Event Summarization for System Management Wei Peng†, Chang-shing Perng§, Tao Li†, Haixun Wang§ †Florida International University §IBM T.J.Waston Research Center -presented by: Wei Peng

Introduction Why Event Summarization? – traditional approaches are cumbersome, labor intensive, and error prone – focus on discovering frequent or interesting patterns, scalability, and efficiency – understanding and interpreting patterns A divide-and-conquer method

A Motivating Example

Steps for Event Summarization Preprocess log data and generate events Discover temporal correlation between events (dependency) Rank dependencies Construct Event Relationship Networks (ERNs) Derive Action Rules from Event Summary

Preprocess Log Data and Generate events Preprocess the brief log messages Categorize it into common situations/states – Incorporate time information An event is a pair that e is the situation/state, t is the time stamp of e

Discover Temporal Correlation between Events (Dependency) b depends on a – If the occurrence of b is predictable by the occurrence of a, then the conditional distribution which models the waiting time of event type b given event type a’s presence would be different from the unconditional one Estimate two distributions Dependency test Independent Dependent

Rank Dependencies Forward Entropy Backward Entropy

Event Relationship Networks (ERNs)

Derive Action Rules from Event Summary If condition is true, take action – Event reduction rules – Event correlation rules – Problem avoidance rules

A Case Study State: start, stop, dependency, create, connection, report, request, configuration, other

Decomposition Process in the Case Study

ERN in the Case Study

Thank You !