Using and updating topological relationships between a set of nodes in event clustering

Abstract

Disclosed is the use and updating of topological relationships between a set of nodes in event clustering. A current event occurs at a current node. A first group of related events includes a first event that occurs at a first node and is temporally related to the current event. The first group does not include any event that is topologically related to the current event based on an existing set of topological relationships. A level of mutual dependence between (a) the occurrence of an event at the current node and (b) the occurrence of an event at the first node is determined. Based on the level of mutual dependence, the current event is added to the first group. In addition, an event-based topological relationship between a first node and a second node is added to the set of topological relationships. Subsequently, a group of new events can be determined based on the event-based topological relationship between the first node and the second node.

Description

Technical Field

[0001] The present disclosure relates to clustering events associated with nodes of a computing system. In particular, the present disclosure relates to using and updating topological relationships between a set of nodes in event clustering. Background Art

[0002] The computing system includes various nodes. A "node" refers to any hardware and / or software component, such as a physical machine, a virtual machine, an operating system, a firmware program, a middleware program, an application, a web service, and / or a software service.

[0003] Each node is associated with various metrics. A "metric" is a measurement of a particular characteristic of a node's performance or efficiency. Examples of metrics include availability, response time, capacity, load, latency, completion time, service time, bandwidth, throughput, relative efficiency, scalability, performance per watt, compression ratio, instruction path length and speedup, processing time (or central processing unit (CPU) time), idle time, input / output (I / O) time, reliability, time between failures, repair time, frequency of security threats, and / or severity of security threats.

[0004] When a metric associated with a node meets certain criteria, an event occurs on the node. A notification of the event is generated so that engineers and / or external applications can analyze, resolve and / or process the event.

[0005] In complex computing systems, the frequency of events can be very high. Processing each event individually would be very burdensome. In addition, multiple events may originate from the same cause. Processing each event without considering related events is inefficient.

[0006] The approaches described in this section are approaches that could be pursued, but are not necessarily approaches that have been previously conceived or pursued. Therefore, unless otherwise indicated, it should not be assumed that any of the approaches described in this section qualify as prior art merely by virtue of their inclusion in this section. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Embodiments are illustrated in the figures of the accompanying drawings by way of example and not limitation. It should be noted that references to "one" or "an" embodiment in the present disclosure do not necessarily refer to the same embodiment, and they mean at least one embodiment. In the drawings:

[0008] Figure 1A illustrates a clustering feedback system according to one or more embodiments;

[0009] Figure 1B illustrates an example relationship graph indicating a topological relationship between a set of nodes of a target computing system according to one or more embodiments;

[0010] Figure 2A-2B illustrates a set of example operations for using and updating topological relationships between a set of nodes in event clustering according to one or more embodiments;

[0011] Figure 3A-3B illustrates an example feedback loop for using and updating topological relationships between a set of nodes in event clustering according to one or more embodiments; and

[0012] Figure 4 A block diagram illustrating a computer system in accordance with one or more embodiments is shown. DETAILED DESCRIPTION

[0013] In the following description, for the purpose of explanation, many specific details are set forth to provide a thorough understanding. One or more embodiments may be practiced without these specific details. Features described in one embodiment may be combined with features described in different embodiments. In some examples, well-known structures and devices are described with reference to block diagram form to avoid unnecessarily obscuring the present invention.

[0014] 1. General Overview

[0015] 2. Clustering feedback system architecture

[0016] 3. Using and updating the topological relationships between a set of nodes in event clustering

[0017] 4. Example Embodiments

[0018] 5. Hardware Overview

[0019] 6. Other aspects; expansion

[0020] 1. General Overview

[0021] One or more embodiments include using and updating topological relationships between a set of nodes in event clustering. An existing set of topological relationships between a set of nodes in a computing system is identified. The topological relationships between specific nodes indicate that the specific nodes are related to each other in a manner in which the specific nodes operate together in the computing system. The existing set of topological relationships is used to identify a first group of related events.

[0022] The second event occurs at the second node. The second event is temporally related to the first event occurring at the first node within the first group of related events. However, based on an existing set of topological relationships, the second event is not topologically related to any event within the first group of related events.

[0023] A level of interdependence between (a) an occurrence of an event at a first node and (b) an occurrence of an event at a second node is determined. Based on the level of interdependence, the second event is added to the first group. Additionally, an event-based topological relationship between the first node and the second node is determined. The set of topological relationships between the set of nodes is updated to include the event-based topological relationship between the first node and the second node.

[0024] Subsequently, a third event occurs on the first node, and a fourth event occurs on the second node. Based on the event-based topological relationship between the first node and the second node, the third event and the fourth event are clustered into the same group.

[0025] Given that processing events individually may lead to inefficiencies and redundancies, clustering related events allows related events to be analyzed, resolved, and / or processed as a group. Thus, clustering events improves the processing of events.

[0026] However, clustering events based on a set of static topological relationships may result in inaccurate clustering. Specifically, a set of static topological relationships may miss a specific topological relationship between a first node and a second node. A first event that occurs on a first node and is actually related to a second event that occurs on a second node may be mistakenly classified as irrelevant. The first event will be in a first group, and the second event will be in a separate second group. The first group and the second group will be analyzed separately, but analyzing the two groups together will be more efficient. Based on the technology described herein, event information is used to update a set of topological relationships between a set of nodes. Specifically, based on event co-occurance and mutual dependence, a topological relationship based on events between a first node and a second node is added to the set of topological relationships. Thereafter, based on the newly added topological relationship based on events between the first node and the second node, it can be determined that the events that occur on the first node and the second node are in the same group and therefore analyzed together.

[0027] One or more embodiments described in this specification and / or recited in the claims may not be included in this General Summary section.

[0028] 2. Clustering feedback system architecture

[0029] Figure 1A and 1B A clustering feedback system according to one or more embodiments is illustrated. Figure 1A and 1B As shown in FIG. 1 , system 100 includes target computing system 102, which includes nodes 104a-c and monitoring agents 106a-b. System 100 also includes cluster manager 110, data repository 116, and interface 124. In one or more embodiments, system 100 may include more than Figure 1A and 1B More or fewer components may be used than shown. Figure 1A and 1B The components shown in may be local to each other or remote from each other. Figure 1A and 1B The components shown in the figure can be implemented in software and / or hardware. Each component can be distributed on multiple applications and / or machines. Multiple components can be combined into one application and / or machine. The operation described with respect to one component can be performed by another component instead.

