System and method for systematic construction of correlation rules for event management
    2.
    发明授权
    System and method for systematic construction of correlation rules for event management 失效
    系统建立事件管理相关规则的系统和方法

    公开(公告)号:US06697791B2

    公开(公告)日:2004-02-24

    申请号:US09849565

    申请日:2001-05-04

    IPC分类号: G06F1700

    CPC分类号: G06N5/025

    摘要: A technique is provided for systematically constructing one or more correlation rules for use by an event management system for managing a network with one or more computing devices. The technique comprises the following steps. First, in association with an event cache, event data representing past or historical events associated with the network of computing devices being managed by the event management system is obtained. Next, a first pattern is found or detected in the obtained event data associated with the event cache. The pattern is then classified. Then, at least one correlation rule is constructed based on the classified pattern. Lastly, in association with the event cache, the one or more events included in the pattern are replaced with a composite or cumulative event such that hierarchical patterns may be subsequently found for use in constructing further correlation rules.

    摘要翻译: 提供了一种用于系统地构建一个或多个相关规则以供事件管理系统用于使用一个或多个计算设备管理网络的技术。 该技术包括以下步骤。 首先,与事件缓存相关联,获得表示由事件管理系统管理的与计算设备的网络相关联的过去或历史事件的事件数据。 接下来,在与事件高速缓存相关联的所获得的事件数据中找到或检测到第一模式。 然后将模式分类。 然后,基于分类模式构建至少一个相关规则。 最后,与事件缓存相关联,包含在模式中的一个或多个事件被替换为复合或累积事件,使得随后可以发现分级模式用于构建进一步的相关规则。

    Systems and methods for pairwise analysis of event data
    5.
    发明授权
    Systems and methods for pairwise analysis of event data 有权
    事件数据成对分析的系统和方法

    公开(公告)号:US06697802B2

    公开(公告)日:2004-02-24

    申请号:US09976574

    申请日:2001-10-12

    IPC分类号: G06F1700

    摘要: Techniques for mining or discovering one or more patterns in an input data set, wherein the input data set is characterized by attributes, comprises the following steps. First, the technique includes mapping attributes of the input data set to mapping values. Then, one or more candidate patterns are formed as groupings of two mapping values that occur within a predefined time period. Next, for each of the one or more candidate patterns, a qualification function is computed and a result of the qualification function is compared with at least one predefined threshold value. The one or more candidate patterns whose qualification function results are greater than or equal to the predefined threshold value are identified as one or more qualified patterns.

    摘要翻译: 用于在输入数据集中挖掘或发现一个或多个模式的技术,其中所述输入数据集由属性表征,包括以下步骤。 首先,该技术包括将输入数据集的属性映射到映射值。 然后,形成一个或多个候选模式作为在预定时间段内出现的两个映射值的分组。 接下来,对于一个或多个候选模式中的每一个,计算资格功能,并将资格功能的结果与至少一个预定义的阈值进行比较。 其资格功能结果大于或等于预定阈值的一个或多个候选模式被识别为一个或多个合格模式。

    METHOD AND APPARATUS FOR NETWORK TOPOLOGY DISCOVERY USING CLOSURE APPROACH
    6.
    发明申请
    METHOD AND APPARATUS FOR NETWORK TOPOLOGY DISCOVERY USING CLOSURE APPROACH 失效
    使用闭路方法发现网络拓扑的方法和装置

    公开(公告)号:US20080232262A1

    公开(公告)日:2008-09-25

    申请号:US11687750

    申请日:2007-03-19

    IPC分类号: H04L1/00

    CPC分类号: H04L41/12 H04L41/0213

    摘要: Improved network topology discovery techniques are disclosed. For example, an automated method for discovering a topology of a network, having a plurality of nodes, includes the following steps. A first traceroute process is performed for a given source node and one or more destination nodes listed in a target list so as to discover one or more paths through one or more intermediate nodes between the given source node and the one or more destination nodes. The one or more intermediate nodes discovered during the first traceroute process are added to the target list. A second traceroute process is performed for the given source node and the one or more intermediate nodes discovered during the first traceroute process so as to discover one or more paths through one or more additional intermediate nodes between the given source node and the one or more intermediate nodes discovered during the first traceroute process. When one or more additional intermediate nodes are discovered as a result of performance of the second traceroute process, the one or more additional intermediate nodes are added to the target list and the traceroute process is repeated to determine the existence of any further intermediate nodes. When no new intermediate nodes are discovered as a result of performance of the second traceroute process or a subsequent traceroute process, the nodes in the target list are identified as a target closure set for the given source node.

