TYPICALITY FILTERING OF EVENT INDICATORS FOR INFORMATION TECHNOLOGY RESOURCES
1 Assignment
0 Petitions
Accused Products
Abstract
A monitor for information technology resources improved by introducing typicality filters to analyze potential event indicators such as alerts. A typicality filter keeps a time-dependent history of the frequency of occurrence of an associated event, wherein time is segmented into monitoring periods. At the end of each monitoring period, a present count of occurrences of the event is determined, and compared with the numbers of occurrences of that event in a subset of monitoring periods read from the history. If the present count exceeds the number of occurrences of the event in a predetermined proportion of the subset of historical monitoring periods, a first action is invoked; otherwise, a second action is invoked.
-
Citations
10 Claims
-
1-4. -4. (canceled)
-
5. A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform method steps suitable for filtering events in an information technology resource monitor, said method steps comprising:
-
determining a present count of occurrences of an event for a present monitoring period; comparing the present count with numbers of occurrences of the event in a plurality of earlier monitoring periods; invoking a first action if the present count exceeds a predetermined proportion of the numbers of occurrences of the event in the plurality of earlier monitoring periods; and invoking a second action if the present count does not exceed the predetermined proportion of the numbers of occurrences of the event in the plurality of earlier monitoring periods; wherein the plurality of earlier monitoring periods all begin at the same time on consecutive days previous to the present monitoring period. - View Dependent Claims (7, 8)
-
-
6. A typicality filter suitable for filtering events in an information technology resource monitor, said filter comprising:
-
an event counter for determining a present count of occurrences of an event for a present monitoring period; a history table for storing numbers of occurrences of the event in earlier monitoring periods; and logic for comparing the present count with numbers of occurrences of the event in a plurality of earlier monitoring periods selected from the history table, invoking a first action if the present count exceeds a predetermined proportion of the numbers of occurrences of the event in the plurality of earlier monitoring periods, and invoking a second action if the present count does not exceed the predetermined proportion of the numbers of occurrences of the event in the plurality of earlier monitoring periods; wherein the plurality of earlier monitoring periods all begin at the same time on consecutive days previous to the present monitoring period. - View Dependent Claims (9, 10)
-
Specification