Creating A Correlation Rule Defining A Relationship Between Event Types

Abstract

In some examples, a system determines that plural occurrences of a particular pattern of event types are present in a collection of events, the particular pattern of event types including a first event of a first event type and a second event of a second event type. The system determines that a number of the plural occurrences exceeds a predefined threshold, and in response, creates a correlation rule correlating the first event type and the second event type. The system determines, the correlation rule, a cause of a symptom event in the IT infrastructure.

What is claimed is: 
     
         1 . A method comprising:
 receiving, by a system comprising a processor, a collection of events that have occurred in an information technology (IT) infrastructure comprising hardware components:   determining, by the system, that plural occurrences of a particular pattern of event types are present in the collection of events, the particular pattern of event types including a first event of a first event type and a second event of a second event type;   determining, by the system, that a number of the plural occurrences exceeds a predefined threshold, and in response, creating a correlation rule correlating the first event type and the second event type by:
 identifying a first configuration item (CI) associated with the first event type and a second CI associated with the second event type; 
 determining that a relationship exists between the first CI and the second CI; 
 creating the correlation rule responsive to determining that the relationship exists between the first CI and the second CI; and 
   determining, by the system using the correlation rule, a cause of a symptom event in the IT infrastructure.   
     
     
         2 . The method of  claim 1 , wherein the number of the plural occurrences is greater than one. 
     
     
         3 . The method of  claim 1 , wherein determining that the relationship exists between the first CI and the second CI comprises:
 accessing an information repository that describes relationships between CIs.   
     
     
         4 . The method of  claim 1 , wherein determining that the relationship exists between the first CI and the second CI comprises:
 accessing a topology graph of CIs that represents the CIs as nodes and defines relationships between the CIs through links between the nodes; and   determining that the relationship exists between the first CI and the second CI responsive to determining there are less than a threshold number of hops between a node representing the first CI and a node representing the second CI.   
     
     
         5 . The method of  claim 1 , wherein determining that the relationship exists between the first CI and the second CI comprises:
 accessing a semantics database defining relationships between CIs.   
     
     
         6 . The method of  claim 1 , further comprising:
 determining a topology of the relationship between the first CI and the second CI; and   specifying the determined topology as part of the correlation rule.   
     
     
         7 . The method of  claim 6 , wherein the topology comprises:
 a containment relationship indicating the first CI contains the second CI; or   an intermediate object relationship indicating the first CI is related to the second CI through an intermediate object.   
     
     
         8 . The method of  claim 1 , wherein determining that the plural occurrences of the particular pattern of the event types are present comprises identifying plural clusters of the event types. 
     
     
         9 . The method of  claim 8 , wherein identifying the plural clusters of the event types comprises identifying the plural clusters of the event types in respective time intervals. 
     
     
         10 . A system comprising:
 a processor; and   a non-transitory storage medium storing instructions executable on the processor to:
 receive a collection of events that have occurred in an information technology (IT) infrastructure comprising hardware components: 
 determine that plural occurrences of a particular pattern of event types are present in the collection of events, the particular pattern of event types including a first event of a first event type and a second event of a second event type; 
 determine that a number of the plural occurrences exceeds a predefined threshold, and in response, create a correlation rule correlating the first event type and the second event type by:
 identifying a first configuration item (CI) associated with the first event type and a second CI associated with the second event type; 
 determining that a relationship exists between the first CI and the second CI, 
 creating the correlation rule responsive to determining that the relationship exists between the first CI and the second CI; and 
 
 determine, using the correlation rule, a cause of a symptom event in the IT infrastructure. 
   
     
     
         11 . The system of  claim 10 , wherein the instructions are executable on the processor to access a topology or semantic database to validate that the relationship exists between the first CI and the second CI. 
     
     
         12 . The system of  claim 11 , wherein the relationship exists if a path of within a predefined number of hops exists between the first CI and the second CI. 
     
     
         13 . The system of  claim 10 , wherein the instructions are executable on the processor to:
 determine a topology of the relationship between the first CI and the second CI; and   specify the determined topology as part of the correlation rule.   
     
     
         14 . The system of  claim 13 , wherein the topology comprises:
 a containment relationship indicating the first CI contains the second CI; or   an intermediate object relationship indicating the first CI is related to the second CI through an intermediate object.   
     
     
         15 . The system of  claim 10 , wherein determining that the plural occurrences of the particular pattern of the event types are present comprises identifying plural clusters of the event types. 
     
     
         16 . The system of  claim 15 , wherein identifying the plural clusters of the event types comprises identifying the plural clusters of the event types in respective time intervals. 
     
     
         17 . A non-transitory machine-readable storage medium storing instructions that upon execution cause a system having a processor to:
 receive a collection of events that have occurred in an information technology (IT) infrastructure comprising hardware components:   determine that plural occurrences of a particular pattern of event types are present in the collection of events, the particular pattern of event types including a first event of a first event type and a second event of a second event type;   determine that a number of the plural occurrences exceeds a predefined threshold, and in response, create a correlation rule correlating the first event type and the second event type by:
 identifying a first configuration item (CI) associated with the first event type and a second CI associated with the second event type; 
 determining that a relationship exists between the first CI and the second CI; 
 creating the correlation rule responsive to determining that the relationship exists between the first CI and the second CI; and 
   determine, using the correlation rule, a cause of a symptom event in the IT infrastructure.   
     
     
         18 . The non-transitory machine-readable storage medium of  claim 17 , wherein the number of the plural occurrences is greater than one. 
     
     
         19 . The non-transitory machine-readable storage medium of  claim 17 , wherein determining that the plural occurrences of the pattern of the event types are present comprises identifying plural clusters of the event types in respective time intervals. 
     
     
         20 . The non-transitory machine-readable storage medium of  claim 17 , wherein the instructions upon execution cause the system to:
 for each of the occurrences of the particular pattern of event types, identify a corresponding set of respective specific events; and   access information of CIs related to the specific events in each of the sets to determine that a relationship exists between the first CI and the second CI.