Entity event logging

• US 7,043,566 B1
• Filed: 10/11/2000
• Issued: 05/09/2006
• Est. Priority Date: 10/11/2000
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Grant, Justin, Thomas, Michael W., Sutton, Alexander M., Murstein, Michael S.
• Primary Examiner(s): Jean, Frantz B.
• Application Number:
  US09/686,426
• Time in Patent Office: 2,036 Days
• Field of Search: 709/223, 709/224, 709/323, 709/324, 719/318, 714/4, 714/47, 714/48, 702/188
• US Class Current: 719/323
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

A system and method for monitoring events of a plurality of members configured as an entity. Configurable event logging settings can be defined at a first member and dynamically propagated to each member of the entity to establish event logging configuration settings at each of the plurality of members. In one aspect of the invention, a system and method log different event types in accordance with configuration settings into a common event type data format at a plurality of members. The different event types can then be coalesced for the entire entity and returned to a requestor residing at a single location. Additionally, a unique identifier can be assigned to assist in monitoring of events. Also, to assist in monitoring, data that is common to all event types can be stored in a separate table from data specific to an event type.

Claims

1. A system for monitoring events of a plurality of members configured as an entity, comprising:

at least one member of the entity having configurable event logging settings for determining at least one of event types to be monitored; and

each of the plurality of members of the entity having member specific configuration settings wherein selection of event types in the at least one member is propagated to the member specific configuration settings of each of the plurality of members, and changes to the configurable event logging settings at the at least one member are dynamically updated at the member specific configuration settings of the plurality of remaining members.

2. The system of claim 1, the at least one of the plurality of members has an event monitor system operable to log event data information based on the member specific configuration settings.

3. The system of claim 2, the event monitor system comprising an event consumer component operable to determine settings in the member specific configuration settings and log at least one of an event source, an event type and an event severity type based on the settings.

4. The system of claim 3, the event consumer component being notified of changes in the member specific configuration settings and being operable to access these changes through an event source.

5. The system of claim 2, the event monitor system further comprising an event mapping component adapted to map different event types into a common data format for logging in a data store.

6. The system of claim 1, the at least one member having configurable event logging settings for determining event severity types to be monitored.

7. The system of claim 1, each event is assigned a unique event identification number, a member identification number and an event time when being logged in a data store.

8. The system of claim 7, the event data common to all event types is logged in a first table and event data specific to the event instance is logged in a second table.

9. A system for monitoring events on a member, comprising:

an event monitor system adapted to receive different event types from an event source and log the different event types into a data store, the event data common to event types is logged in a first table and event data unique to an event type instance being logged is logged in a second table,

the event monitor system filter comprising an event mapping component adapted to map data fields of the different event types into common data fields such that the different event types conform to a common event type schema in the data store.

10. The system of claim 9, the event monitor system further comprising an event consumer component operable to determine settings in a member specific configuration settings and log at least one of an event source, an event type and an event severity type based on the settings.

11. The system of claim 9, each event is assigned a unique event identification number, a member identification number and an event time when being logged in the data store.

12. The system of claim 9, the event types comprising at least one of operating system events, entity events and health monitor events.

13. The system of claim 9, the event monitor system being operable log event common data and event data specific to the instance of the event upon receipt of a new event and logging only event data specific to the instance of the event upon receipt of a reoccurrence of an event.

14. A system for monitoring events of a plurality of members configured as an entity, each member comprising:

all event monitor system adapted to receive different event types from an event source and log the different event types into a data store, the event data common to event types is logged in a first table and event data unique to an event type instance being logged is logged in a second table,

the event monitor system further comprising an event mapping component adapted to map data fields of the different event types into common data fields such that the different event types conform to a common event type schema in the data store.

15. A method for monitoring events of a plurality of members configured as an entity, comprising:

setting configurable event logging settings at any of the plurality of members for determining one of event types to be monitored and event types not to be monitored;

dynamically propagating the selection of event logging settings to the plurality of members of the entity to establish event logging configuration settings at the plurality of members; and

dynamically updating the logging of event types at each of the plurality of members based on any changes in event logging settings at any of the plurality of members.

16. The method of claim 15, the act of setting configurable event logging settings at any of the plurality of members further comprising setting configurable event logging settings for determining an event severity type to be logged.

17. A method for monitoring events of a plurality of members configured as an entity, comprising:

receiving different event types having different data fields from an event source;

mapping the data fields of different event types to common data fields such that each event type conforms to a common schema;

logging the mapped event types to a data store; and

logging the event data common to event types in a first table and event data unique to an event type in a second table.

18. A system for monitoring events of a plurality of members configured as an entity, comprising:

means for configuring event log settings at a first member of the entity for determining event types to be monitored;

means for propagating the selection of event log settings to the plurality of members of the entity to establish event log configuration settings at the plurality of members; and

means for dynamically updating the logging of event types at each of the plurality of members based on any changes in the event log settings at the first member.

19. The system of claim 18, further comprising means for logging different event types into a common format at each of the plurality of members.

20. A system for monitoring events of a plurality of members configured as an entity, comprising:

means for receiving different event types having different data fields from an event source;

means for logging event data common to event types in a first table and event data unique to an event type instance being logged in a second table,

means for mapping the data fields of different event types to common data fields such that each event type conforms to a common schema; and

means for logging the mapped event type to a data store.

21. The system of claim 20, further comprising means for merging event data specific to an event occurrence into event data common to the event.