System, method, apparatus and program for event processing

• US 20070150571A1
• Filed: 06/21/2006
• Published: 06/28/2007
• Est. Priority Date: 12/08/2005
• Status: Abandoned Application

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Morimura, Tomohiro, Kudo, Yutaka, Haga, Futoshi
• Application Number:
  US11/471,480
• Publication Number:
  US 20070150571A1
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling

Abstract

An event processing system that can perform processing corresponding to event messages certainly, and improve efficiency of processing event messages.

To that end, the event processing system of the present invention holds event messages, which are received owing to state transitions of an IT service system, in an event message holding unit in order of issue. Among the event messages held in the event message holding unit, the event processing system searches for an event message for which a state of the IT service system after issue of the event message in question coincides with a state of the IT service system before issue of the oldest event message in the event message holding unit. When the event processing system can retrieve the event message in question, the event processing system deletes event messages ranging from the oldest event message to the retrieved event message from the event message holding unit.

Claims

1. An event processing system that receives, each time when a state of a monitored system makes a transition, an event message specifying a content of said transition from a monitoring system, and controls said monitored system according to the received event message, wherein:

said event processing system comprises;

an event message holding means, which holds event messages issued by said monitoring system and outputs said event messages in order of issue;

an event processing means, which processes the event messages outputted from said event message holding means, to control said monitored system; and

an event filtering means, which selects event messages to be processed among the event messages in said event message holding means and supplies the selected event messages to said event processing means; and

said event filtering means searches the event messages held in said event message holding means for an event message for which a state of said monitored system after issue of said event message coincides with a state of said monitored system before issue of an oldest event message stored in said event message holding means; and

when said event filtering means can retrieve the event message in question, the event filtering means performs filtering processing by deleting event messages ranging from the oldest event message to the retrieved event message from said event message holding means.

2. An event processing system according to claim 1, wherein:

with respect to n event messages held in said event message holding means, when said event filtering means can retrieve a k-th (1<

k<

=n) event message, for which a state of the monitored system after issue of said k-th event message coincides with a state of the monitored system before issue of the oldest event message stored in the event message holding means, then said event filtering means deletes event messages ranging from the oldest event message to the k-th event message from said event message holding means, and performs said filtering processing again with respect to event messages remaining in the event message holding means.

3. An event processing system according to claim 1, wherein:

said event filtering means performs said filtering processing when said event processing means finishes processing of event messages supplied last time.

4. An event processing according to claim 1, wherein:

each of said event messages includes at least an event identifier that identifies the event message in question;

said event processing system further comprises an event correspondence table storage means, which stores, in association with an event identifier of each event message, a before-issue state indicating a state of said monitored system before issue of said event message and an after-issue state indicating a state of the monitored system after issue of said event message; and

based on an event identifier of an event message in said event message holding means, said event filtering means refers to said event correspondence table storage means to acquire a state of said monitored system before issue of said event message and a state of said monitored system after issue of said event message.

5. An event processing method in an event processing system that receives, each time when a state of a monitored system makes a transition, an event message specifying a content of said transition from a monitoring system, and controls said monitored system according to the received event message, wherein:

said event processing system performs;

a step of holding an event message issued from said monitoring system in an event message holding means;

a step of searching for an event message for which a state of said monitored system after issue of said event message coincides with a state of said monitored system before issue of an oldest event message stored in said event message holding means, among event messages held in said event message holding means; and

a step of deleting, from said event message holding means, event messages ranging from said oldest event message to the retrieved event message in question when the event processing system can retrieve said event message.

6. An event processing method in an event processing system that receives, each time when a state of a monitored system makes a transition, an event message specifying a content of said transition from a monitoring system, and controls said monitored system according to the received event message, wherein:

said event processing system performs;

a first step in which event messages issued from said monitoring system are held in an event holding means;

a second step in which, with respect to n event messages held in said event message holding means, a k-th (1<

k<

=n)) event message, for which a state of the monitored system after issue of said k-th event message coincides with a state of the monitored system before issue of an oldest event message stored in said event message holding means, is searched for;

a third step in which, when the event processing system can retrieve the k-th event message in the second step, the event processing system deletes event messages ranging from said oldest event message to said k-th event message from said event message holding means; and

a fourth step in which said first step through said third step are repeated with respect to event messages remaining in said event message holding means.

