Event relationship analysis in fault management

Abstract

Method and system for event relationship analysis in fault management. The method includes identifying a group of related events based on a history of a plurality of event instances relating to multiple events. For each event occurrence of each event of the group of related events, an event type and one or more resources associated with the event occurrence is identified. The method also comprises: identifying a group of event occurrences associated with the same resource, and identifying from the group of event occurrences a set of event occurrences of the same type.

What is claimed is: 
     
         1 . A computer program product for event relationship analysis in fault management, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processing unit to cause the processing unit to perform a method comprising:
 identifying a group of related events based on a history of a plurality of event instances relating to multiple events;   identifying an event type and a one or more resources associated with an event occurrence from the group of related events;   identifying a first set of event occurrences from the group of related events, wherein each event occurrence of the set is of the same event type; and   identifying a first group of event occurrences of the first set from event occurrences, wherein each event occurrence of the first group is associated with the same resource.   
     
     
         2 . The computer program product of  claim 1 , wherein identifying a first group of event occurrences comprises:
 identifying, by the computer, an event occurrence that does not have an associated resource which is the same as the one or more resources associated with the remaining event occurrences of the first set of event occurrences; and   removing, by the computer, the identified event occurrence from the first set of event occurrences.   
     
     
         3 . The computer program product of  claim 1 , wherein the one or more resources associated with each event occurrence are represented by information provided in a plurality of data fields,
 wherein identifying a first group of event occurrences comprises:   identifying, by the computer, a resource that is associated with all event occurrences of the first set of event occurrences;   analyzing, by the computer, the information provided in the plurality of data fields to identify a data field containing the most instances of the identified resource; and   identifying, by the computer, a first group of event occurrences associated with the same resource based on the identified resource and the identified data field.   
     
     
         4 . The computer program product of  claim 1 , further comprising:
 identifying, by the computer, a second group of event occurrences of the first set of event occurrences, wherein each event occurrence of the first group is associated with the same resource; and   combining, by the computer, the first and second groups of event occurrences to create a parent group of connected events having the same event type.   
     
     
         5 . The computer program product of  claim 4 , further comprising:
 in response to an expand command, separating the parent group of connected events into the first and second groups of event occurrences.   
     
     
         6 . The computer program product of  claim 1 , wherein the events are identified by event identifiers, wherein an event instance has one or more event occurrences referencing an event identifier, each event occurrence having a timestamp, and the history including the event occurrences and resolution event information,
 wherein identifying a group of related events comprises:   analyzing, by the computer, the event occurrences relating to each event identifier to identify one or more first occurrence of an event instance;   analyzing, by the computer, the resolution event information relating to each event identifier to identify any event resolution time for an event instance;   comparing two event identifiers to obtain a relationship score between the two event identifiers, wherein the comparing is based on a combination of first occurrences of event instances relating to the two event identifiers and resolution times of the event instances; and   creating, by the computer, a group of events that are related based on the relationship scores.   
     
     
         7 . The computer program product of  claim 6 , wherein comparing two event identifiers to obtain a relationship score includes:
 scoring, by the computer, a pair of a first occurrence of each event identifier occurring within a given time window; and   augmenting, by the computer, the score based on resolution times of the event instances of the event identifiers.   
     
     
         8 . The computer program product of  claim 6 , wherein comparing two event identifiers to obtain a relationship score includes:
 identifying, by the computer, first occurrences of event instances of an event identifier and resolutions times of the event instances to create a list of timestamps for each event identifier; and   analyzing, by the computer, the first occurrences and resolution times of two event identifiers to obtain the relationship score.   
     
     
         9 . The computer program product of  claim 6 , wherein comparing two event identifiers to obtain a relationship score includes:
 using, by the computer, a first occurrence method of scoring a pair of event identifiers to result in a first score;   using, by the computer a combination of a first occurrence and a resolution time to score a pair of event identifiers to result in a second score;   using, by the computer, a resolution time to score a pair of event identifiers to result in a third score;   merging, by the computer, the results of the first, second and third scores; and   outputting, by the computer, the merged score if it is not less than the first score.   
     
     
         10 . A computer program product for event relationship analysis in fault management, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processing unit to cause the processing unit to perform a method comprising:
 identifying a group of related events based on a history of a plurality of event instances relating to multiple events;   identifying an event type and a one or more resources associated with an event occurrence from the group of related events;   identifying a first group of event occurrences from the group of related events, wherein each event occurrence of the first group is associated with the same resource; and   identifying a first set of event occurrences from the first group of event occurrences, wherein each event occurrence of the set is of the same event type.   
     
     
         11 . The computer program product of  claim 10 , wherein identifying a first group of event occurrences comprises:
 identifying, by the computer, an event occurrence that does not have an associated resource in common with the one or more resources associated with the remaining event occurrences of the group of related events; and   removing, by the computer, the identified event occurrence from the group of related events.   
     
     
         12 . The computer program product of  claim 10 , wherein the one or more resources associated with each event occurrence are represented by information provided in a plurality of data fields,
 wherein identifying a first group of event occurrences comprises:   identifying, by the computer, a resource that is associated with all event occurrences of the group of related events;   analyzing, by the computer, the information provided in the plurality of data fields to identify a data field containing the most instances of the identified resource; and   identifying, by the computer, a first group of event occurrences associated with the same resource based on the identified resource and the identified data field.   
     
     
         13 . The computer program product of  claim 10 , further comprising:
 identifying, by the computer, a second set of event occurrences of the first group of event occurrences, wherein each event occurrence of the second set is of the same event type; and   combining, by the computer, the first and second sets of event occurrences to create a parent set of connected events associated with the same resource.   
     
     
         14 . The computer program product of  claim 13 , further comprising:
 in response to an expand command, separating the parent set of connected events into the first and second sets of event occurrences.   
     
     
         15 . A system for event relationship analysis in fault management, the system comprising:
 a memory; and   a processor communicatively coupled to the memory, wherein the system is adapted to perform a method comprising:   identifying a group of related events based on a history of a plurality of event instances relating to multiple events;   identifying an event type and a one or more resources associated with an event occurrence from the group of related events;   identifying a first set of event occurrences from the group of related events, wherein each event occurrence of the set is of the same event type; and   identifying a first group of event occurrences from the first set of event occurrences, wherein each event occurrence of the first group is associated with the same resource.   
     
     
         16 . The system of  claim 15 , wherein identifying a first group of event occurrences comprises:
 identifying, by the computer, an event occurrence that does not have an associated resource which is the same as the one or more resources associated with the remaining event occurrences of the first set of event occurrences; and   removing, by the computer, the identified event occurrence from the first set of event occurrences.   
     
     
         17 . The system of  claim 15 , further comprising:
 identifying, by the computer, a second group of event occurrences of the first set of event occurrences, wherein each event occurrence of the first group is associated with the same resource; and   combining, by the computer, the first and second groups of event occurrences to create a parent group of connected events having the same event type.   
     
     
         18 . The system of  claim 17 , further comprising:
 in response to an expand command, separating the parent group of connected events into the first and second groups of event occurrences.