SYSTEM AND METHOD PROVIDING LEARNING CORRELATION OF EVENT DATA
Systems, methods, architectures and/or apparatus for implementing an event correlation function in which a correlation window (CW) utilized therefor is dynamically adapted in response to changes in average correlation distance (CD) as indicated by unambiguous event pair occurrences.
1 . A method for correlating events, comprising:
in response to an event correlation request indicative of an event of interest, examining event log information within a correlation window (CW) to identify one or more events correlated with said event of interest; and
in response to an occurrence of an unambiguous event pair, updating said CW using correlation distance (CD) information associated with said unambiguous event pair.
2 . The method of claim 1 , wherein said event of interest comprises a virtual machine (VM) event within a data center (DC), and said one or more events correlated with said event of interest comprise Border Gateway Protocol (BGP) events.
3 . The method of claim 1 , wherein said event of interest comprises a Border Gateway Protocol (BGP) within a data center (DC), and said one or more events correlated with said event of interest comprise virtual machine (VM) events.
4 . The method of claim 1 , wherein said CW is defined as an Average CD±one CD Standard Deviation.
5 . The method of claim 2 , wherein said CW is defined as
+Average CD±one CD Standard Deviation.
6 . The method of claim 3 , wherein said CW is defined as
−Average CD±one CD Standard Deviation.
7 . The method of claim 1 , wherein said occurrence of an unambiguous event pair is determined by:
detecting an event of interest;
examining event log portions associated with a selected timer interval to identify therein any candidate root events; and
in the case of a single candidate root event, selecting the single candidate root event as being correlated with the event of interest to provide thereby said unambiguous event pair.
8 . The method of claim 7 , wherein said timer interval comprises said CW.
9 . The method of claim 7 , wherein said timer interval comprises an Unambiguous Event Correlation Window (UECW) selected according to a type of event of interest.
10 . The method of claim 9 , wherein said type of event of interest comprises one of a failure event and a recovery event.
11 . The method of claim 7 , wherein said selected interval is increased in duration in response to a failure to find a candidate root event during said selected interval.
12 . The method of claim 11 , wherein said selected interval is decreased in duration in response to finding more than one candidate root event during said selected interval.
13 . The method of claim 12 , wherein said selected interval is increased or decreased by a fixed amount of time.
14 . The method of claim 12 , wherein said selected interval is increased or decreased by a fixed percentage of said selected interval.
15 . The method of claim 7 , wherein said event of interest comprises one or more of a BGP fault/failure event, a BGP fault/failure recovery event, a VM fault/failure event and a VM fault/failure recovery event.
16 . The method of claim 5 , wherein said Average CD comprises a rolling average of CDs for a plurality of unambiguous event pairs.
17 . The method of claim 5 , wherein said Average CD comprises a weighted average of CDs for a plurality of unambiguous event pairs, wherein more recent pairs are given a higher weight than less recent pairs.
18 . An apparatus for correlating events, the apparatus comprising:
a processor configured for:
in response to an event correlation request indicative of an event of interest, examining event log information within a correlation window (CW) to identify one or more events correlated with said event of interest; and
in response to an occurrence of an unambiguous event pair, updating said CW using correlation distance (CD) information associated with said unambiguous event pair.
19 . A tangible and non-transient computer readable storage medium storing instructions which, when executed by a computer, adapt the operation of the computer to perform a method for correlating events, the method comprising:
in response to an event correlation request indicative of a event of interest, examining event log information within a correlation window (CW) to identify one or more events correlated with said event of interest; and
in response to an occurrence of an unambiguous event pair, updating said CW using correlation distance (CD) information associated with said unambiguous event pair.
20 . A computer program product wherein computer instructions, when executed by a processor in a network element, adapt the operation of the network element to provide a method for correlating events, the method comprising:
in response to an event correlation request indicative of an event of interest, examining event log information within a correlation window (CW) to identify one or more events correlated with said event of interest; and
in response to an occurrence of an unambiguous event pair, updating said CW using correlation distance (CD) information associated with said unambiguous event pair.