Algorithm for prioritization of event datum in generic asynchronous telemetric streams
First Claim
Patent Images
1. A method for prioritizing event datum received from a plurality of asynchronous telemetric streams within a system, the method comprising:
- receiving an event from one of the streams;
determining whether a value of the event is less than a previously recorded minimum value for the stream, and if the value of the event is less than the previously recorded minimum value, updating the recorded minimum value to the value of the event;
determining whether the value of the event is greater than a previously recorded maximum value for the stream, and if the value of the event is greater than the previously recorded, updating the recorded maximum value to the value of the event;
generating a normalized event value based upon the value of the event, the recorded minimum value, and the recorded maximum value;
determining a system threat level as a percentage of the streams that exhibit an alarm state;
calculating a normalized rate of change of the stream;
calculating a first exponential average based upon the determined threat level and a threat level previously stored in a first table providing a correlation between system threat levels and normalized event values;
calculating a second exponential average based upon the determined threat level and a threat level previously stored in a second table providing a correlation between system threat levels and normalized stream rates of change; and
calculating a priority of the stream based upon a predetermined relationship between the first exponential average, the second exponential average, and an alarm status indicator associated with the stream.
6 Assignments
0 Petitions
Accused Products
Abstract
Systems, methods, and algorithms for prioritizing event datum received from a plurality of asynchronous telemetric streams. A historic learning algorithm is utilized to prioritize event datum based upon a current level of system health and historic correlations between event values and recorded levels of system health.
-
Citations
9 Claims
-
1. A method for prioritizing event datum received from a plurality of asynchronous telemetric streams within a system, the method comprising:
-
receiving an event from one of the streams; determining whether a value of the event is less than a previously recorded minimum value for the stream, and if the value of the event is less than the previously recorded minimum value, updating the recorded minimum value to the value of the event; determining whether the value of the event is greater than a previously recorded maximum value for the stream, and if the value of the event is greater than the previously recorded, updating the recorded maximum value to the value of the event; generating a normalized event value based upon the value of the event, the recorded minimum value, and the recorded maximum value;
determining a system threat level as a percentage of the streams that exhibit an alarm state;calculating a normalized rate of change of the stream; calculating a first exponential average based upon the determined threat level and a threat level previously stored in a first table providing a correlation between system threat levels and normalized event values; calculating a second exponential average based upon the determined threat level and a threat level previously stored in a second table providing a correlation between system threat levels and normalized stream rates of change; and calculating a priority of the stream based upon a predetermined relationship between the first exponential average, the second exponential average, and an alarm status indicator associated with the stream. - View Dependent Claims (2, 3)
-
-
4. A method for prioritizing event datum received from a plurality of streams within a system, the method comprising:
-
receiving an event value from a stream; generating a normalized event value based upon the received event value; calculating a normalized rate of change of the stream; determining a system threat level based upon a number of alarm status indications associated with the plurality of streams; calculating a first exponential average based upon the determined threat level and a threat level previously stored in a first table providing a correlation between system threat levels and normalized event values; calculating a second exponential average based upon the determined threat level and a threat level previously stored in a second table providing a correlation between system threat levels and normalized stream rates of change; and calculating a priority of the stream based upon a predetermined relationship between the first exponential average, the second exponential average, and an alarm status indicator associated with the stream.
-
-
5. A method for prioritizing event datum received from a plurality of streams within a system, the method comprising:
-
receiving an event from one of the streams;
determining a current state of system health;generating a current normalized event value and a current normalized stream rate of change value; and defining a priority for the stream based upon a predetermined relationship between the current state of system health, the current normalized event value, the current normalized stream rate of change value, previously stored normalized event values, previously stored stream rate of change values, and an alarm status indicator associated with the stream. - View Dependent Claims (6, 7)
-
-
8. A computer program product in computer readable medium for use in an event monitoring system, the computer program product comprising instructions that, when executed by a processor, cause the processor to:
-
get an event from a stream selected from a plurality of streams; determine a current normalized event value and a current normalized rate of change of event values for the stream; determine a level of current system health; evaluate a historic relationship between levels of system health, normalized event values for the stream, and normalized rates of change of event values for the stream; predict an effect upon system health that is likely to occur based upon the determined current normalized event value for the stream, the determined current normalized rate of change of event values for the stream, and the evaluated historic relationship; and
determine a priority for the event based upon the predicted effect.
-
-
9. An event prioritization system for using in monitoring a plurality of data streams generated by a communications network, the event prioritization system comprising:
-
a plurality of agent applications for monitoring selected parameters descriptive of a functionality of the communications network, each such agent generating an independent data stream and delivering the generated stream to a common nexus, and a processor associated with the common nexus, the processor being configured to execute a historic learning algorithm to assign priorities to event datum received from the data streams generated by the agents, wherein the processor executes a set of programming instructions for causing the processor to receive an event from one of the streams; determine whether a value of the event is less than a previously recorded minimum value for the stream, and if the value of the event is less than the previously recorded minimum value, update the recorded minimum value to the value of the event; determine whether the value of the event is greater than a previously recorded maximum value for the stream, and if the value of the event is greater than the previously recorded, update the recorded minimum value to the value of the event; generate a normalized event value based upon the value of the event, the recorded minimum value, and the recorded maximum value; determine a system threat level as a percentage of the streams that exhibit an alarm state; calculate a normalized rate of change of the stream; calculate a first exponential average based upon the determined threat level and a threat level previously stored in a first table providing a correlation between system threat levels and normalized event values; calculate a second exponential average based upon the determined threat level and a threat level previously stored in a second table providing a correlation between system threat levels and normalized stream rates of change; and calculate a priority of the stream based upon a predetermined relationship between the first exponential average, the second exponential average, and an alarm status indicator associated with the stream.
-
Specification