    摘要翻译: 公开了改进的网络拓扑发现技术。 例如,用于发现具有多个节点的网络拓扑的自动化方法包括以下步骤。 对给定源节点和目标列表中列出的一个或多个目的地节点执行第一跟踪路由进程,以便发现通过给定源节点和一个或多个目的地节点之间的一个或多个中间节点的一个或多个路径。 在第一个跟踪路由过程中发现的一个或多个中间节点被添加到目标列表中。 对于给定源节点和在第一跟踪路由过程期间发现的一个或多个中间节点执行第二跟踪路由进程,以便发现通过给定源节点与一个或多个中间体之间的一个或多个附加中间节点的一个或多个路径 在第一个跟踪路由过程中发现的节点。 当作为执行第二跟踪路由进程的结果发现一个或多个附加中间节点时,将一个或多个附加中间节点添加到目标列表中,并且重复跟踪路由进程以确定任何其他中间节点的存在。 由于执行第二个跟踪路由进程或后续的跟踪路由进程,没有新的中间节点被发现,目标列表中的节点被标识为给定源节点的目标封闭集。

    METHOD AND APPARATUS FOR AUTHORING AND OPTIMIZING FLOWCHARTS
    7.
    发明申请
    METHOD AND APPARATUS FOR AUTHORING AND OPTIMIZING FLOWCHARTS 失效
    用于执行和优化流量的方法和装置

    公开(公告)号:US20080227066A1

    公开(公告)日:2008-09-18

    申请号:US11686959

    申请日:2007-03-15

    IPC分类号: G09B19/00

    CPC分类号: G09B7/00

    摘要: A method and system for generating problem resolution flowcharts, whereby users do not author flowcharts directly but instead author a dependency matrix of questions and answers related by state or underlying problem cause. After creation of a matrix of questions and answers, a corresponding flowchart is then calculated based on the information in the dependency matrix, and also based on the likelihood of the various problems and their causes. The probabilities of problems and their causes may be estimated or may be calculated from historical data accumulated by use of the flow chart, or some combination of the two. These probabilities are incorporated into the answer cells of the dependency matrix. The resulting flowchart is tested and evaluated, and the results of testing and evaluation are used to make modifications in the matrix of questions and answers. The flowchart is then made available for execution by a problem determination engine, usable by staff at a help center or directly as self-help to a customer over a network. Experience from use of the problem determination engine is accumulated for use in further refinements of the dependency matrix and its probabilities.

    摘要翻译: 用于生成问题解决流程图的方法和系统,其中用户不直接创作流程图,而是创建与状态或潜在问题原因相关的问题和答案的依赖矩阵。 在创建了问题和答案矩阵之后,根据依赖矩阵中的信息,并根据各种问题及其原因的可能性,计算出相应的流程图。 问题的可能性及其原因可以估计,或者可以通过使用流程图累积的历史数据或两者的某种组合来计算。 这些概率被并入依赖矩阵的答案单元格中。 得到的流程图进行了测试和评估,测试和评估的结果用于对问题和答案矩阵进行修改。 然后,该流程图可由问题确定引擎执行,可由帮助中心的工作人员使用,或直接作为对网络上的客户的自助。 积累了使用问题确定引擎的经验,用于进一步细化依赖矩阵及其概率。

    Smart event parser for autonomic computing
    8.
    发明授权
    Smart event parser for autonomic computing 有权
    用于自主计算的智能事件解析器

    公开(公告)号:US07596793B2

    公开(公告)日:2009-09-29

    申请号:US10334254

    申请日:2002-12-31

    IPC分类号: G06F9/46

    摘要: An autonomic event parser configured for association with a message adapter. An autonomic event parser can include a store of parsing rules, the parsing rules having a strategically specified order. Additionally, a pattern analyzer can be programmed to identify patterns of received messages and to recommend the strategically specified order of the parsing rules. Finally, a parsing rules manager can be communicatively coupled both to the pattern analyzer and the store of parsing rules, the parsing rules manager having a configuration for ordering the parsing rules in the store based upon the recommended order of the pattern analyzer.

