System for decomposing events from managed infrastructures that includes a reference tool signalizer
A system is provided for clustering events. A first engine is configured to receive message data from managed infrastructure that includes managed infrastructure physical hardware that supports the flow and processing of information. A second engine determines common characteristics of events and produces dusters of events relating to the failure of errors in the managed infrastructure. Membership in a cluster indicates a common factor of the events that is a failure or an actionable problem in the physical hardware managed infrastructure directed to supporting the flow and processing of information. One or more situations is created that is a collection of one or more events or alerts representative of the actionable problem in the managed infrastructure. In response to the production of the clusters one or more physical changes is made to at least a portion of the managed infrastructure hardware.
1. A system for clustering events, comprising: a managed infrastructure with hardware components; a first engine configured to receive message data from managed infrastructure that includes managed infrastructure physical hardware that supports the flow and processing of information, the first engine producing events that relate to the managed infrastructure and converts the events into a sequence of attributes that have text or numerical values indicative of a state of a hardware component; a second engine that uses one or more recipes as a subset of monitored events which are analyzed using a feature detection algorithm to determine textual similarity, when there is a textual similarity, then it determines that collections of events share a common attribute, possessing either identically equal textual values, or values that are similar to a pre-defined threshold with production of an output of clusters, and in response to production of the clusters one or more physical changes in a managed infrastructure hardware is made; associated to these clusters are one or more situations which we define as this collection of one or more events or alerts representative of the actionable problem or incident in the managed infrastructure.
2. The system of claim 1 , wherein the reference tool is modifiable.
3. The system of claim 1 , wherein the reference tool includes one or more filters and determines one or more algorithms to use for a set of events.
4. The system of claim 1 , further comprising:
reference tool recipes, where a recipe is a subset of monitored events are analyzed using a specific feature detection algorithm.
5. The system of claim 1 , wherein a recipe captures parameters that govern the behavior of a feature detection algorithm.
6. The system of claim 4 , wherein at least a portion of be recipes create situations using qualifying factors.
7. The system of claim 6 , wherein at least a portion of the qualifying factors are selected from one or more of: event filtering; rate calculations, and; flexible similarity comparisons.
8. The system of claim 4 , wherein at least a portion of the reference tool recipes have a deterministic behavior.
9. The system of claim 1 , wherein at least one factor is selected from at least one of: a frequency of an alert; a temporal proximity of an alert; a temporal proximity of an event; a trigger; a creation of a recipe; an editing of a recipe; a determination of which of an alert and is clustered into a situation, and; a determination of which of an event is clustered into a situation.
10. The system of claim 1 , wherein the reference tool is a reference tool signalizer.
11. The system of claim 10 , wherein the reference tool signalizer is a signalizer algorithmic decomposition of events implemented in code.
12. The system of claim 11 , wherein the algorithmic decomposition of events is available in one or more files of settings that creates situations in a deterministic way using recipes.
13. The system of claim 12 , wherein the reference tools are collections of recipes with further settings.
14. The system of claim 13 , wherein the reference tool signalizer includes one or more of: a default configuration, and; configuring a reference tool recipe.
15. The system of claim 14 , where configuration of a reference tool recipe includes one or more of a recipe; creation; editing; duplication; deletion; and matching list items.
16. The system of claim 15 , wherein matching list items includes custom information.
17. The system of claim 1 , wherein the reference tool is configured by editing a default reference tool.
18. The system of claim 1 , wherein a user can edit a reference tool recipe.
19. The system of claim 1 , wherein a user can create a reference tool recipe.
20. The system of claim 1 , wherein a user can create a new reference tool with settings that are the same as an existing reference tool.
21. The system of claim 1 , wherein a user can delete a reference tool.