Using query language for event filtering and aggregation

• US 6,367,034 B1
• Filed: 09/21/1998
• Issued: 04/02/2002
• Est. Priority Date: 09/21/1998
• Status: Expired due to Term

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Novik, Lev, Hudis, Irena, McCollum, Raymond
• Primary Examiner(s): Beausoleil, Robert
• Assistant Examiner(s): CHUNG TRANS, XUONG MY
• Application Number:
  US09/158,171
• Time in Patent Office: 1,289 Days
• Field of Search: 714/39, 714/48, 714/57, 707/103, 707/3, 707/6, 709/318, 709/321
• US Class Current: 714/39
• CPC Class Codes: G06F 16/24568 Data stream processing; Continuous queries
• CPC Class Codes: Y10S 707/99933 Query processing, i.e. searching

Abstract

Systems and methods for reporting the occurrence of events in a computer system to event subscriber software. A computer system includes an event-filtering component that receives notification of the occurrence of events, filters the events, and reports selected events to the subscriber software. The event-filtering component can expose standardized interfaces to the event providers that report events and to the subscriber software to which events are reported. Filtering can be facilitated by event-filtering definitions written in a query language and associated with the subscriber software. The definitions are processed in the context of an object-oriented, hierarchical classification of event classes that comprehend any possible events that can be reported by the event providers. When reported events satisfy one or more query-based filtering definitions, the events are passed to the appropriate subscriber software. Otherwise, the events are discarded. Events can be filtered and grouped according to the time of their occurrence. Filtering can be further simplified by registering event-reporting definitions defining the scope of events to be reported by particular event providers.

Claims

1. In a computer system including an event provider for reporting to an event-filtering component of the computer system the occurrence of events in the computer system or in the environment of the computer system, a method for selecting a subset of the events to be reported by the event-filtering component to an event subscriber associated with the computer system, the method comprising the steps of:

storing, in a computer-readable medium accessible by the computer system, a hierarchical classification of event classes that comprehend a set of possible events, wherein each of the possible events belongs to at least one of the event classes;

providing to the event-filtering component an event-reporting definition written in a query language and specifying a first subset of the set of the possible events, wherein the event-reporting definition is associated with the event provider and specifies that events to be reported by the event provider to the event-filtering component will belong to the first subset;

providing to the event-filtering component an event-filtering definition written in the query language and specifying a second subset of the set of possible events comprehended by event classes, wherein the event-filtering definition is associated with the event subscriber and specifies that events belonging to the second subset are to be reported by the event-filtering component to the event subscriber;

by the event provider, reporting to the event-filtering component the occurrence of events in the computer system or in the environment of the computer system that have been detected by an event-detection component; and

by the event-filtering component, using the event-filtering definition to report to the event subscriber the occurrence of only those of the events that belong to both the first subset and the second subset.

2. A method as defined in claim 1, wherein the occurrence of events in the computer system is detected using more than one event-detection component.

3. A method as defined in claim 2, wherein the step of reporting, to the event-filtering component, the occurrence of events comprises the step of sending notifications, by each of the more than one event-detection components, of the occurrence of the events to the event-filtering component via a standard interface associated with the event-filtering component.

4. A method as defined in claim 1, wherein the event-filtering definition includes a where clause, such that events not having a value of a parameter that satisfies the where clause do not belong to the second subset of the set of possible events.

5. A method as defined in claim 1, further comprising the step of detecting the occurrence of events by periodically polling the event-detection component.

6. A method as defined in claim 1, further comprising, prior to the step of reporting, to the event-filtering component, the occurrence of events, the step of activating the event-detection component in response to a determination that the event-detection component is configured to report the occurrence of events that belong to the second subset of the set of possible events.

7. A method as defined in claim 1, wherein:

the step of reporting, to the event-filtering component, the occurrence of events is conducted during a period of time equal to a time interval specified by the event-filtering definition; and

the step of using the event-filtering component to report to the event subscriber comprises the step of transmitting to the event subscriber a summary of a group of events that includes only the events that have been detected during the period of time and belong to the subset of the second set of possible events.

8. A method as defined in claim 1, wherein the event-filtering definition further specifies a maximum reporting latency that is to be allowed to elapse between the occurrence of an event belonging to the second subset and the event-filtering definition reporting to the event subscriber event subscriber of the occurrence, and wherein the method further comprises the steps of:

determining that the computer system does not execute an event provider computer program for automatically reporting each occurrence of the event belonging to the second subset; and

periodically, at time intervals no greater than the maximum reporting latency, polling the event-detection component to determine whether the event belonging to the second subset has occurred.

9. A method as defined in claim 1, wherein the hierarchical classification of event classes defines at least a first event class and a second event class in a parent/child relationship.

10. A method as defined in claim 1, wherein:

the first subset is subsumed by the second subset, such that any event reported by the event provider necessarily belongs to both the first subset and the second subset; and

the step of using the event-filtering definition to report to the event subscriber the occurrence of only the events that belong to both the first subset and the second subset is conducted without the event filtering component analyzing parameters or an event class of the events reported by the event provider.

11. A method as defined in claim 1, wherein the computer system further includes a second event provider, the method further comprising the step of providing to the event-filtering component another event-reporting definition written in the query language and specifying another subset of the set of the possible events, wherein said other event-reporting definition is associated with said other event provider and specifies that events to be reported by said other event provider to the event-filtering component will belong to the third subset.

