Automatic event correlation in computing environments
View Patent ↗Systems and methods of automatic event correlation for computing environments are disclosed. An example method may include parsing an event message to identify an event, and marking the event message when the event is related to a previous event. The method may also include adding the marked event message to a trail of events. The method may also include parsing the trail of events. The method may also include changing the marked event message when parsing the trail of events confirms a condition in the computing environment.
1. A method of automatic event correlation in a computing environment, comprising:
parsing an event message to identify an event, and marking the event message when the event is related to a previous event;
adding the marked event message to a trail of events;
parsing the trail of events; and
changing the marked event message when parsing the trail of events confirms a condition in the computing environment.
2. The method of claim 1 , wherein marking the event message comprises coloring the event message when a pattern is identified.
3. The method of claim 2 , wherein marking the event message comprises changing color of the event message when the pattern is a consequence of another event.
4. The method of claim 2 , wherein coloring the event message describes a plurality of event messages as automated correlation events, strong relational events, and weak relational events.
5. The method of claim 1 , wherein marking the event message is with a unique identifier to distinguish correlations from one another.
6. The method of claim 1 , further comprising clustering high relational events in the trail of events.
7. The method of claim 1 , further comprising temporally parsing event messages, wherein each parsing of the event message is during a predetermined time window.
8. The method of claim 1 , further comprising:
updating a dictionary based on parsing the event message; and
accessing the dictionary in a subsequent parsing of event messages.
9. The method of claim 1 , further comprising mapping events using a topological classification to correlate events.
10. The method of claim 9 , wherein mapping events using a topological classification to correlate events further comprises generating a topology map of configuration items identifying a root cause of issues and potential issues for maintaining operations of a computing environment.
11. The method of claim 1 , wherein the event message includes information of a configuration item or an event object.
12. The method of claim 1 , wherein the condition indicates an anomaly in the computing environment.
13. The method of claim 1 , further comprising parsing the event message by a first parsing module before storing correlation expressions in a container.
14. The method of claim 13 , further comprising parsing the event message from the first parsing module at a second parsing module to follow a trail using correlation expressions from the first parsing module to generate a set of relational events.
15. The method of claim 1 , wherein analyzing a number of event messages temporally indicates a trend which by itself does not indicate an immediate negative effect, but the trend indicates a condition ultimately resulting in an error condition.
16. A system of automatic event correlation in a computing environment, the system comprising program code stored on a computer readable medium and executable by a processor to:
parse an event message to identify an event, and mark the event message if the event is related to a previous event, and add the marked event message to a trail of events;
parse the trail of events; and
change the marked event message when parsing the trail of events confirms a condition in the computing environment.
17. The system of claim 16 , wherein the program code is further executable to:
color the event message when a pattern is identified; and
change the color of the event message when the pattern is a consequence of another event.
18. The system of claim 16 , wherein the event message has an event object and corresponding event state.
19. The system of claim 16 , further comprising a correlation repository to learn events and automate event correlation.
20. The system of claim 19 , wherein the program code is further executable to push correlated events into the correlation repository for future use to adapt and learn continuously.
21. The system of claim 16 , wherein the program code is further executable to cluster high relational events.
22. The system of claim 16 , wherein the program code is further executable to update a dictionary based on parsing event messages.
23. The system of claim 22 , wherein the program code is further executable to access the dictionary to determine event relations.
24. The system of claim 16 , further comprising mapping events using a topological classification of event correlations.
25. The system of claim 16 , wherein the condition predicts an anomaly.