Identification of constituent events in an event storm within operations management

Abstract

A method and system are provided for identifying constituent events in an event storm in operational management. The method includes: detecting an event storm by detecting anomalies from a dynamic baseline range of expected event rates over a sampling period; and when an event storm is detected, identifying the event group as part of the event storm for each event in an event group grouped by event category and occurring during the sampling period of the event storm, if the rate of event occurrence in the group during the sampling period is outside a threshold deviation from the average for the group.

Description

Technical Field

[0001] This invention relates to log event operation management, and more specifically, to the identification of constituent events in an event storm within operation management. Background Technology

[0002] Information technology operations management aims to identify, isolate, and resolve IT issues in a business environment by logging events and applying analysis to event logs. As an example, operations can involve a wide range of infrastructure related to communications, computing resources, storage resources, networks, etc., that can be geographically distributed.

[0003] In an IT environment, event logs record events that occur during system execution to provide an audit trail that can be used to understand system activity and diagnose problems. Event logs are essential for understanding the activity of complex systems, especially in applications with limited user interaction, such as server applications. Statistical analysis using operational analytics can be used to analyze events and determine correlations between seemingly unrelated events.

[0004] In event log management, operators expect a normal rate of events, occurring due to maintenance or problems. However, when the volume of incoming events overwhelms operators' ability to process them, an event storm sometimes occurs. This is often referred to as a "red ocean." This means that operators cannot distinguish between important events and what might be happening.

[0005] Storms are often triggered by major incidents. For example, a failure in something like a core switch in the network, or a malfunction in a part of the monitoring system. This situation will cause a large number of devices, subsystems, and applications to send alarms or events to the monitoring system; from the system's perspective, all alarms or events effectively report the same problem.

[0006] The most common method for detecting such event storms is for systems engineers to set static thresholds for event types based on past experience. For example, the event type could be "LINK DOWN," and if the number of "LINK DOWN" log events exceeds a threshold within a defined time period, a storm is declared and all events of that type are grouped together. Summary of the Invention

[0007] According to an aspect of the invention, a computer-implemented method is provided for identifying constituent events in an event storm in operations management, comprising: detecting an event storm by detecting anomalies from a dynamic baseline range of expected event rates over a sampling period; and when an event storm is detected, identifying the event group as part of an event storm for each event in an event group grouped by event category and occurring during the sampling period of the event storm if the rate of event occurrence in the group during the sampling period is outside a threshold deviation from the average for the group.

[0008] This has the following advantages: by using statistical evaluation of event instances within a sampling period during the detected storm, a link is established between event storm detection and the identification of events that contribute to the event storm. This reduces the number of false positives that events are labeled as causing the storm.

[0009] This method may include associating multiple event groups identified as part of an event storm for use in the output.

[0010] This method may include learning the expected event rates over one or more sampling periods of defined length. Detecting event storms may include: using a dynamic thresholding algorithm to determine a dynamic baseline range of expected event rates over one or more sampling periods of defined length; and using an anomaly detection algorithm to detect anomalies from the dynamic baseline range indicating an event storm. Operational analysis can be used to precisely identify the occurrence of event storms.

[0011] The method may also include learning event attribute information over one or more sampling time periods of a defined length. Event categories may include individual event attributes or clusters of event attributes based on distance metrics. Event groups may include a minimum number of event instances. The distance metric for the event attributes used for clustering may be one of the following: a text string metric; a location metric; or another metric obtained from event log entry information. Event attributes of events in the learning environment are used to group events by individual attributes and / or by clustering based on distance metrics of event attributes. Event attributes may be obtained from information available in event log entries.

[0012] This method may include clustering events within a sampling time period using a distance metric based on event attributes. In one embodiment, if the number of groups based on individual event attributes within the sampling time period is not higher than a threshold deviation of the individual event attributes, the method may cluster multiple individual event attributes to form event groups.

[0013] This method may include testing clustering to meet a threshold percentage of event instances belonging to a cluster within a sampling time period. The method may also include selecting clusters by comparing them to a distance metric of variation over the sampling time period. Testing clustering and selecting the strongest cluster enhances the system and makes it risk-averse. It also enables segmented event instances to be clustered and identified as relevant to event storms.

[0014] The sampling time period can be configured to provide granularity for event storm detection, and can include short and long time windows to capture different event storm behaviors. Event storms can have different time frames, and configuring different sampling time periods or windows helps in detecting different forms of event storms, whether they are slowly brewing storms or sudden event blizzards.

[0015] Threshold deviation of an event group can be measured from the group's mean using statistical deviation methods, such as the threshold Z-score test for the event group. Many statistical threshold tests are available and can be selected based on the overall statistical pattern of the events. If the events follow a normal distribution, the standard deviation test may be appropriate.

[0016] According to another aspect of the invention, a computer-implemented method is provided for identifying constituent events in an event storm in operational management, comprising: detecting an event storm by detecting anomalies from a dynamic baseline range of expected event rates of a total event population over a sampling time period; and identifying event instances as constituent events of the storm for a sampling time period within the detected event storm by clustering event attributes and determining whether the rate of occurrence of event instances in the clusters during the sampling time period deviates from a threshold norm for the clustered event attributes.

[0017] This has the following advantages: it clusters event instances based on the event attributes available in the log entries using a distance metric. Grouping off-target individual attributes can exclude some log entries that are related but have different attributes.