[0030] In one or more embodiments, target computing system 102 is the computing system being analyzed. Events occurring on nodes 104a-c in target computing system 102 are analyzed to determine any problems that may be occurring within target computing system 102.

[0031] In one or more embodiments, a node, such as any of nodes 104a-c, refers to any hardware and / or software component within target computing system 102. Examples of nodes include a physical machine, a virtual machine, an operating system, a firmware program, a middleware program, an application, a web service, and / or a software service.

[0032] In one or more embodiments, monitoring agent (such as any one of monitoring agent 106a-b) refers to software and / or hardware configured to monitor the metric and / or event associated with one or more nodes 104a-c. Monitoring agent generates notifications related to the metric and / or event associated with node 104a-c. As shown, monitoring agent 106a monitors the metric and / or event of node 104a. Monitoring agent 106b monitors the metric and / or event of node 104b and node 104c. Monitoring agent can be a component separated from the monitored node. Alternatively, monitoring agent can be a component in the monitored node.

[0033] A metric of a node is a measurement of a particular characteristic of the performance or efficiency of the node. Examples of metrics include availability, response time, capacity, load, latency, completion time, service time, bandwidth, throughput, relative efficiency, scalability, performance per watt, compression ratio, instruction path length and speedup, processing time (or central processing unit (CPU) time), idle time, input / output (I / O) time, reliability, time between failures, repair time, frequency of security threats, and / or severity of security threats.

[0034] When the metric associated with a node meets a certain standard, an event (such as event 108a-b) occurs on the node. As an example, an event may occur when the availability of a node drops below a threshold. As another example, an event may occur when the response time of a node exceeds a threshold. As another example, an event may occur when a security threat of a particular type is detected. As shown, monitoring agent 106a determines that event 108a has occurred. Monitoring agent 106b determines that event 108b has occurred.

[0035] In one or more embodiments, data repository 116 is any type of storage unit and / or device for storing data (e.g., a file system, a database, a collection of tables, or any other storage mechanism). In addition, data repository 116 may include multiple different storage units and / or devices. Multiple different storage units and / or devices may or may not be of the same type or located at the same physical site. In addition, data repository 116 may be implemented or executed on the same computing system as cluster manager 110. Alternatively or additionally, data repository 116 may be implemented or executed on a computing system separate from cluster manager 110. Data repository 116 may be coupled to cluster manager 110 via a direct connection or via a network communication.

[0036] The information describing the relationship repository 118 may be implemented across any component within the system 100. However, for purposes of clarity and explanation, this information is illustrated within the data repository 116.

[0037] In one or more embodiments, the relationship repository 118 refers to information indicating topological relationships between a set of nodes 104a-c in the target computing system 102. The topological relationships between specific nodes indicate that the specific nodes are related to each other in a manner in which the specific nodes operate together in the computing system. Various types of topological relationships may be included. The relationship repository 118 indicates the overall architecture and / or arrangement of the nodes 104a-c.

[0038] In an embodiment, the structural topological relationship 120 is a topological relationship determined based on analyzing code, files, and / or operations of the target computing environment 102 .

[0039] A set of codes executed by one or more nodes of the target computing environment 102 may indicate various types of structural topological relationships 120. For example, a set of codes may indicate which node is configured to invoke an operation of another node, which node is configured to provide input to another node, which node is configured to receive output of another node, which node is configured to import code and / or data from another node, and / or which node is configured to communicate with another node.

[0040] The files of the target computing environment 102 may include, for example, configuration files, deployment files, and / or other written information associated with the target computing environment 102. The files of the target computing environment 102 may indicate which node is dependent on and / or related to another node.

[0041] The files of the target computing environment 102 may include user input indicating topological relationships between nodes. The user input may indicate that a particular node is dependent on and / or related to another node.

[0042] The operation of the target computing environment 102 may be determined by monitoring the target computing environment 102. Network traffic associated with the target computing environment 102 may be monitored. Additionally or alternatively, functions, methods, and / or steps performed by the target computing environment 102 may be monitored. The operation of the target computing environment 102 may indicate which node invokes an operation of another node, which node provides input to another node, which node receives output from another node, which node imports code and / or data from another node, and / or which node communicates with another node.

[0043] Examples of structural topological relationships 120 include, but are not limited to, a particular node using another node, a particular node being used by another node, a particular node being stored and / or executed on another node, and a particular node communicating with another node. A structural topological relationship 120 may be unidirectional (unidirectional dependency) or bidirectional (bidirectional dependency). A structural topological relationship 120 may be storage-related, input / output (I / O)-related, central processing unit (CPU)-related, storage-related, and / or application-related.

[0044] As an example, the first node may execute a first set of codes. The first set of codes may include operations that depend on operations of the second node. Based on the first set of codes, it may be determined that there is a structural topological relationship between the first node and the second node. Meanwhile, the second node may execute a second set of codes. The second set of codes may include operations that depend on operations of the first node. Based on the first set of codes and the second set of codes, it may be determined that there is a bidirectional structural topological relationship between the first node and the second node.

[0045] As another example, the first node may be associated with a specific configuration file. The specific configuration file may instruct the first node to import code executed on the second node. Based on the specific configuration file, it may be determined that there is a structural topological relationship between the first node and the second node.

[0046] As another example, a computing system may be deployed based on a deployment file. The deployment file may indicate that instantiation of a first node requires instantiation of a second node. Based on the deployment file, it may be determined that a topological relationship exists between the first node and the second node.

[0047] As another example, a specific application may be executed on a specific virtual machine, which is executed on a specific server. Based on the software stack, it can be determined that there is a structural topological relationship between the specific application, the specific virtual machine, and the specific server. In particular, there is one hop between the specific application and the specific virtual machine. There is one hop between the specific virtual machine and the specific server. There are two hops between the specific application and the specific server.

[0048] As another example, network traffic associated with an application may be intercepted. The monitored traffic may indicate that the application transmitted a particular data packet to a database server. The particular data packet may include data to be written to the database server. Based on the network traffic, it may be determined that a structural topological relationship exists between the application and the database server. Furthermore, since the data packet transmitted from the application to the database server includes data to be written to the database server, the structural topological relationship is storage-related.

[0049] In an embodiment, the event-based topological relationship 122 is a topological relationship determined based on event information. Figure 2A-2B Operations for determining event-based topological relationships 122 are described.

