Event Relationship Analysis for Fault Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current event management systems struggle to effectively identify and correlate related events across diverse data schemas and event types, often requiring multiple occurrences of events to establish patterns, which limits their ability to manage new or poorly structured data.
Innovation Solution
A method for event relationship analysis that identifies groups of related events based on historical data, determining event types and associated resources, and automatically suggests correlation rules, even for previously unseen events, by using unsupervised learning algorithms and identifying primary keys for event, time, and resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If event management systems use traditional pattern identification methods, then they can identify recurrent patterns in event streams, but they require events to occur multiple times before patterns are identified and provide limited information
Solution Approach 1:
The system performs preliminary actions by pre-identifying event groups based on resource associations before new events occur. It establishes correlation rules in advance by analyzing historical event data and grouping events that share common resources, so when new events occur, they can be immediately correlated without requiring multiple occurrences.
Solution Approach 2:
The system enables self-service by automatically suggesting correlation rules and event groups without requiring manual configuration or multiple event occurrences. The unsupervised learning algorithm autonomously analyzes event data, identifies resource associations, and generates correlation rules that the system applies itself to new events.
2Productivity
If event management systems correlate commonly co-occurring alerts together, then operation cost is reduced, but the systems struggle to effectively identify and correlate related events across diverse data schemas
Solution Approach 1:
The system achieves universality by creating correlation rules based on resource associations that work across diverse event types and data schemas. Instead of requiring specific event patterns, the system identifies events that share common resources (devices, services, components) and correlates them universally, regardless of their specific schemas or types.
Solution Approach 2:
The system applies parameter changes by shifting from traditional pattern-based correlation (requiring multiple occurrences of specific event sequences) to resource-based correlation. This parameter change allows the system to correlate events based on their resource associations, making it adaptable to diverse data schemas while maintaining high correlation efficiency.
3Measurement precision
If event management systems use resource-specific patterns, then patterns can be identified for specific resources, but they cannot effectively manage new or poorly structured data
Solution Approach 1:
The system performs preliminary action by pre-establishing correlation rules based on resource associations before new events occur. It analyzes historical data to identify groups of events associated with the same resources and creates correlation rules in advance, enabling precise correlation of new events without requiring multiple occurrences or predefined patterns.
Solution Approach 2:
The system uses resources as intermediaries to correlate events. Instead of directly correlating events based on their schemas or types, it uses shared resources (devices, services, components) as mediators to establish correlations. This intermediary approach allows precise correlation while being adaptable to new and diverse event types.
Data Source
AI summary
Method and system for event relationship analysis in fault management. The method includes identifying a group of related events based on a history of a plurality of event instances relating to multiple events. For each event occurrence of each event of the group of related events, there is identified: an event type; and one or more resources associated with the event occurrence. The method also comprises: identifying a set of event occurrences of the same type; and identifying event occurrences associated with the same resource.