[0018] According to another aspect of the invention, a system is provided for identifying constituent events in an event storm in operational management, comprising: a processor and a memory, the memory being configured to provide computer program instructions to the processor to perform the functions of: an event storm detection component for detecting an event storm by detecting anomalies from a dynamic baseline range of expected event rates during a sampling period; and an event constituent identification component for identifying an event group as constituting part of the event storm for each event in an event group grouped by event categories occurring during the sampling period of the event storm, if the rate of event occurrence in the group during the sampling period is outside a threshold deviation from the average for the group.

[0019] The system may include an event composition association component for associating multiple groups of events that are identified as part of an event storm.

[0020] The event storm detection component may include: a dynamic thresholding component for determining a dynamic baseline range of expected event rates over one or more sampling time periods of a defined length using a dynamic thresholding algorithm; and an anomaly detection component for detecting anomalies from the dynamic baseline range indicating an event storm using an anomaly detection algorithm.

[0021] The system may include a learning component for learning the expected event rate over one or more sampling time periods of a defined length, and event attribute information over one or more sampling time periods of a defined length.

[0022] The system may include an attribute clustering component for clustering events over a sampling period using a distance metric of event attributes. The attribute clustering component may include testing clusters over the sampling period to satisfy a threshold percentage of event instances belonging to a cluster. The attribute clustering component may also include selecting clusters by comparing clusters with varying distance metrics over the sampling period.

[0023] The system may include configuration components for configuring sampling time periods for event storm detection granularity to capture different event storm behaviors, including short time windows and longer time windows.

[0024] According to another aspect of the invention, a system is provided for identifying constituent events in an event storm in operational management, comprising: a processor and a memory, the memory being configured to provide computer program instructions to the processor to perform the functions of: an event storm detection component for detecting an event storm by detecting anomalies from a dynamic baseline range of expected event rates of a total event population within a sampling time period; and an event constituent identifier for identifying event instances as constituent events of a storm for the sampling time period within a detected event storm by clustering event attributes and determining whether the rate of occurrence of event instances in the clusters within the sampling time period deviates from a threshold norm for the clustered event attributes.

[0025] According to another aspect of the invention, a computer program product is provided for identifying constituent events in an event storm in operational management, the computer program product comprising a computer-readable storage medium having program instructions embodied therein, the program instructions being executable by a processor to cause the processor to: detect an event storm by detecting anomalies from a dynamic baseline range of expected event rates during a sampling time period; and, when an event storm is detected, for each event in an event group grouped by event category and occurring during the sampling time period, identify the event group as part of an event storm if the rate of occurrence of the events in the group during the sampling time period is outside a threshold deviation from the average for the group.

[0026] The computer-readable storage medium may be a non-transient computer-readable storage medium, and the computer-readable program code may be executed by processing circuitry. Attached Figure Description

[0027] The subject matter of this invention is specifically pointed out and explicitly claimed in the concluding section of the specification. The invention (with regard to organization and operation methods) and its objectives, features, and advantages can be best understood by referring to the following detailed description when read in conjunction with the accompanying drawings.

[0028] Preferred embodiments of the invention will now be described by way of example only with reference to the following accompanying drawings, in which:

[0029] Figure 1A This is a flowchart of an exemplary embodiment of the method according to the present invention;

[0030] Figure 1B This is a flowchart illustrating an exemplary embodiment of an aspect of the method according to the present invention;

[0031] Figure 2 This is a block diagram of an exemplary embodiment of the system according to the present invention;

[0032] Figure 3 This is a block diagram of an embodiment of a computer system or cloud server in which the present invention can be implemented;

[0033] Figure 4 This is a schematic diagram of a cloud computing environment that can implement the present invention; and

[0034] Figure 5 This is a schematic diagram of the abstract model layer of the cloud computing environment that can implement the present invention.

[0035] It should be understood that, for the sake of simplicity and clarity, the elements shown in the figures are not necessarily drawn to scale. For example, for clarity, the size of some elements may be enlarged relative to others. Furthermore, where deemed appropriate, reference numerals may be repeated in the figures to indicate corresponding or similar features. Detailed Implementation

[0036] The described method and system identify constituent events in event storm detection within event log operation management. This method and system can be applied to any form of event logging in an information technology environment, including computing systems, communication systems, etc.

[0037] As events occur in an information technology environment, event logs provide event log entries that move over time. Event logs can be used for error events, operational events, transaction events, messages, or other activities that can be recorded over time. Log entries can include multiple attributes that provide information about what happened, when it happened, and through which component.

[0038] The described method works in two phases: first, it detects storm windows; second, it classifies events that will constitute a storm to identify the storm-forming events.

[0039] Once a storm is detected, this method can determine what events constitute the storm, which is related to whether the events are normal activity or associated with another problem. Many systems are large enough that there may be more than one problem at any given time, and therefore events that arrive but are not part of the storm. This is achieved by using a combination of holistic storm detection and event classification.

[0040] Combining these two phases reduces system complexity and avoids erroneous associations that may occur due to the wide variety of event types that occur outside of event storms.

[0041] Storms generally have two groups of events: a large number of the same event types occurring (e.g., core network inspection (ping down)), or a large number of different alerts and different types of events occurring.

[0042] The described method and system have the advantage of being able to combine multiple types of events to establish the existence of a storm. The described method identifies the events that constitute a storm, rather than the events that constitute the normal operating state of the system when no storm is present.

