Selected alert delivery in a distributed processing system

• US 8,688,769 B2
• Filed: 01/10/2013
• Issued: 04/01/2014
• Est. Priority Date: 10/18/2011
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Atkins, Mark G., Carey, James E., Sanders, Philip J.
• Primary Examiner(s): JEAN GILLES, JUDE
• Application Number:
  US13/738,043
• Publication Number:
  US 20130144932A1
• Time in Patent Office: 446 Days
• Field of Search: 709201-207, 709/237, 709/246, 709/229, 709/230
• US Class Current: 709/201
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0748 in a remote unit communicating with a single-box computer node experiencing an error/fault remote testing G06F11/2294
• CPC Class Codes: G06F 11/0781 Error filtering or prioritizing based on a policy defined by the user or on a policy defined by a hardware/software module, e.g. according to a severity level
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3055 Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available error or fault processing without redundancy G06F11/0703; error detection or correction by redundancy in data representation G06F11/08; error detection or correction by redundancy in operation G06F11/14; error detection or correction by redundancy in hardware G06F11/16
• CPC Class Codes: G06F 11/3058 Monitoring arrangements for monitoring environmental properties or parameters of the computing system or of the computing system component, e.g. monitoring of power, currents, temperature, humidity, position, vibrations thermal management in cooling arrangements of a computing system G06F1/206
• CPC Class Codes: G06F 11/3072 where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
• CPC Class Codes: H04L 41/0618 based on the physical or logical position
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

Methods, apparatuses, and computer program products for selected alert delivery in a distributed processing system are provided. Embodiments include receiving a plurality of events from one or more event producing components of the distributed processing system; creating, by an incident analyzer, in dependence upon the events a truth space representing events that make one or more conditional event processing rules true, the truth space including a set of truth points, each truth point including a set of events and a set of event locations; creating, by the incident analyzer, in dependence upon the truth space one or more alerts including assigning one of the locations of the truth space to one or more of the alerts; and sending, by the incident analyzer, the alerts to at least one component of the distributed processing system.

Claims

1. A method of selected alert delivery in a distributed processing system, the method comprising:

receiving a plurality of events from one or more event producing components of the distributed processing system;

creating, by an incident analyzer, in dependence upon the events a truth space representing events that make one or more conditional event processing rules true, the truth space including a set of truth points, each truth point including a set of events and a set of event locations;

creating, by the incident analyzer, in dependence upon the truth space one or more alerts including assigning one of the locations of the truth space to one or more of the alerts; and

sending, by the incident analyzer, the alerts to at least one component of the distributed processing system.

2. The method of claim 1 wherein the location assigned to the alert indicates a location that the alert occurred.

3. The method of claim 1 wherein the location assigned to the alert is assigned a random location selected from one of the event locations of the event corresponding to the alert.

4. The method of claim 1 wherein the location assigned to the alert is assigned the first event location selected from one of the event locations corresponding to the alert.

5. The method of claim 1 wherein creating in dependence upon the truth space one or more alerts further comprises scoping one or more truth spaces.

6. The method of claim 1 further comprising updating, by the incident analyzer, the truth space.

7. An apparatus for selected alert delivery in a distributed processing system, the system comprising a computer processor, a computer memory operatively coupled to the computer processor, the computer memory having disposed within it computer program instructions capable, when executed by the computer processor, of causing the apparatus to carry out the steps of:

receiving a plurality of events from one or more event producing components of the distributed processing system;

creating, by an incident analyzer, in dependence upon the events a truth space representing events that make one or more conditional event processing rules true, the truth space including a set of truth points, each truth point including a set of events and a set of event locations;

creating, by the incident analyzer, in dependence upon the truth space one or more alerts including assigning one of the locations of the truth space to one or more of the alerts; and

sending, by the incident analyzer, the alerts to at least one component of the distributed processing system.

8. The apparatus of claim 7 wherein the location assigned to the alert indicates a location that the alert occurred.

9. The apparatus of claim 7 wherein the location assigned to the alert is assigned a random location selected from one of the event locations of the event corresponding to the alert.

10. The apparatus of claim 7 wherein the location assigned to the alert is assigned the first event location selected from one of the event locations corresponding to the alert.

11. The apparatus of claim 7 wherein creating in dependence upon the truth space one or more alerts further comprises scoping one or more truth spaces.

12. The apparatus of claim 7 further comprising computer program instructions capable, when executed by the computer processor, of causing the apparatus to carry out the steps of updating, by the incident analyzer, the truth space.

13. A computer program product for selected alert delivery in a distributed processing system, the computer program product including a computer readable storage medium, wherein the computer readable storage medium is not a signal, the computer readable storage medium including computer program instructions that when executed by a processor cause the processor to carry out the steps of:

receiving a plurality of events from one or more event producing components of the distributed processing system;

creating, by an incident analyzer, in dependence upon the events a truth space representing events that make one or more conditional event processing rules true, the truth space including a set of truth points, each truth point including a set of events and a set of event locations;

creating, by the incident analyzer, in dependence upon the truth space one or more alerts including assigning one of the locations of the truth space to one or more of the alerts; and

sending, by the incident analyzer, the alerts to at least one component of the distributed processing system.

14. The computer program product of claim 13 wherein the location assigned to the alert indicates a location that the alert occurred.

15. The computer program product of claim 13 wherein the location assigned to the alert is assigned a random location selected from one of the event locations of the event corresponding to the alert.

16. The computer program product of claim 13 wherein the location assigned to the alert is assigned the first event location selected from one of the event locations corresponding to the alert.

17. The computer program product of claim 13 wherein creating in dependence upon the truth space one or more alerts further comprises scoping one or more truth spaces.

18. The computer program product of claim 13, wherein the computer readable medium further comprises a computer readable signal medium.

19. The computer program product of claim 13, wherein the computer readable medium further comprises a computer readable storage medium.