Syntax Pattern Engine for Automated Event Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems for managing and decomposing events from managed infrastructures are inefficient, particularly in organizing and retrieving information due to the lack of automated indexing and effective clustering, leading to difficulties in identifying failures or errors within complex systems.
Innovation Solution
A system utilizing a syntax pattern engine to cluster events from managed infrastructures, determining common characteristics and producing clusters that represent actionable problems, and generating alerts based on these patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If manual organization of events into folders is used, then information can be stored in topic-based folders, but it becomes impractical to handle massive amounts of web-based information and difficult to locate information of interest
Solution Approach 1:
The system enables automated organization of events into topic-based clusters without requiring manual intervention. The syntax pattern engine automatically analyzes event data, identifies patterns, and organizes events into meaningful groups, allowing the system to serve itself rather than requiring human operators to manually create and maintain directories.
Solution Approach 2:
The patent replaces the mechanical manual process of creating and maintaining directory hierarchies with an automated computational system. The syntax pattern engine uses algorithmic processing to analyze and organize events, substituting human manual labor with automated pattern recognition and clustering mechanisms.
2Ease of operation
If traditional folder-based systems are used, then messages can be sorted into categories, but any given message can only be in one folder at a time and cannot serve multiple activities at once
Solution Approach 1:
The system merges multiple folder assignments into a single unified event representation. By clustering events based on syntax patterns, a single event can simultaneously belong to multiple topic-based clusters, allowing the same event to serve multiple activities and purposes without requiring physical copying or movement between folders.
Solution Approach 2:
The patent implements multi-functionality by enabling events to participate in multiple topic-based clusters simultaneously. This universal approach allows a single event to fulfill multiple roles and serve different activities at the same time, overcoming the limitation of traditional single-folder assignment systems.
3Extent of automation
If rule-based systems are used for event decomposition, then events can be processed according to predefined logic, but the systems lack automated indexing and effective clustering capabilities
Solution Approach 1:
The patent replaces rule-based systems with a syntax pattern engine that uses automated pattern recognition and clustering algorithms. This substitution enables the system to automatically index and cluster events based on their syntactic structures, eliminating the need for manual rule definition while preserving and enhancing information organization capabilities.
Solution Approach 2:
The syntax pattern engine enables the system to automatically perform indexing and clustering without external intervention. The engine self-organizes events into topic-based clusters by analyzing syntax patterns, allowing the system to maintain effective indexing and clustering capabilities through autonomous operation.
Data Source
AI summary
A system is provided for clustering events. A first engine configured to receive message data from managed infrastructure that includes managed infrastructure physical hardware that supports the flow and processing of information. The at least one engine is configured to determine common characteristics of events and produce clusters of events relating to failure of errors in the managed infrastructure, where membership in a cluster indicates a common factor of the events that is a failure or an actionable problem in the physical hardware managed infrastructure directed to supporting the flow and processing of information. The at least one engine is configured to create one or more situations that is a collection of one or more events or alerts representative of the actionable problem in the managed infrastructure. A second engine is configured to determine one or more common steps from events and produces clusters relating to events. The second engine determines one or more common characteristics of events and produces clusters of events relating to the failure or errors in the managed infrastructure. An anomaly engine is configured to perform bitwise operations. A change to a managed infrastructure physical hardware component is made.