[0043] See Figure 1A Flowchart 100 illustrates an exemplary embodiment of a described method for detecting storms in an event log and identifying events that are part of a storm.

[0044] This method can learn the expected event rate of 101 over one or more defined sampling time periods. This is the rate at which all events are recorded, providing the overall group event rate.

[0045] The method can determine a dynamic baseline range for the expected event rate of 102 within one or more defined time-period sampling lengths. A dynamic thresholding algorithm can be used to determine the expected range. The dynamic thresholding algorithm provides a varying baseline that depends on and adapts to factors such as time of day or load on the system. The dynamic thresholding algorithm can dynamically define a consistency threshold that varies over time based on the monitored system profile and parameters.

[0046] The sampling time period can be defined to fit the system and can be a discrete-time bucket or window. More than one sampling time period can be defined, such as short and long periods. This ensures the capture of short spikes in events as well as longer brewing issues and edge events. In an exemplary embodiment, time periods of 5 minutes and 20 minutes are used, and the event rate is continuously monitored within these time periods.

[0047] This method can also learn and organize the decomposition of event attribute information within a 103-event group. This event attribute information is used to group events and serve as a baseline for the expected occurrence rate of event attributes within a time period. Event attributes can be event types or other appropriate attributes of event instances, such as geographical indications in event log entries, such as for events originating from a single cell site in a telecommunications environment or from a specific plant or location in a system environment.

[0048] This method can monitor incoming events over a 104-sample time period and determine if there are any anomalies indicating an event storm or deviations from the dynamic baseline range of the expected event rate during the sample time period. Anomaly detection algorithms can be used to detect anomalies in the crowd event rate.

[0049] Anomaly detection can be performed using a variety of known statistical measures. In one implementation, anomaly detection can be implemented using existing operational analytics software. For example, IBM Operations Analytics Predictive Insights (IBM is a trademark of International Business Machines Corporation) is outlined below.

[0050] An alternative approach for identifying anomalous behavior in the rate of mass events is to use profiling techniques to detect sudden changes in system processes. Normal operating parameters are established using historical data across timeframes of periodic behavior. These timeframes are segmented into consecutive sampling periods, which can be processed individually based on the profiling parameters. Then, statistical process control techniques are used to detect both short-term and long-term process changes. When an event storm occurs, short-term increases in processing changes will be detected.

[0051] Whether an event storm has been detected (105) can be determined by identifying an anomaly in the event rate defined as a storm. If no storm is currently detected, the method can continue to monitor the incoming event rate (104) and determine if an anomaly exists. Event storms can be detected over a series of sampling time periods.

[0052] When an event storm of 105 is detected, the constituent events of the event storm are identified and organized based on the events that occurred during the sampling period of the storm, as described below.

[0053] Events recorded during the sampling period in which the event storm was detected are grouped according to event category 106. Category can be an event attribute such as event type or other event attributes such as event location. Grouping can utilize event attribute information compiled during the learning phase 103. In this phase, groups can be groups of events with the same individual attributes to determine if a large number of events exist within the sampling period of the same event attribute.

[0054] Only event groups with a minimum number of event instances are included. If the number of instances of an event attribute in a group is low, the group is not included in further analysis. This is because, even if the ratio of these events is outside the expected range for the group, a low number indicates that these events are not constituent events of the storm.

[0055] For each group of events 107, the method can determine whether the event occurrence rate during the sampling period 108 is outside the expected range for that group. This can be done through different forms of statistical testing.

[0056] The ability to determine whether the rate of occurrence of an event is outside the expected range is based on the decomposition of event attribute information (103) while determining the total group event rate (102).

[0057] In one embodiment, tests outside the expected range may deviate above a threshold from the average event rate of the group. In one embodiment, this can be done using a Z-score test as described below, which measures the statistical deviation of a normal distribution. Alternatively, another form of statistical deviation from the mean may be used.

[0058] If it is not determined that the occurrence rate of group 108 is outside the expected range of individual event attributes, it can be determined whether it is possible to cluster the event attributes with other event attributes 109, which are also outside the expected range when grouped individually.

[0059] Alternatively, the approach could try clustering event attributes without testing the bias of the grouped individual event attributes.

[0060] If attributes can be clustered, then the method can cluster event attributes together based on a distance metric, as shown below. Figure 1B Further description.

[0061] Clustering can be viewed as event group 107, for which it is determined whether the rate at which 108 occurs is outside the expected range.

[0062] However, if it is not possible to cluster event attributes with other event attributes 109, or if the group is already clustered, then the group of events can be indicated 111 as not being a component of the storm. A storm is composed of events caused by the issues that trigger the event storm or a set of issues.

[0063] If the occurrence rate of group 108 is determined to be outside the expected range, then event group 112 can be designated as a component of the storm.

[0064] Event members from all groups of components indicated as storms can be associated 113 or grouped as storm-related and displayed and handled accordingly.

[0065] Anomaly detection algorithm for storm detection

[0066] IBM Operations Analytics Predictive Insights provides an analytics component for consuming and analyzing data from multiple data sources within an organization's monitoring and performance management systems. The analytics component builds a model of the system's normal behavior and then compares the extracted subsequent data with the data in the model to identify any changes in system behavior and to identify anomalies. A user interface is provided to display detailed information about the anomalies.

[0067] Different anomaly detection algorithms are used, including robust boundaries for detecting anomalies when the value of a metric deviates from the metric's baseline. The baseline is the normal operating range that the algorithm dynamically maintains for the metric.

