公开(公告)号：US10474520B2

公开(公告)日：2019-11-12

申请号：US15350950

申请日：2016-11-14

Applicant: MOOGSOFT, INC.

Inventor： Philip Tee ,  Robert Duncan Harper ,  Charles Mike Silvey

IPC: G06F11/00 ,  G06F11/07 ,  H04L12/24 ,  H04L12/26 ,  H04L29/08 ,  G06F11/30 ,  H04L12/58 ,  G06F16/28 ,  G06F16/901

Abstract: A method is provided for clustering events. Messages are received at an extraction engine from managed infrastructure that includes managed infrastructure physical hardware that supports the flow and processing of information. Events are produced that relate to the managed infrastructure. The events are converted into words and subsets used to group the events that relate to failures or errors in the managed infrastructure, including the managed infrastructure physical hardware. One or more common characteristics of events are determined and clusters of events are produced relating to the failure or errors in the managed infrastructure. A source address is used for each event as is a graph topology of the managed infrastructure to assign a graph coordinate to the event. Membership in a cluster indicates a common factor of the events that is a failure or an actionable problem in the physical hardware managed infrastructure directed to supporting the flow and processing of information. In response to production of the clusters one or more physical changes are made in the managed infrastructure hardware.

公开(公告)号：US10379932B2

公开(公告)日：2019-08-13

申请号：US15348731

申请日：2016-11-10

Applicant: Moogsoft, Inc.

Inventor： Philip Tee ,  Robert Duncan Harper ,  Charles Mike Silvey

IPC: G06F11/00 ,  G06F11/07 ,  H04L12/26 ,  H04L12/24 ,  G06F16/28 ,  G06F16/901 ,  G06F11/30 ,  H04L12/58

Abstract: A system for clustering events includes an extraction engine configured to receive message data from managed infrastructure that includes managed infrastructure physical hardware that supports the flow and processing of information. The managed infrastructure is associated with produced events that relate to it. Those events are converted into words and subsets used to group the events that relate to failures or errors in the managed infrastructure, including the managed infrastructure physical and virtual hardware and software. A sigalizer engine and a compare and merge engine are included.

公开(公告)号：US10237119B2

公开(公告)日：2019-03-19

申请号：US15213752

申请日：2016-07-19

Applicant: Moogsoft, Inc.

Inventor： Philip Tee

IPC: G06F15/173 ,  H04L12/24 ,  H04L29/08 ,  H04L12/26

Abstract: An event clustering system includes an extraction engine in communication with a managed infrastructure. A sigalizer engine includes one or more of an NMF engine, a k-means clustering engine and a topology proximity engine. The sigalizer engine determines one or more common steps from events and produces clusters relating to events. The sigalizer engine determines one or more common characteristics of events and produces clusters of events relating to the failure or errors in the managed infrastructure. Membership in a cluster indicates a common factor of the events that is a failure or an actionable problem in the physical hardware managed infrastructure directed to supporting the flow and processing of information. In response to production of the clusters one or more physical changes in a managed infrastructure hardware is made, where the hardware supports the flow and processing of information.

公开(公告)号：US20190036760A1

公开(公告)日：2019-01-31

申请号：US16043168

申请日：2018-07-24

Applicant: Moogsoft Inc.

Inventor： Philip Tee ,  Robert Duncan Harper

IPC: H04L12/24 ,  H04L29/06 ,  H04L29/08 ,  H04L12/26 ,  G06F17/30

CPC classification number: H04L41/046 ,  G06F16/951 ,  H04L41/064 ,  H04L41/065 ,  H04L41/0886 ,  H04L41/0893 ,  H04L41/12 ,  H04L41/142 ,  H04L41/145 ,  H04L41/22 ,  H04L43/067 ,  H04L43/0823 ,  H04L43/10 ,  H04L63/0272 ,  H04L63/029 ,  H04L67/34 ,  H04L67/42

Abstract: A system is provided for decomposing events from managed infrastructures. A first engine is configured to receive message data from a managed infrastructure that includes managed infrastructure physical hardware that supports the flow and processing of information, the at least one engine is configured to determine common characteristics of events and produce clusters of events relating to the failure of errors in the managed infrastructure. Membership in a cluster indicates a common factor of the events that is a failure or an actionable problem in a physical hardware of the managed infrastructure directed to supporting the flow and processing of information. The first engine is configured to create one or more situations that is a collection of one or more events or alerts representative of the actionable problem in the managed infrastructure. A second engine is configured to determine one or more common steps from events and produces clusters relating to events. The second engine determines one or more common characteristics of events and produces clusters of events relating to the failure or errors in the managed infrastructure. The system is configured to use data-driven fault localization, more particularly using semantic clustering.

公开(公告)号：US10169122B2

公开(公告)日：2019-01-01

申请号：US15382988

申请日：2016-12-19

Applicant: MOOGSOFT, INC.

Inventor： Philip Tee ,  Robert Duncan Harper ,  Charles Mike Silvey

IPC: G06F11/00 ,  G06F11/07 ,  H04L12/24 ,  H04L29/08 ,  G06F17/30 ,  G06F11/30 ,  H04L12/58 ,  H04L29/14 ,  H04L12/26

Abstract: A system for clustering events includes a first engine that receives message data from a managed infrastructure which includes managed infrastructure physical hardware and supports the flow and processing of information. A second engine determines common characteristics of events and produces clusters of events relating to the failure of errors in the managed infrastructure. Membership in a cluster indicates a common factor of the events that is a failure or an actionable problem in the physical hardware managed infrastructure directed to supporting the flow and processing of information. Events are produced that relate to the managed infrastructure while converting the events into words and subsets used to group the events that relate to failures or errors in the managed infrastructure, including the managed infrastructure physical hardware. The second engine or a third engines uses a source address for each event to assign a graph coordinate to each of an event and making a change to at least a portion of the managed infrastructure.

