Restarting Event And Alert Analysis After A Shutdown In A Distributed Processing System

• US 20120331347A1
• Filed: 06/22/2011
• Published: 12/27/2012
• Est. Priority Date: 06/22/2011
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Carey, James E., Markland, Matthew W., Sanders, Philip J.
• Granted Patent: US 8,713,366 B2
• Time in Patent Office: Days
• US Class Current: 714/37
• CPC Class Codes: G06F 11/1471 involving logging of persistent data for recovery
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/0686 Additional information in the notification, e.g. enhancement of specific meta-data
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications

Abstract

Methods, systems, and computer program products for restarting event and alert analysis after a shutdown in a distributed processing system are provided. Embodiments include identifying, by an incident analyzer, a shutdown condition of the distributed processing system; and determining, by the incident analyzer, whether the shutdown was a planned shutdown or an unplanned shutdown; if the shutdown was planned, storing, by the incident analyzer, an identification of the last event in an event log that was injected in an event queue at the time of the planned shutdown and restarting, by the incident analyzer, event and alert analysis using the next event identified in the event log; if the shutdown was unplanned, identifying, by the incident analyzer, a previously configured restart mode; selecting, by the incident analyzer, an identification of a restart event in the event log according to the previously configured restart mode; and restarting, by the incident analyzer, event and alert analysis using the restart event identified in the event log.

Claims

1. A method of restarting event and alert analysis after a shutdown in a distributed processing system, the method comprising:

identifying, by an incident analyzer, a shutdown condition of the distributed processing system;

determining, by the incident analyzer, whether the shutdown was a planned shutdown or an unplanned shutdown;

if the shutdown was planned, storing, by the incident analyzer, an identification of the last event in an event log that was injected in an event queue at the time of the planned shutdown and restarting, by the incident analyzer, event and alert analysis using the next event identified in the event log;

if the shutdown was unplanned, identifying, by the incident analyzer, a previously configured restart mode;

selecting, by the incident analyzer, an identification of a restart event in the event log according to the previously configured restart mode; and

restarting, by the incident analyzer, event and alert analysis using the restart event identified in the event log.

2. The method of claim 1 wherein selecting a restart event in the event log according to a previously configured restart mode further comprises selecting, by the incident analyzer, as the restart event a next event received from a component after the shutdown condition is identified.

3. The method of claim 1 wherein selecting a restart event in the event log according to a previously configured restart mode further comprises selecting, by the incident analyzer, as the restart event the first event stored in the event log.

4. The method of claim 1 wherein selecting a restart event in the event log according to a previously configured restart mode further comprises determining, by the incident analyzer, the last event injected in the event queue from the event log and selecting, by the incident analyzer, as the restart event the last event injected in the event queue.

5. The method of claim 1 wherein selecting a restart event in the event log according to a previously configured restart mode further comprises determining, by the incident analyzer, the last event injected in the event queue from the event log, determining, by the incident analyzer, the logged time of the last event injected in the event queue, and selecting, by the incident analyzer, as the restart event an event logged in the event log a predetermined period of time before the logged time of the last event injected in the event queue.

6. The method of claim 5 further comprising identifying, by the incident analyzer, which events were logged the predetermined period of time from the logged time of the last event injected in the event queue.

7. The method of claim 6 further comprising:

determining, by the incident analyzer, which of the identified events generated alerts; and

preventing duplicate alerts from being generated in response to the identified events being reprocessed.

8. A system for restarting event and alert analysis after a shutdown in a distributed processing system, the system comprising a computer processor, a computer memory operatively coupled to the computer processor, the computer memory having disposed within it computer program instructions capable, when executed by the computer processor, of causing the system to carry out the steps of:

identifying, by an incident analyzer, a shutdown condition of the distributed processing system;

determining, by the incident analyzer, whether the shutdown was a planned shutdown or an unplanned shutdown;

if the shutdown was planned, storing, by the incident analyzer, an identification of the last event in an event log that was injected in an event queue at the time of the planned shutdown and restarting, by the incident analyzer, event and alert analysis using the next event identified in the event log;

if the shutdown was unplanned, identifying, by the incident analyzer, a previously configured restart mode;

selecting, by the incident analyzer, an identification of a restart event in the event log according to the previously configured restart mode; and

restarting, by the incident analyzer, event and alert analysis using the restart event identified in the event log.