    摘要翻译: 被配置为与消息适配器关联的自主事件解析器。 自主事件解析器可以包括解析规则存储,解析规则具有策略性地指定的顺序。 另外,可以对模式分析器进行编程,以识别接收到的消息的模式,并推荐解析规则的策略性指定顺序。 最后,解析规则管理器可以通信地耦合到模式分析器和解析规则存储,解析规则管理器具有基于模式分析器的推荐顺序来排序存储器中的解析规则的配置。

    Methods and apparatus for creation of parsing rules
    9.
    发明授权
    Methods and apparatus for creation of parsing rules 有权
    用于创建解析规则的方法和设备

    公开(公告)号:US07343604B2

    公开(公告)日:2008-03-11

    申请号:US10627824

    申请日:2003-07-25

    IPC分类号: G06F9/54 G06F15/177

    CPC分类号: G06F8/427

    摘要: Techniques for parsing rule creation are provided. A technique for constructing one or more message parsing rules may comprise the following steps. First, message data representing past messages, for example, associated with a network, an application and/or a system being analyzed, is obtained. For example, this may involve reading the past or historical message data from messages logs or having a system point to the message data in existing data storage. Parsing rules are then generated by a process from one or more existing rule templates and/or based on user selection and classification of at least a portion of a message. For example, the user may choose a message part and demonstratively classify the part, for example, as a positive or negative example. The generated rules may then be stored for access by a rule-based parsing system such as a message adaptation system. Prior to generation of the one or more parsing rules, a message structure may be established upon which generation of the rules may be based.

    摘要翻译: 提供了解析规则创建的技术。 用于构建一个或多个消息解析规则的技术可以包括以下步骤。 首先,获得表示与网络相关联的过去消息的消息数据,正在分析的应用和/或系统。 例如,这可能涉及从消息日志中读取过去或历史消息数据或者将系统指向现有数据存储器中的消息数据。 解析规则然后由来自一个或多个现有规则模板的过程和/或基于消息的至少一部分的用户选择和分类生成。 例如,用户可以选择一个消息部分并且将该部分示范地分类,例如,作为肯定或否定的示例。 然后,所生成的规则可以被存储以用于基于规则的解析系统(例如消息适配系统)的访问。 在生成一个或多个解析规则之前,可以建立基于规则的生成的消息结构。

    System and program product for throttling events in an information technology system
    10.
    发明授权
    System and program product for throttling events in an information technology system 失效
    用于在信息技术系统中调节事件的系统和程序产品

    公开(公告)号:US07657627B2

    公开(公告)日:2010-02-02

    申请号:US12027369

    申请日:2008-02-07

    IPC分类号: G06F15/173 G06F15/16

    摘要: A system and program product for generating throttling parameters for an information management (IT) system based on historical event log data. An embodiment of the system comprises: an identification system that examines the historical event log data and identifies throttling candidates, wherein each throttling candidate comprises an event type for redundant events that reoccur over at least one measured time period; and an analysis system that statistically analyzes event data associated with each throttling candidate and generates a set of throttling parameters for each throttling candidate based on the event data.

    摘要翻译: 一种用于根据历史事件日志数据为信息管理(IT)系统生成调节参数的系统和程序产品。 该系统的实施例包括:识别系统,其检查历史事件日志数据并识别限制候选,其中每个节流候选包括用于在至少一个测量时间周期上重现的冗余事件的事件类型; 以及分析系统,其统计分析与每个节流候选相关联的事件数据,并且基于事件数据为每个节流候选产生一组节流参数。