System and program product for throttling events in an information technology system

• US 7,657,627 B2
• Filed: 02/07/2008
• Issued: 02/02/2010
• Est. Priority Date: 06/19/2003
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Grabarnik, Genady, Perng, Chang-Shing, Thoenen, David H., Ma, Sheng
• Primary Examiner(s): EL CHANTI, HUSSEIN A
• Application Number:
  US12/027,369
• Publication Number:
  US 20080133750A1
• Time in Patent Office: 726 Days
• Field of Search: 709/207, 709/223, 709/224
• US Class Current: 709/224
• CPC Class Codes: H04L 41/064 involving time analysis
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/067 using time frame reporting
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 67/62 Establishing a time schedule for servicing the requests
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A system and program product for generating throttling parameters for an information management (IT) system based on historical event log data. An embodiment of the system comprises: an identification system that examines the historical event log data and identifies throttling candidates, wherein each throttling candidate comprises an event type for redundant events that reoccur over at least one measured time period; and an analysis system that statistically analyzes event data associated with each throttling candidate and generates a set of throttling parameters for each throttling candidate based on the event data.

Claims

1. A computerized system for generating throttling parameters for an information technology (IT) management system based on historical event log data, comprising:

an identification system examining events in the historical event log data, wherein an event comprises a message issued by an IT resource in accordance with a predefined protocol and identifies throttling candidates by comparing how often the event reoccurs and a measured time period analysis that measures how long of a time frame the event reoccurred with predefined identifier settings, wherein each throttling candidate comprises an event type for a series of redundant events that reoccur over at least one measured time period;

an analysis system implemented on at least one computer device for statistically analyzing event data associated with each throttling candidate and generating a set of throttling parameters for each throttling candidate based on the event data wherein the set of throttling parameters include a throttling window which determines a time frame during which the redundant events are discarded;

a throttling system detecting and recording occurrence of the event type and discarding future occurrences of the event type until the throttling window has expired; and

a system passing the set of throttling parameters to the IT management system for throttling of a set of new events, based on the set of throttling parameters.

2. The system of claim 1, wherein the throttling candidates are identified by examining the inter-arrival time of redundant events.

3. The system of claim 1, wherein the throttling candidates are identified by examining the at least one measured time period during which redundant events occurred.

4. The system of claim 1, wherein at least one throttling candidate comprises an event type that reoccurred over a plurality of different measured time periods.

5. The system of claim 1, wherein the event data associated with each throttling candidate includes:

the at least one measured time period during which redundant events reoccur; and

an inter-arrival time of the redundant events occurring during each at least one measured time period.

6. The system of claim 1, wherein the throttling parameters for each throttling candidate comprise an event type and a throttling window.

7. A computer program product stored on a computer-readable medium for generating throttling parameters for an information technology (IT) management system based on historical event log data, the program product, which when executed by a computer device performs the steps of:

examining the historical event log data, wherein an event comprises a message issued by an IT resource in accordance with a predefined protocol and identifies throttling candidates by comparing how often the event reoccurs and a measured time period analysis that measures how long of a time frame the event reoccurred with predefined identifier settings, wherein each throttling candidate comprises an event type for a series of redundant events that reoccur over at least one measured time period;

statistically analyzing event data associated with each throttling candidate and generating a set of throttling parameters for each throttling candidate based on the event data wherein the set of throttling parameters include a throttling window which determines a time frame during which the redundant events are discarded;

detecting and recording occurrence of the event type and discarding future occurrences of the event type until the throttling window has expired; and

passing the set of throttling parameters to the IT management system for throttling of a set of new events, based on the throttling parameters.

8. The program product of claim 7, wherein the throttling candidates are identified by examining the inter-arrival time of redundant events.

9. The program product of claim 7, wherein the throttling candidates are identified by examining the at least one measured time period during which redundant events reoccur.

10. The program product of claim 7, wherein at least one throttling candidate comprises a redundant event that reoccurs over a plurality of different measured time periods.

11. The program product of claim 7, wherein the event data associated with each throttling candidate includes:

the at least one measured time period during which a redundant event occurs, and

an inter-arrival time of the redundant events occurring during each at least one measured time period.

12. The program product of claim 7, wherein the throttling parameters for each throttling candidate comprise an event type and a throttling window.

13. An information technology (IT) management system, comprising:

a database for storing historical event log data;

an identification system that examines the historical event log data, wherein an event comprises a message issued by an IT resource in accordance with a predefined protocol and identifies throttling candidates based on how often the event reoccurs and a measured time period analysis that measures how long of a time frame the event reoccurred with predefined identifier settings, wherein each throttling candidate comprises an event type for a series of redundant events that reoccur over at least one measured time period;

an analysis system that statistically analyzes event data associated with each throttling candidate and generates a set of throttling parameters for each throttling candidate based on the event data wherein the set of throttling parameters include a throttling window which determines a time frame during which the redundant events are discarded;

a throttling system detecting and recording occurrence of the event type and discarding future occurrences of the event type until the throttling window has expired; and

a system passing the set of throttling parameters to the IT management system for throttling of a set of new events, based on the throttling parameters.

14. The IT management system of claim 13, wherein the throttling candidates are identified by examining the inter-arrival time of redundant events.

15. The IT management system of claim 13, wherein the throttling candidates are identified by examining a length of the at least one measured time period during which redundant events occur.

16. The IT management system of claim 13, wherein at least one throttling candidate comprises an event type that reoccurs over a plurality of different measured time periods.

17. The IT management system of claim 13, wherein the event data associated with each throttling candidate includes the at least one measured time period during which a redundant event occurs, and an inter-arrival time of the redundant events occurring during each at least one measured time period.

18. The IT management system of claim 13, wherein the throttling parameters for each throttling candidate comprise an event type and a throttling window.

19. The IT management system of claim 13, wherein identification system includes identifier settings that control selection of throttling candidates.