[0050] The relationship repository 118 may store relationship information in various forms, such as a relationship graph and / or a relationship table. Figure 1B An example relationship diagram indicating topological relationships between a set of nodes of a target computing system according to one or more embodiments is illustrated. As shown, the relationship diagram 119 includes nodes 104a-f. There is a structural topological relationship 120a between node 104a and node 104c. There is a structural topological relationship 120b between node 104b and node 104c. There is a structural topological relationship 120c between node 104d and node 104e. There is a structural topological relationship 120d between node 104e and node 104f. There is an event-based topological relationship 122a between node 104b and node 104d. There is an event-based topological relationship 122b between node 104a and node 104e.

[0051] " hop " between the first node and the second node represents the distance between the first node and the second node as indicated by the relationship repository 118.Using relationship diagram 119 as an example, there is a direct topological relationship (topological relationship 122a based on events) between node 104b and node 104d.Therefore, node 104b and node 104d are referred to as being "one hop" away from each other.Meanwhile, there is no direct topological relationship between node 104b and node 104e.But, there is a direct topological relationship (topological relationship 122a based on events) between node 104b and node 104d.And there is a direct topological relationship (structural topological relationship 120c) between node 104d and node 104e.Therefore, node 104b and node 104e are referred to as being "two hops" away from each other.Similarly, node 104b and node 104e are referred to as being "three hops" away from each other.

[0052] Return to reference Figure 1A In one or more embodiments, cluster manager 110 refers to hardware and / or software configured to perform the operations described herein for using and updating topological relationships between a set of nodes in event clustering. Figure 2A-2B Describes examples of operations for using and updating topological relationships between a set of nodes in event clustering.

[0053] The cluster manager 110 may include matching logic 112 and interdependence logic 114. The matching logic 112 may be configured to cluster events based on an existing set of topological relationships in the relationship repository 118. The interdependence logic 114 may be configured to update a set of topological relationships in the relationship repository 118 based on event information. The matching logic 112 and the interdependence logic 114 may be implemented in separate modules or components. Alternatively, the matching logic 112 and the interdependence logic 114 may be implemented within the same module or component.

[0054] In an embodiment, cluster manager 110 is implemented on one or more digital devices. The term "digital device" generally refers to any hardware device that includes a processor. A digital device may refer to a physical device or a virtual machine that executes an application. Examples of digital devices include computers, tablet computers, laptops, desktops, netbooks, servers, web servers, network policy servers, proxy servers, general purpose machines, special purpose hardware devices, mainframes, televisions, content receivers, set-top boxes, printers, mobile phones, smart phones, personal digital assistants (PDAs).

[0055] In one or more embodiments, interface 124 refers to hardware and / or software configured to facilitate communications to and / or from cluster manager 110. In embodiments, interface 124 may include a user interface, an application interface, or both.

[0056] In an embodiment, interface 124 is a user interface configured to facilitate communication between cluster manager 110 and a user. The user interface outputs information in the form of user interface elements, and / or receives input of information via user interface elements. Examples of user interfaces include graphical user interfaces (GUIs), command line interfaces (CLIs), tactile interfaces, and voice command interfaces. Examples of user interface elements include text, graphics, check boxes, radio buttons, drop-down lists, list boxes, buttons, toggle keys, text fields, date and time selectors, command lines, sliders, pages, and forms.

[0057] In an embodiment, interface 124 is an application interface configured to facilitate communication between cluster manager 110 and one or more applications. An application interface, such as an application programming interface (API), may facilitate communication based on one or more communication protocols, such as a hypertext transfer protocol (HTTP). The communication protocol may conform to a representational state transfer (REST) ​​architectural style.

[0058] The information describing group 126 may be implemented across any component within system 100. However, for purposes of clarity and explanation, this information is illustrated within interface 124.

[0059] In one or more embodiments, a group 126 is a set of one or more related events. The set of events can be related in various ways.

[0060] In an embodiment, group 126 is a group of related events such that the group of events should be processed together. A user and / or application receiving group 126 via interface 124 processes the group of events included in the group as a group. The user and / or application processes the group of events as a group more efficiently, rather than processing the group of events individually.

[0061] In an embodiment, group 126 includes a related first event and a second event, so that solving the first event will inevitably lead to solving the second event. If the first event and the second event are considered as a group, they will be processed more efficiently. When the first event is marked as solved, the second event can be automatically marked as also solved. As an example, a computing system may include a database node and an application node. The application node can access information from the database node, thereby relying on the database node. Due to an error on the database node, the application node may not be able to access information from the database node. Therefore, an event can be detected on each of the database node and the application node. The event on the database node can be solved. Then, the application node may be able to access information from the database node again. Therefore, in this example, solving the event on the database node will inevitably solve the event on the application node. The event on the database node and the event on the application node can be grouped in the same group.

[0062] In an embodiment, group 126 includes two related events, so that only one of the two events needs to be analyzed when analyzing the performance and / or errors of target computing system 102. When events are grouped in group 126, because only one of the events is selected for analysis, the events are processed more efficiently. The remaining events do not need to be analyzed. As an example, a computing system may include a database node and an application node. The application node can access information from the database node, thereby relying on the database node. Due to errors on the database node, the application node may not be able to access information from the database node. Therefore, events can be detected on each of the database node and the application node. However, solving the event on the database node must solve the event on the application node. Therefore, the user only needs to analyze the event on the database node. The user does not need to analyze the event on the application node separately. The event on the database node and the event on the application node can be grouped in the same group.

[0063] In an embodiment, group 126 is a group of events related by temporal correlation and / or topological correlation. If two events occur within a threshold duration within each other, then the two events are related by temporal correlation. Two events that are temporally related can also be referred to as having "event co-occurrence". In addition, if the nodes associated with the two events are within a threshold hop count of each other, then the two events are related by topological correlation. The number of hops between the two nodes is determined based on the relationship repository 118. In an embodiment, if a specific event is temporally related to at least one event already in group 126 and the specific event is topologically related to at least one event already in the group 126, then the group 126 can include the specific event. As an example, a group can include a first event occurring on a first node and a second event occurring on a second node. A third event can occur on a third node. The third event can be temporally related to the first event. In addition, the third event can be topologically related to the second event. Therefore, the third event can be added to the group.

