Typicality filtering of event indicators for information technology resources
First Claim
1. A method suitable for filtering events in an information technology resource monitor, comprising the steps of:
- determining by a typicality filter a present count of occurrences of an event for a present monitoring period;
comparing by the typicality filter the present count with numbers of occurrences of the event in a plurality of earlier monitoring periods;
invoking by the typicality filter a first action if the present count exceeds a predetermined proportion of the numbers of occurrences of the event in the plurality of earlier monitoring periods; and
invoking by the typicality filter a second action if the present count does not exceed the predetermined proportion of the numbers of occurrences of the event in the plurality of earlier monitoring periods;
wherein the plurality of earlier monitoring periods all begin at the same times on consecutive days previous to the present monitoring period.
1 Assignment
0 Petitions
Accused Products
Abstract
A monitor for information technology resources improved by introducing typicality filters to analyze potential event indicators such as alerts. A typicality filter keeps a time-dependent history of the frequency of occurrence of an associated event, wherein time is segmented into monitoring periods. At the end of each monitoring period, a present count of occurrences of the event is determined, and compared with the numbers of occurrences of that event in a subset of monitoring periods read from the history. If the present count exceeds the number of occurrences of the event in a predetermined proportion of the subset of historical monitoring periods, a first action is invoked; otherwise, a second action is invoked.
-
Citations
3 Claims
-
1. A method suitable for filtering events in an information technology resource monitor, comprising the steps of:
-
determining by a typicality filter a present count of occurrences of an event for a present monitoring period; comparing by the typicality filter the present count with numbers of occurrences of the event in a plurality of earlier monitoring periods; invoking by the typicality filter a first action if the present count exceeds a predetermined proportion of the numbers of occurrences of the event in the plurality of earlier monitoring periods; and invoking by the typicality filter a second action if the present count does not exceed the predetermined proportion of the numbers of occurrences of the event in the plurality of earlier monitoring periods; wherein the plurality of earlier monitoring periods all begin at the same times on consecutive days previous to the present monitoring period. - View Dependent Claims (2, 3)
-
Specification