Using and updating topological relationships amongst a set of nodes in event clustering

1. A non-transitory computer readable medium comprising instructions which, when executed by one or more hardware processors, cause performance of operations comprising:

identifying a plurality of events that occur on a set of nodes in a computing environment;

determining a first cluster of related events, from the plurality of events, based on an existing set of topological relationships associated with the set of nodes;

determining that there is event co-occurrence between (a) one or more events of the first cluster of related events and (b) a first event that is not within the first cluster of related events;

based at least on the event co-occurrence between (a) the one or more events of the first cluster of related events and (b) the first event:

determining an event-based topological relationship between (a) a first node, of the set of nodes, that is associated with at least one event of the first cluster of related events and (b) a second node, of the set of nodes, that is associated with the first event but not associated with any event of the first cluster of related events;

identifying a second event that is associated with the first node;

identifying a third event, not already within the plurality of events, that is associated with the second node; and

based at least on the event-based topological relationship: clustering the second event and the third event into a second cluster of related events.

2. The medium of claim 1 , wherein:

the operations further comprise:

determining a level of interdependence between occurrence of events on the first node and occurrence of events on the second node;

determining that the level of interdependence is above a threshold value; and

determining the event-based topological relationship between the first node and the second node is further based on determining that the level of interdependence is above the threshold value.

3. The medium of claim 2 , wherein determining the level of interdependence comprises:

determining a first probability of a cluster having a fourth event on the second node;

determining a second probability of a cluster having both (a) a fifth on the second node and (b) a sixth event on the first node that is within a threshold duration of time from the fifth event on the second node; and

dividing the second probability by the first probability to obtain the level of interdependence.

4. The medium of claim 1 , wherein:

the operations further comprise: determining that the one or more events of the first cluster of related events and the first event satisfy a statistical criteria; and

determining the event-based topological relationship between the first node and the second node is further based on determining that the one or more events of the first cluster of related events and the first event satisfy the statistical criteria.

5. The medium of claim 1 , wherein the operations further comprise:

adding the event-based topological relationship between the first node and the second node to the existing set of topological relationships.

6. The medium of claim 1 , wherein the existing set of topological relationships includes:

a topological relationship that is determined based on one or more configuration files associated with one or more of the set of nodes.

7. The medium of claim 1 , wherein the existing set of topological relationships includes:

a topological relationship that is specified via user input.

8. The medium of claim 1 , wherein identifying the first cluster of related events based on the existing set of topological relationships associated with the set of nodes comprises:

determining that a fourth event and a fifth event occur within a threshold duration of time of each other;

determining that a third node, on which the fourth event occurs, and a fourth node, on which the fifth event occurs, are within a threshold number of hops from each other based on the existing set of topological relationships; and

determining that the fourth event and the fifth event are within the first cluster of related events.

9. The medium of claim 1 , wherein the operations further comprise:

based at least on the event co-occurrence between (a) the one or more events of the first cluster of related events and (b) the first event: adding the first event to the first cluster of related events.

10. The medium of claim 1 , wherein the first cluster of related events and the second cluster of related events are different.

11. The medium of claim 1 , wherein the first cluster of related events is same as the second cluster of related events.

12. The medium of claim 1 , wherein the operations further comprise:

presenting, at a user interface, information associated with the second cluster of related events, wherein the information associated with the second cluster of related events indicates that the second cluster of related events includes the second event and the third event.

13. The medium of claim 1 , wherein the operations further comprise:

responsive to determining that the second cluster of related events includes the second event and the third event: selecting the second event for analysis without selecting the third event for analysis.

14. The medium of claim 1 , wherein the operations further comprise:

determining that the third event, within the second cluster of related events, has been resolved;

responsive to determining that the third event has been resolved: indicating that the second event, within the second cluster of related events, is also resolved.

15. A method, comprising:

identifying a plurality of events that occur on a set of nodes in a computing environment;

determining a first cluster of related events, from the plurality of events, based on an existing set of topological relationships associated with the set of nodes;

determining that there is event co-occurrence between (a) one or more events of the first cluster of related events and (b) a first event that is not within the first cluster of related events;

based at least on the event co-occurrence between (a) the one or more events of the first cluster of related events and (b) the first event:

determining an event-based topological relationship between (a) a first node, of the set of nodes, that is associated with at least one event of the first cluster of related events and (b) a second node, of the set of nodes, that is associated with the first event but not associated with any event of the first cluster of related events;

identifying a second event that is associated with the first node;

identifying a third event, not already within the plurality of events, that is associated with the second node; and

based at least on the event-based topological relationship: clustering the second event and the third event into a second cluster of related events;

wherein the method is performed by at least one device including a hardware processor.

16. The method of claim 15 , further comprising:

determining a level of interdependence between occurrence of events on the first node and occurrence of events on the second node;

determining that the level of interdependence is above a threshold value;

wherein determining the event-based topological relationship between the first node and the second node is further based on determining that the level of interdependence is above the threshold value.

17. The method of claim 16 , wherein determining the level of interdependence comprises:

determining a first probability of a cluster having a fourth event on the second node;

determining a second probability of a cluster having both (a) a fifth on the second node and (b) a sixth event on the first node that is within a threshold duration of time from the fifth event on the second node; and

dividing the second probability by the first probability to obtain the level of interdependence.

18. A system, comprising:

at least one device including a hardware processor; and

the system being configured to perform operations comprising:

identifying a plurality of events that occur on a set of nodes in a computing environment;

determining a first cluster of related events, from the plurality of events, based on an existing set of topological relationships associated with the set of nodes;

determining that there is event co-occurrence between (a) one or more events of the first cluster of related events and (b) a first event that is not within the first cluster of related events;

based at least on the event co-occurrence between (a) the one or more events of the first cluster of related events and (b) the first event:

determining an event-based topological relationship between (a) a first node, of the set of nodes, that is associated with at least one event of the first cluster of related events and (b) a second node, of the set of nodes, that is associated with the first event but not associated with any event of the first cluster of related events;

identifying a second event that is associated with the first node;

identifying a third event, not already within the plurality of events, that is associated with the second node; and

based at least on the event-based topological relationship: clustering the second event and the third event into a second cluster of related events.

19. The system of claim 18 , wherein:

the operations further comprise:

determining a level of interdependence between occurrence of events on the first node and occurrence of events on the second node;

determining that the level of interdependence is above a threshold value; and

determining the event-based topological relationship between the first node and the second node is further based on determining that the level of interdependence is above the threshold value.

20. The system of claim 19 , wherein determining the level of interdependence comprises:

determining a first probability of a cluster having a fourth event on the second node;

determining a second probability of a cluster having both (a) a fifth on the second node and (b) a sixth event on the first node that is within a threshold duration of time from the fifth event on the second node; and

dividing the second probability by the first probability to obtain the level of interdependence.