Event supression method and system

• US 8,417,809 B1
• Filed: 12/25/2007
• Issued: 04/09/2013
• Est. Priority Date: 12/25/2007
• Status: Active Grant

• Current Assignee: NetApp, Inc.
• Original Assignee: NetApp, Inc.
• Inventors: Lancaster, Larry, Bag, Milan
• Primary Examiner(s): DONAGHUE, LARRY D
• Application Number:
  US11/964,034
• Time in Patent Office: 1,932 Days
• Field of Search: 709/224
• US Class Current: 709/224
• CPC Class Codes: G06F 11/0727 in a storage system, e.g. in a DASD or network based storage system drivers for digital recording or reproducing units G06F3/06; circuits for error detection or correction within digital recording or reproducing units G11B20/18; for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS], H04L67/1097
• CPC Class Codes: G06F 11/0781 Error filtering or prioritizing based on a policy defined by the user or on a policy defined by a hardware/software module, e.g. according to a severity level
• CPC Class Codes: H04L 41/0813 characterised by the conditions triggering a change of settings
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation

Abstract

A method and system for managing and dynamically suppressing event notification is provided. The method and system receives an indication of an event from a storage environment to be processed by a support system according to a set of default delivery parameters. Next, the method and system determines if one or more event specific delivery parameters have been associated with the event. If this is the case, then the method and system modifies the default delivery parameters for the information associated with the event according to the one or more event specific delivery parameters. These event specific delivery parameters are also used to determine when to transmit a notification of the event to the support system. The dynamic suppression of events combines events gathered into an event log together into a set of one or more recurring events. From these events, the method and system then identifies a high frequency subset as one or more recurring events considered to occur at a higher frequency compared with a low frequency subset having one or more recurring events that occur at a lower frequency. Based on this information gathered, the method and system then eliminates a portion of the events in the high frequency subset until the frequency of events in the high frequency subset approximates the frequency of events in the low frequency subset.

Claims

1. A method of gathering events associated with a storage environment comprising:

combining events gathered into an event log together into a set of the one or more recurring events associated with the storage environment;

identifying a high frequency subset as one or more recurring events considered to occur at a higher frequency compared with a low frequency subset having one or more recurring events that occur at a lower frequency; and

eliminating a portion of the events in the high frequency subset until the frequency of events in the low frequency subset approximates a predetermined proportion of the frequency of events in the high frequency subset.

2. The method of claim 1 further comprising:

receiving a target event log size value to limit the size of the event log used to gather event information on events occurring in association with operation of the storage environment; and

determining if the event log size has reached a predetermined fraction of the target event log size value thereby triggering an attempt to reduce the event log size.

3. The method of claim 1 wherein the portion of events in the higher frequency subset are eliminated until the average frequency of events in the higher frequency subset approximates the average frequency of events in the lower frequency subset.

4. The method of claim 1 wherein the portion of events in the higher frequency subset are eliminated until the frequency of events in the higher frequency subset approximates the frequency of events in the lower frequency subset.

5. The method of claim 1 wherein identifying a high frequency subset further comprises:

ranking the one or more recurring events in ascending order according to a frequency of their recurrence as derived from information in the event log; and

comparing pairs of recurring events in ascending order until a difference between a pair of adjacent recurring events exceeds a threshold differential value and indicates a separation between the high frequency subset of recurring events and the low frequency subset of recurring events.

6. An apparatus for gathering events associated with a storage environment, comprising:

a processor capable of executing instructions;

a memory containing instructions when executed on the processor combines events gathered into an event log together into a set of the one or more recurring events associated with the storage environment, identifies a high frequency subset as one or more recurring events considered to occur at a higher frequency compared with a low frequency subset having one or more recurring events that occur at a lower frequency and eliminates a portion of the events in the high frequency subset until the frequency of events in the low frequency subset approximates a predetermined proportion of the frequency of events in the high frequency subset.

7. The apparatus of claim 6 further comprising instructions when executed on the processor that receive a target event log size value to limit the size of the event log used to gather event information on events occurring in association with operation of the storage environment and determine if the event log size has reached a predetermined fraction of the target event log size value thereby triggering an attempt to reduce the event log size.

8. The apparatus of claim 6 wherein the portion of events in the higher frequency subset are eliminated until the average frequency of events in the higher frequency subset approximates the average frequency of events in the lower frequency subset.

9. The apparatus of claim 6 wherein the portion of events in the higher frequency subset are eliminated until the frequency of events in the higher frequency subset approximates the frequency of events in the lower frequency subset.

10. The apparatus of claim 6 wherein the instructions that identify a high frequency subset further comprises instructions when executed on the processor that rank the one or more recurring events in ascending order according to a frequency of their recurrence as derived from information in the event log and compare pairs of recurring events in ascending order until a difference between a pair of adjacent recurring events exceeds a threshold differential value and indicates a separation between the high frequency subset of recurring events and the low frequency subset of recurring events.

11. A method of managing entries in an event log in association with a storage environment, comprising:

combining events gathered into an event log together into a set of the one or more recurring events associated with the storage environment;

determining that the event log shall not exceed a predetermined target event log size in order to prevent the event log from becoming overly large;

performing a suppression of events in the event log when an aggregate number of events in the event log reaches a predetermined fraction of the target event log size, further comprising,

identifying a high frequency subset as one or more recurring events considered to occur at a higher frequency compared with a low frequency subset having one or more recurring events that occur at a lower frequency; and

eliminating a portion of the events in the high frequency subset until the frequency of events in the low frequency subset approximates a predetermined proportion of the frequency of events in the high frequency subset and wherein the aggregate number of events in the event log have been reduced.