基于改进causality graph的分布式可伸缩事件关联机制  

Distributed scalable event correlation scheme based on enhanced causality graph

作　　者：郭楠[1] 高天寒[1] 赵宏 

机构地区：[1]东北大学计算机软件国家工程研究中心,沈阳110179

出　　处：《通信学报》2004年第4期23-30,共8页Journal on Communications

基　　金：国家"863"高科技项目基金资助(863-317-01-03-99)

摘　　要：传统事件关联技术无法有效满足分布式网络管理的需求,本文提出一种分布式可伸缩事件关联机制,采用先分布再集中的关联模式与自适应可伸缩的关联关系。定义了本地关联和网络关联两个过程,首先由设备进行本地关联,而后各地关联结果汇总到管理平台进行网络关联;将事件的关联关系与管理任务的关联关系相结合,根据管理任务在设备端的动态配置情况构建自适应可伸缩的关联关系,并支持对逻辑事件的推理。同时,在改进Causality Graph算法的基础上提出了实现该机制的相关算法。原型系统的应用实例验证了机制的有效性和优越性。The existing event correlation methods, which are implemented in centralized style, cannot work effectively in distributed network management. In this paper, we present a distributed scalable event correlation (DSEC) scheme to solve this problem. DSEC is divided into two steps, local correlation and network correlation. Firstly, it automatically constructs local correlation graph according to the configuration of management tasks assigned by management station, and makes correlation of events emitted locally. Secondly each network component sends its local correlated result to management station to make final reasoning in network environment. The management station will deduce if there is any problem not observable in individual components but happening in network. Thus, DSEC decomposes the complexity of event correlation in both network component and management station, and eliminates the redundancy computation of traditional algorithms. In addition, the scheme makes event correlation graph based on the correlation of management tasks. It achieves scalability by extending or shrinking local correlation graph adaptively according to dynamic extension or retraction of management tasks, so it is of great flexibility. We also propose five algorithms for the scheme through enhancing the algorithm of causality graph.

关 键 词：分布式网络管理 事件关联 分布式可伸缩事件关联 因果关系图 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]