Random event capturing mechanism for application systems
A device may receive a first alert from a first technology layer of an information technology system. The first alert may be associated with an occurrence of a first event within the first technology layer. The device may receive a second alert from a second, different technology layer of the information technology system. The second alert may be associated with an occurrence of a second event within the second technology layer. The device may determine that the first alert is related to the second alert. The device may generate, based on the first alert being related to the second alert, a third alert that includes information associated with the first alert and information associated with the second alert. The device may provide the third alert to at least one of the first technology layer or the second technology layer.
1. A method comprising:
receiving, by a device, a first alert from a first technology layer of an information technology system,
the first alert being associated with an occurrence of a first event within the first technology layer, and
the first technology layer being a database layer;
receiving, by the device, a second alert from a second technology layer of the information technology system,
the second alert being associated with an occurrence of a second event within the second technology layer,
the second technology layer being an application layer or a network layer, and
the second technology layer being different from the first technology layer;
determining, by the device, that the first alert is related to the second alert;
generating, by the device and based on determining that the first alert is related to the second alert, a third alert that includes information associated with the first alert and information associated with the second alert; and
providing, by the device, the third alert to at least one of the first technology layer or the second technology layer.
2. The method of claim 1 , further comprising:
classifying the first alert based on the first alert being associated with at least one of:
a particular device,
a particular process, or
a particular application; and
classifying the second alert based on the second alert being associated with at least one of:
the particular device,
the particular process, or
the particular application,
where determining that the first alert is related to the second alert includes:
determining that the first alert is related to the second alert based on classifying the first alert and classifying the second alert.
3. The method of claim 2 , wherein determining that the first alert is related to the second alert includes:
determining that the first alert and the second alert have a same classification, and
determining that the first alert is related to the second alert based on the first alert and the second alert having the same classification.
4. The method of claim 1 , wherein determining that the first alert is related to the second alert includes:
forming a group of alerts associated with the at least one of:
a particular device,
a particular process, or
a particular application,
determining that the first alert and the second alert are included in the group of alerts, and
determining that the first alert is related to the second alert based on the first alert and the second alert being included in the group of alerts.
5. The method of claim 1 , wherein generating the third alert includes:
determining that the first alert was generated at a first time,
determining that the second alert was generated at a second time,
the second time being subsequent to the first time, and
generating the third alert as a chronological listing of alerts that includes the first alert and the second alert,
the first alert being listed in the chronological listing of alerts prior to the second alert based on the second time being subsequent to the first time.
6. The method of claim 1 , further comprising:
receiving a fourth alert,
the fourth alert being related to the second alert,
where generating the third alert includes:
determining that the fourth alert is related to the second alert,
determining whether the fourth alert is received from the second technology layer, and
selectively including, in the third alert, information associated with the fourth alert based on whether the fourth alert is received from the second technology layer,
the information associated with the fourth alert being included in the third alert when the fourth alert is not received from the second technology layer, and
the information associated with the fourth alert being omitted from the third alert when the fourth alert is received from the second technology layer.
7. The method of claim 1 , further comprising:
determining a sequence of events based on the information associated with the first alert and the information associated with the second alert,
the sequence of events including the first event and the second event; and
determining that the occurrence of the second event results from the occurrence of the first event based on the sequence of events.
8. A device comprising:
a processor to:
receive a first alert from a first technology layer of an information technology system,
the first alert being associated with an occurrence of a first event within the first technology layer, and
the first technology layer being an application layer;
receive a second alert from a second technology layer of the information technology system,
the second alert being associated with an occurrence of a second event within the second technology layer,
the second technology layer being a database layer or a network layer, and
the second technology layer being different from the first technology layer;
determine that the first alert is related to the second alert;
generate, based on the first alert being related to the second alert, a system alert that includes:
alert-related information associated with the first alert, and
alert-related information associated with the second alert; and
provide the system alert to one or more of the first technology layer or the second technology layer.
9. The device of claim 8 , where the processor is further to:
determine a classification for the first alert based on the first alert being associated with one or more of:
a particular device,
a particular process, or
a particular application; and
determine a classification for the second alert based on the first alert being associated with one or more of:
the particular device,
the particular process, or
the particular application,
where, when determining that the first alert is related to the second alert, the processor is to:
determine that the first alert is related to the second alert based on the classification for the first alert and the classification for the second alert.
10. The device of claim 8 , where, when determining that the first alert is related to the second alert, the processor is to:
determine that the first alert and the second alert are associated with a particular classification, and
determine that the first alert is related to the second alert based on the first alert and the second alert being associated with the particular classification.