9. The system of claim 8 wherein selecting a restart event in the event log according to a previously configured restart mode further comprises selecting, by the incident analyzer, as the restart event a next event received from a component after the shutdown condition is identified and stored in the event log.

10. The system of claim 8 wherein selecting a restart event in the event log according to a previously configured restart mode further comprises selecting, by the incident analyzer, as the restart event the first event stored in the event log.

11. The system of claim 8 wherein selecting a restart event in the event log according to a previously configured restart mode further comprises determining, by the incident analyzer, the last event injected in the event queue from the event log and selecting as the restart event that last event injected in the event queue.

12. The system of claim 8 wherein selecting a restart event in the event log according to a previously configured restart mode further comprises determining, by the incident analyzer, the last event injected in the event queue from the event log, determining the logged time of the last event injected in the event queue, and selecting as the restart event an event logged in the event log a predetermined period of time before the logged time of the last event injected in the event queue.

13. The system of claim 8 further comprising identifying, by the incident analyzer, which events were logged the predetermined period of time from the logged time of the last event injected in the event queue.

14. The system of claim 13 further comprising:

determining, by the incident analyzer, which of the identified events generated alerts; and

preventing, by the incident analyzer, duplicate alerts from being generated in response to the identified events being reprocessed.

15. A computer program product for restarting event and alert analysis in a distributed processing system, the computer program product disposed upon a computer readable storage medium, the computer program product comprising computer program instructions for:

identifying, by an incident analyzer, a shutdown condition of the distributed processing system;

determining, by the incident analyzer, whether the shutdown was a planned shutdown or an unplanned shutdown;

if the shutdown was planned, storing, by the incident analyzer, an identification of the last event in an event log that was injected in an event queue at the time of the planned shutdown and restarting, by the incident analyzer, event and alert analysis using the next event identified in the event log;

if the shutdown was unplanned, identifying, by the incident analyzer, a previously configured restart mode;

selecting, by the incident analyzer, an identification of a restart event in the event log according to the previously configured restart mode; and

restarting, by the incident analyzer, event and alert analysis using the restart event identified in the event log.

16. The computer program product of claim 15 wherein selecting a restart event in the event log according to a previously configured restart mode further comprises selecting, by the incident analyzer, as the restart event a next event received from a component after the shutdown condition is identified and stored in the event log.

17. The computer program product of claim 15 wherein selecting a restart event in the event log according to a previously configured restart mode further comprises selecting, by the incident analyzer, as the restart event the first event stored in the event log.

18. The computer program product of claim 15 wherein selecting a restart event in the event log according to a previously configured restart mode further comprises determining, by the incident analyzer, the last event injected in the event queue from the event log and selecting, by the incident analyzer, as the restart event that last event injected in the event queue.

19. The computer program product of claim 15 wherein selecting a restart event in the event log according to a previously configured restart mode further comprises determining, by the incident analyzer, the last event injected in the event queue from the event log, determining, by the incident analyzer, the logged time of the last event injected in the event queue, and selecting, by the incident analyzer, as the restart event an event logged in the event log a predetermined period of time before the logged time of the last event injected in the event queue.

20. The computer program product of claim 19 further comprising:

identifying, by the incident analyzer, which events were logged the predetermined period of time from the logged time of the last event injected in the event queue;

determining, by the incident analyzer, which of the identified events generated alerts; and

preventing, by the incident analyzer, duplicate alerts from being generated in response to the identified events being reprocessed.