Sliding window for alert generation

• US 7,257,515 B2
• Filed: 03/03/2004
• Issued: 08/14/2007
• Est. Priority Date: 03/03/2004
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Haeuptle, Michael
• Primary Examiner(s): Hoff; Marc S.
• Assistant Examiner(s): SUGLO, JANET L
• Application Number:
  US10/792,557
• Publication Number:
  US 20050197792A1
• Time in Patent Office: 1,259 Days
• Field of Search: 702 82- 84, 702/122, 702113-115, 702/177, 702/179, 702182-188, 340/511, 340/525, 340/691.1, 340/691.6, 340/7.58, 340/7.59, 700/12, 700/17, 700/83
• US Class Current: 702/185
• CPC Class Codes: G05B 23/0235 based on a comparison with predetermined threshold or range, e.g. "classical methods", carried out during normal operation; threshold adaptation or choice; when or how to compare with the threshold

Abstract

A method for generating alerts from a periodically sampled system is disclosed. The method includes maintaining a sampling window having a predefined number of most-recently collected samples. The method further includes calculating an alert value, the alert value representing a ratio of a first value to a total number of samples in the sampling window, the first value representing a total number of samples in the sampling window having parameters exceeding a predefined sample alert threshold. The method additionally includes generating a first alert if the alert value exceeds a predefined alert threshold.

Claims

1. A method for generating alerts from a periodically sampled system, comprising:

maintaining a sampling window having a predefined number of most-recently collected samples;

calculating an alert value, said alert value representing a ratio of a first value to a total number of samples in said sampling window, said first value representing a total number of samples in said sampling window having parameters exceeding a predefined sample alert threshold; and

generating a first alert if said alert value exceeds a predefined alert threshold, wherein said first alert is generated for a sampling period that results in said alert value exceeding said predefined alert threshold only if an alert is not generated in an immediately preceding sampling period.

2. The method of claim 1 wherein said first value further includes a total number of samples in said sampling window having parameters that are equal to said predefined sample alert threshold.

3. The method of claim 1 wherein said maintaining said sampling window includes adding a most-recently collected sample to said sampling window after said most-recently collected sample is obtained and removing an oldest sample from said sampling window responsive to one of said adding said most-recently collected sample and anticipating adding said most-recently collected sample.

4. The method of claim 1 further including generating a second alert if a first condition and a second condition are met, said first condition being characterized by a generation of said first alert in a first sampling period, said second condition being characterized by an alert value X calculated with a sample obtained in a second sampling period taken into account, said second sampling period being immediately succeeding said first sampling period, said alert value X being lower than said predefined alert threshold.

5. The method of claim 1 wherein said first alert reflects a most severe violation encountered among samples of said sampling window.

6. The method of claim 1 wherein said predefined sample alert threshold comprises a plurality of threshold values.

7. The method of claim 6 further including generating a second alert if a first condition and a second condition are met, said first condition being characterized by a generation of said first alert in a first sampling period, said second condition being characterized by an alert value X calculated with a sample obtained in a second sampling period taken into account, said second sampling period being immediately succeeding said first sampling period, said alert value X being higher than said predefined alert threshold and associated with a second threshold value of said plurality of threshold values, said second threshold value being different from a first threshold value of said plurality of threshold values that is associated with said first alert.

8. The method of claim 7 wherein said second alert is generated only if said second threshold value reflects a higher level of severity than a level of severity associated with said first threshold value.

9. An article of manufacture comprising a program storage medium having computer readable code embodied therein, said computer readable code being configured to generate alerts from a periodically sampled system, comprising:

computer readable code for maintaining a sampling window having a predefined number of most-recently collected samples;

computer readable code for calculating an alert value, said alert value representing a ratio of a first value to a total number of samples in said sampling window, said first value representing a total number of samples in said sampling window having parameters exceeding a predefined sample alert threshold; and

computer readable code for generating a first alert if said alert value exceeds a predefined alert threshold, wherein said first alert is generated for a sampling period that results in said alert value exceeding said predefined alert threshold only if an alert is not generated in an immediately preceding sampling period.

10. The article of manufacture of claim 9 wherein said first value further includes a total number of samples in said sampling window having parameters that are equal to said predefined sample alert threshold.

11. The article of manufacture of claim 9 wherein said computer readable code for maintaining said sampling window includes computer readable code for adding a most-recently collected sample to said sampling window after said most-recently collected sample is obtained and computer readable code for removing an oldest sample from said sampling window responsive to one of said adding said most-recently collected sample and anticipating adding said most-recently collected sample.

12. The article of manufacture of claim 9 further including computer readable code for enabling generating a second alert if a first condition and a second condition are met, said first condition being characterized by a generation of said first alert in a first sampling period, said second condition being characterized by an alert value X calculated with a sample obtained in a second sampling period taken into account, said second sampling period being immediately succeeding said first sampling period, said alert value X being lower than said predefined alert threshold.

13. The article of manufacture of claim 9 wherein said first alert reflects a most severe violation encountered among samples of said sampling window.

14. The article of manufacture of claim 9 wherein said predefined sample alert threshold comprises a plurality of threshold values.

15. The article of manufacture of claim 14 further including computer readable code for enabling generating a second alert if a first condition and a second condition are met, said first condition being characterized by a generation of said first alert in a first sampling period, said second condition being characterized by an alert value X calculated with a sample obtained in a second sampling period taken into account, said second sampling period being immediately succeeding said first sampling period, said alert value X being higher than said predefined alert threshold and associated with a second threshold value of said plurality of threshold values, said second threshold value being different from a first threshold value of said plurality of threshold values that is associated with said first alert.

16. The article of manufacture of claim 15 wherein said second alert is generated only if said second threshold value reflects a higher level of severity than a level of severity associated with said first threshold value.

17. A method for fine-tuning an alert signal obtained from a periodically sampled system, comprising:

providing an alert signal generator, said alert signal generator having

first logic for maintaining a sampling window at a constant window size, said sampling window containing most-recently collected samples,

second logic for calculating an alert value, said alert value representing a ratio of a first value to a total number of samples in said sampling window, said first value representing a total number of samples in said sampling window having parameters exceeding a sample alert threshold, and

third logic for generating a first alert if said alert value exceeds an alert threshold, wherein said first alert is generated for a sampling period that results in said alert value exceeding said alert threshold only if an alert is not generated in an immediately preceding sampling period; and

providing a control panel having a plurality of user-manipulable controls, said plurality of user-manipulable controls including at least one of a first control for varying said window size, a second control for varying said sample alert threshold, and a third control for varying said alert threshold.

18. The method of claim 17 wherein said first alert reflects a most severe violation encountered among samples of said sampling window.

19. The method of claim 17 wherein said periodically sampled system represents an internet service monitoring system.