1. Event Summarization for System Management Wei Peng†, Chang-shing Perng§, Tao Li†, Haixun Wang§ †Florida International University §IBM T.J.Waston Research Center -presented by: Wei Peng

2. Introduction Why Event Summarization? – traditional approaches are cumbersome, labor intensive, and error prone – focus on discovering frequent or interesting patterns, scalability, and efficiency – understanding and interpreting patterns A divide-and-conquer method

3. A Motivating Example

4. Steps for Event Summarization Preprocess log data and generate events Discover temporal correlation between events (dependency) Rank dependencies Construct Event Relationship Networks (ERNs) Derive Action Rules from Event Summary

5. Preprocess Log Data and Generate events Preprocess the brief log messages Categorize it into common situations/states – Incorporate time information An event is a pair that e is the situation/state, t is the time stamp of e

6. Discover Temporal Correlation between Events (Dependency) b depends on a – If the occurrence of b is predictable by the occurrence of a, then the conditional distribution which models the waiting time of event type b given event type a’s presence would be different from the unconditional one Estimate two distributions Dependency test Independent Dependent

7. Rank Dependencies Forward Entropy Backward Entropy

8. Event Relationship Networks (ERNs)

9. Derive Action Rules from Event Summary If condition is true, take action – Event reduction rules – Event correlation rules – Problem avoidance rules

10. A Case Study State: start, stop, dependency, create, connection, report, request, configuration, other

11. Decomposition Process in the Case Study

12. ERN in the Case Study

13. Thank You !