Administering event reporting rules in a distributed processing system

• US 8,805,999 B2
• Filed: 12/07/2010
• Issued: 08/12/2014
• Est. Priority Date: 12/07/2010
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Carey, James E., Markland, Matthew W., Sanders, Philip J.
• Primary Examiner(s): Burgess, Glenton B
• Assistant Examiner(s): Nguyen, Angela
• Application Number:
  US12/962,217
• Publication Number:
  US 20120144021A1
• Time in Patent Office: 1,344 Days
• Field of Search: 709/224
• US Class Current: 709/224
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3072 where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
• CPC Class Codes: G06F 11/3096 wherein the means or processing minimize the use of computing system or of computing system component resources, e.g. non-intrusive monitoring which minimizes the probe effect: sniffing, intercepting, indirectly deriving the monitored data from other directly available data
• CPC Class Codes: H04L 43/065 related to network devices

Abstract

Methods, systems and products are provided for administering event reporting rules in a distributed processing system that includes identifying that one or more nodes of the distributed processing system is idle; for each identified idle node, collecting by the idle node any suppressed events and logged data from the node; sending the suppressed events and logged data to a database of events; and changing the event reporting rules for one or more components on the identified idle node in dependence upon the suppressed events and the logged data.

Claims

1. A method of administering event reporting rules in a distributed processing system, the method comprising:

identifying that one or more nodes of the distributed processing system is idle;

for each identified idle node, collecting by the idle node any suppressed events and logged data from the node; and

sending the suppressed events and logged data to a database of events;

determining whether to change the event reporting rules for one or more components of the identified idle node, including comparing the suppressed events and logged data with component reporting change rules identifying the conditions under which an event analyzer will instruct one or more components of the distributed processing system to locally change its event reporting rules; and

responsive to determining to change the event reporting rules for one or more components of the identified idle node, changing the event reporting rules for one or more components on the identified idle node including discontinuing to suppress one or more events of one or more event types.

2. The method of claim 1 wherein identifying that one or more nodes of the distributed processing system is idle further comprises identifying a node undergoing a rolling update.

3. The method of claim 1 wherein identifying that one or more nodes of the distributed processing system is idle further comprises identifying a node that has failed.

4. The method of claim 1 wherein changing the event reporting rules for one or more components on the identified idle node in dependence upon the suppressed events and the logged data further comprises identifying by an events analyzer new event reporting rules for the idle node and instructing by the events analyzer the idle node to change the event reporting rules for one or more components on the node.

5. The method of claim 1 wherein collecting by the idle node any suppressed events and logged data from the node is carried out in response to an instruction from an event analyzer.

6. The method of claim 1 wherein collecting by the idle node any suppressed events and logged data from the node is carried out by the idle node in response to identifying that the node is idle without instruction from another component of the distributed processing system.

7. A system for administering event reporting rules in a distributed processing system, the system comprising a computer processor, a computer memory operatively coupled to the computer processor, the computer memory having disposed within it computer program instructions capable, when executed by the computer processor, of causing the system to carry out the steps of:

identifying that one or more nodes of the distributed processing system is idle;

for each identified idle node, collecting by the idle node any suppressed events and logged data from the node; and

sending the suppressed events and logged data to a database of events;

determining whether to change the event reporting rules for one or more components of the identified idle node, including comparing the suppressed events and logged data with component reporting change rules identifying the conditions under which an event analyzer will instruct one or more components of the distributed processing system to locally change its event reporting rules; and

responsive to determining to change the event reporting rules for one or more components of the identified idle node, changing the event reporting rules for one or more components on the identified idle node including discontinuing to suppress one or more events of one or more event types.

8. The system of claim 7 wherein identifying that one or more nodes of the distributed processing system is idle further comprises identifying a node undergoing a rolling update.

9. The system of claim 7 wherein identifying that one or more nodes of the distributed processing system is idle further comprises identifying a node that has failed.

10. The system of claim 7 wherein changing the event reporting rules for one or more components on the identified idle node in dependence upon the suppressed events and the logged data further comprises identifying by an events analyzer new event reporting rules for the idle node and instructing by the events analyzer the idle node to change the event reporting rules for one or more components on the node.

11. The system of claim 7 wherein collecting by the idle node any suppressed events and logged data from the node is carried out in response to an instruction from an event analyzer.

12. The system of claim 7 wherein collecting by the idle node any suppressed events and logged data from the node is carried out by the idle node in response to identifying that the node is idle without instruction from another component of the distributed processing system.

13. A computer program product for administering event reporting rules in a distributed processing system, the computer program product disposed upon a computer readable medium, wherein the computer readable medium is not a signal, the computer program product comprising computer program instructions for:

identifying that one or more nodes of the distributed processing system is idle;

for each identified idle node, collecting by the idle node any suppressed events and logged data from the node; and

sending the suppressed events and logged data to a database of events;

determining whether to change the event reporting rules for one or more components of the identified idle node, including comparing the suppressed events and logged data with component reporting change rules identifying the conditions under which an event analyzer will instruct one or more components of the distributed processing system to locally change its event reporting rules; and

responsive to determining to change the event reporting rules for one or more components of the identified idle node, changing the event reporting rules for one or more components on the identified idle node including discontinuing to suppress one or more events of one or more event types.

14. The computer program product of claim 13 wherein identifying that one or more nodes of the distributed processing system is idle further comprises identifying a node undergoing a rolling update.

15. The computer program product of claim 13 wherein identifying that one or more nodes of the distributed processing system is idle further comprises identifying a node that has failed.

16. The computer program product of claim 13 wherein changing the event reporting rules for one or more components on the identified idle node in dependence upon the suppressed events and the logged data further comprises identifying by an events analyzer new event reporting rules for the idle node and instructing by the events analyzer the idle node to change the event reporting rules for one or more components on the node.

17. The computer program product of claim 13 wherein the computer readable medium comprises a storage medium.