Cloud Event Correlation via Modular Query Engine
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud computing environments, application owners face challenges in identifying the root causes of anomalies due to limited visibility into various events affecting their applications, leading to reduced system performance and potential impact on growth.
Innovation Solution
A processing system for event correlation in cloud computing that includes an event repository, a processor, memory, and a query engine module to filter, aggregate, and present relevant events, enabling users to understand the behavior and health of the cloud environment through correlation with latency graphs and reports.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If comprehensive monitoring of all cloud environment events is implemented, then visibility into system behavior is improved, but system complexity and data volume increase significantly
Solution Approach 1:
The patent segments the complex cloud environment monitoring into modular components: event sources generate discrete events, the event repository stores them in organized collections, and the query engine processes specific event types. This segmentation allows comprehensive monitoring without overwhelming system complexity by dividing the monitoring function into manageable, independent modules that can be selectively activated.
Solution Approach 2:
The event repository acts as an intermediary layer between diverse event sources and the query engine. It standardizes different event types into a common format with consistent fields (timestamp, event type, source, severity), enabling the query engine to process various events uniformly without directly handling the complexity of individual event sources.
2Measurement precision
If all events are collected and stored in detail, then event correlation accuracy is improved, but storage requirements and processing time increase
Solution Approach 1:
The query engine implements partial action by selectively querying only the specific event types and time ranges needed for a particular analysis. Instead of processing all stored events, users can specify precise query parameters (event type, source, time range, severity) to retrieve only the relevant subset, maintaining correlation accuracy while minimizing processing time and resource usage.
Solution Approach 2:
Events are pre-processed and stored in the event repository with standardized formats and organized metadata before querying. This preliminary organization includes timestamp indexing, event type categorization, and source identification, which enables the query engine to quickly locate and correlate relevant events without performing extensive real-time processing.
3Ease of operation
If event filtering and aggregation are applied, then ease of analysis is improved, but detail information may be lost
Solution Approach 1:
The query engine adds analytical dimensions through aggregation operations that group events by multiple criteria simultaneously (event type, source, time range, severity). This multi-dimensional grouping organizes detailed event data into structured summaries that maintain the underlying detail information while presenting it in an easily analyzable format, allowing users to drill down from aggregated views to individual events when needed.
Data Source
AI summary
The present invention pertains to cloud computing systems and handling of events that occur in the cloud. A correlation system obtains and analyzes various events to obtain comprehensive information about the behavior of the cloud. An event repository receives and maintains time-stamped events, which may be obtained from the cloud itself or from external sources reporting on the cloud. A query engine is employed to select, filter and aggregate events from the event repository. The query engine may take into account metadata which describes relationships between different parts of the cloud. Results from the query engine may be presented on a display or otherwise reported. Using such information, the system may fix known problems or change certain parameters to improve the cloud computing process.