7. An event processing method according to claim 6, wherein:

when said event processing system can not retrieve an event message for which a state of said monitored system after issue of said event message coincides with the state of said monitored system before issue of said oldest event message, then said event processing system performs, in said third and fourth steps, a fifth step in which said monitored system is controlled according to an oldest event message remaining in said event message holding means.

8. An event processing apparatus that receives, each time when a state of a monitored system makes a transition, an event message specifying a content of said transition from a monitoring system, wherein:

said event processing apparatus comprises;

an event message holding unit that holds event messages issued by said monitoring system and outputs said event messages in order of issue;

an event processing unit that processes the event messages outputted from said event message holding unit, to control said monitored system; and

an event filtering unit that selects event messages to be processed among the event messages in said event message holding unit and supplies the selected event messages to said event processing unit; and

with respect to n event messages held in said event message holding unit, said event message filtering unit searches for a k-th (1<

k<

=n) event message, for which a state of the monitored system after issue of said k-th event message coincides with a state of said monitored system before issue of an oldest event message stored in said event message holding unit; and

when the event message filtering unit can retrieve said k-th event message, the event message filtering unit performs filtering processing by deleting event messages ranging from said oldest event message to said k-th event message from said event message holding unit.

9. An event processing apparatus according to claim 8, wherein:

in a case where event messages remain in said event message holding unit after last filtering processing is finished, said event filtering unit repeats said filtering processing with respect to said remaining event messages.

10. An event processing apparatus according to claim 8, wherein:

in a case where said event filtering unit can not retrieve an event message for which a state of the monitored system after issue of said event message coincides with the state of the monitored system before issue of said oldest event message, said event filtering unit ends said filtering processing and supplies an oldest event message among event messages remaining in said event message holding unit to said event processing unit.

11. An event processing unit according to claim 8, wherein:

in a case where one event message remains in said event message holding unit when said event processing unit finishes processing of an event message supplied last time, said event filtering unit performs said filtering processing with respect to said remaining event message.

12. A storage medium storing an event processing program that makes an event processing apparatus operate such that said event processing apparatus receives, each time when a state of a monitored system makes a transition, an event message specifying a content of said transition from a monitoring system and controls said monitored system according to the received event message, wherein:

said event processing program comprises;

an event message holding module that holds event messages issued by said event monitoring system and outputs said event messages in order of issue;

an event processing module that processes the event messages outputted from said event message holding module, to control said monitored system; and

an event filtering module that selects event messages to be processed among the event messages held by said event message holding module and supplies the selected event messages to said event processing module; and

with respect to n event messages held by said event message holding module, said event message filtering module searches for a k-th (1<

k<

=n) event message, for which a state of the monitored system after issue of said k-th event message coincides with a state of said monitored system before issue of an oldest event message stored by said event message holding module; and

when the event message filtering module can retrieve said k-th event message, the event message filtering module performs filtering processing by deleting event messages ranging from said oldest event message to said k-th event message from said event message holding module.

13. A storage medium storing an event processing program according to claim 12, wherein:

in a case where event messages remain in said event message holding module after last filtering processing is finished, said event filtering module repeats said filtering processing with respect to said remaining event messages.

14. A storage medium storing an event processing program according to claim 12, wherein:

in a case where said event filtering module can not retrieve an event message for which a state of the monitored system after issue of said event message coincides with the state of the monitored system before issue of said oldest event message, said event filtering module ends said filtering processing and supplies an oldest event message among event messages remaining in said event message holding module to said event processing module.

15. A storage medium storing an event processing program according to claim 12, wherein:

in a case where one event message remains in said event message holding module when said event processing module finishes processing of an event message supplied last time, said event filtering module performs said filtering processing with respect to said remaining event message.