11. The device of claim 8 , where, when determining that the first alert is related to the second alert, the processor is to:
determine that the first alert is associated with one or more of:
a particular device,
a particular process, or
a particular application,
determine that the second alert is associated with the one or more of the particular device, the particular process, or the particular application,
form a group of alerts associated with the one or more of the particular device, the particular process, or the particular application,
determine that the first alert and the second alert are included in the group of alerts, and
determine that the first alert is related to the second alert based on the first alert and the second alert being included in the group of alerts.
12. The device of claim 8 , where, when generating the system alert, the processor is to:
determine a time at which the first alert was generated,
determine a time at which the second alert was generated, and
generate, based on the time at which the first alert was generated and the time at which the second alert was generated, the system alert as a chronological listing of alerts,
the chronological listing of alerts including the first alert and the second alert.
13. The device of claim 8 ,
where the processor is further to:
receive a fourth alert,
the fourth alert being related to the second alert; and
where, when generating the system alert, the processor is to:
determine that the fourth alert is related to the second alert,
determine whether the fourth alert is received from the second technology layer, and
selectively include, in the system alert, alert-related information associated with the fourth alert based on whether the fourth alert is received from the second technology layer,
the system alert including the alert-related information associated with the fourth alert when the fourth alert is not received from the second technology layer, and
the system alert omitting the alert-related information associated with the fourth alert when the fourth alert is received from the second technology layer.
14. The device of claim 8 , where the processor is further to:
determine a sequence of events based on the alert-related information associated with the first alert and the alert-related information associated with the second alert,
the sequence events including the first event and the second event; and
determine, based on the sequence of events, that the occurrence of the second event results from the occurrence of the first event.
15. A non-transitory computer-readable medium storing instructions, the instructions comprising:
one or more instructions that, when executed by one or more processors, cause the one or more processors to:
receive a first alert associated with an occurrence of a first event,
the first event occurring within a first technology layer of an information technology system, and
the first technology layer being an application layer or a database layer;
receive a second alert from a second technology layer of the information technology system,
the second alert being associated with an occurrence of a second event within the second technology layer, and
the second technology layer being a network layer;
determine that the first alert is related to the second alert;
generate, based on the first alert being related to the second alert, a system alert that includes:
alert-related information associated with the first alert, and
alert-related information associated with the second alert;
and
provide the system alert to at least one of the first technology layer or the second technology layer.
16. The non-transitory computer-readable medium of claim 15 , where the instructions further comprise:
one or more instructions that, when executed by the one or more processors, cause the one or more processors to:
determine a classification for the first alert based on the first alert being associated with:
a particular device,
a particular process, or
a particular application; and
determine a classification for the second alert based on the second alert being associated with:
the particular device,
the particular process, or
the particular application; and
where the one or more instructions to determine that the first alert is related to the second alert include:
one or more instructions that, when executed by the one or more processors, cause the one or more processors to:
determine that the first alert is related to the second alert based on the classification for the first alert and the classification for the second alert.
17. The non-transitory computer-readable medium of claim 15 , where the one or more instructions to determine that the first alert is related to the second alert include:
one or more instructions that, when executed by the one or more processors, cause the one or more processors to:
determine that the first alert and the second alert are associated with a particular classification, and
determine that the first alert is related to the second alert based on the first alert and the second alert being associated with the particular classification.
18. The non-transitory computer-readable medium of claim 15 , where the one or more instructions to determine that the first alert is related to the second alert include:
one or more instructions that, when executed by the one or more processors, cause the one or more processors to:
determine that the first alert is associated with a particular application provided by the information technology system,
determine that the second alert is associated with the particular application,
form a group of alerts associated with the particular application,
the first alert and the second alert being included in the group of alerts, and
determine that the first alert is related to the second alert based on the first alert and the second alert being included in the group of alerts.
19. The non-transitory computer-readable medium of claim 15 , where the one or more instructions to generate the system alert include:
one or more instructions that, when executed by the one or more processors, cause the one or more processors to:
determine a time at which the first alert was generated,
determine a time at which the second alert was generated,
generate, based on the time at which the first alert was generated and the time at which the second alert was generated, a chronological listing of alerts, and
generate the system alert based on the chronological listing of alerts,
the chronological listing of alerts including the first alert and the second alert.
20. The non-transitory computer-readable medium of claim 15 , where the instructions further comprise:
one or more instructions that, when executed by the one or more processors, cause the one or more processors to:
determine a sequence of events based on the alert-related information associated with the first alert and the alert-related information associated with the second alert; and
determine, based on the sequence of events, that the first event is a root cause of the second event.