[0068] Other anomaly detection algorithms may include, for example: variant / invariant algorithms for detecting anomalies when the variance between high and low values ​​of a metric decreases significantly; Granger algorithms for detecting anomalies by finding causal relationships between metrics and detecting anomalies if the relationships change; finite field algorithms for detecting anomalies when a metric rises to a level not previously reached; and primary range algorithms for detecting anomalies when a metric changes beyond the range of normal changes in the metric.

[0069] Each algorithm may include a training process to build a model of the normal operating behavior of the data. Anomalies can be detected when data is subsequently received at later intervals.

[0070] Statistical deviation test for event groups

[0071] The Z-test is any statistical test for which the distribution of the test statistic under the null hypothesis can be approximated by a normal distribution. Due to the Central Limit Theorem, it is a reasonable assumption that the sampling of event rates will approximate a normal distribution. Therefore, at any given time, a sample of event rates can be compared to the sampling distribution to determine whether it falls within the normal operating margin. The Z-test can use the Z-score or a modified Z-score.

[0072] The Z-score is a numerical measure of a value's relationship to the mean of a set of measured values, based on the standard deviation from the mean. A Z-score of 0 indicates that the value is the same as the mean. A Z-score of 1.0 indicates that the value is one standard deviation from the mean. For most large datasets, 99% of the values ​​have a Z-score between -3 and 3, meaning they are within three standard deviations above and below the mean.

[0073] The modified Z-score is a standardized score that measures outlier strength or how much a particular score differs from a typical score. Using units of standard deviation, it approximates the difference between the score and the median.

[0074] The modified Z-score can be more robust than the standard Z-score because it relies on the median to calculate the Z-score. It is less affected by outliers when compared to the standard Z-score.

[0075] The standard Z-score is calculated by dividing the difference from the mean by the standard deviation. A modified Z-score is calculated based on the mean absolute deviation (Mean AD) or median absolute deviation (MAD). These values ​​are multiplied by a constant to approximate the standard deviation.

[0076] For each event group grouped by attribute or attribute clustering, the method can calculate the median absolute deviation (MAD) and modified Z-score for each element of the time period when the event type occurred. For example, "linkdown" = median = 10, and "machine on fire" = median = 20.

[0077] If the current value of a group is higher than the defined threshold of 3.5Z score, the event group is identified as constituting a storm event and contributing to the event storm.

[0078] It should be noted that additional protection is needed when the count of an attribute is low. For example, in the current prototype, if the MAD score is less than 2, then it is not included. This is because, even if the rate of these events is outside the expected range of the group, a low count indicates that these events are not constitutive events of the storm.

[0079] See Figure 1B Flowchart 150 shows Figure 1AAn exemplary embodiment of an aspect of the flowchart: clustering event attributes to test whether the clustered event attributes exceed a threshold deviation from the cluster norm during the sampling period in which the storm is detected.

[0080] Event attributes in the sampling window can be clustered based on one or more distance metrics.151 Distance metrics can be configured for event log scenarios and based on information available in event log entries.

[0081] Examples of distance metrics can be the text string similarity of event log entries. Another example of a distance metric can be the location similarity of the origin of an event log entry, such as through the site unit used for telecommunications logs or the location of an administrative facility or server in distributed computing system logs. Other forms of distance metrics can be based on information available in the log entries.

[0082] In the example of text strings as a distance metric, clustering can be performed using string comparison techniques such as edit distance metrics (e.g., Jaro-Winkler distance). Edit distance quantifies how dissimilar two strings are by counting the minimum number of operations required to transform one string into another.

[0083] For example, if three distinct event types exist and the statistical bias does not exceed a certain threshold, string similarity can be used to detect clustering.151 For instance, the following event instances related to inter-domain routing protocols (such as the Border Gateway Protocol (BGP) in the Cisco implementation) (Cisco is a trademark of Cisco Systems, Inc.) can be clustered and considered as event groups due to their string similarity:

[0084] BGP_CISCO_STATE_1

[0085] BGP_CISCO_STATE_2

[0086] BGP_CISCO_STATE_3

[0087] Multiple clusters can be generated for the sampling time using different distance metrics and / or by using different constraints on the same distance metric.151

[0088] The generated clusters can be tested by the number of event log instances belonging to a cluster at the sampling time. This can be tested as a percentage of the total number of events at the sampling time. For clusters deemed useful, a test could be whether events representing a percentage threshold number at the sampling time are members of the cluster.

[0089] Alternatively, the generated clusters can be compared with other clusters to determine one or more clusters that have the highest number of events during the sampling time.

[0090] One or more clusters with the highest individual measure or the highest comparative measure of an event can be selected 154 as primary candidates for clustering. Once selected, or as part of the selection process, the clusters can be tested 155 to determine whether the number of events in the cluster is higher than a threshold percentage of the total events in the sampling window.

[0091] For example, if the cluster accounts for more than 60% of the expected range, then clustering alone can be used. If the expected maximum count is 100 events in the sampling time of the detected storm, then 60 events must be members of a cluster in order to use that cluster.

[0092] Once one or more clusters have been selected, the clusters can be used as 156 new groups, and it can be determined whether the event rate of the clusters is outside a threshold deviation from the average of the event metrics for the clusters against the sampling window. If it does not pass further testing, further clustering with different distance metrics can be tried 151.