12. A method as defined in claim 11, further comprising the steps of:

by said other event provider, reporting to the event-filtering component the occurrence of other events in the computer system or in the environment of the computer system

by the event-filtering component, using the event-filtering definition to report to the event subscriber the occurrence of only those of said other events that belong to both the second subset and the third subset.

13. A method as defined in claim 11, wherein the second subset and the third subset do not intersect, such that necessarily none of said events that could be reported by said other event provider would belong to both the second subset and the third subset, and wherein said other event provider is accordingly not activated.

14. In a computer system including an event-detection component for detecting events in the computer system or in the environment of the computer system, a method for selecting a subset of the events to be reported by an event-filtering component of the computer system to an event subscriber associated with the computer system, the method comprising the steps of:

storing, in a computer-readable medium accessible by the computer system, a hierarchical classification of event classes that comprehend a set of possible events, wherein each of the possible events belongs to at least one of the event classes and wherein the hierarchical classification defines at least a first event class and a second event class in a parent/child relationship;

providing to the event-filtering component an event-filtering definition written in a query language and specifying a subset of the set of possible events comprehended by event classes, the event-filtering definition further specifying a time interval, wherein the event-filtering definition is associated with the event subscriber and specifies that events that belong to the subset and are detected during the time interval are to be reported by the event-filtering component to the event subscriber;

detecting the occurrence of events in the computer system or in the environment of the computer system using the event-detection component during a period of time equal to the time interval;

generating by the event-filtering component a summary of a group of events that includes only the events whose occurrence has been detected during the period of time and that belong to the subset of the set of possible events; and

reporting the summary to the event subscriber.

15. A method as defined in claim 14, wherein the step of generating a summary comprises the step of including in the summary the number of occurrences of the events that belong to the subset.

16. A method as defined in claim 14, wherein the step of generating a summary comprises the step of including in the summary a representative example of the events that belong to the subset.

17. A method as defined in claim 14, wherein the step of generating a summary comprises grouping the events according to the value of a parameter associated with the events, the value being defined in the event-filtering definition.

18. In a computer system including an event-detection component for detecting events in the computer system or in the environment of the computer system, a method for selecting a subset of the events to be reported by an event-filtering component of the computer system to an event subscriber associated with the computer system, the method comprising the steps of:

storing, in a computer-readable medium accessible by the computer system, a hierarchical classification of event classes that comprehend a set of possible events, wherein each of the possible events belongs to at least one of the event classes;

providing to the computer system a first event-filtering definition written in a query language and specifying a subset of the set of possible events comprehended by event classes, the first event-filtering definition further specifying a first maximum reporting latency that is to be allowed to elapse between the occurrence of an event belonging to the subset and the event subscriber being notified of the occurrence;

determining that the computer system does not execute an event provider computer program for automatically reporting each occurrence of the event belonging to the subset; and

periodically, at time intervals no greater than the first maximum reporting latency, determining whether the event belonging to the subset has occurred by polling the event-detection component.

19. A method as defined in claim 18, further comprising, whenever the event belonging to the subset has occurred, the step of reporting, to the event subscriber, the occurrence of the event belonging to the subset within a period of time after the occurrence no greater than the first maximum reporting latency.

20. A method as defined in claim 18, further comprising the steps of:

providing to the computer system a second event-filtering definition associated with a second event subscriber and specifying a second maximum reporting latency that is to be allowed to elapse between the occurrence of the event belonging to the subset and the second event subscriber being notified of the occurrence; and

determining which of the first event-filtering definition and the second event-filtering definition specifies a smaller maximum reporting latency;

wherein the step of periodically determining whether the event belonging to the subset has occurred is conducted at time intervals no greater than the smaller maximum reporting latency.

21. A method as defined in claim 18, wherein the subset of the set of possible events includes events associated with installation of hardware components or software components to the computer system.

22. A method as defined in claim 18, wherein the subset of the set of possible events includes events associated with deinstallation of hardware components or software components to the computer system.

23. A method as defined in claim 18, wherein the subset of the set of possible events includes events associated with modification of hardware components or software components to the computer system.

24. A computer system for reporting the occurrence of events in the computer system or in the environment of the computer system to an event subscriber, the system comprising:

an event-detection component capable of detecting events in the computer system or in the environment of the computer system and generating notifications of the occurrence of the events;

an event subscriber capable of receiving reports of the occurrence of at least some of the events;

a computer-readable medium accessible by the computer system having stored therein a hierarchical classification of event classes that comprehend a set of possible events, wherein each of the possible events belongs to at least one of the event classes and wherein the hierarchical classification defines at least a first event class and a second event class in a parent/child relationship;

an event-filtering module providing an interface to the event-detection component and being capable of identifying which of the events are to be reported to the event subscriber, the event-filtering module including;

means for receiving an event-filtering definition written in a query language and specifying a subset of the set of possible events comprehended by event classes, wherein the event-filtering definition is associated with the event subscriber and specifies that events belong to the subset are to be reported by the event-filtering component to the event subscriber;

means for receiving notification of the occurrence of events detected by the event-detection component; and

means for using the event-filtering definition to report to the event subscriber the occurrence of only those of the events that belong to both the first subset and the second subset.