Event Correlation for Service Root Cause Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current techniques for cross-domain correlation of components in network systems require significant effort to pre-define correlation scopes and are limited in their operational domains, often failing when deployed to new configurations or technologies, and do not effectively utilize topology information to detect relationships across domains.
Innovation Solution
A system that performs event correlation using covariance matrices and sequence mining to identify components belonging to the same service domain, generating service domains and aiding in root cause analysis by suppressing unnecessary notifications through network management software.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If event correlation techniques are used to identify service domains, then the ability to detect relationships across domains is improved, but the system complexity and computational resources required increase
Solution Approach 1:
The patent introduces an event correlator as an intermediary component that receives events from multiple sources, processes them through covariance analysis and sequence mining, and outputs correlated event patterns. This intermediary handles the computational complexity internally while providing simplified relationship detection capabilities to the rest of the system, resolving the contradiction between improved detection capability and system complexity.
Solution Approach 2:
The system segments the complex task of service domain identification into distinct modular components: event collection, covariance matrix generation, sequence mining, and pattern matching. Each module performs a specific function, making the overall complex process manageable and maintainable while achieving sophisticated relationship detection across domains.
2Measurement precision
If manual pre-definition of correlation scopes is performed, then the precision of cross-domain correlation is improved, but the time and effort required for setup increases
Solution Approach 1:
The system performs self-service by automatically learning correlation patterns from event data through covariance analysis and sequence mining algorithms. Instead of requiring manual configuration of correlation scopes, the system autonomously identifies service domains and relationships by analyzing event sequences and statistical correlations, eliminating setup time while maintaining precision through data-driven pattern recognition.
Solution Approach 2:
The system performs preliminary analysis of event data to pre-identify correlation patterns and service domain relationships before actual monitoring and alerting begins. By pre-processing event sequences and building correlation models in advance, the system prepares precise correlation scopes automatically, reducing both manual setup effort and enabling rapid deployment.
3Loss of information
If all events from multiple components are notified, then the completeness of information is improved, but the number of superfluous notifications increases
Solution Approach 1:
The system uses feedback from correlated event patterns to dynamically control notification generation. By analyzing sequences of events and identifying causal relationships, the system determines which events are root causes versus symptoms, providing feedback that suppresses notifications for dependent events while maintaining notifications for independent root cause events, thus reducing noise while preserving information completeness.
Solution Approach 2:
The system extracts and identifies root cause events from the set of all correlated events using sequence mining and pattern analysis. By separating root cause events from their dependent effects, the system extracts only the essential notifications that require administrator attention, eliminating superfluous notifications while maintaining complete information about the underlying issue through the identified event sequences.
Data Source
AI summary
A system uses event correlation to identify components belonging to a same service or service domain. The system correlates events by generating covariance matrices or by performing sequence mining with temporal databases in order to discover event patterns that occur sequentially in a fixed time window. Components corresponding to the correlated events are identified as being part of a same service domain and can be indicated in a service domain data structure, such as a topology. The system utilizes the identified service domains during root cause analysis. The system can determine an anomalous event occurring a lowest layer component in a service domain as a root cause or can determine an anomalous event which occurs first in an identified event sequence of a service domain as a root cause. After identifying the root cause event, the system suppresses notifications of events occurring at other components in the service domain.