[0093] This method is capable of detecting ongoing storms and capturing significant clusters of associated events, although it does not need to be exhaustive. The described method does not guarantee that it will discover all events that constitute a storm. However, the requirement for total inclusion of events constituting a storm is not as paramount as the requirement for accurate storm detection.

[0094] It should be noted that simply applying a baseline algorithm to the original event type (i.e., the original event type) is inaccurate. This is because most baseline algorithms become extremely inaccurate or discard metrics from the analysis when they tend to zero, regardless of the individual event type. This is why scores or biases are only calculated for the available sampling window where scores or biases occur within the detected storms.

[0095] The described method essentially couples the bias of multiple grouped or classified events in storm detection and event sampling, in which storms are detected due to limitations of standard baseline algorithms.

[0096] Figure 2 An exemplary embodiment of system 200 is shown, wherein event log 230 dynamically evaluates events occurring in an information technology environment to determine whether an event storm has occurred and to identify events that contribute to the storm.

[0097] System 200 includes a computer system 210 providing a storm event identification system 240. The computer system 210 includes at least one processor 201, hardware modules, or circuitry for performing the functions of the described components, which may be software units executing on at least one processor. Multiple processors running parallel processing threads may be provided, enabling parallel processing of some or all of the components' functions. Memory 202 may be configured to provide computer instructions 203 to at least one processor 201 to perform the components' functions.

[0098] The storm event identification system 240 can use the operation analysis system 220, which can analyze log event entries of the event log 230 of the information technology environment. The operation analysis system 220 can be remotely provided to the storm event identification system 240, or the storm event identification system 240 can be a component of the operation analysis system 220.

[0099] The storm event identification system 240 may include a configuration component 250 for configuring parameters of the storm event identification system 240, a learning component 260 for learning the behavior of events in the event log 230, an event storm detection component 270, an event composition identification component 280, and an event composition association component 242.

[0100] Configuration component 250 may include sampling window component 251 for configuring the sampling window duration to configure the granularity of event storm detection. Sampling time periods can be configured to be discrete or continuous and have one or more durations. In one embodiment, they are configured as short sampling time windows and longer sampling time windows to capture different event storm behaviors.

[0101] Configuration component 250 may also include threshold deviation component 252 for configuring threshold deviation to configure the sensitivity of the identification of event components.

[0102] The learning component 260 may include a global event range learning component 261, which learns the expected event rates over one or more sampled time periods of a defined length in the event log as a whole. The learning component 260 may also include an event attribute learning component 262, which learns event attribute information over one or more sampled time periods of a defined length for classifying and clustering event attributes.

[0103] The event storm detection component 270 may include a dynamic thresholding component 272 and an anomaly detection component 273. The dynamic thresholding component 272 is used to determine a dynamic baseline range of expected event rates within one or more defined sampling time periods using a dynamic thresholding algorithm. The anomaly detection component 273 is used to detect anomalies from the dynamic baseline range indicating an event storm using an anomaly detection algorithm.

[0104] The event composition identification component 280 can identify each event group in an event group grouped by event categories that occur during the sampling period of the event storm as part of the event storm if the rate of event occurrence in that group during the sampling period is outside a threshold deviation from the average for that group.

[0105] The event composition identifier component 280 may include a grouping component 282 and a minimum event component 281. The grouping component 282 is used to group events according to event categories, which include individual event attributes or clusters of event attributes. The minimum event component 281 is used to ensure that event grouping includes a minimum number of event instances.

[0106] Event composition identification component 280 may include group bias component 283 for determining whether the rate of event occurrence of a group during the sampling period is outside a threshold deviation from the average value for the group.

[0107] The event composition identifier component 280 may include an attribute clustering component 284 for clustering events within a sampling time period using distance metrics of event attributes. For example, the distance metric for event attributes may be a text string metric or a location metric.

[0108] The attribute clustering component 284 may include testing clusters during a sampling period to satisfy a threshold percentage of event instances belonging to the cluster, and may include selecting clusters by comparing clusters with a varying distance metric during the sampling period.

[0109] Event component association component 242 can associate all event groups identified as storm components and can display the events as system output.

[0110] Figure 3 An embodiment of the invention is depicted. Figure 2 A block diagram of the components of computer system 210 in system 200. It should be understood that... Figure 3 This is merely an illustration of an implementation and does not imply any limitation regarding the environment in which different embodiments may be implemented. Many modifications can be made to the depicted environment.

[0111] Computer system 210 may include one or more processors 302, one or more computer-readable RAMs 304, one or more computer-readable ROMs 306, one or more computer-readable storage media 308, device drivers 312, read / write drivers or interfaces 314, and network adapters or interfaces 316 all interconnected via communication structure 318. Communication structure 318 may be implemented using any architecture designed for transferring data and / or control information between processors (such as microprocessors, communication and network processors, etc.), system memory, peripheral devices, and any other hardware components within the system.

[0112] One or more operating systems 310 and applications 311 (e.g., event storm detection system 240) are stored on one or more computer-readable storage media 308 for execution by one or more processors 302 via one or more corresponding RAMs 304 (which typically include cache memory). In the illustrated embodiment, according to embodiments of the invention, each of the computer-readable storage media 308 may be a disk storage device such as an internal hard disk, CD-ROM, DVD, Memory Stick, magnetic tape, magnetic disk, optical disk, semiconductor storage device such as RAM, ROM, EPROM, flash memory, or any other computer-readable storage medium capable of storing computer programs and digital information.

