Restarting Event And Alert Analysis After A Shutdown In A Distributed Processing System
First Claim
1. A method of restarting event and alert analysis after a shutdown in a distributed processing system, the method comprising:
- identifying, by an incident analyzer, a shutdown condition of the distributed processing system, the incident analyzer including a plurality of event analyzers and a monitor that monitors the plurality of event analyzers; and
determining, by the incident analyzer, whether the shutdown was a planned shutdown or an unplanned shutdown;
if the shutdown was planned, storing, by the incident analyzer, an identification of the last event in an event log that was injected in an event queue at the time of the planned shutdown and restarting, by the incident analyzer, event and alert analysis using the next event identified in the event log; and
if the shutdown was unplanned, for each event analyzer, identifying the last event included in the last event pool that the event analyzer closed; and
restarting, by the incident analyzer, event and alert analysis at the event analyzer using the next event received by the event analyzer after the identified last event.
1 Assignment
0 Petitions
Accused Products
Abstract
Methods, systems, and computer program products for restarting event and alert analysis after a shutdown in a distributed processing system are provided. Embodiments include identifying, by an incident analyzer, a shutdown condition of the distributed processing system, the incident analyzer including a plurality of event analyzers and a monitor that monitors the plurality of event analyzers; and determining, by the incident analyzer, whether the shutdown was a planned shutdown or an unplanned shutdown; if the shutdown was planned, storing, by the incident analyzer, an identification of the last event in an event log that was injected in an event queue at the time of the planned shutdown and restarting, by the incident analyzer, event and alert analysis using the next event identified in the event log; and if the shutdown was unplanned, for each event analyzer, identifying the last event included in the last event pool that the event analyzer closed; and restarting, by the incident analyzer, event and alert analysis at the event analyzer using the next event received by the event analyzer after the identified last event.
-
Citations
18 Claims
-
1. A method of restarting event and alert analysis after a shutdown in a distributed processing system, the method comprising:
-
identifying, by an incident analyzer, a shutdown condition of the distributed processing system, the incident analyzer including a plurality of event analyzers and a monitor that monitors the plurality of event analyzers; and determining, by the incident analyzer, whether the shutdown was a planned shutdown or an unplanned shutdown; if the shutdown was planned, storing, by the incident analyzer, an identification of the last event in an event log that was injected in an event queue at the time of the planned shutdown and restarting, by the incident analyzer, event and alert analysis using the next event identified in the event log; and if the shutdown was unplanned, for each event analyzer, identifying the last event included in the last event pool that the event analyzer closed; and
restarting, by the incident analyzer, event and alert analysis at the event analyzer using the next event received by the event analyzer after the identified last event. - View Dependent Claims (2, 3, 4, 5, 6)
-
-
7. A system for restarting event and alert analysis after a shutdown in a distributed processing system, the system comprising a computer processor, a computer memory operatively coupled to the computer processor, the computer memory having disposed within it computer program instructions capable, when executed by the computer processor, of causing the system to carry out the steps of:
-
identifying, by an incident analyzer, a shutdown condition of the distributed processing system, the incident analyzer including a plurality of event analyzers and a monitor that monitors the plurality of event analyzers; and determining, by the incident analyzer, whether the shutdown was a planned shutdown or an unplanned shutdown; if the shutdown was planned, storing, by the incident analyzer, an identification of the last event in an event log that was injected in an event queue at the time of the planned shutdown and restarting, by the incident analyzer, event and alert analysis using the next event identified in the event log; and if the shutdown was unplanned, for each event analyzer, identifying the last event included in the last event pool that the event analyzer closed; and
restarting, by the incident analyzer, event and alert analysis at the event analyzer using the next event received by the event analyzer after the identified last event. - View Dependent Claims (8, 9, 10, 11, 12)
-
-
13. A computer program product for restarting event and alert analysis in a distributed processing system, the computer program product disposed upon a computer readable storage medium, the computer program product comprising computer program instructions for:
-
identifying, by an incident analyzer, a shutdown condition of the distributed processing system, the incident analyzer including a plurality of event analyzers and a monitor that monitors the plurality of event analyzers; and determining, by the incident analyzer, whether the shutdown was a planned shutdown or an unplanned shutdown; if the shutdown was planned, storing, by the incident analyzer, an identification of the last event in an event log that was injected in an event queue at the time of the planned shutdown and restarting, by the incident analyzer, event and alert analysis using the next event identified in the event log; and if the shutdown was unplanned, for each event analyzer, identifying the last event included in the last event pool that the event analyzer closed; and
restarting, by the incident analyzer, event and alert analysis at the event analyzer using the next event received by the event analyzer after the identified last event. - View Dependent Claims (14, 15, 16, 17, 18)
-
Specification