System and method for throttling events in an information technology system

• US 7,392,311 B2
• Filed: 06/19/2003
• Issued: 06/24/2008
• Est. Priority Date: 06/19/2003
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Grabarnik, Genady, Thoenen, David H., Ma, Sheng, Perng, Chang-Shing
• Primary Examiner(s): Etienne; Ario
• Assistant Examiner(s): EL CHANTI, HUSSEIN A
• Application Number:
  US10/464,997
• Publication Number:
  US 20040260804A1
• Time in Patent Office: 1,832 Days
• Field of Search: 709/207, 709/223, 709/224
• US Class Current: 709/224
• CPC Class Codes: H04L 41/064 involving time analysis
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/067 using time frame reporting
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 67/62 Establishing a time schedule for servicing the requests
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A system and method for generating throttling parameters for an information management (IT) system based on historical event log data. The system comprises: an identification system that examines the historical event log data and identifies throttling candidates, wherein each throttling candidate comprises an event type for redundant events that reoccur over at least one measured time period; and an analysis system that statistically analyzes event data associated with each throttling candidate and generates a set of throttling parameters for each throttling candidate based on the event data.

Claims

1. A computerized method for generating throttling parameters for an information technology (IT) management system based on historical event log data, the computerized method comprising the steps of:

examining the historical event log data, wherein an event comprises a message issued by an IT resource in accordance with a predefined protocol and identifying throttling candidates by comparing how often the event reoccurs and a measured time period analysis that measures how long of a time frame the event reoccurred with predefined identifier settings, wherein each throttling candidate comprises an event type for redundant events that reoccur over at least one measured time period;

statistically analyzing event data associated with each throttling candidate and generating a set of throttling parameters for each throttling candidate based on the event data wherein the set of throttling parameters include a throttling window which determines a time frame during which the redundant events are discarded;

detecting and recording occurrence of the event type and discarding future occurrences of the event type until the throttling window has expired; and

passing the set of throttling parameters to the IT management system for throttling of a set of new events, based on the throttling parameters.

2. The method of claim 1, wherein the step of identifying throttling candidates includes examining the inter-arrival time of redundant events.

3. The method of claim 1, wherein the step of identifying throttling candidates includes examining the at least one measured time period during which redundant events occur.

4. The method of claim 1, wherein at least one throttling candidate comprises an event type that reoccurs over a plurality of different measured time periods.

5. The method of claim 1, wherein the event data associated with each throttling candidate includes the at least one measured time period during which a redundant event occurs, and an inter-arrival time of the redundant events occurring during each at least one measured time period.

6. The method of claim 1, wherein the throttling parameters for each throttling candidate comprise an event type and a throttling window.

7. The method of claim 1, comprising the further step of inputting the throttling parameters into the IT management system.

8. The method of claim 7, comprising the further step of throttling events detected by the IT management system based on the inputted throttling parameters.