[0113] Computer system 210 may also include a read / write driver or interface 314 for reading from and writing to one or more portable computer-readable storage media 326. Application program 311 on computer system 210 may be stored on one or more portable computer-readable storage media 326, and read and loaded into the corresponding computer-readable storage media 308 via the corresponding read / write driver or interface 314.

[0114] Computer system 210 may also include a network adapter or interface 316, such as a TCP / IP adapter card or a wireless communication adapter. Application program 311 on computer system 210 can be downloaded to the computing device from an external computer or external storage device via a network (e.g., the Internet, a local area network, or other wide area networks or wireless networks) and network adapter or interface 316. The program can be loaded from network adapter or interface 316 into computer-readable storage medium 308. The network may include copper wire, fiber optic, wireless transmission, routers, firewalls, switches, gateway computers, and edge servers.

[0115] Computer system 210 may also include a display screen 320, a keyboard or keypad 322, and a computer mouse or touchpad 324. Device driver 312 interfaces to display screen 320 for imaging, to keyboard or keypad 322, to computer mouse or touchpad 324, and / or interfaces to display screen 320 for alphanumeric character input and user-selected pressure sensing. Device driver 312, read / write driver or interface 314, and network adapter or interface 316 may include hardware and software stored in computer-readable storage medium 308 and / or ROM 306.

[0116] This invention can be a system, method, and / or computer program product with any possible level of technical detail integration. The computer program product may include a computer-readable storage medium (or media) having computer-readable program instructions thereon for causing a processor to execute aspects of the invention.

[0117] Computer-readable storage media can be tangible means for retaining and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example, but not limited to, electronic storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital universal disk (DVD), memory sticks, floppy disks, mechanical encoding devices such as punch cards or protrusions in slots having instructions recorded thereon, and any suitable combination of the foregoing. As used herein, computer-readable storage media should not be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses passing through fiber optic cables), or electrical signals transmitted through wires.

[0118] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a suitable computing / processing device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network), or to an external computer or external storage device. The network may include copper cables, optical fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to a computer-readable storage medium within the suitable computing / processing device.

[0119] Computer-readable program instructions used to perform the operations of this invention may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, integrated circuit configuration data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​(such as Smalltalk, C++, etc.) and procedural programming languages ​​(such as the "C" programming language or similar programming languages). The computer-readable program instructions may be executed entirely on a user's computer, partially on a user's computer, as a standalone software package, partially on a user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer via any type of network (including a local area network (LAN) or a wide area network (WAN)) or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs) may execute computer-readable program instructions by utilizing state information from the computer-readable program instructions to perform aspects of this invention.

[0120] The present invention will now be described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each block of the flowchart illustrations and / or block diagrams, as well as combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0121] These computer-readable program instructions may be provided to a processor of a computer or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / actions specified in one or more boxes of a flowchart and / or block diagram. These computer-readable program instructions may also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner, such that the computer-readable storage medium storing the instructions comprises an article of manufacture containing instructions that implement aspects of the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0122] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus, or other device to produce computer-implemented processing, such that the instructions executed on the computer, other programmable apparatus, or other device perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0123] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. Each block in a flowchart or block diagram may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the figures. For example, two blocks shown consecutively may actually be completed as a single step, executed simultaneously, substantially simultaneously, or with partial or complete temporal overlap, or the blocks may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action or executes a combination of dedicated hardware and computer instructions.

[0124] cloud computing

[0125] It should be understood that while this disclosure includes a detailed description of cloud computing, the implementation of the teachings cited herein is not limited to cloud computing environments. Rather, embodiments of the invention can be implemented in conjunction with any other type of computing environment now known or developed hereafter.

[0126] Cloud computing is a service delivery model that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services), which can be rapidly provisioned and released with minimal management effort or interaction with the service provider. This cloud model may include at least five features, at least three service models, and at least four deployment models.

[0127] The features are as follows:

[0128] On-demand self-service: Cloud consumers can unilaterally and automatically provide computing power, such as server time and network storage, as needed, without requiring human interaction with the service provider.

[0129] Extensive network access: Capabilities are available through networks and accessed via standard mechanisms that facilitate the use of heterogeneous thin client or thick client platforms (e.g., mobile phones, laptops, and PDAs).

[0130] Resource pooling: A provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, where different physical and virtual resources are dynamically assigned and reassigned as needed. There is a sense of location independence because consumers typically do not have control or knowledge of the exact location of the resources provided, but may be able to specify the location at a higher level of abstraction (e.g., country, state, or data center).

[0131] Rapid flexibility: The ability to provide capacity quickly and flexibly, automatically scaling down and up rapidly in some situations to scale up rapidly. For consumers, the available supply capacity often appears unlimited and can be purchased in any quantity at any time.

[0132] Measuring services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at a level of abstraction appropriate to the service type (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both service providers and consumers.

[0133] The service model is as follows:

[0134] Software as a Service (SaaS): This provides consumers with the ability to use the provider's applications running on cloud infrastructure. The applications can be accessed from different client devices via a thin client interface such as a web browser (e.g., web-based email). Consumers do not manage or control the underlying cloud infrastructure, including the network, servers, operating system, storage, or even individual application capabilities, with possible exceptions such as limited user-specific application configuration settings.

