METHOD AND SYSTEM FOR PROCESSING MULTIPLE HETEROGENEOUS EVENT TYPES IN A COMPLEX EVENT PROCESSING ENGINE

• US 20070255529A1
• Filed: 05/01/2006
• Published: 11/01/2007
• Est. Priority Date: 05/01/2006
• Status: Active Grant

• Current Assignee: GlobalFoundries, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Moser, Michael, Gschwind, Thomas, Feridun, Metin, Biazetti, Ana, Darney, Adam, Phelps, Mack, Gajda, Kimberly, Dobner, Edward, Pate, Brian
• Granted Patent: US 8,589,949 B2
• Time in Patent Office: Days
• US Class Current: 702/186
• CPC Class Codes: G06F 9/541 via adapters, e.g. between incompatible applications
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications
• CPC Class Codes: G06Q 10/00 Administration; Management

Abstract

An invention is disclosed for improved computer system management by allowing complex computer-monitored events to be handled in different formats for correlation, analysis and action. Specifically, a method and system are disclosed for processing multiple heterogeneous event types in a complex event processing (CEP) engine.

Claims

1. A computer management system comprised of a complex event processing engine for handling computer-monitored events using correlation rules acting upon different event types having attributes expressed in different formats to produce a desired result when common attributes defined by the rules are encountered as an event is processed.

2. The computer management system of claim 1 further comprised of the following components:

(a). a runtime event wrapper component for capturing the original format of an event; and

(b) an event definition provider component for handling metadata defining the attributes of an event type in a specific format;

wherein the components are used in cooperation with each other to select attributes that form correlation rules expressing relationships between different events.

3. The computer management system of claim 2 wherein the event definition provider component is used to represent metadata for an event type in terms of a preferred set of attributes for an event format.

4. The computer management system of claim 3 wherein the event definition provider component is used to create the rules through a graphical user interface.

5. The computer management system of claim 3 wherein the runtime event wrapper component is used to access event attributes by capturing an event in its original format instead of converting attributes of different events to a common format.

6. The computer management system of claim 5 wherein the runtime event wrapper component is comprised of a set of methods for allowing specific attributes of an event format to be retrieved and used in their original form.

7. The computer management system of claim 6 wherein at least one method is used to support the hierarchical arrangement of complex attributes with a notation that allows a user to access different hierarchical levels for an event type having a specific format.

8. The computer management system of claim 7 wherein the event definition provider component implements at least one method to return an event type hierarchy organized in a tree-like structure as well as detailed information about the attributes that compose a given event type.

9. The computer management system of claim 8 wherein the detailed attribute information is selected from a group consisting of at least one of the attribute name, attribute type, attribute default value(s), attribute allowed value(s) and attribute hierarchical path.

10. A method of using a complex event processing engine for handling computer-monitored events using correlation rules acting upon different event types having attributes expressed in different formats to produce a desired result when common attributes defined by the rules are encountered as events are processed, comprised of the following steps:

(a). using a runtime event wrapper component of the engine for capturing the original format of an event; and

(b). using an event definition provider component of the engine for handling metadata defining the attributes of an event type or format;

wherein the components are used in cooperation with each other to select attributes that form correlation rules expressing relationships between different events.

11. The method of claim 10 wherein the runtime event wrapper component is used to access event attributes by capturing an event in its original format instead of converting attributes of different events to a common format.

12. The method of claim 10 wherein the event definition provider component is used to represent metadata for an event type in terms of a preferred set of attributes for an event format.

13. The method of claim 10 wherein the engine is used to process multiple heterogeneous event types by accessing or manipulating lower-level events having different formats to perform correlations between events that generate a higher-level event.

14. The method of claim 13 wherein the engine is used to dynamically handle heterogeneously formatted complex events to improve system performance through a real-time utilization of a specific event format that occurs during system processing of the event.