[0064] 3. Using and updating the topological relationships between a set of nodes in event clustering

[0065] Figure 2A-2B

[0013] Illustrated is a set of example operations for using and updating topological relationships between a set of nodes in event clustering in accordance with one or more embodiments. Figure 2A-2B One or more of the operations shown in may be modified, rearranged, or omitted altogether. Figure 2A-2B The particular sequence of operations shown in the drawings should not be construed as limiting the scope of one or more embodiments.

[0066] One or more embodiments include obtaining information associated with a current event (operation 202). Metrics associated with a set of nodes in a target computing system are monitored. A particular metric associated with a particular node satisfies a certain criterion. A current event is determined to have occurred. A notification of the current event is generated. The notification includes information associated with the current event, such as the node where the current event occurred, the time when the current event occurred, and the event type of the current event.

[0067] One or more embodiments include determining a current node associated with a current event (operation 204). Based on the information associated with the current event obtained at operation 202, a current node at which the event occurs is determined.

[0068] One or more embodiments include determining whether there are any groups having at least one event that is temporally related to the current event (referred to herein as "temporally related groups") (operation 206). An existing set of groups is identified. Each existing group is analyzed to determine whether the group includes at least one event that is temporally related to the current event. As described above, two events are temporally related if they occur within a threshold duration of each other. The threshold duration may be specified by a user and / or an application.

[0069] In an embodiment, for a given group, a recent event is identified. A time at which the recent event in the group occurred is determined. A time at which the current event occurred is determined. A time difference between the occurrence of the recent event in the group and the occurrence of the current event is compared to a threshold duration. If the time difference is less than the threshold duration, the two events are temporally related. Thus, the group is identified as a temporally related group. If the time difference is greater than the threshold duration, the group is not a temporally related group for the current event.

[0070] In an embodiment, for a given group, one or more events are analyzed until an event is identified that is temporally related to the current event. If there is at least one event that is temporally related to the current event, the group is identified as a temporally related group. If there is no event that is temporally related to the current event, the group is not a temporally related group for the current event.

[0071] If there is no temporally related group, one or more embodiments include generating a new group including the current event (operation 208). A new group is generated to include the current event. The new group now includes only a single event - the current event. Subsequently, based on Figure 2A-2BThe operation is relative to the iteration of new events, and zero, one or more events can also be added to the new group. Information about the new group can be presented and / or transmitted via the interface. The information about the new group can indicate that the new group includes the current event. Users and / or applications that obtain information about the new group from the interface can process the new group. Users and / or applications can analyze and / or resolve the events in the new group as a group. Analyzing and / or resolving events improves the performance of the target computing system and / or resolves errors in the target computing system. Based on the correlation between the events of the group, processing the events as a group can be more efficient than processing the events individually.

[0072] One or more embodiments include determining whether any temporally related group has at least one event that is topologically related to the current event (operation 210). Each temporally related group identified at operation 206 is analyzed to determine whether the group includes at least one event that is topologically related to the current event. As described above, if the respective nodes associated with two events according to the relationship repository are within a threshold number of hops of each other, then the two events are topologically related. The threshold number of hops can be specified by a user and / or an application. A group that includes both (a) an event that is temporally related to the current event and (b) an event that is topologically related to the current event is referred to as a "matching group."

[0073] In an embodiment, for a given temporally related group, one or more events are analyzed until an event that is topologically related to the current event is identified. Each node associated with the one or more events is analyzed to determine whether the node is within a threshold number of hops from the current node. If there is an event that is topologically related to the current event, the group is identified as a matching group. If there is no event that is topologically related to the current event, the group is not a matching group for the current event.

[0074] refer to Figure 1B As an example, the current event may occur on node 104b. The first temporally related group of the current event may include a first event occurring on node 104d. The second temporally related group of the current event may include a second event occurring on node 104e. The threshold hop count for determining topological relevance may be 1.

[0075] The second temporally related group can be analyzed. The second event within the second temporally related group can be analyzed to determine that the second event is associated with node 104e. Based on relationship graph 119, there are two hops (i.e., event-based relationship 122a and structural relationship 120c) between node 104e and node 104b. The number of hops between node 104e and node 104b is greater than threshold 1. All other events of the second temporally related group can also be analyzed and determined to be not topologically related to the current event. Therefore, the second temporally related group is not a matching group for the current event.

[0076] The first temporally related group may be analyzed. The first event within the first temporally related group may be analyzed to determine that the first event is associated with node 104d. Based on relationship graph 119, there is one hop between node 104d and node 104b (i.e., event-based relationship 122a). The number of hops between node 104d and node 104b is within a threshold of 1. Therefore, the first temporally related group is determined to be a matching group for the current event.

[0077] If there is a matching group, one or more embodiments include adding the current event to the matching group (operation 212). The current event is added to the matching group. Information indicating the events of the matching group (including the current event) can be presented and / or transmitted via the interface. Users and / or applications that obtain information about the matching group from the interface can process the matching group. Users and / or applications can analyze and / or resolve the events in the matching group as a group.

[0078] If there are multiple matching groups, one or more embodiments include merging the matching groups and adding the current event to the merged group (operation 214). The matching groups are merged into a merged group. The merged group includes all events of each matching group and the current event. Information indicating the events of the merged group (including the current event) can be presented and / or transmitted via the interface. Users and / or applications that obtain information about the merged group from the interface can process the merged group. Users and / or applications can analyze and / or resolve the events in the merged group as a group.

[0079] If there are no matching groups, one or more embodiments include identifying nodes associated with each temporally related group (referred to herein as "temporally related nodes") (operation 216). Each temporally related group identified at operation 206 is analyzed. For a given temporally related group, each event is analyzed to identify the node at which the event occurred. Each identified node (except the current node and nodes that are already topologically related to the current node) is referred to as a "temporally related node" for the current event. Therefore, a set of temporally related nodes for the current event can be associated with one or more temporally related groups.

[0080] One or more embodiments include, for each temporally related node, determining a level of mutual dependence between an occurrence of an event at a current node and an occurrence of an event at a temporally related node (operation 218). Each temporally related node identified at operation 216 is analyzed. For each temporally related node, a level of mutual dependence between an occurrence of an event at a current node and an occurrence of an event at a temporally related node is determined. The level of mutual dependence can be determined based on various statistical models, probability models, and / or information theory models. Examples of models for determining the level of mutual dependence include mutual information and / or correlation coefficients.