[0135] Platform as a Service (PaaS): This provides consumers with the ability to deploy applications created or acquired by the consumer using programming languages ​​and tools supported by the provider onto cloud infrastructure. Consumers do not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but they have control over the deployed applications and the configuration of any application hosting environment.

[0136] Infrastructure as a Service (IaaS): The capabilities offered to consumers are processing, storage, networking, and other basic computing resources that enable consumers to deploy and run arbitrary software, which may include operating systems and applications. Consumers do not manage or control the underlying cloud infrastructure, but rather have control over the operating system, storage, deployed applications, and potentially limited control over selected networking components (e.g., host firewalls).

[0137] The deployment model is as follows:

[0138] Private cloud: A cloud infrastructure that operates solely for an organization. It can be managed by the organization or a third party and can exist on-site or off-site.

[0139] Community cloud: A cloud infrastructure shared by several organizations and supporting a specific community with shared concerns (e.g., tasks, security requirements, policies, and compliance considerations). It can be managed by an organization or a third party and can exist on-site or off-site.

[0140] Public cloud: Makes cloud infrastructure available to the public or large industry groups and is owned by an organization that sells cloud services.

[0141] Hybrid cloud: A cloud infrastructure is a combination of two or more clouds (private, community, or public) that remain a single entity but are bound together by standardized or proprietary technologies that enable data and applications to be ported (e.g., cloud bursting for load balancing between clouds).

[0142] Cloud computing environments are service-oriented, focusing on statelessness, loose coupling, modularity, and semantic interoperability. At the heart of cloud computing is the infrastructure comprising a network of interconnected nodes.

[0143] Referring now to Figure 7, an illustrative cloud computing environment 50 is depicted. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 with which local computing devices used by cloud consumers can communicate. These local computing devices include, for example, personal digital assistants (PDAs) or cellular phones 54A, desktop computers 54B, laptop computers 54C, and / or automotive computer systems 54N. Nodes 10 can communicate with each other. They can be physically or virtually grouped (not shown) in one or more networks, such as private clouds, community clouds, public clouds, or hybrid clouds, or combinations thereof, as described above. This allows the cloud computing environment 50 to provide infrastructure, platforms, and / or software as services for which cloud consumers do not need to maintain resources on their local computing devices. It should be understood that the types of computing devices 54A-N shown in Figure 7 are intended to be illustrative only, and the computing nodes 10 and the cloud computing environment 50 can communicate with any type of computerized device via any type of network and / or network-addressable connectivity (e.g., using a web browser).

[0144] Referring now to Figure 8, a set of functional abstraction layers provided by the cloud computing environment 50 (Figure 7) is shown. It should be understood beforehand that the components, layers, and functions shown in Figure 8 are intended to be illustrative only, and embodiments of the invention are not limited thereto. As described, the following layers and corresponding functions are provided:

[0145] The hardware and software layer 60 includes hardware and software components. Examples of hardware components include: a mainframe 61; a RISC (Reduced Instruction Set Computer) based server 62; a server 63; a blade server 64; a storage device 65; and network and networking components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0146] The virtualization layer 70 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual server 71; virtual storage 72; virtual network 73, including virtual private network; virtual application and operating system 74; and virtual client 75.

[0147] In one example, management layer 80 may provide the following functionalities: Resource Provisioning 81 provides dynamic procurement of computing resources and other resources used to perform tasks within the cloud computing environment. Metering and Pricing 82 provides cost tracking as resources are utilized within the cloud computing environment and bills or invoices for the consumption of these resources. In one example, these resources may include application software licenses. Security provides authentication for cloud consumers and tasks, as well as protection for data and other resources. User Portal 83 provides access to the cloud computing environment for consumers and system administrators. Service Level Management 84 provides cloud resource allocation and management to ensure that required service levels are met. Service Level Agreement (SLA) Planning and Fulfillment 85 provides pre-scheduling and procurement of cloud resources based on anticipated future needs according to the SLA.

[0148] Workload layer 90 provides examples of functionalities that can be leveraged in a cloud computing environment. Examples of workloads and functionalities that can be provided from this layer include: mapping and navigation 91; software development and lifecycle management 92; virtual classroom education delivery 93; data analytics and processing 94; transaction processing 95; and event log processing 96.

[0149] The computer program product of the present invention includes one or more computer-readable hardware storage devices storing computer-readable program code that can be executed by one or more processors to implement the method of the present invention.

[0150] The computer system of the present invention includes one or more processors, one or more memories, and one or more computer-readable hardware storage devices, wherein the one or more hardware storage devices contain program code executable by the one or more processors via the one or more memories to implement the method of the present invention.

[0151] Various embodiments of the invention have been described for illustrative purposes, but are not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein has been chosen to best explain the principles of the embodiments, their practical application, or technical improvements to technologies found in the market, or to enable those skilled in the art to understand the embodiments disclosed herein.

[0152] The foregoing may be improved and modified without departing from the scope of the present invention.

Claims

1. A computer-implemented method for identifying constituent events in an event storm during operations management, comprising: Event storms are detected by detecting anomalies from a dynamic baseline range of expected event rates within a sampling period. as well as When the event storm is detected, for each event in the event group grouped by event category and occurring during the sampling time period of the event storm, if the rate of occurrence of the event in the group during the sampling time period is outside a threshold deviation from the average value for the group, then the event group is identified as part of the event storm, wherein the event category is obtained by clustering the events in the sampling time period using a distance metric of event attributes, and the event category includes clusters of individual event attributes or event attributes based on distance metrics.

