SORTED EVENT MONITORING BY CONTEXT PARTITION

• US 20140379892A1
• Filed: 06/20/2013
• Published: 12/25/2014
• Est. Priority Date: 06/20/2013
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Klimov, Aleksandr, Filimonov, Vitaly, Zakonov, Alexandre
• Granted Patent: US 9,584,379 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3072 where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: G06F 2201/865 Monitoring of software
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation

Abstract

An event monitoring system that includes two stages, an event sorting stage and an event processing stage. The event sorting stage receives events provided by at least one application, and includes multiple event sorting systems. The event processing stage includes at least one event processing system that processes events forwarded by the event sorting stage. The event processing system(s) is/are capable of processing events that fall within a particular set of one or more context partitions that correspond to the respective event processing system. As the event sorting system receives an event, the event sorting system identifies which context partition the event falls within. The event sorting system then identifies the event processing system that corresponds to the identified context partition of the event, and then forwards the event to the identified event processing system. The event processing system then applies the set of one or more monitoring rules.

Claims

1. An event monitoring system comprising:

an event sorting stage comprising a plurality of event sorting systems and that receives a plurality of events provided by at least one application;

an event processing stage comprising at least one event processing system that processes events, wherein each of the at least one event processing system is capable of processing events that fall within a particular set of one or more context partitions that correspond to the respective event processing system,

wherein each of the plurality of event sorting systems is configured to perform the following in response to receiving each of at least some of the plurality of events;

an act of identified which context partition the event falls within;

an act of identifying the event processing system that corresponds to the identified context partition of the event; and

an act of forwarding the event towards the identified event processing system;

wherein each of the at least one of the event processing systems is configured to perform the following;

an act of applying monitoring rules to events received from the event sorting stage.

2. The system in accordance with claim 1, wherein a particular application of the at least one application is a distributed application.

3. The system in accordance with claim 2, wherein the event sorting stage is also distributed such that a first plurality of events generated by a first part of the distributed particular application are received at a first event sorting system of the plurality of event sorting systems, and such that a second plurality of events generated by a second part of the particular distributed application are received at a second event sorting system of the plurality of event sorting systems.

4. The system in accordance with claim 1, wherein the event processing stage is distributed.

5. The system in accordance with claim 4, wherein the at least one event processing stage comprises at least a first event processing system and a second event processing system, wherein the first event processing system processes events that fall within a first set of one or more context partitions, and the second event processing system processes events that fall within a second set of one or more context partitions.

6. The system in accordance with claim 5, wherein the first event processing system has a first processor-addressable data vessel usable by code executing on the first event processing system, and wherein the second event processing system has a second processor-addressable data vessel usable by code executing on the second event processing system.

7. The system in accordance with claim 1, wherein a context partition of an event is identified using at least a customer identifier.

8. The system in accordance with claim 1, wherein a context partition of an event is identified using at least an application identifier.

9. The system in accordance with claim 1, wherein a context partition of an event is identified using at least hosted service name.

10. The system in accordance with claim 1, wherein a context partition of an event is identified using at least a role identifier.

11. The system in accordance with claim 1, wherein a context partition of an event is identified using at least a namespace.

12. The system in accordance with claim 1, wherein a context partition of an event is identified using at least a network site identifier.

13. The system in accordance with claim 1, wherein a context partition of an event is identified using at least a time identifier.

14. The system in accordance with claim 1, wherein the act of applying monitoring rules to events received from the event sorting stage comprises:

an act of accessing an input event;

an act of determining whether the event has one or more characteristics;

if the event has the one or more characteristics, an act of using the input event to generate an output event; and

an act of taking action upon the output event.

15. The system in accordance with claim 14, wherein the act of taking action upon the output event comprises:

an act of saving the output event.

16. The system in accordance with claim 14, wherein the act of taking action upon the output event comprises:

an act of looping back the output event to an output context partition such that the output event is treated as an input event to an event processing system that corresponds to the output context partition.

17. The system in accordance with claim 16, wherein the output context partition of the output event is different than the context partition of the original input event.

18. The system in accordance with claim 14, wherein the act of taking action upon the output event comprises:

an act of transmitting the output event outside of the system.

19. A method for an event processing system to process an input event comprising:

an act of receiving an input event having a context partition identified therewith, the input event having been routed from a distributed application via an event sorting stage configured to direct events having the context partition to the event processing system; and

an act of applying a monitoring rule to the event by performing the following;

an act of generating an event based on the monitoring rule as applied to the input event; and

an act of determining whether the event has one or more characteristics;

if the event has the one or more characteristics, an act of using the input event to generate an output event; and

an act of performing at least one of the following acts upon the output event;

an act of saving the output event;

an act of looping back the output event to an output context partition such that the output event is treated as an input event to an event processing system that corresponds to the output context partition; and

an act of transmitting the output event outside of the system.

20. A computer program product comprising one or more computer-readable storage media having thereon computer-executable instructions that are structured such that, when executed by one or more processors of an event processing system, cause the event processing system to perform a method for processing an input event, the method comprising:

an act of receiving an input event having a context partition identified therewith, the input event having been routed from a distributed application via an event sorting stage configured to direct events having the context partition to the event processing system, wherein the context partition is determined based on at least one of a customer identifier, an application identifier, hosted service name, a role identifier, a namespace, a network site identifier, or a time identifier;

an act of applying a monitoring rule to the event by performing the following;

an act of determining whether the input event has one or more characteristics;

if the event has the one or more characteristics, an act of using the input event to generate an output event; and

an act of processing the output event.