Abstract: Methods, systems, and computer program products for generating a common event format representation of information from a plurality of messages include parsing a rule associated with a current message to determine if a property of a common event format representation for the current message is to be populated with a property value from a previous message. If the rule specifies to obtain the property value from the previous message, the property value is obtained from the previous message and the common event format representation for the current message is populated with the obtained property value from the previous message. The property value may be obtained by generating a computed key based on properties of the current message that are common to the previous message, and identifying the previous message based on the key of the current message.

Abstract: An off-line knowledge acquisition process takes IT resource messages and automatically generates a set of rules used to provide situation categories for the resource messages/events. The off-line knowledge acquisition process generates an event-to-situation mapping file for efficiently mapping situation to events in runtime. Rules are fed back into a knowledge repository and process for reuse. The off-line knowledge acquisition process provides methods to reiterate the process of mining (autonomically and/or by human interaction) to improve the rules and confidence level assigning the situation categories. A runtime categorizer component uses the event-to-situation mapping file to add situation categories to the IT resource events. The runtime categorizer uses a plurality of annotator components each capable of adding a situation annotation to incoming messages based on rules generated by the off-line knowledge acquisition process.

Abstract: A computer processing device receives computer readable data to derive computer executable rules for mining and constructing situation categories. The received data is transformed into a predetermined standard format if the received data is not already in the predetermined standard format. The predetermined standard formatted data is parsed, and an outer, iterative loop is performed until at least one predetermined stopping criterion is met. An inner iterative loop is performed within the outer iterative loop until all desired subsets of data are processed. During the inner iterative loop, selected subsets of data are labeled with labels associated with corresponding previously labeled subsets of data. New computer executable rules are generated for mining and constructing situation categories from the labeled subsets of data. Keyword list classifiers are transformed using the stored labeled subsets of data.

Abstract: An autonomic event parser configured for association with a message adapter. An autonomic event parser can include a store of parsing rules, the parsing rules having a strategically specified order. Additionally, a pattern analyzer can be programmed to identify patterns of received messages and to recommend the strategically specified order of the parsing rules. Finally, a parsing rules manager can be communicatively coupled both to the pattern analyzer and the store of parsing rules, the parsing rules manager having a configuration for ordering the parsing rules in the store based upon the recommended order of the pattern analyzer.

Abstract: Selectively obfuscating, or obscuring, a portion or portions of information in a multi-party transmission. A user participating in a multi-party exchange signals a communication device (or proxy) that he will provide private information that is to be perceptible only to a subset of the other participants. This user also identifies that subset, preferably by providing a group identifier for a group in which that subset of participants are members. The communication device transmits a member-specific descriptor comprising an encrypted version of a group key, and uses this group key to encrypt the private information that is to be perceptible only to the subset. Device-specific characteristics of participant devices are used, in addition to user-provided data (such as a user's log-on identifier and/or password), as input to create cryptographic key information.

Abstract: A technique to generically manage extensible correlation data is provided for correlating a series of events. The technique employs a global unique identifier (GUID) for identifying an event and uses the GUID as a key to associate one or more extensible correlators of correlation data. A transport correlator may be configured to transport the GUID for associating with a GUID of a second event such that a small and fixed amount of data is passed by the communications layer providing the transport, minimally impacting communications. An arbitrary amount of data may be logged and keyed with the GUID, providing optimization and flexibility.

Abstract: A technique to generically manage extensible correlation data is provided for correlating a series of events. The technique employs a global unique identifier (GUID) for identifying an event and uses the GUID as a key to associate one or more extensible correlators of correlation data. A transport correlator may be configured to transport the GUID for associating with a GUID of a second event such that a small and fixed amount of data is passed by the communications layer providing the transport, minimally impacting communications. An arbitrary amount of data may be logged and keyed with the GUID, providing optimization and flexibility.

Abstract: Problems are resolved in a business process that includes application programs that run on an Information Technology (IT) infrastructure having IT components. A symptom is generated that identifies a problem in the business process. Selected application programs and/or IT components in the IT infrastructure that may cause the problem in the business process are identified, based on the symptom. A respective situation for a respective selected application program and/or IT component is obtained. The respective situation is one of a set of component-independent predefined situation categories that is associated with a respective selected application program and/or IT component. The respective situations provide the status of the selected application programs and/or IT components in a common situation format that includes the associated one of the component-independent predefined situation categories.

Abstract: Methods, systems, and computer program products for generating a common event format representation of information from a plurality of messages include parsing a rule associated with a current message to determine if a property of a common event format representation for the current message is to be populated with a property value from a previous message. If the rule specifies to obtain the property value from the previous message, the property value is obtained from the previous message and the common event format representation for the current message is populated with the obtained property value from the previous message. The property value may be obtained by generating a computed key based on properties of the current message that are common to the previous message, and identifying the previous message based on the key of the current message.

