Method, system and program product for optimizing event monitoring filter settings and metric threshold

• US 20060221848A1
• Filed: 03/31/2005
• Published: 10/05/2006
• Est. Priority Date: 03/31/2005
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Lake, John M.
• Granted Patent: US 8,291,064 B2
• Time in Patent Office: Days
• US Class Current: 370/252
• CPC Class Codes: G06F 11/008 Reliability or availability analysis

Abstract

Under the present invention indications of an event are monitored based upon a comparison of a computer system metric to a corresponding metric threshold over time. It is then determined whether a predetermined probability is reached that the indications will persist at least as long as a minimum detection and repair time for the event. Determining whether the predetermined probability is reached is typically accomplished based upon the monitoring of the indications over time and historical data for past instances of the event. The present invention will then optimize the filter setting for the event to minimize false positives and optimize the metric threshold so that indications are more accurately monitored.

Claims

1. A method for optimizing event monitoring filter settings, comprising:

monitoring indications of an event over time;

obtaining a minimum detection and repair time for the event; and

determining an optimal filter setting for registering the event based on the minimum detection and repair time.

2. The method of claim 1, further comprising:

determining whether a predetermined probability is reached that the indications will persist at least as long as the minimum detection and repair time for the event, wherein the step of determining an optimal filter setting for the event comprises determining an optimal filter setting for the event so that the event will be registered only if the predetermined probability is reached.

3. The method of claim 2, wherein the step of determining whether the predetermined probability is reached is based upon the monitoring of the indications over time and historical data for past instances of the event.

4. The method of claim 1, wherein the step of determining comprises:

determining an optimal filter setting in which a sum of occurrences and non-occurrences of the indications are less or equal to a quotient of the minimum detection and repair time and a time between samples for the event.

5. The method of claim 1, wherein the indications are monitored based upon a comparison of a computer system metric to a corresponding metric threshold over time.

6. The method of claim 5, further comprising optimizing the metric threshold based upon historical data for the indications.

7. The method of claim 1, wherein the optimal filter setting comprises a particular arrangement of occurrences and non-occurrences of the indications over time.

8. The method of claim 1, wherein the minimum detection and repair time is obtained based on at least one of an approximation and a policy.

9. A method for optimizing event monitoring filter settings, comprising:

monitoring indications of an event based upon a comparison of a computer system metric to a corresponding metric threshold over time;

determining whether a predetermined probability is reached that the indications will persist at least as long as a minimum detection and repair time for the event, wherein step of determining whether the predetermined probability is reached is based upon the monitoring of the indications over time and historical data for past instances of the event; and

determining an optimal filter setting for the event so that the event will be registered only if the predetermined probability is reached.

10. A system for optimizing event monitoring filter settings, comprising:

an event monitoring system for monitoring indications of an event;

an event persistence system for determining whether a predetermined probability is reached that the indications will persist at least as long as a minimum detection and repair time for the event; and

a filter optimization system for determining an optimal filter setting for the event so that the event will be registered only if the predetermined probability is reached.

11. The system of claim 10, wherein the event persistence system determines whether the predetermined probability is reached based upon the monitoring of the indications over time and historical data for past instances of the event.

12. The system of claim 10, wherein the event monitoring system monitors the indications based upon a comparison of a computer system metric to a corresponding metric threshold over time.

13. The system of claim 12, further comprising a metric optimization system for optimizing the metric threshold based upon historical data for the indications.

14. The system of claim 10, wherein the optimal filter setting comprises a particular arrangement of occurrences and non-occurrences of the indications over time.

15. The system of claim 10, further comprising an event registration system for registering the event is registered by communicating an event alert.

16. The system of claim 10, wherein the minimum detection and repair time is determined based on an approximation.

17. The system of claim 10, wherein the minimum detection and repair time is determined based on a policy.

21. The system of claim 12, wherein the program product further comprises program code for performing the following step:

optimizing the metric threshold based upon historical data for the indications.

18. A program product stored on a computer readable medium for optimizing event monitoring filter settings, the program product comprising program code for performing the following steps:

monitoring indications of an event;

determining whether a predetermined probability is reached that the indications will persist at least as long as a minimum detection and repair time for the event; and

determining an optimal filter setting for the event so that the event will be registered only if the predetermined probability is reached.

19. The program product of claim 18, wherein the determining of whether the predetermined probability is reached is performed based upon the monitoring of the indications over time and historical data for past instances of the event.

20. The program product of claim 18, wherein the monitoring of the indications is based upon a comparison of a computer system metric to a corresponding metric threshold over time.

22. The program product of claim 18, wherein the optimal filter setting comprises a particular arrangement of occurrences and non-occurrences of the indications over time.

23. The program product of claim 18, wherein the program product further comprises program code for performing the following step:

registering the event is registered by communicating an event alert.

24. The program product of claim 18, wherein the minimum detection and repair time is determined based on an approximation.

25. The program product of claim 18, wherein the minimum detection and repair time is determined based on a policy.

26. A method for deploying an application for optimizing event monitoring filter settings, comprising:

providing a computer infrastructure being operable to;

monitor indications of an event;

determine whether a predetermined probability is reached that the indications will persist at least as long as a minimum detection and repair time for the event; and

determine an optimal filter setting for the event so that the event will be registered only if the predetermined probability is reached.

27. The method of claim 26, wherein determining whether the predetermined probability is reached is based upon the monitoring of the indications over time and historical data for past instances of the event, and wherein the indications are monitored based upon a comparison of a computer system metric to a corresponding metric threshold over time.