Dynamic Topology Model for IT Event Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current IT event correlation systems struggle to detect causal relationships between events from different infrastructure elements, requiring hard-coding of IT topology into correlation rules, which is costly, inflexible, and time-consuming, especially in dynamic environments, necessitating the involvement of specialized experts.
Innovation Solution
A system that dynamically identifies and correlates domain events using a management server, a rule knowledge base, and a correlation module, which maintains a topology of managed objects and applies correlation rules to identify interactions, allowing for runtime adjustments and configuration by domain experts, utilizing a uniform event indicator format and automated rule definition.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If correlation rules are hard-coded with IT topology information to identify causal relationships between events, then the ability to detect and identify causal relationships between events from different infrastructure elements is improved, but the device complexity and maintenance cost increase significantly
Solution Approach 1:
The patent introduces a topology model as an intermediary layer between events and correlation rules. Instead of hard-coding topology information directly into correlation rules, the system maintains a separate topology model that represents infrastructure elements and their relationships. This topology model serves as a mediator that enables correlation rules to identify causal relationships without containing embedded topology information, thereby resolving the contradiction between detection accuracy and rule complexity
Solution Approach 2:
The patent extracts topology information from correlation rules and places it into a separate topology model. By taking out the topology representation from the correlation rules themselves, the system allows rules to focus solely on causal relationships while the topology model handles infrastructure element relationships. This separation reduces correlation rule complexity while maintaining the ability to detect causal relationships accurately
2Measurement precision
If correlation rules include detailed IT topology information to represent relationships between managed objects, then the identification of relevant events is improved, but the ease of operation and adaptability to infrastructure changes deteriorate
Solution Approach 1:
The patent implements a dynamic topology model that can be updated as infrastructure changes occur. Instead of requiring manual updates to hard-coded correlation rules, the topology model can be dynamically modified to reflect additions, removals, or changes in infrastructure elements. This dynamic approach maintains accurate event identification while significantly improving ease of operation, as administrators can update the topology model without rewriting correlation rules
Solution Approach 2:
The topology model acts as an intermediary that absorbs the complexity of infrastructure representation. Correlation rules can remain relatively simple and stable, while the topology model adapts to infrastructure changes. This intermediary layer shields correlation rules from the need to be frequently modified, improving ease of operation while maintaining event identification accuracy
3Reliability
If specialized correlation specialists are involved to address system correlation issues, then the measurement precision and reliability of causal analysis is improved, but the loss of time and increased cost deteriorate
Solution Approach 1:
The patent enables domain experts to perform correlation rule configuration and topology model updates without requiring specialized correlation specialists. By providing user-friendly interfaces and automated assistance, the system allows domain experts to self-service the correlation setup and maintenance. This self-service capability maintains reliable causal analysis while eliminating the need for expensive and time-consuming specialist involvement
Solution Approach 2:
The topology model serves as an intermediary that simplifies the correlation configuration process. Instead of requiring specialists to manually craft complex correlation rules with embedded topology information, the system provides pre-built topology models that domain experts can configure more easily. This intermediary layer bridges the gap between complex causal analysis requirements and user-friendly configuration capabilities
Data Source
AI summary
A system is provided for dynamically identifying and correlating network domain events. The system includes a network domain and a plurality of managed objects in the network domain. A management server is in communication with the managed objects. The management server can receive domain events from at least one of the managed objects. A management module on the management server maintains a topology of managed objects in the network domain. A rule knowledge base is in communication with the management server. The rule knowledge base includes correlation rules for identifying and correlating domain events. A correlation module utilizes a processor to correlate the domain events with the topology using the correlation rules to identify an interaction between the managed objects and the domain events.