System and method for throttling events in an information technology system

• US 20040260804A1
• Filed: 06/19/2003
• Published: 12/23/2004
• Est. Priority Date: 06/19/2003
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Grabarnik, Genady, Thoenen, David H., Ma, Sheng, Perng, Chang-Shing
• Granted Patent: US 7,392,311 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/064 involving time analysis
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/067 using time frame reporting
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 67/62 Establishing a time schedule for servicing the requests
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A system and method for generating throttling parameters for an information management (IT) system based on historical event log data. The system comprises: an identification system that examines the historical event log data and identifies throttling candidates, wherein each throttling candidate comprises an event type for redundant events that reoccur over at least one measured time period; and an analysis system that statistically analyzes event data associated with each throttling candidate and generates a set of throttling parameters for each throttling candidate based on the event data.

Claims

1. A system for generating throttling parameters for an information technology (IT) management system based on historical event log data, comprising:

an identification system that examines events in the historical event log data and identifies throttling candidates, wherein each throttling candidate comprises an event type for a series of redundant events that reoccur over at least one measured time period; and

an analysis system that statistically analyzes event data associated with each throttling candidate and generates a set of throttling parameters for each throttling candidate based on the event data.

2. The system of claim 1, wherein the throttling candidates are identified by examining the inter-arrival time of redundant events.

3. The system of claim 1, wherein the throttling candidates are identified by examining the at least one measured time period during which redundant events occurred.

4. The system of claim 1, wherein at least one throttling candidate comprises an event type that reoccurred over a plurality of different measured time periods.

5. The system of claim 1, wherein the event data associated with each throttling candidate includes:

the at least one measured time period during which redundant events reoccur; and

an inter-arrival time of the redundant events occurring during each at least one measured time period.

6. The system of claim 1, wherein the throttling parameters for each throttling candidate comprise an event type and a throttling window.

7. A program product stored on a recordable medium for generating throttling parameters for an information technology (IT) management system based on historical event log data, comprising:

means for examining the historical event log data and identifying throttling candidates, wherein each throttling candidate comprises an event type for redundant events that reoccur over at least one measured time period; and

means for statistically analyzing event data associated with each throttling candidate and generating a set of throttling parameters for each throttling candidate based on the event data.

8. The program product of claim 7, wherein the throttling candidates are identified by examining the inter-arrival time of redundant events.

9. The program product of claim 7, wherein the throttling candidates are identified by examining the at least one measured time period during which redundant events reoccur.

10. The program product of claim 7, wherein at least one throttling candidate comprises a redundant event that reoccurs over a plurality of different measured time periods.

11. The program product of claim 7, wherein the event data associated with each throttling candidate includes:

the at least one measured time period during which a redundant event occurs, and

an inter-arrival time of the redundant events occurring during each at least one measured time period.

12. The program product of claim 7, wherein the throttling parameters for each throttling candidate comprise an event type and a throttling window.

13. A method for generating throttling parameters for an information technology (IT) management system based on historical event log data, comprising:

examining the historical event log data and identifying throttling candidates, wherein each throttling candidate comprises an event type for redundant events that reoccur during at least one measured time period;

statistically analyzing event data associated with each throttling candidate; and

generating a set of throttling parameters for each throttling candidate based on the event data.

14. The method of claim 13, wherein the step of identifying throttling candidates includes examining the inter-arrival time of redundant events.

15. The method of claim 13, wherein the step of identifying throttling candidates includes examining the at least one measured time period during which redundant events occur.

16. The method of claim 13, wherein at least one throttling candidate comprises an event type that reoccurs over a plurality of different measured time periods.

17. The method of claim 13, wherein the event data associated with each throttling candidate includes the at least one measured time period during which a redundant event occurs, and an inter-arrival time of the redundant events occurring during each at least one measured time period.

18. The method of claim 13, wherein the throttling parameters for each throttling candidate comprise an event type and a throttling window.

19. The method of claim 13, comprising the further step of inputting the throttling parameters into the IT management system.

20. The method of claim 19, comprising the further step of throttling events detected by the IT management system based on the inputted throttling parameters.

21. The IT management system of claim 20, wherein the throttling candidates are identified by examining the inter-arrival time of redundant events.

22. The IT management system of claim 20, wherein the throttling candidates are identified by examining a length of the at least one measured time period during which redundant events occur.

23. The IT management system of claim 20, wherein at least one throttling candidate comprises an event type that reoccurs over a plurality of different measured time periods.

24. The IT management system of claim 20, wherein the event data associated with each throttling candidate includes the at least one measured time period during which a redundant event occurs, and an inter-arrival time of the redundant events occurring during each at least one measured time period.

25. The IT management system of claim 20, wherein the throttling parameters for each throttling candidate comprise an event type and a throttling window.

26. The IT management system of claim 20, wherein identification system includes identifier settings that control selection of throttling candidates.

20-1. An information technology (IT) management system, comprising:

a database for storing historical event log data;

an identification system that examines the historical event log data and identifies throttling candidates, wherein each throttling candidate comprises an event type for redundant events that reoccur over at least one measured time period;

an analysis system that statistically analyzes event data associated with each throttling candidate and generates a set of throttling parameters for each throttling candidate based on the event data; and

a throttling system for filtering events from the IT management system based on the throttling parameters.