Processing Network Events

• US 20110106941A1
• Filed: 05/19/2010
• Published: 05/05/2011
• Est. Priority Date: 10/30/2009
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Franklin, David Richard
• Granted Patent: US 8,930,526 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06F 9/4843 by program, e.g. task dispatcher, supervisor, operating system
• CPC Class Codes: G06F 9/541 via adapters, e.g. between incompatible applications
• CPC Class Codes: G06F 9/544 Buffers; Shared memory; Pipes

Abstract

Processing network events generates multiple events from a single network device event. The system includes a network monitoring device for acquiring event data and a processing system for receiving an input event from a network monitoring device on a processing thread, wherein the processing system includes a communications thread generating component for generating multiple communications threads each for transmitting event data to a server database. The communication threads open connections to required server databases and these connections are maintained in an open state while the network monitoring device is running.

Claims

1. A method for processing network events, comprising:

receiving an input network event from a monitoring device on a processing thread;

generating a plurality of data outputs from the input network event; and

generating a plurality of communications threads, wherein each communications thread is used for transmitting one or more of the plurality of data outputs to one of a plurality of server databases.

2. The method as claimed in claim 1, wherein the processing thread receives the input network event and further comprising processing a rules files for the input network event, wherein the rules file includes a generate event command to create a new communications thread.

3. The method as claimed in claim 1, wherein a first communications thread marshals and transmits event data to a first server database.

4. The method as claimed in claim 1, wherein the communication threads open a plurality of connections to the plurality of server databases and further comprising maintaining the connections in an open state while the monitoring device is running.

5. The method as claimed in claim 1, further comprising:

processing a rules file to find one or more instances of one or more registered targets; and

determining one or more server database connections.

6. The method as claimed in claim 1, wherein the server databases include one or more tables for event data, and wherein each communications thread corresponds to one of the plurality of server databases.

7. The method as claimed in claim 1, wherein inter-thread communication is asynchronous via one or more message queues.

8. The method as claimed in claim 1, further comprising:

transferring event data via an inter-thread data structure.

9. The method as claimed in claim 1, further comprising:

sending one or more flush commands from the processing thread to clear the communications threads.

10. The method as claimed in claim 1, further comprising parsing event data to generate the plurality of data outputs.

11. The method as claimed in claim 1, further comprising:

processing a rules files for the input network event; and

transferring event data via a pointer to a selected communications thread when a generate event command is reached.

12. The method as claimed in claim 1, wherein event data is passed to a first communications thread as target and column data and converted into a structured query language (SQL) and appended to a text memory allocation for transmission.

13. A computer software product for processing network events, the product comprising a computer-readable storage medium, in which a computer program comprising computer-executable instructions are stored, which instructions, when executed by a computer, perform the following steps:

receiving an input network event from a monitoring device on a processing thread;

generating a plurality of data outputs from the input network event; and

generating a plurality of communications threads, wherein each communications thread is used for transmitting one or more of the plurality of data outputs to one of a plurality of server databases.

14. A system for processing network events, comprising:

a network monitoring device for acquiring network event data;

a processing system for receiving an input event from a monitoring device on a processing thread, wherein the processing system includes a communications thread generating component for generating a plurality of communications threads, wherein each communications thread is used for transmitting event data to one of a plurality of server databases.

15. The system as claimed in claim 14, wherein the processing system includes a receiver for the input event and one or more rules files for the input event, the rules files including a generate event command to create a new communications thread.

16. The system as claimed in claim 14, wherein a first communications thread marshals and transmits event data to a first server database.

17. The system as claimed in claim 14, wherein the communication threads open a plurality of connections to the plurality of server databases and wherein the plurality of connections are maintained in an open state while the monitoring device is running.

18. The system as claimed in claim 14, further comprising:

a rules file for processing to find one or more instances of one or more registered targets; and

a component for determining one or more server database connections.

19. The system as claimed in claim 14, wherein the server databases include one or more tables for event data, and wherein each communications thread corresponds to one of the plurality of server databases.

20. The system as claimed in claim 14, wherein inter-thread communication is asynchronous via one or more message queues.

21. The system as claimed in claim 14, further comprising:

an inter-thread data structure for transferring event data.

22. The system as claimed in claim 14, further comprising:

a component for flushing the communications threads.

23. The system as claimed in claim 14, further comprising a parsing component for parsing event data to generate the plurality of data outputs.

24. The system as claimed in claim 14, wherein the communications threads include a converter for converting event data into structured query language (SQL) and appending it to a text memory allocation for transmission.

25. The system as claimed in claim 14, wherein the processing system runs on a plurality of processors enabling the processing thread and the communications threads to be executed simultaneously.