Correlation Handler for Event Storm Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Event-monitoring systems often generate a 'storm' of messages due to identifying discrete events related to a root cause, leading to inefficient alerting and notification, as they fail to correlate anomalous events effectively across network topologies.
Innovation Solution
Implementing a method within event-monitoring systems to perform correlation algorithms on anomalous events, creating composite events that identify root causes, and sending targeted alerts to appropriate individuals, thereby reducing redundant messages and improving alert specificity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If event-monitoring systems issue alerts for each discrete anomalous event, then individual events are detected and notified, but a storm of redundant messages is generated
Solution Approach 1:
The patent combines multiple discrete anomalous events into a single composite event by identifying common root causes. The correlation handler aggregates events that share the same root cause indicator, merging them into one unified alert notification, thereby reducing message volume while preserving detection accuracy.
Solution Approach 2:
The correlation handler acts as an intermediary component between the event-monitoring system and the alert notification system. It receives discrete anomalous events, performs correlation analysis to identify root causes, and transforms multiple events into composite events before alert generation, preventing redundant notifications.
2Reliability
If alerts are issued for all anomalous events including those caused by root causes above, then complete event coverage is achieved, but redundant notifications to the same individuals occur
Solution Approach 1:
The patent extracts and identifies the root cause indicator from composite anomalous events. By isolating the common root cause, the system can determine which events should be aggregated into a single notification, thereby eliminating redundant alerts to the same individuals while maintaining comprehensive event coverage.
Solution Approach 2:
The correlation handler performs preliminary correlation analysis on anomalous events before alert generation. It pre-identifies root causes and groups related events into composite events, so that when alerts are issued, only one notification is sent per root cause rather than multiple redundant notifications.
3Loss of information
If discrete alerts are sent for each anomalous event, then individual event details are provided, but message storms overwhelm recipients
Solution Approach 1:
The patent merges multiple discrete anomalous events into a single composite event that includes aggregated detail information. The correlation handler consolidates event data while preserving essential details about each event and their common root cause, thereby reducing notification volume without sacrificing information completeness.
Solution Approach 2:
The system creates a composite event representation that copies and aggregates information from multiple discrete events. This composite structure preserves the essential details of individual events while presenting them as a unified notification, reducing the time recipients spend processing multiple similar alerts.
Data Source
AI summary
The method includes monitoring a plurality of information handling systems. The method further includes receiving an anomalous event with respect to at least one information handling system of the plurality of information handling systems. In addition, the method includes performing, via at least one correlation handler, at least one correlation algorithm on the anomalous event. Further, the method includes, responsive to the performing, creating, via the correlation handler, at least one composite event. Additionally, the method includes sending the at least one composite event to an event handler. The method also includes issuing, via the event handler, an alert for the at least one composite event.