Abstract: A technique is provided for systematically constructing one or more correlation rules for use by an event management system for managing a network with one or more computing devices. The technique comprises the following steps. First, in association with an event cache, event data representing past or historical events associated with the network of computing devices being managed by the event management system is obtained. Next, a first pattern is found or detected in the obtained event data associated with the event cache. The pattern is then classified. Then, at least one correlation rule is constructed based on the classified pattern. Lastly, in association with the event cache, the one or more events included in the pattern are replaced with a composite or cumulative event such that hierarchical patterns may be subsequently found for use in constructing further correlation rules.

Abstract: A technique is provided for systematically constructing one or more correlation rules for use by an event management system for managing a network with one or more computing devices. The technique comprises the following steps. First, in association with an event cache, event data representing past or historical events associated with the network of computing devices being managed by the event management system is obtained. Next, a first pattern is found or detected in the obtained event data associated with the event cache. The pattern is then classified. Then, at least one correlation rule is constructed based on the classified pattern. Lastly, in association with the event cache, the one or more events included in the pattern are replaced with a composite or cumulative event such that hierarchical patterns may be subsequently found for use in constructing further correlation rules.

Abstract: Information is retrieved from a database using natural language (NL) queries and graphical interfaces and displays. A query is separated into tokens which are parsed into elements. The parsed elements are matched to a list of database names. If all the parsed elements can be uniquely matched to database names, a database query is constructed and used to query the database to retrieve information and to present to a user. However, when an ambiguous query is encountered, i.e. all of whose elements cannot be uniquely matched with database names, the understood components of the ambiguous query, i.e., those elements matching database names, are presented the user along with relationships of the elements to other names in the database so that the user can use an interface to explore the database by accessing and displaying this database information and these relationships. The interface can take the form of views on a graphical interface.