Reactive detection of conditions of interest in distributed systems

• US 6,629,139 B1
• Filed: 09/01/1999
• Issued: 09/30/2003
• Est. Priority Date: 09/01/1999
• Status: Expired due to Term

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Kennedy, Thomas A.
• Primary Examiner(s): Jean, Frantz B.
• Application Number:
  US09/388,397
• Time in Patent Office: 1,490 Days
• Field of Search: 709/224, 709/223, 707/1, 707/10, 340/500
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions

Abstract

A method for detecting conditions of interest in a distributed system. First, a condition of interest is formulated as a Boolean statement and stored at a condition detection component of the distributed system. The condition detection component then selectively receives events related to the condition of interest from a data collection component. Finally, the received events are combined and evaluated against the Boolean statement to determine if the condition is met. In one embodiment, the condition also includes a WITHIN element which filters out events received outside of a pre-specified time period.

Claims

1. A method for detecting conditions of interest in a distributed system, said method comprising the steps of:

formulating a condition of interest as a single Boolean statement;

storing said Boolean statement at a condition detection component of said distributed system;

attaching a WITHIN parameter to said Boolean statement wherein only an event which occurs within a time period specified by said WITHIN element may contribute to said condition;

selectively accepting events sent to said condition detection component from at least one data collection component; and

evaluating said accepted events against said Boolean statement to determine if said condition is met.

2. The method of claim 1, wherein said WITHIN parameter operates as a filter and said attaching step further includes the step of creating a WITHIN window specification, wherein said condition detection point utilizes said WITHIN window specification to filter out events based on a time of occurrence.

3. The method of claim 1, wherein said condition of interest in said formulating step is one, or a combination of more than one, event which is detected by said data collection component, wherein each of said one or said combination of more than one events may have a plurality of types and/or attributes and said formulating step further includes the step of:

formulating said condition of interest based on an occurrence of a special type and/or attribute of an event.

4. The method of claim 1, wherein said condition detection point has a logic component and a memory, and said storing step includes the step of:

parsing a file containing said conditions of interest as a Boolean statement to create a program code;

storing said program code in said memory; and

said accepting step utilizes said logic component to complete the steps of;

comparing all events accepted against a list of events or event types for said occurrence of said condition; and

accepting only an event or event type which matches one within said list.

5. The method of claim 4, wherein further said evaluating step includes the steps of:

storing each instance of an event which satisfies a WITHIN parameter in said memory location, wherein said WITHIN parameter provides a time period during which an event may contribute to the condition being monitored;

systematically substituting each event instance for a parameter in said Boolean statement; and

evaluating each combination from said substituting step to determine if said Boolean statement is satisfied.

6. The method of claim 5, wherein said storing step further includes the step of creating an operand list for each instance of a parameter in said Boolean statement, wherein each of said instance is stored in said operand list.

7. The method of claim 1, wherein said condition detection component is a remotely located data processing system.

8. The method of claim 1, wherein said condition of interest in said formulating step includes a failure within said distributed system.

9. The method of claim 1, wherein said distributed system is a heterogeneous system having more than one type of data collection component further comprising the step of:

parameterizing an event received from a data collection component into a standard event recognizable by said condition detection component.

10. The method of claim 9, wherein further:

said condition of interest in said formulating step includes an event attribute corresponding to a particular data collection component; and

said evaluating step includes the step of evaluating said condition of interest utilizing said event attribute.

11. A system for detecting conditions of interest in a distributed system, said system comprising:

means for formulating a condition of interest as a single Boolean statement;

means for storing said Boolean statement at a condition detection component of said distributed system, wherein;

said condition detection component has a logic component and a memory, and

said storing means includes means for parsing a file containing said conditions of interest as said Boolean statement to create a program code, and storing said program code in said memory;

means for selectively accepting events sent to said condition detection component from at least one data collection component; and

means for evaluating said accepted events against said Boolean statement to determine if said condition is met.

12. The system of claim 11, said formulating means further comprises means for attaching a WITHIN parameter to said Boolean statement wherein only an event which occurs within a time period specified by said WITHIN element may contribute to said condition.

13. The system of claim 12, wherein said WITHIN parameter operates as a filter and said attaching means further includes means for creating a WITHIN window specification, wherein said condition detection component utilizes said WITHIN window specification to filter out events based on a time of occurrence.

