Automatically Acquiring Rules for Event Correlation from Event Logs
Tim Oates, David D. Jensen, Paul R. Cohen · 1997
A single fault in a complex network can generate a cascade of events, potentially overloading a manager's console with information. One way to reduce the number of events is event correlation, a process that groups several related events into a single composite event. We have developed Multi-Event Dependency Detection (MEDD), an algorithm that automatically constructs event correlation rules. MEDD is a prototype for a component of NASA's EOSDIS Core System. The algorithm efficiently searches the space of possible dependencies between events and selects the most useful rules. Preliminary results indicate that MEDD identifies useful rules for event correlation, and could reduce the information burden on network managers. This research was supported by DARPA under contract F30602-91-C-0076 and DoD Fellowship F3060293 -C-0100. 1 Multi-Event Dependency Detection medd finds dependencies between patterns of network events recorded in event logs. 1 Dependencies are unexpectedly frequent o...