[0081] In an embodiment, the level of mutual dependence is determined using mutual information (MI). Mutual information is a measure of the mutual dependence between two variables. Mutual information quantifies the "amount of information" about one variable obtained through another variable.

[0082] In an embodiment, the mutual information between the occurrence of an event at a current node and the occurrence of an event at a temporally related node is based on:

[0083] a) the probability P(current node) of the group having the event on the current node; and

[0084] b) The probability P(current node|temporally related node) of a group having an event on the current node and an event on a temporally related node that is within a threshold duration from the event on the current node.

[0085] The mutual information is determined as:

[0086] As an example, an existing set of groups may include:

[0087] (a) Group A: event 1 on node 1, event 2 on node 2, event 3 on node 3;

[0088] (b) Group B: event 4 on node 1, event 5 on node 4;

[0089] (c) Group C: event 6 on node 1, event 7 on node 2;

[0090] (d) Group D: event 8 on node 2, event 9 on node 4.

[0091] The current event may occur at node 4. A temporally related group of node 4 may be group A. Based on group A, temporally related nodes are node 1, node 2, and node 3.

[0092] Mutual information associated with Node 4 (the current node) and each of Node 1 , Node 2 , and Node 3 (the temporally related nodes) may be determined.

[0093] Each mutual information is based on the probability P(node ​​4) of a group having an event on node 4 (current node). The number of groups having at least one event on node 4 is 2 (i.e., group B and group D). The total number of groups is 4. Therefore, P(current node) is 2 / 4=0.5.

[0094] The mutual information associated with node 4 and node 1 is based on the probability P(node ​​4 | node 1) of a group having an event on node 4 and an event on node 1 within a threshold duration from the event on node 4. Assume that event 4 is within a threshold duration from event 5. Then the number of groups having an event on node 4 and an event on node 1 within a threshold duration from the event on node 4 is 1 (i.e., group B). The total number of groups is 4. Therefore, P(node ​​4 | node 1) is 1 / 4 = 0.25.

[0095] Therefore, the mutual information It is 0.25 / 0.5=0.5.

[0096] The mutual information associated with node 4 and node 2 is based on the probability P(node ​​4 | node 2) of a group having an event on node 4 and an event on node 2 within a threshold duration from the event on node 4. Assume that event 8 is not within the threshold duration from event 9. Then the number of groups having an event on node 4 and an event on node 2 within the threshold duration from the event on node 4 is 0. Therefore, P(node ​​4 | node 2) is 0.

[0097] Therefore, the mutual information is 0.

[0098] The mutual information associated with node 4 and node 3 is based on the probability P(node ​​4 | node 3) of a group having an event on node 4 and an event on node 3 that is within a threshold duration from the event on node 4. The number of groups having an event on node 4 and an event on node 3 that is within a threshold duration from the event on node 4 is 0. Therefore, P(node ​​4 | node 3) is 0.

[0099] Therefore, the mutual information is 0.

[0100] Additional and / or alternative approaches for determining a level of interdependence between an occurrence of an event at a current node and an occurrence of an event at a temporally related node may be used.

[0101] One or more embodiments include determining whether the level of interdependence between the current node and the temporally related nodes is above a threshold (operation 220). The respective interdependence levels of the current node and each temporally related node determined at operation 218 are compared to the threshold. The threshold may be specified by a user and / or an application.

[0102] If the interdependence level is not above the threshold, one or more embodiments include generating a new group including the current event (operation 222). Embodiments and examples for generating a new group including the current event are described above with reference to operation 208.

[0103] If the interdependence level is above the threshold, one or more embodiments include adding the current event to the temporally related group(s) associated with the temporally related node (operation 224). As described at operation 220, the respective interdependence levels associated with the current node and each temporally related node are analyzed. Each temporally related node associated with the respective interdependence level above the threshold is identified. For each identified temporally related node, one or more temporally related groups are identified that include at least one event at the identified temporally related node. The current event is added to each identified temporally related group.

[0104] Information about each group may be presented and / or transmitted via the interface. The information may indicate that one or more specific groups include the current event. Users and / or applications that obtain information about the groups from the interface may process the groups. Users and / or applications may analyze and / or resolve events in a specific group as a group.

[0105] As an example, a current event may occur at node 1. A set of temporally related nodes for the current event may include node 2, node 3, and node 4. The level of mutual dependence of the occurrence of the event at node 1 (the current node) with the occurrence of the event at node 2 may be above a threshold. The level of mutual dependence of the occurrence of the event at node 1 with the occurrence of the event at node 3 may be below a threshold. The level of mutual dependence of the occurrence of the event at node 1 with the occurrence of the event at node 4 may be above a threshold. Therefore, node 2 and node 4 are identified as being associated with respective levels of mutual dependence that are above the threshold.

[0106] Node 2 may be analyzed. Temporally related groups of the current event including the event on node 2 may be group A and group B. Thus, the current event is added to each of group A and group B.

[0107] Node 4 may be analyzed. Temporally related groups of the current event including the event on node 4 may be group A and group C. The current event has been added to group A. The current event is further added to group C.

[0108] One or more embodiments include adding an event-based topological relationship between a current node and the temporally related nodes to a relationship repository (operation 226). As described in operation 220, the corresponding interdependence levels associated with the current node and each temporally related node are analyzed. Each temporally related node associated with a corresponding interdependence level above a threshold is identified. For each identified temporally related node, an event-based topological relationship between the current node and the identified temporally related node is added. The event-based topological relationship is added to the relationship repository.

[0109] Continuing the example from above, the current event has occurred on node 1. Nodes 2 and 4 have been identified as being associated with respective interdependency levels above a threshold.

[0110] Therefore, an event-based topological relationship is added between Node 1 and Node 2. In addition, an event-based topological relationship is added between Node 1 and Node 4.

[0111] The added event-based topological relationship between the current node and the temporally related node may indicate that the number of hops between the current node and the temporally related node is one.

[0112] refer to Figure 1B As an example, the current event may occur at node 104b. The temporally related node of the current event may be node 104f. The threshold number of hops for determining topological relevance may be two.

[0113] The mutual dependence level between the generation of the event on node 104b and the generation of the event on node 104f can be higher than threshold value.Therefore, current event can be added to each time-related group associated with node 104f.In addition, add the topological relationship based on event between node 104b and the node 104f.The topological relationship based on event can indicate that there is direct topological relationship between node 104b and node 104f.Therefore, the hop count between node 104b and node 104f can be one.