14. The system of claim 11, wherein said condition of interest in said formulating means is one or a combination of more than one events which are detected by said data collection component, wherein each of said one or said combination of more than one events may have a plurality of types and/or attributes and said formulating means further includes means for formulating said condition of interest based on an occurrence of a special type and/or attribute of an event.

15. The system of claim 11, wherein:

said accepting means utilizes said logic component to provide means for comparing all events accepted against a list of events or event types for said occurrence of said condition, and accepting only an event or event type which matches one within said list.

16. The system of claim 15, wherein further said evaluating means includes:

means for storing each instance of an event which satisfies a WITHIN parameter in said memory location, wherein said WITHIN parameter provides a time period during which an event may contribute to the condition being monitored;

means for systematically substituting each event instance for a parameter in said Boolean statement; and

means for evaluating each combination from said substituting means to determine if said Boolean statement is satisfied.

17. The system of claim 16, wherein said storing means further includes means for creating an operand list for each instance of a parameter in said Boolean statement, wherein each of said instance is stored in said operand list.

18. The system of claim 11, wherein said condition detection is a remotely located data processing system.

19. The system of claim 11, wherein said condition of interest in said formulating means includes a failure within said distributed system.

20. The system of claim 11, wherein said distributed system is a heterogeneous system having more than one type of data collection component, said system further comprising:

means for parameterizing an event received from a data collection component into a standard event recognizable by said condition detection component.

21. The system of claim 20, wherein further:

said condition of interest in said formulating means includes an event attribute corresponding to a particular data collection component; and

said evaluating means includes means for evaluating said condition of interest utilizing said event attribute.

22. A computer program product for detecting conditions of interest in a distributed system, said computer program product comprising:

a computer readable storage medium; and

program instructions on said computer readable storage medium for;

formulating a condition of interest as a single Boolean statement;

attaching a WITHIN parameter to said Boolean statement wherein only an event which occurs within a time period specified by said WITHIN element may contribute to said condition;

storing said Boolean statement at a condition detection component of said distributed system;

selectively accepting events sent to said condition detection component from at least one data collection component; and

evaluating said accepted events against said Boolean statement to determine if said condition is met.

23. The computer program product of claim 22, wherein said WITHIN parameter operates as a filter and said program instructions for said attaching step further includes program instructions for creating a WITHIN window specification, wherein said condition detection component utilizes said WITHIN window specification to filter out events based on a time of occurrence.

24. The computer program product of claim 22, wherein said condition of interest in said formulating step is one or a combination of more than one events which are detected by said data collection component, wherein each of said one or said combination of more than one events may have a plurality of types and/or attributes and said program instructions for said formulating step further includes program instructions for formulating said condition of interest based on an occurrence of a special type and/or attribute of an event.

25. The computer program product of claim 22, wherein said condition detection point has a logic component and a memory and wherein further:

said program instructions for said storing step includes program instructions for parsing a file containing said conditions of interest as a Boolean statement to create a program code, and storing said program code in said memory; and

said program instructions for said accepting step includes instructions for comparing all events accepted against a list of events or event types for said occurrence of said condition, and accepting only an event or event type which matches one within said list.

26. The computer program product of claim 25, wherein further said program instructions for said evaluating step includes:

program instructions for storing each instance of an event which satisfies a WITHIN parameter in said memory location, wherein said WITHIN parameter provides a time period during which an event may contribute to the condition being monitored;

program instructions for systematically substituting each event instance for a parameter in said Boolean statement; and

program instructions for evaluating each combination from said substituting step to determine if said Boolean statement is satisfied.

27. The computer program product of claim 26, wherein said program instructions for said storing step further includes program instructions for creating an operand list for each instance of a parameter in said Boolean statement, wherein each of said instance is stored in said operand list.

28. The computer program product of claim 22, wherein said condition detection component is a remotely located data processing system.

29. The computer program product of claim 22, wherein said condition of interest in said program instructions for said formulating includes a failure within said distributed system.

30. The computer program product of claim 22, wherein said distributed system is a heterogeneous system having more than one type of data collection component further comprising:

program instructions for parameterizing an event received from a data collection component into a standard event recognizable by said condition detection component.

31. The computer program product of claim 30, wherein further:

said condition of interest in said program instructions for said formulating a step includes an event attribute corresponding to a particular data collection component; and

said program instructions for said evaluating step includes;

program instructions for evaluating said condition of interest utilizing said event attribute.