Analyzing policies executed in a computer system
There is provided a method, apparatus and computer program product for analysing policies executed in a computer system which comprises a plurality of entities. The system is operable to detect one or more policies within a set of policies that have executed a predetermined number of times within a time window; identify a plurality of co-occurring, and thereby related, policies based on the detecting; and group the identified co-occurring policies.
1. A method for analysing policies executed in a computer system which comprises a plurality of entities, the system operable to emit a plurality of events providing status information for any of the entities in the system and wherein emitted events cause one or more policies to execute, the method comprising:
detecting one or more policies within a set of policies that have executed a predetermined number of times within a time window;
identifying a plurality of co-occurring, and thereby related, policies based on the detecting; and
grouping the identified co-occurring policies.
2. The method of claim 1 , wherein the time window is a rolling time window.
3. The method of claim 1 , comprising:
responsive to a policy executing, determining that the predetermined number has been met for a plurality of policies comprising the set.
4. The method of claim 1 , comprising:
presenting the one or more identified co-occurring policies to a user.
5. The method of claim 1 , comprising:
responsive to a user changing a policy of the set of policies, identifying a group that the changed policy is associated with; and
displaying suggestions to the user indicating that the user should consider changing one or more additional policies in the identified group.
6. The method of claim 1 , wherein the detecting comprises:
using an association rule mining algorithm to identify relationships between policies.
7. The method of claim 6 , wherein a support parameter determines one or more instances of co-occurrence required to identify a group of policies as related, and a confidence parameter determines a required similarity of the instances.
8. The method of claim 7 , wherein the support parameter and the confidence parameter are set empirically based on training data or using a default value.
9. The method of claim 5 , wherein event information about events emitted by the system is stored in a database, the method comprising:
responsive to one or more suggestions, making changes to one or more policies within one or more groups;
replaying, on-demand, one or more events stored in the database;
tracking one or more resulting policy executions; and
analysing the policy executions to produce updated policy grouping information.
10. An apparatus for analysing policies executed in a computer system which comprises a plurality of entities, the system operable to emit a plurality of events providing status information for any of the entities in the system and wherein emitted events cause one or more policies to execute, the apparatus comprising:
one or more processors;
a memory coupled to at least one of the processors; and
a set of computer program instructions stored in the memory and executed by at least one of the processors in order to perform a method comprising:
detecting one or more policies within a set of policies that have executed a predetermined number of times within a time window;
identifying a plurality of co-occurring, and thereby related, policies based on the detecting; and
grouping the identified co-occurring policies.
11. The apparatus of claim 10 , wherein the time window is a rolling time window.
12. The apparatus of claim 10 , wherein the method comprises:
presenting the one or more identified co-occurring policies to a user.
13. The apparatus of claim 10 , wherein the method comprises:
responsive to a user changing a policy of the set of policies, identifying a group that the changed policy is associated with; and
displaying suggestions to the user indicating that the user should consider changing one or more additional policies in the identified group.
14. The apparatus of claim 10 , wherein the detecting comprises using an association rule mining algorithm to identify relationships between policies, and wherein a support parameter determines one or more instances of co-occurrence required to identify a group of policies as related, and a confidence parameter determines a required similarity of the instances.
15. A computer program product for analysing policies executed in a computer system which comprises a plurality of entities, the system operable to emit a plurality of events providing status information for any of the entities in the system and wherein emitted events cause one or more policies to execute, the computer program product comprising:
a computer readable storage medium, comprising computer program code that, when executed by a computer performs a method comprising the steps of:
detecting one or more policies within a set of policies that have executed a predetermined number of times within a time window;
identifying a plurality of co-occurring, and thereby related, policies based on the detecting; and
grouping the identified co-occurring policies.
16. The computer program product of claim 15 , wherein the time window is a rolling time window.
17. The computer program product of claim 15 , wherein the method comprises:
presenting the one or more identified co-occurring policies to a user.
18. The computer program product of claim 15 , wherein the method comprises:
responsive to a user changing a policy of the set of policies, identifying a group that the changed policy is associated with; and
displaying suggestions to the user indicating that the user should consider changing one or more additional policies in the identified group.
19. The computer program product of claim 15 , wherein the detecting comprises using an association rule mining algorithm to identify relationships between policies, and wherein a support parameter determines one or more instances of co-occurrence required to identify a group of policies as related, and a confidence parameter determines a required similarity of the instances.
20. The computer program product of claim 18 , wherein event information about events emitted by the system is stored in a database, the method comprising:
responsive to one or more suggestions, making changes to one or more policies within one or more groups;
replaying, on-demand, one or more events stored in the database;
tracking one or more resulting policy executions; and
analysing the policy executions to produce updated policy grouping information.