[0114] Alternatively, the added event-based topological relationship between the current node and the temporally related node may indicate that the number of hops between the current node and the temporally related node is equal to the threshold number of hops used to determine the topological correlation at operation 210 .

[0115] refer to Figure 1B As an example, the current event may occur at node 104b. The temporally related node of the current event may be node 104f. The threshold number of hops for determining topological relevance may be two.

[0116] The mutual dependence level between the occurrence of the event on node 104b and the occurrence of the event on node 104f can be higher than threshold value.Therefore, current event can be added to each time-related group associated with node 104f.In addition, add the topological relationship based on event between node 104b and the node 104f.The topological relationship based on event can indicate that the hop count between node 104b and the node 104f is equal to the threshold hop count for determining topological relevance.Therefore, the hop count between node 104b and the node 104f can be two.

[0117] Therefore, the event information associated with the current event is used to update the relationship repository. The relationship repository is updated to include one or more new event-based topological relationships.

[0118] Subsequently, new events can occur at a specific node. Figure 2A-2B Operation. Use the updated relationship repository to iterate on new events Figure 2A-2B operation.

[0119] 4. Example Embodiments

[0120] For clarity, detailed examples are described below. The components and / or operations described below should be understood as a specific example that may not be applicable to certain embodiments. Therefore, the components and / or operations described below should not be interpreted as limiting the scope of any claim.

[0121] Figure 3A-3B An example feedback loop for using and updating a topological relationship between a set of nodes in event clustering according to one or more embodiments is illustrated. As shown, Figure 3A-3B A relationship graph 319 , a set of groups 326 a - c , matching logic 312 , and interdependency logic 314 are included.

[0122] refer to Figure 3A , a relationship graph 319 indicates an existing set of topological relationships. The relationship graph 319 includes various nodes, including a web application 304a, a middleware program 304b, a computing server 304c, and a database (DB) server 304d. There is a structural relationship 320a between the web application 304a and the middleware program 304b. There is a structural relationship 320b between the middleware program 304b and the computing server 304c. There is an event-based relationship 322a between the computing server 304c and the DB server 304d.

[0123] As an example, the configuration file of web application 304a may indicate that web application 304a is executed on middleware program 304b. Therefore, it may be determined that there is a unidirectional structural topological relationship 320a between web application 304a and middleware program 304b. In addition, the monitored network traffic may indicate that middleware program 304b and computing server 304c communicate with each other. Therefore, it may be determined that there is a bidirectional structural topological relationship 320b between middleware program 304b and computing server 304c. In addition, an event-based relationship 322a between computing server 304c and DB server 304d may be determined based on a previous analysis of events occurring on each of computing server 304c and DB server 304d.

[0124] The current event 308a may occur on the DB server 304d. For example, the current event 308a may indicate that the response time on the DB server 304d has exceeded a threshold.

[0125] The relationship graph 319 is input into the matching logic 312. Applying the relationship graph 319, the matching logic 312 determines the correlation between the current event 308a and a set of groups 326a-c. Specifically, the matching logic 312 determines whether any of the groups 326a-c includes both (a) an event that is temporally related to the event 308a and (b) an event that is topologically related to the event 308a based on the relationship graph 319. The matching logic 312 determines that no such group exists for the event 308a.

[0126] In particular, group 326a includes event 308b that occurs on web application 304a and event 308c that occurs on middleware program 304b. Event 308b may occur within a threshold duration of current event 308a. Therefore, matching logic 312 determines that group 326a includes event 308b that is temporally related to current event 308a. Group 326a is a temporally related group of current event 308a.

[0127] The hop count used to determine topological relevance may be 1. Matching logic 312 determines the hop count between the current node (DB server 304d) and each temporally related node. The temporally related nodes include nodes associated with temporally related group 326a, which are web application 304a and middleware program 304b. The hop count between DB server 304d and web application 304a is 3, which is above a threshold of 1. The hop count between DB server 304d and middleware program 304b is 2, which is above a threshold of 1. Therefore, matching logic 312 determines that group 326a does not include any events that are topologically related to current event 308a.

[0128] The clustering information determined above by the matching logic 312 is input into the interdependence logic 314. Using the clustering information, the interdependence logic 314 determines the respective interdependence levels of the current node (DB server 304d) and each temporally related node (web application 304a and middleware program 304b). For example, the value of the mutual information between the nodes may be calculated. The interdependence level of the DB server 304d and the web application 304a may be below a threshold. The interdependence level of the DB server 304d and the middleware program 304b may be above a threshold.

[0129] refer to Figure 3B In response to determining that the interdependence level of the DB server 304d and the middleware program 304b is above the threshold, the interdependence logic 314 adds the current event 308a to the group 326a. In addition, the interdependence logic 314 updates the relationship graph 319. Specifically, the interdependence logic 314 adds an event-based relationship 322b directly between the DB server 304d and the middleware program 304b. The event-based relationship 322b indicates that there is one hop between the DB server 304d and the middleware program 304b.

[0130] Subsequently, the new relationship graph 319 including the event-based relationships 322b is used to determine clusters of one or more new events. The matching logic 312 applies the new relationship graph 319 to determine correlations between the new event and the set of groups 326a-c.

[0131] 5. Hardware Overview

[0132] According to one embodiment, the technology described herein is implemented by one or more special-purpose computing devices. The special-purpose computing device can be hard-wired to perform the technology, or can include digital electronic devices such as one or more application-specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), or network processing units (NPUs) that are permanently programmed to perform the technology, or can include one or more general-purpose hardware processors that are programmed to perform the technology according to program instructions in firmware, memory, other storage devices, or combinations. These special-purpose computing devices can also combine custom hard-wired logic, ASICs, FPGAs, or NPUs with custom programming to implement the technology. The special-purpose computing device can be a desktop computer system, a portable computer system, a handheld device, a network device, or any other device that incorporates hard-wired and / or program logic to implement the technology.

[0133] For example, Figure 44 is a block diagram illustrating a computer system 400 upon which embodiments of the present invention may be implemented. Computer system 400 includes a bus 402 or other communication mechanism for communicating information, and a hardware processor 404 coupled with bus 402 for processing information. Hardware processor 404 may be, for example, a general purpose microprocessor.