公开(公告)号：US20180351779A1

公开(公告)日：2018-12-06

申请号：US16041851

申请日：2018-07-23

Applicant: Moogsoft Inc.

Inventor： Philip Tee ,  Richard Whitehead

IPC: H04L12/24 ,  H04L29/08 ,  H04L29/06 ,  H04L12/26 ,  G06F17/30

CPC classification number: H04L41/046 ,  G06F16/951 ,  H04L41/065 ,  H04L41/0886 ,  H04L41/0893 ,  H04L41/12 ,  H04L41/142 ,  H04L41/145 ,  H04L41/22 ,  H04L43/067 ,  H04L43/0823 ,  H04L43/10 ,  H04L63/029 ,  H04L63/1416 ,  H04L67/10 ,  H04L67/34 ,  H04L67/42

Abstract: A system is provided for decomposing events from managed infrastructures. A first engine is configured to receive message data from a managed infrastructure that includes managed infrastructure physical hardware that supports the flow and processing of information, the at least one engine is configured to determine common characteristics of events and produce clusters of events relating to the failure of errors in the managed infrastructure. Membership in a cluster indicates a common factor of the events that is a failure or an actionable problem in a physical hardware of the managed infrastructure directed to supporting the flow and processing of information. The first engine is configured to create one or more situations that is a collection of one or more events or alerts representative of the actionable problem in the managed infrastructure. A second engine is configured to determine one or more common steps from events and produces clusters relating to events. The second engine determines one or more common characteristics of events and produces clusters of events relating to the failure or errors in the managed infrastructure. An anomaly engine is configured to perform bitwise operations.

公开(公告)号：US10027553B2

公开(公告)日：2018-07-17

申请号：US15592689

申请日：2017-05-11

Applicant: MOOGSOFT, INC.

Inventor： Philip Tee

IPC: H04L12/24 ,  H04L29/06 ,  H04L12/26

Abstract: A distributed system includes a plurality of managed devices of an infrastructure that includes a plurality of system parameters. At least one agent is in communication with the managed devices. The at least one agent is configured to determine which of a managed device it runs on. A server is in communication with the at least one agent, with the at least one agent communicating over a subscribed bus. A portal bridge is in communication with the bus and communicates through a client's firewall to a Network System. A server is provided with a database of anomies and time series, wherein a repository of system parameters run on the server.

公开(公告)号：US10027529B2

公开(公告)日：2018-07-17

申请号：US15596648

申请日：2017-05-16

Applicant: Moogsoft Inc.

Inventor： Philip Tee

IPC: H04L12/24 ,  H04L12/26 ,  H04L29/08 ,  G06F17/30 ,  H04L29/06

Abstract: A distributed system includes a plurality of managed devices of an infrastructure with a plurality of system parameters; at least one agent in communication with the managed devices. The at least one agent is configured to determine which of a managed device it runs on. A first server is in communication with the at least one agent, with the at least one agent communicating over a subscribed bus. A portal bridge is in communication with the bus and communicates through a client's firewall to a Network System. The system is configured to be in communication with a second server with a database of anomalies and time series. A repository of system parameters run on the second server.

公开(公告)号：US20180181666A1

公开(公告)日：2018-06-28

申请号：US15854091

申请日：2017-12-26

Applicant: Moogsoft Inc.

Inventor： Philip Tee

IPC: G06F17/30 ,  H04L12/58 ,  H04L12/24 ,  G06F17/10 ,  G06Q10/10

CPC classification number: G06F16/9535 ,  G06F16/35 ,  G06F17/10 ,  G06Q10/107 ,  H04L41/0253 ,  H04L41/0604 ,  H04L41/0893 ,  H04L51/12 ,  H04L51/16

Abstract: A system is provided for clustering events. At least one engine is configured to receive message data from managed infrastructure that includes managed infrastructure physical hardware that supports the flow and processing of information. The at least one engine is configured to determine common characteristics of events and produce clusters of events relating to the failure of errors in the managed infrastructure. Membership in a cluster indicates a common factor of the events that is a failure or an actionable problem in the physical hardware managed infrastructure directed to supporting the flow and processing of information. The at least one engine is configured to create one or more situations that is a collection of one or more events or alerts representative of the actionable problem in the managed infrastructure. A situation room includes a collaborative interface (UI) for decomposing events from managed infrastructures. In response to the production of the clusters one or more physical changes is made in managed infrastructure hardware. A reference tool provides for a decomposition of events.

公开(公告)号：US10007716B2

公开(公告)日：2018-06-26

申请号：US14325575

申请日：2014-07-08

Applicant: Moogsoft, Inc.

Inventor： Philip Tee

IPC: G06F3/048 ,  G06F17/30 ,  H04L12/58 ,  H04L12/24 ,  H04L12/18 ,  G06Q10/10

CPC classification number: G06F16/285 ,  G06F16/35 ,  G06Q10/107 ,  H04L12/1895 ,  H04L41/065 ,  H04L41/12 ,  H04L41/22 ,  H04L51/16 ,  H04L51/22 ,  H04L51/24

Abstract: An event clustering system is provided. An extraction engine is in communication with an infrastructure. The extraction engine in operation receives data from the infrastructure and produces events. An alert engine receives the events and creates alerts mapped into a matrix, M. A sigalizer engine includes one or more of an NMF engine, a k-means clustering engine and a topology proximity engine. The sigalizer engine determines one or more common steps from events and produces clusters relating to the alerts and or events. A data extraction device is configured to be coupled to the event clustering system.