Preliminary Classification of Events to Facilitate Cause-Based Analysis

Abstract

The present invention provides methods and systems for performing preliminary cause-based classification of events in a computer or networked computer system. Methods are provided in which, based on an event message, cause-based preliminary classification of an associated event is performed. The result of the preliminary classification is used to facilitate subsequent cause-based analysis, such as root cause analysis, relating to the event. Methods are provided in which preliminary classification is performed using a database including a catalog associating event messages with appropriate preliminary classifications of events associated with the event messages.

1 . A system for facilitating cause-based analysis relating to events in a networked computer system, the system comprising:
 one or more server computers;   one or more event message databases connected to the one or more server computers; and one or more preliminary cause-based classification databases connected to the one or more server computers;   wherein the one or more event message databases are adapted to receive and store a plurality of event messages, each of the event messages relating to an event within the networked computer system, and the plurality of event messages comprising a first event message associated with a first event;   wherein at least one of the one or more server computers is adapted to, prior to cause-based analysis relating to the first event being performed, perform preliminary cause-based classification of the first event to determine a cause-based preliminary classification of the first event from among a plurality of possible cause-based preliminary classifications, wherein the preliminary cause-based classification is performed based on comparing the first event message with information contained in the one or more cause-based preliminary classification databases; and   wherein at least one of the one or more server computers is adapted to use the determined preliminary cause-based classification of the first event to facilitate cause-based analysis relating to the first event.   
     
     
         2 . The system of  claim 1 , wherein performing cause-based preliminary classification comprises determining a most likely classification of the first event. 
     
     
         3 . The system of  claim 2 , comprising:
 one or more cause-based preliminary classification engines for performing event cause-based preliminary classification of events to determine most likely classifications of events; and   one or more cause-based analysis engines for performing cause-based analysis to determine of actual classifications of events using, as input, results of cause-based preliminary classification of events.   
     
     
         4 . The system of  claim 3 , comprising:
 one or more event cause-based preliminary classification results databases for storing results of cause-based preliminary classification;   one or more event cause-based analysis results database for storing results of cause-based analysis.