Abstract: A method for determining a correlation of one or more events occurring in a plurality of nodes of a network includes accessing, by a computing device, address information associated with each of the plurality of nodes on the network. The computing device can further access one or more event IDs associated with one or more events occurring on the plurality of nodes. The computing device can further create an association the one or more events occurring on the plurality of nodes with related events occurring on others of the plurality of nodes, the association including the address information.

Abstract: A method, computer system, and a computer program for grouping a plurality of computing system fault events is provided. The present invention may include extracting a summary of computing system fault events based on at least one similarity detected. The present invention may then include generating a plurality of vectors in which each vector corresponds to a summary, clustering the plurality of vectors into a plurality of clusters based on the at least one similarity, and compressing each cluster of the plurality of clusters into at least one cluster centroid. The present invention may further include generating a group centroid for a group including the plurality of clusters based on the at least one cluster centroid. The present invention may also include presenting a correlation statement derived from a result associated with the group centroid and generating a system fault solution based on the correlation statement.

Abstract: Method and system are provided for scoring events as likely cause events in a resource network. The method processes incoming events relating to resources in a resource network to correlate related events as a related group and maps the events of the related group onto nodes of a sub-topology representing resources of the resource network and having edges representing relationships between the resources. The method scores each event by discovering one or more paths between the node event and other node events of the related group, with the scoring based on a combination of an event classification weight and a discovered path score of aggregated relationship scores of edges of a discovered path.

Abstract: A method and system are provided for identification of constituent events in an event storm in operations management. The method includes: detecting an event storm by detecting an anomaly from a dynamic baseline range of expected event rates in a sample time period; and, when an event storm is detected, for each of a group of events grouped by an event category and occurring in a sample time period of an event storm, identifying the group of events as constituting part of the event storm if the rate of the event occurrences of the group in the sample time period is outside a threshold deviation from an average for that group.

Abstract: Aspects of the present invention disclose a method for automated incident prioritization in network monitoring systems. The method includes one or more processors determining historical sentiment impact scores for one or more incident parameters based at least in part on textual content of customer feedback and changes of a customer sentiment during a time period corresponding to one or more system incidents of the time period. The method further includes assigning a classification to the one or more system incidents, wherein the classification corresponds to the one or more incident parameters. The method further includes determining an active incident sentiment impact score for each of one or more active incidents. The method further includes applying the active incident sentiment impact scores as a factor to prioritize incident handling of the one or more active incidents.

Abstract: A method and system are provided for identification of constituent events in an event storm in operations management. The method includes: detecting an event storm by detecting an anomaly from a dynamic baseline range of expected event rates in a sample time period; and, when an event storm is detected, for each of a group of events grouped by an event category and occurring in a sample time period of an event storm, identifying the group of events as constituting part of the event storm if the rate of the event occurrences of the group in the sample time period is outside a threshold deviation from an average for that group.

Abstract: A protocol analyzer is provided including a monitoring state machine for tracking a communication protocol. A trigger mechanism triggers a trace by the analyzer when the state of the protocol differs from the monitoring state machine. The state of the protocol differs from the monitoring state machine when no state change occurs in a pre-defined time period, which may be defined for a given state change. The state of the protocol also differs from the monitoring state machine when a different state change takes place to that indicated by the monitoring state machine.

Abstract: Provided are a method for operating a disk array, a disk array, and a rebuilding process. The disk array comprises a plurality of data disks and a parity disk. A failed data disk in the disk array is detected and the failed data disk is isolated from the disk array. A rebuild is initiated of the data in the failed data disk to a spare data disk from data in surviving data disks comprising the at least one of the data disks that did not fail and the parity disk in the disk array. An error is detected in one of the surviving data disks. Data is read from the failed data disk. The rebuild of the failed data disk is completed using the surviving data disks, the parity disk, and the data read from the failed data disk.

