Administering incident pools for event and alert analysis

• US 8,639,980 B2
• Filed: 01/15/2013
• Issued: 01/28/2014
• Est. Priority Date: 05/26/2011
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Atkins, Mark G., Carey, James E., Sanders, Philip J.
• Primary Examiner(s): LE, DIEU MINH T
• Application Number:
  US13/742,325
• Publication Number:
  US 20130132460A1
• Time in Patent Office: 378 Days
• Field of Search: 714/27, 714/25, 714/37, 714/39, 714/48, 714/57, 718/100, 709/223, 709/224, 719/318
• US Class Current: 714/27
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0748 in a remote unit communicating with a single-box computer node experiencing an error/fault remote testing G06F11/2294
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/0781 Error filtering or prioritizing based on a policy defined by the user or on a policy defined by a hardware/software module, e.g. according to a severity level
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3072 where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
• CPC Class Codes: H04L 41/0622 based on time

Abstract

Administering incident pools including receiving, by an incident analyzer from an incident queue, a plurality of incidents from one or more components of the distributed processing system; assigning, by the incident analyzer, each received incident to a pool of incidents; assigning, by the incident analyzer, to each incident a particular combined minimum time for inclusion in one or more pools, each particular combined minimum time corresponding to a particular incident; in response to the pool closing, determining, by the incident analyzer, for each incident in the pool whether the incident has met its combined minimum time for inclusion in one or more pools; and if the incident has been in the pool for its combined minimum time, including, by the incident analyzer, the incident in the closed pool; and if the incident has not been in the pool for its combined minimum time, including the incident in a next pool.

Claims

1. A method of administering incident pools for event and alert analysis in a distributed processing system, the method comprising:

receiving, by an incident analyzer from an incident queue, a plurality of incidents from one or more components of the distributed processing system;

assigning, by the incident analyzer, each received incident to a pool of incidents;

assigning, by the incident analyzer, to each incident a particular combined minimum time for inclusion in one or more pools, each particular combined minimum time corresponding to a particular incident;

in response to the pool closing, determining, by the incident analyzer, for each incident in the pool whether the incident has met its combined minimum time for inclusion in one or more pools; and

if the incident has been in the pool for its combined minimum time, including, by the incident analyzer, the incident in the closed pool; and

if the incident has not been in the pool for its combined minimum time, including the incident in a next pool.

2. The method of claim 1 wherein including the incident in the next pool includes forwarding to the next pool, by the incident analyzer, any associations between the incident and any other incidents that are included in the pool.

3. The method of claim 1 further comprising retaining in the next pool, by the incident analyzer, a suppression state of an incident included in the next pool.

4. The method of claim 1 further comprising removing, by the incident analyzer, the incident included in the next pool from consideration of determination of a next pool start time and closure of the next pool.

5. The method of claim 1 further comprising:

preventing in the next pool, by the incident analyzer, creation of an alert based solely on the incident included in the next pool; and

based solely on the incident included in the next pool, determining, by the incident analyzer, to suppress in the next pool, the incident included in the next pool.

6. The method of claim 1 wherein the incidents comprise events and the pool of incidents comprise an events pool.

7. The method of claim 1 wherein the incidents comprise alerts and the pool of incidents comprise an alerts pool.