[0134] The computer system 400 also includes a main memory 406, such as a random access memory (RAM) or other dynamic storage device, coupled to the bus 402 for storing information and instructions to be executed by the processor 404. The main memory 406 may also be used for storing temporary variables or other intermediate information during execution of instructions to be executed by the processor 404. When these instructions are stored in a non-transitory storage medium accessible to the processor 404, they render the computer system 400 into a special-purpose machine customized to perform the operations specified in the instructions.

[0135] Computer system 400 also includes a read only memory (ROM) 408 or other static storage device coupled to bus 402 for storing static information and instructions for processor 404. A storage device 410, such as a magnetic or optical disk, is provided and coupled to bus 402 for storing information and instructions.

[0136] The computer system 400 may be coupled to a display 412, such as a cathode ray tube (CRT), via the bus 402 for displaying information to a computer user. An input device 414, including alphanumeric and other keys, is coupled to the bus 402 for communicating information and command selections to the processor 404. Another type of user input device is a cursor control 416, such as a mouse, trackball, or cursor direction keys, for communicating direction information and command selections to the processor 404 and for controlling movement of a cursor on the display 412. Such input devices typically have two degrees of freedom in two axes, a first axis (e.g., x) and a second axis (e.g., y), which allows the device to specify a position in a plane.

[0137] Computer system 400 may implement the techniques described herein using custom hardwired logic, one or more ASICs or FPGAs, firmware, and / or program logic that, in combination with the computer system, makes computer system 400 or programs computer system 400 into a special purpose machine. According to one embodiment, the techniques herein are performed by computer system 400 in response to processor 404 executing one or more sequences of one or more instructions contained in main memory 406. These instructions may be read into main memory 406 from another storage medium, such as storage device 410. Execution of the sequences of instructions contained in main memory 406 causes processor 404 to perform the process steps described herein. In alternative embodiments, hardwired circuitry may be used in place of or in combination with software instructions.

[0138] As used herein, the term "storage medium" refers to any non-transient medium that stores data and / or instructions that cause a machine to operate in a particular manner. Such storage media may include non-volatile media and / or volatile media. Non-volatile media include, for example, optical or magnetic disks, such as storage device 410. Volatile media include dynamic memory, such as main memory 406. Common forms of storage media include, for example, floppy disks, flexible disks, hard disks, solid-state drives, tapes or any other magnetic data storage media, CD-ROMs, any other optical data storage media, any physical media with hole patterns, RAM, PROM and EPROM, FLASH-EPROM, NVRAM, any other memory chip or cassette, content addressable memory (CAM) and ternary content addressable memory (TCAM).

[0139] Storage media are distinct from but may be used in conjunction with transmission media. Transmission media participate in the transmission of information between storage media. For example, transmission media include coaxial cables, copper wire, and optical fiber, including the wires that comprise bus 402. Transmission media may also take the form of acoustic or light waves, such as those generated during radio wave and infrared data communications.

[0140] Various forms of media may be involved in carrying one or more sequences of one or more instructions to processor 404 for execution. For example, the instructions may initially be carried on a disk or solid-state drive of a remote computer. The remote computer can load the instructions into its dynamic memory and send the instructions over a telephone line using a modem. A modem local to computer system 400 can receive the data on the telephone line and use an infrared transmitter to convert the data to an infrared signal. An infrared detector can receive the data carried in the infrared signal, and appropriate circuitry can place the data on bus 402. Bus 402 carries the data to main memory 406, from which processor 404 retrieves and executes the instructions. The instructions received by main memory 406 may optionally be stored on storage device 410 before or after execution by processor 404.

[0141] Computer system 400 also includes a communication interface 418 coupled to bus 402. Communication interface 418 provides bidirectional data communication coupled to network link 420, which is connected to local network 422. For example, communication interface 418 can be an integrated services digital network (ISDN) card, a cable modem, a satellite modem, or a modem that provides a data communication connection to a telephone line of a corresponding type. As another example, communication interface 418 can be a LAN card that provides a data communication connection to a compatible local area network (LAN). Wireless links can also be implemented. In any such implementation, communication interface 418 sends and receives electrical signals, electromagnetic signals, or optical signals that carry digital data streams representing various types of information.

[0142] The network link 420 typically provides data communications to other data devices through one or more networks. For example, the network link 420 can provide a connection to a host computer 424 or to data devices operated by an Internet Service Provider (ISP) 426 through a local network 422. The ISP 426 in turn provides data communication services through a worldwide packet data communication network now commonly referred to as the "Internet" 428. Both the local network 422 and the Internet 428 use electrical, electromagnetic, or optical signals that carry digital data streams. The signals through the various networks and the signals on the network link 420 and through the communication interface 418 are example forms of transmission media that carry digital data to or from the computer system 400.

[0143] Computer system 400 can send messages and receive data, including program code, through network(s), network link 420 and communication interface 418. In the Internet example, server 430 can transmit request code for an application program through Internet 428, ISP 426, local network 422 and communication interface 418.

[0144] The received code may be executed by processor 404 as it is received, and / or stored in storage device 410 or other non-volatile storage for later execution.

[0145] 6. Other aspects; expansion

[0146] Embodiments are directed to a system having one or more devices comprising a hardware processor and configured to perform any of the operations described herein and / or set forth in any of the following claims.

[0147] In an embodiment, a non-transitory computer-readable storage medium comprises instructions that, when executed by one or more hardware processors, cause performance of any of the operations described herein and / or set forth in any of the claims.

[0148] Any combination of the features and functions described herein may be used according to one or more embodiments. In the foregoing description, embodiments have been described with reference to many specific details that vary depending on the implementation. Therefore, the description and drawings should be regarded as illustrative rather than restrictive. The sole and exclusive indicator of the scope of the invention and what the applicants intend as the scope of the invention is the literal and equivalent range of the set of claims issuing from this application, in the specific form in which such claims issue, including any subsequent corrections.

Claims

1. A non-transitory computer readable medium comprising instructions which, when executed by one or more hardware processors, cause execution of operations comprising: identifying a plurality of events occurring on a set of nodes in a computing environment; determining a first group of related events from the plurality of events based on an existing set of topological relationships associated with the set of nodes; determining that there is event co-occurrence between one or more events of the first group of related events and a first event that is not within the first group of related events; Based at least on the event co-occurrence between the one or more events of the first group of related events and the first event: determining an event-based topological relationship between a first node in the set of nodes that is associated with at least one event of the first group of related events and a second node in the set of nodes that is associated with the first event but is not associated with any event of the first group of related events; identifying a second event associated with the first node; identifying a third event associated with the second node that is not already within the plurality of events; as well as Based at least on the event-based topological relationship: clustering the second event and the third event into a second group of related events.

