Automated Event Correlation Engine for Storage System Impact Assessment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In network systems, identifying and addressing issues with monitored resources, such as hard disk components, is time-consuming and error-prone due to the manual interpretation of low-level system log information, requiring users to manually correlate system impacts and determine urgency.
Innovation Solution
An automated system processes low-level system information to generate comprehensive impact reports, using a notification processing program that extracts additional information from event logs, allowing users to quickly assess the impact and risk of resource events without direct manual intervention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual interpretation of system log information is used, then users can identify system issues, but the process is time-consuming and error-prone
Solution Approach 1:
The system performs self-assessment by automatically correlating log events with system configuration data and impact information without requiring manual user intervention. The event correlation engine autonomously determines the impact of detected issues on system operations, eliminating the need for users to manually interpret logs and assess impacts.
Solution Approach 2:
An event correlation engine acts as an intermediary between raw log events and users. This engine processes low-level log information, correlates it with system configuration data, and generates high-level impact assessments, thereby reducing both the time and error rate associated with manual analysis.
2Ease of operation
If users manually correlate system impacts and determine urgency, then corrective actions can be prioritized, but the process requires significant user time and expertise
Solution Approach 1:
The system automatically performs impact correlation by querying system configuration data and analyzing event relationships. The event correlation engine generates prioritized corrective action recommendations without requiring users to manually correlate impacts or determine urgency levels.
Solution Approach 2:
The system pre-establishes relationships between system components and their dependencies by maintaining configuration data that maps events to potential impacts. This preliminary structuring of information allows the event correlation engine to quickly assess impacts without requiring users to perform time-consuming manual correlation during incident response.
3Loss of information
If detailed low-level log information is provided to users, then complete system information is available, but users need advanced skills to interpret the information effectively
Solution Approach 1:
The event correlation engine serves as an intermediary that transforms detailed low-level log information into high-level impact assessments. It preserves the completeness of system information by maintaining detailed logs while presenting processed, contextualized information to users that is easier to interpret without requiring advanced technical skills.
Solution Approach 2:
The system segments information presentation into two levels: detailed low-level log data is retained for completeness but separated from the user-facing view. The event correlation engine creates a separate layer of high-level impact information that is presented to users, allowing them to access complete information when needed while receiving simplified interpretations by default.
Data Source
AI summary
The subject disclosure is directed towards providing a user with impact-related information regarding the impact of a monitored event (for a detected resource issue) to a managed system, such as a storage system. An event is generated when a resource such as a hard disk has an issue, e.g., has failed. Information from the event is automatically extracted and used to communicate with a management program coupled to the resource. Communication with the management program obtains information as to the impact the resource issue has to the system, e.g., what servers and/or applications are impacted. The impact-related data may be presented in a report to a user.