Abstract: A system and method for enhancing event correlation with exploitation of external data is presented. A correlation engine receives events and selects a correlation rule that corresponds to the events. The correlation rule includes an event selection, a trigger condition, and a correlation conclusion. The correlation engine uses the event selection to access external data and select events based upon the external data. In turn, the correlation engine monitors the selected events and checks whether they meet the correlation rule's trigger condition. When the events meet the correlation rule's trigger condition, the correlation engine performs an action based upon the correlation rule's correlation condition.

Abstract: A method of event correlation implemented within a distributed environment having a management server and a set of managed machines. The preferred event correlation method begins by establishing a discrete set of correlation rules. One preferred implementation of a correlation rule is a software-based state machine. Each correlation rule is adapted to recognize a given pattern of one or more events indicative of a given condition. A set of correlation rules comprise a set of efficiently-coupled state machines, each of which is optimized for a particular, low-level logical function. Then, as events are received and/or generated at the machine, the events are examined by the state machines comprising the correlator to search for the defined event patterns. If a given event pattern is recognized, a given condition sought to be monitored has occurred, and the event correlator may then be used to take a given action.

Abstract: This invention concerns a method for organizing the execution of Common Management Information Protocol (CMIP) requests in an Open Systems Interconnection (OSI) environment by providing main threads and sub-threads within each main thread for simultaneous processing of multiple CMIP requests. In brief, a main thread is started sequentially for executing incoming CMIP requests, the main thread checks whether a particular managed object is available, i.e. not locked, lock it, and starts a sub-thread to process the CMIP request in this managed object. This allows the main thread to start another sub-thread, thus providing for the parallel execution of a plurality of CMIP requests.