2. The medium of claim 1, wherein: The operations also include: determining a level of interdependence between an occurrence of an event at the first node and an occurrence of an event at the second node; determining that the level of interdependence is above a threshold; and Determining the event-based topological relationship between the first node and the second node is further based on determining that the interdependence level is above the threshold.

3. The medium of claim 2, wherein determining the level of interdependence comprises: determining a first probability of a group having a fourth event at the second node; determining a second probability of a group having both a fifth event at the second node and a sixth event at the first node within a threshold duration of the fifth event at the second node; and The second probability is divided by the first probability to obtain the interdependence level.

4. The medium of claim 1, wherein: The operations also include: determining that the one or more events of the first group of related events and the first event satisfy a statistical criterion; and Determining the event-based topological relationship between the first node and the second node is further based on determining that the one or more events of the first group of related events and the first event satisfy a statistical criterion.

5. The medium of claim 1, wherein the operations further comprise: The event-based topological relationship between the first node and the second node is added to the existing set of topological relationships.

6. The medium of claim 1, wherein the existing set of topological relationships comprises: A topological relationship is determined based on one or more configuration files associated with one or more nodes in the set of nodes.

7. The medium of claim 1, wherein the existing set of topological relationships comprises: The topological relationships are specified via user input.

8. The medium of claim 1 , wherein identifying the first group of related events based on the existing set of topological relationships associated with the set of nodes comprises: determining that the fourth event and the fifth event occur within a threshold duration of each other; Determining based on the existing set of topological relationships that the third node on which the fourth event occurs and the fourth node on which the fifth event occurs are within a threshold number of hops from each other; as well as It is determined that the fourth event and the fifth event are within the first group of related events.

9. The medium of claim 1, wherein the operations further comprise: Based at least on the event co-occurrence between the one or more events of the first group of related events and the first event: adding the first event to the first group of related events.

10. The medium of claim 1, wherein the first group of related events and the second group of related events are different.

11. The medium of claim 1, wherein the first group of related events is the same as the second group of related events.

12. The medium of claim 1, wherein the operations further comprise: Information associated with the second group of related events is presented at a user interface, wherein the information associated with the second group of related events indicates that the second group of related events includes the second event and the third event.

13. The medium of claim 1, wherein the operations further comprise: In response to determining that the second group of related events includes the second event and the third event: selecting the second event for analysis and not selecting the third event for analysis.

14. The medium of claim 1, wherein the operations further comprise: determining that the third incident within the second group of related incidents has been resolved; In response to determining that the third event has been resolved: indicating that the second event within the second group of related events is also resolved.

15. A method for clustering events associated with nodes of a computing system, wherein the method is performed by at least one device including a hardware processor, the method comprising: identifying a plurality of events occurring on a set of nodes in a computing environment; determining a first group of related events from the plurality of events based on an existing set of topological relationships associated with the set of nodes; determining that there is event co-occurrence between one or more events of the first group of related events and a first event that is not within the first group of related events; Based at least on the event co-occurrence between the one or more events of the first group of related events and the first event: determining an event-based topological relationship between a first node in the set of nodes that is associated with at least one event of the first group of related events and a second node in the set of nodes that is associated with the first event but is not associated with any event of the first group of related events; identifying a second event associated with the first node; identifying a third event associated with the second node that is not already within the plurality of events; as well as Based at least on the event-based topological relationship: clustering the second event and the third event into a second group of related events.

16. The method of claim 15, wherein: The method further comprises: determining a level of interdependence between an occurrence of an event at the first node and an occurrence of an event at the second node; determining that the level of interdependence is above a threshold; and Determining the event-based topological relationship between the first node and the second node is further based on determining that the interdependence level is above the threshold.

17. The method of claim 16, wherein determining the level of interdependence comprises: determining a first probability of a group having a fourth event at the second node; determining a second probability of a group having both a fifth event at the second node and a sixth event at the first node within a threshold duration of the fifth event at the second node; and The second probability is divided by the first probability to obtain the interdependence level.

18. The method of claim 15, wherein: The method further includes determining that the one or more events of the first group of related events and the first event satisfy a statistical criterion; and Determining the event-based topological relationship between the first node and the second node is further based on determining that the one or more events of the first group of related events and the first event satisfy a statistical criterion.

19. The method of claim 15, further comprising: The event-based topological relationship between the first node and the second node is added to the existing set of topological relationships.

20. The method of claim 15, wherein the existing set of topological relationships comprises: A topological relationship is determined based on one or more configuration files associated with one or more nodes in the set of nodes.

21. The method of claim 15, wherein the existing set of topological relationships comprises: The topological relationships are specified via user input.

22. The method of claim 15, wherein identifying the first group of related events based on the existing set of topological relationships associated with the set of nodes comprises: determining that the fourth event and the fifth event occur within a threshold duration of each other; Determining based on the existing set of topological relationships that the third node on which the fourth event occurs and the fourth node on which the fifth event occurs are within a threshold number of hops from each other; as well as It is determined that the fourth event and the fifth event are within the first group of related events.

23. The method of claim 15, further comprising: Based at least on the event co-occurrence between the one or more events of the first group of related events and the first event: adding the first event to the first group of related events.

24. The method of claim 15, wherein the first group of related events and the second group of related events are different.

25. The method of claim 15, wherein the first group of related events is the same as the second group of related events.

26. The method of claim 15, further comprising: Information associated with the second group of related events is presented at a user interface, wherein the information associated with the second group of related events indicates that the second group of related events includes the second event and the third event.

27. The method of claim 15, further comprising: In response to determining that the second group of related events includes the second event and the third event: selecting the second event for analysis and not selecting the third event for analysis.

28. The method of claim 15, further comprising: determining that the third incident within the second group of related incidents has been resolved; In response to determining that the third event has been resolved: indicating that the second event within the second group of related events is also resolved.

29. A system for clustering events associated with nodes of a computing system, comprising: at least one device including a hardware processor; and The system is configured to perform the method of any one of claims 15-28.

30. An apparatus for clustering events associated with nodes of a computing system, comprising means for performing the method of any one of claims 15-28.

Images