;
normalize the events to a common event schema;
transmit the normalized events to a second device;
store the normalized events to a computer-readable storage device;
retrieve one or more of the normalized events from the computer-readable storage device; and
transmit the retrieved normalized events to the second device; and
the second device comprising a second hardware processor configured to:
receive the normalized events and correlate the normalized events according to a first rule; and
receive the retrieved normalized events and correlate the retrieved normalized events according to a second rule, wherein the second rule differs from the first rule,
wherein the second rule is applied to live events reported by one or more computer network devices.
12. The system of claim 11 , wherein the second hardware processor of the second device is further configured to display a meta-event.
13. The system of claim 12 , wherein the meta-event represents an instance for which various ones or more of the retrieved normalized events satisfy a condition associated with the second rule.
14. The system of claim 11 , wherein prior to being normalized, one or more of the events was gathered from one or more of routers, e-mail logs, anti-virus products, firewalls, network intrusion detection systems, access control servers, virtual private network systems, network device event logs, and network device Syslogs.
15. The system of claim 11 , wherein the first device stores a software agent that is associated with the computer network device.
16. The system of claim 11 , wherein the hardware processor of the first device is further configured to transmit the retrieved normalized events in response to user selection.
17. The system of claim 16 , wherein the user selection is made through a graphical user interface having elements defining modes of re-transmission.
18. The system of claim 17 , wherein the modes of re-transmission include “play”, “fast forward” and “reverse”.
19. The system of claim 16 , wherein the user selection indicates a time interval.
20. The system of claim 11 , wherein the transmission of the retrieved normalized events to the second device is performed faster than the initial transmission of the normalized events to the second device.