Abstract: An architecture for error log processing is provided. Each error log is given a defined priority and mapped to an error recovery procedure (ERP) to be run if the log is seen. The system has a plurality of software layers to process the errors. Each software layer processes the error independently. Errors are reported to a higher software stack when error recovery fails from the lower stack ERPs and recovery is non-transparent. If the system host identified for error processing fails, the control of the ERP is transferred during the failover process. Non-obvious failed component isolating ERPs are grouped to be run together to assist in isolating the failed component. Prioritization of the error systems may be based on a plurality of criteria. ERPs are assigned to run within a particular software stack.

Abstract: An apparatus and method for controlling a disk drive is provided. A disk lubricant sweep component for periodically initiates a disk lubricant spreading action. A disk data read check component checks data at one or more LBAs during the disk lubricant sweep. The apparatus may cache data from LBAs that have been checked by the disk data read check component and found correct and record LBAs that have been found correct, so that they can be omitted from subsequent operation of the read check component. The apparatus may further comprise an error checking and correcting component for checking and correcting data found incorrect by reason of a soft error, and an error reporting component for reporting on one or more LBAs that have been checked and found incorrect by reason of a hard error.

Abstract: A system and method for autonomically monitoring data integrity during logical and physical storage and retrieval of data by a storage device. In one embodiment, the method of the present invention includes scheduling data integrity checking in accordance with an operative input/output (I/O) state of the storage device. The scheduling preferably includes first retrieving an I/O command, such as a read or write command, from a disk interface controller and determining whether or not the I/O command has been pre-marked for data checking. In response to the I/O command not being marked for prescribed data checking, a further determination is made of whether or not data integrity checking is required in association with the object I/O command as specified by scheduler rules. Responsive to determining that a data integrity check is required in association with the I/O command, the I/O command is marked as requiring an associated data integrity check.

Abstract: An apparatus and method for controlling a disk drive is provided. A disk lubricant sweep component for periodically initiates a disk lubricant spreading action. A disk data read check component checks data at one or more LBAs during the disk lubricant sweep. The apparatus may cache data from LBAs that have been checked by the disk data read check component and found correct and record LBAs that have been found correct, so that they can be omitted from subsequent operation of the read check component. The apparatus may further comprise an error checking and correcting component for checking and correcting data found incorrect by reason of a soft error, and an error reporting component for reporting on one or more LBAs that have been checked and found incorrect by reason of a hard error.

Abstract: An architecture for error log processing is provided. Each error log is given a defined priority and mapped to an error recovery procedure (ERP) to be run if the log is seen. The system has a plurality of software layers to process the errors. Each software layer processes the error independently. Errors are reported to a higher software stack when error recovery fails from the lower stack ERPs and recovery is non-transparent. If the system host identified for error processing fails, the control of the ERP is transferred during the failover process. Non-obvious failed component isolating ERPs are grouped to be run together to assist in isolating the failed component. Prioritization of the error systems may be based on a plurality of criteria. ERPs are assigned to run within a particular software stack.

Abstract: Provided are a method for operating a disk array, a disk array, and a rebuilding process. The disk array comprises a plurality of data disks and a parity disk. A failed data disk in the disk array is detected and the failed data disk is isolated from the disk array. A rebuild is initiated of the data in the failed data disk to a spare data disk from data in surviving data disks comprising the at least one of the data disks that did not fail and the parity disk in the disk array. An error is detected in one of the surviving data disks. Data is read from the failed data disk. The rebuild of the failed data disk is completed using the surviving data disks, the parity disk, and the data read from the failed data disk.

Abstract: A protocol analyzer is provided including a monitoring state machine for tracking a communication protocol. A trigger mechanism triggers a trace by the analyzer when the state of the protocol differs from the monitoring state machine. The state of the protocol differs from the monitoring state machine when no state change occurs in a pre-defined time period, which may be defined for a given state change. The state of the protocol also differs from the monitoring state machine when a different state change takes place to that indicated by the monitoring state machine.