2. The method of claim 1, comprising associating multiple groups of events identified as part of the event storm.

3. The method of claim 1, further comprising learning the expected event rate over one or more sampling time periods of a defined length.

4. The method of claim 1, wherein detecting the event storm comprises: A dynamic thresholding algorithm is used to determine the dynamic baseline range of the expected event rate over one or more sampling time periods of a defined length; as well as Anomaly detection algorithms are used to detect anomalies from the dynamic baseline range that indicates the event storm.

5. The method of claim 1, comprising learning event attribute information over one or more sampling time periods of a defined length.

6. The method of claim 1, wherein if the group based on individual event attributes during the sampling time period is not higher than a threshold deviation for the individual event attributes, then the multiple individual event attributes are clustered to form the event group.

7. The method of claim 1, wherein the distance metric of the event attribute is one of the following: a text string metric; a location metric; or another metric obtained from event log entry information.

8. The method of claim 1, further comprising testing the cluster during the sampling time period to satisfy a threshold percentage of event instances belonging to the cluster.

9. The method of claim 1, further comprising selecting a cluster by comparing clusters that have a changing distance metric over the sampling time period.

10. The method of claim 1, wherein the event group comprises a minimum number of event instances.

11. The method of claim 1, wherein the sampling time period is configured for the granularity of the event storm detection, the granularity of the event storm detection including short time windows and longer time windows to capture different event storm behaviors.

12. The method of claim 1, wherein the threshold deviation from the average value for the group is a threshold Z-score test for the event group.

13. A computer-implemented method for identifying constituent events in an event storm during operations management, comprising: Event storms are detected by detecting anomalies from the dynamic baseline range of the expected event rate of the total event population during the sampling period; as well as For the sampling time period in the detected event storm, event instances are identified as constituent events of the event storm by clustering event attributes and determining whether the occurrence rate of event instances in the clusters during the sampling time period deviates from a threshold for the norm of the clustered event attributes. Event categories are obtained by clustering events in the sampling time period using a distance metric of event attributes, and the event categories include clusters of individual event attributes or event attributes based on distance metrics.

14. A system for identifying constituent events in an event storm during operations management, comprising: A processor and memory, the memory being configured to provide the processor with computer program instructions to perform the functions of the components: An event storm detection component is used to detect the event storm by detecting anomalies from a dynamic baseline range of the expected event rate during a sampling period; as well as An event constituting identification component is used to identify an event group as part of the event storm for each event grouped by event categories occurring during the sampling time period of the event storm, if the rate of occurrence of events in the group during the sampling time period is outside a threshold deviation from the average value for the group. The event categories are obtained by an attribute clustering component that clusters events in the sampling time period using a distance metric for event attributes, and the event categories include clusters of individual event attributes or event attributes based on distance metrics.

15. The system of claim 14, further comprising an event constituting association component for associating multiple groups of events identified as part of the event storm.

16. The system of claim 14, wherein the event storm detection component comprises: A dynamic thresholding component is used to determine a dynamic baseline range for the expected event rate over one or more sampling time periods of a defined length using a dynamic thresholding algorithm. as well as An anomaly detection component is used to detect anomalies from the dynamic baseline range that indicates the event storm using an anomaly detection algorithm.

17. The system of claim 14, further comprising a learning component for learning expected event rates over one or more sampling time periods of a defined length and for learning event attribute information over the one or more sampling time periods of a defined length.

18. The system of claim 14, wherein the attribute clustering component includes testing the cluster to satisfy a threshold percentage of event instances belonging to the cluster during the sampling time period.

19. The system of claim 14, wherein the attribute clustering component includes selecting clusters by comparing clusters that have a distance metric that changes over the sampling time period.

20. The system of claim 14, further comprising a configuration component for configuring sampling time periods for the granularity of the event storm detection, the granularity of the event storm detection including short time windows and longer time windows to capture different event storm behaviors.

21. A system for identifying constituent events in an event storm during operations management, comprising: A processor and memory, the memory being configured to provide the processor with computer program instructions to perform the functions of the components: An event storm detection component is used to detect event storms by detecting anomalies from a dynamic baseline range of the expected event rate of the total event population over a sampling period. as well as An event constitutive identification component is used to identify an event instance as a constitutive event of the storm in the detected event storm for the sampling time period by clustering event attributes and determining whether the rate of occurrence of event instances in the clusters during the sampling time period is a threshold deviation from the norm of the clustered event attributes. The event category is obtained by an attribute clustering component that clusters events in the sampling time period using a distance metric for event attributes, and the event category includes individual event attributes or clusters of event attributes based on distance metrics.

22. A computer program product for identifying constitutive events in an event storm during operations management, the computer program product comprising a computer-readable storage medium having program instructions embodied therein, the program instructions being executable by a processor to cause the processor to: Event storms are detected by detecting anomalies from a dynamic baseline range of the expected event rate over a sampling period; and When the event storm is detected, for each event in the event group grouped by event category and occurring during the sampling time period, if the rate of occurrence of the event in the group during the sampling time period is outside a threshold deviation from the average value for the group, then the event group is identified as part of the event storm, wherein the event category is obtained by clustering the events in the sampling time period using a distance metric of event attributes, and the event category includes clusters of individual event attributes or event attributes based on distance metrics.

Images