Hierarchical Event Tree for Parent-Child Error Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems for recording and analyzing system events, such as error logs and access logs, require extensive analysis to identify underlying causes of performance issues, making it difficult to efficiently link child events to parent events and correlate errors across distributed storage networks.
Innovation Solution
A dispersed storage network (DSN) with a hierarchical event tree structure is implemented, where events are encoded and decoded using Cauchy Reed-Solomon encoding, allowing for the capture and storage of parent-child relationships between events, enabling efficient analysis and correlation of errors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If logs of individual events are maintained for system monitoring, then system event recording capability is improved, but analysis complexity and time required to identify underlying causes increases
Solution Approach 1:
The patent segments event analysis by introducing a hierarchical structure that divides events into parent events and child events. This segmentation allows the system to organize individual event logs into structured hierarchies where related events are grouped under common parent events, making it easier to trace root causes without analyzing every individual log entry separately.
Solution Approach 2:
The patent adds a hierarchical dimension to event logging by introducing parent-child relationships between events. This dimensional change transforms flat event logs into multi-level hierarchical structures, enabling analysts to navigate from specific child events to broader parent events and vice versa, significantly reducing the time needed to identify underlying causes.
2Measurement precision
If hierarchical event tree structure with parent-child relationships is implemented, then error correlation capability is improved, but system complexity increases
Solution Approach 1:
The patent segments the complex task of error correlation into manageable hierarchical levels. By dividing events into parent and child categories, the system breaks down complex error relationships into simpler, more manageable units that can be analyzed independently and then reassembled to understand the complete error picture.
Solution Approach 2:
The patent implements a nested hierarchical structure where child events are nested within parent events, forming an event tree. This nesting allows the system to contain multiple levels of event detail within a structured framework, enabling precise error correlation while maintaining organizational simplicity through the nested arrangement.
3Measurement precision
If extensive analysis of individual event logs is performed, then diagnostic accuracy is improved, but productivity and efficiency decrease
Solution Approach 1:
The patent performs preliminary organization of events into hierarchical parent-child relationships before diagnostic analysis is needed. This preliminary structuring of event data into meaningful hierarchies enables faster and more accurate diagnostics by pre-organizing information in a way that highlights relationships and potential root causes, eliminating the need for extensive post-hoc analysis.
Data Source
AI summary
Event records from multiple computing devices are received at a managing unit. Individual event records include an event identifier field including an event identifier identifying a first event associated with a particular computing device, a parent event identifier field identifying a parent event that initialized the first event, and an entity identifier field including an entity identifier identifying the particular computing device. The managing unit generates log records associated with event identifiers included in the event records. The log records include state fields indicating a state of a particular event associated with a particular event identifier. Based on a correlation of the event and log records, the managing unit determines at least two computing devices associated with events resulting in an error state, and identifies parent events that initialized the events with errors. The managing unit generates a report linking the parent events to the events having an error state.