Abstract: An off-line knowledge acquisition process takes IT resource messages and automatically generates a set of rules used to provide situation categories for the resource messages/events. The off-line knowledge acquisition process generates an event-to-situation mapping file for efficiently mapping situation to events in runtime. Rules are fed back into a knowledge repository and process for reuse. The off-line knowledge acquisition process provides methods to reiterate the process of mining (autonomically and/or by human interaction) to improve the rules and confidence level assigning the situation categories. A runtime categorizer component uses the event-to-situation mapping file to add situation categories to the IT resource events. The runtime categorizer uses a plurality of annotator components each capable of adding a situation annotation to incoming messages based on rules generated by the off-line knowledge acquisition process.

Abstract: A method to correlate and consolidate a plurality of events may include consolidating each of the plurality of events to form a multi-personality event. Each event may be emitted from a respective one of a plurality of components forming an event producer in response to an incident affecting the event producer. The method may also include providing the multi-personality event to an event consumer.

Abstract: A method to correlate and consolidate a plurality of events includes consolidating each of the plurality of events to form a multi-personality event. Each event may be emitted from a respective one of a plurality of components forming an event producer in response to an incident affecting the event producer. The method also includes providing the multi-personality event to an event consumer.

Abstract: Classifying a message includes receiving a message to be classified, wherein the message includes a message identifier. If the message identifier uniquely maps to a corresponding classification category, the message is labeled with the identified classification category. If the message identifier does not map directly to a corresponding classification category, the message to be classified is parsed and a plurality of features from the parsed message are identified, wherein at least one classification rule is compared to the plurality of features. Each classification rule that matches to the plurality of features is rated and a classification category is identified from the rating, wherein the message is labeled with the identified classification category.

Abstract: Methods, systems, and computer program products for generating a common event format representation of information from a plurality of messages include parsing a rule associated with a current message to determine if a property of a common event format representation for the current message is to be populated with a property value from a previous message. If the rule specifies to obtain the property value from the previous message, the property value is obtained from the previous message and the common event format representation for the current message is populated with the obtained property value from the previous message. The property value may be obtained by generating a computed key based on properties of the current message that are common to the previous message, and identifying the previous message based on the key of the current message.

Abstract: A rule set to convert an event into a standardized format can be established based on cooperation among peer processing nodes. A processing node that receives the event takes the initial responsibility to convert the event. The responsible processing node initially attempts to convert the event using locally available rules. If the initial attempt fails, the responsible processing node will communicate the event to peer processing nodes and request them to provide conversion rules. Upon receipt of the rules provided by the peer processing nodes, the responsible processing node combines the received rules with the locally available rules to generate a rule set to convert the event. The responsible processing node may also transfer the event to another processing node for the other processing node to take the responsibility to convert the event.

Abstract: Techniques for parsing rule creation are provided. A technique for constructing one or more message parsing rules may comprise the following steps. First, message data representing past messages, for example, associated with a network, an application and/or a system being analyzed, is obtained. For example, this may involve reading the past or historical message data from messages logs or having a system point to the message data in existing data storage. Parsing rules are then generated by a process from one or more existing rule templates and/or based on user selection and classification of at least a portion of a message. For example, the user may choose a message part and demonstratively classify the part, for example, as a positive or negative example. The generated rules may then be stored for access by a rule-based parsing system such as a message adaptation system.

Abstract: Monitoring components of a system is provided by associating status of at least one component of the system with one of a set of component independent predefined situation categories to provide the status of the component in a common situation format that includes the associated component independent predefined situation category. Status of the system is analyzed based on the common situation format representation of the component status.

Abstract: Methods, systems, and computer program products for organizing and viewing electronic objects (such as incoming electronic mail messages, documents, and so forth) according to relationships among the objects. Objects may be organized according to user-selectable, node-specific criteria. These criteria may be dynamically learned, based upon a particular user's behavior, using the disclosed techniques.

Abstract: Techniques for parsing rule creation are provided. A technique for constructing one or more message parsing rules may comprise the following steps. First, message data representing past messages, for example, associated with a network, an application and/or a system being analyzed, is obtained. For example, this may involve reading the past or historical message data from messages logs or having a system point to the message data in existing data storage. Parsing rules are then generated by a process from one or more existing rule templates and/or based on user selection and classification of at least a portion of a message. For example, the user may choose a message part and demonstratively classify the part, for example, as a positive or negative example. The generated rules may then be stored for access by a rule-based parsing system such as a message adaptation system.

Abstract: A computer system includes a symptoms database having symptoms that relate to problems, where each symptom includes an event correlation rule having corresponding predicates. To identify a root cause of a problem, collected events are correlated with symptoms based upon their associated event correlation rule(s). For each symptom at least partially matched to an event, visualization information is associated with corresponding events based upon the visualization attribute of the symptom, and textual information is associated with event based upon the recommendation of the symptom. Moreover, recommendations may be provided to an operator, such as based upon information associated with the symptom. The event and symptom data is analyzed by grouping events in the set of events based upon their associated visualization information and presenting the textual information associated with an operator-selected event.