Administering incident pools for event and alert analysis

• US 8,645,757 B2
• Filed: 05/26/2011
• Issued: 02/04/2014
• Est. Priority Date: 05/26/2011
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Atkins, Mark G., Carey, James E., Sanders, Philip J.
• Primary Examiner(s): LE, DIEU MINH T
• Application Number:
  US13/116,382
• Publication Number:
  US 20120304012A1
• Time in Patent Office: 985 Days
• Field of Search: 714/27, 714/48, 714/57, 714/37, 714/39, 714/25, 718/100, 709/223, 709/224, 719/318, 719/319
• US Class Current: 714/27
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0748 in a remote unit communicating with a single-box computer node experiencing an error/fault remote testing G06F11/2294
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/0781 Error filtering or prioritizing based on a policy defined by the user or on a policy defined by a hardware/software module, e.g. according to a severity level
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3072 where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
• CPC Class Codes: H04L 41/0622 based on time

Abstract

Administering incident pools including receiving, by an incident analyzer from an incident queue, a plurality of incidents from one or more components of the distributed processing system; assigning, by the incident analyzer, each received incident to a pool of incidents; assigning, by the incident analyzer, to each incident a particular combined minimum time for inclusion in one or more pools, each particular combined minimum time corresponding to a particular incident; in response to the pool closing, determining, by the incident analyzer, for each incident in the pool whether the incident has met its combined minimum time for inclusion in one or more pools; and if the incident has been in the pool for its combined minimum time, including, by the incident analyzer, the incident in the closed pool; and if the incident has not been in the pool for its combined minimum time, including the incident in a next pool.

Claims

1. A system for administering incident pools for event and alert analysis in a distributed processing system, the system comprising a computer processor, a computer memory operatively coupled to the computer processor, the computer memory having disposed within it computer program instructions capable, when executed by the computer processor, of causing the system to carry out the steps of:

receiving, by an incident analyzer from an incident queue, a plurality of incidents from one or more components of the distributed processing system;

assigning, by the incident analyzer, each received incident to a pool of incidents;

assigning, by the incident analyzer, to each incident a particular combined minimum time for inclusion in one or more pools, each particular combined minimum time corresponding to a particular incident;

in response to the pool closing, determining, by the incident analyzer, for each incident in the pool whether the incident has met its combined minimum time for inclusion in one or more pools; and

if the incident has been in the pool for its combined minimum time, including, by the incident analyzer, the incident in the closed pool; and

if the incident has not been in the pool for its combined minimum time, including the incident in a next pool.

2. The system of claim 1 wherein including the incident in the next pool includes forwarding to the next pool, by the incident analyzer, any associations between the incident and any other incidents that are included in the pool.

3. The system of claim 1 further comprising computer program instructions capable, when executed by the computer processor, of causing the system to carry out the steps of retaining in the next pool, by the incident analyzer, a suppression state of an incident included in the next pool.

4. The system of claim 1 further comprising computer program instructions capable, when executed by the computer processor, of causing the system to carry out the steps of removing, by the incident analyzer, the incident included in the next pool from consideration of determination of a next pool start time and closure of the next pool.

5. The system of claim 1 further comprising computer program instructions capable, when executed by the computer processor, of causing the system to carry out the steps of:

preventing in the next pool, by the incident analyzer, creation of an alert based solely on the incident included in the next pool; and

based solely on the incident included in the next pool, determining, by the incident analyzer, to suppress in the next pool, the incident included in the next pool.

6. The system of claim 1 wherein the incidents comprise events and the pool of incidents comprise an events pool.

7. The system of claim 1 wherein the incidents comprise alerts and the pool of incidents comprise an alerts pool.

8. A computer program product for administering incident pools for event and alert analysis in a distributed processing system, the computer program product disposed upon a computer readable storage medium, wherein the computer readable storage medium is not a signal, the computer program product comprising computer program instructions for:

receiving, by an incident analyzer from an incident queue, a plurality of incidents from one or more components of the distributed processing system;

assigning, by the incident analyzer, each received incident to a pool of incidents;

assigning, by the incident analyzer, to each incident a particular combined minimum time for inclusion in one or more pools, each particular combined minimum time corresponding to a particular incident;

in response to the pool closing, determining, by the incident analyzer, for each incident in the pool whether the incident has met its combined minimum time for inclusion in one or more pools; and

if the incident has been in the pool for its combined minimum time, including, by the incident analyzer, the incident in the closed pool; and

if the incident has not been in the pool for its combined minimum time, including the incident in a next pool.

9. The computer program product of claim 8 wherein including the incident in the next pool includes forwarding to the next pool, by the incident analyzer, any associations between the incident and any other incidents that are included in the pool.

10. The computer program product of claim 8 further comprising computer program instructions for retaining in the next pool, by the incident analyzer, a suppression state of an incident included in the next pool.

11. The computer program product of claim 8 further comprising computer program instructions for removing, by the incident analyzer, the incident included in the next pool from consideration of determination of a next pool start time and closure of the next pool.

12. The computer program product of claim 8 further comprising computer program instructions for:

preventing in the next pool, by the incident analyzer, creation of an alert based solely on the incident included in the next pool; and

based solely on the incident included in the next pool, determining, by the incident analyzer, to suppress in the next pool, the incident included in the next pool.

13. The computer program product of claim 8 wherein the incidents comprise events and the pool of incidents comprise an events pool.