Restarting event and alert analysis after a shutdown in a distributed processing system

• US 8,880,943 B2
• Filed: 06/22/2011
• Issued: 11/04/2014
• Est. Priority Date: 06/22/2011
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Carey, James E., Markland, Matthew W., Sanders, Philip J.
• Primary Examiner(s): PATEL, JIGAR P
• Application Number:
  US13/166,027
• Publication Number:
  US 20120331332A1
• Time in Patent Office: 1,231 Days
• Field of Search: 714/23
• US Class Current: 714/23
• CPC Class Codes: G06F 11/1438 Restarting or rejuvenating
• CPC Class Codes: G06F 11/1471 involving logging of persistent data for recovery
• CPC Class Codes: G06F 11/3404 for parallel or distributed programming
• CPC Class Codes: G06F 2201/86 Event-based monitoring

Abstract

Restarting event and alert analysis after a shutdown in a distributed processing system, including: identifying a shutdown condition of the distributed processing system, the incident analyzer including a plurality of event analyzers and a monitor that monitors the plurality of event analyzers; and determining whether the shutdown was a planned shutdown or an unplanned shutdown; if the shutdown was planned, storing an identification of the last event in an event log that was injected in an event queue at the time of the planned shutdown and restarting event and alert analysis using the next event identified in the event log; and if the shutdown was unplanned, for each event analyzer, identifying the last event included in the last event pool that the event analyzer closed; and restarting event and alert analysis at the event analyzer using the next event received by the event analyzer after the identified last event.

Claims

1. A system for restarting event and alert analysis after a shutdown in a distributed processing system, the system comprising a computer processor, a computer memory operatively coupled to the computer processor, the computer memory having disposed within it computer program instructions capable, when executed by the computer processor, of causing the system to carry out the steps of:

identifying, by an incident analyzer, a shutdown condition of the distributed processing system, the incident analyzer including a plurality of event analyzers and a monitor that monitors the plurality of event analyzers, and each event analyzer corresponding to a plurality of event pools;

upon determining, by the incident analyzer, that the shutdown was an unplanned shutdown;

for each event analyzer, identifying the last event included in the last event pool that the event analyzer closed, by;

identifying a last pool closed by the particular event analyzer by comparing the time log for each of the plurality of event pools;

examining the events in the last pool closed to identify a last event in the last pool closed;

wherein each event pool comprises a collection of events organized by time and each event in the plurality of event pools comprises an indication of a particular occurrence in or on a component of the distributed processing system; and

restarting, by the incident analyzer, event and alert analysis at the event analyzer using the next event received by the event analyzer after the identified last event.

2. The system of claim 1, wherein identifying the last event included in the last event pool that the event analyzer closed includes:

assigning, by each event analyzer, a checkpoint to each last event included in the event pool that is closed by the event analyzer; and

determining, by the monitor, for each event analyzer, the last checkpoint assigned.

3. The system of claim 2, wherein restarting event and alert analysis at the event analyzer using the next event received after by the event analyzer after the identified last event includes identifying, by the incident analyzer, the next event in dependence upon the last assigned checkpoint.

4. The system of claim 1, wherein restarting event and alert analysis at the event analyzer using the next event after the identified last event includes:

identifying, by the incident analyzer, all events that were not included in the last pool that is closed by the event analyzer; and

including, by the incident analyzer, the identified events in a next pool.

5. The system of claim 4, wherein identifying all events that were not included in the last pool that is closed by the event analyzer includes receiving from each event analyzer, by the monitor, a list of events that were moved forward.

6. The system of claim 4, wherein restarting event and alert analysis at the event analyzer using the next event after the identified last event includes:

identifying, by the incident analyzer, any events in the identified events that have already been processed; and

ignoring, by the incident analyzer, the identified already processed events.

7. A computer program product for restarting event and alert analysis in a distributed processing system, the computer program product disposed upon a computer readable storage medium, wherein the computer readable storage medium is not a signal and the computer program product comprises computer program instructions for:

identifying, by an incident analyzer, a shutdown condition of the distributed processing system, the incident analyzer including a plurality of event analyzers and a monitor that monitors the plurality of event analyzers, and each event analyzer corresponding to a plurality of event pools;

upon determining, by the incident analyzer, that the shutdown was an unplanned shutdown;

for each event analyzer, identifying the last event included in the last event pool that the event analyzer closed, by;

identifying a last pool closed by the particular event analyzer by comparing the time log for each of the plurality of event pools;

examining the events in the last pool closed to identify a last event in the last pool closed;

wherein each event pool comprises a collection of events organized by time and each event in the plurality of event pools comprises an indication of a particular occurrence in or on a component of the distributed processing system; and

restarting, by the incident analyzer, event and alert analysis at the event analyzer using the next event received by the event analyzer after the identified last event.

8. The computer program product of claim 7, wherein identifying the last event included in the last event pool that the event analyzer closed includes:

assigning, by each event analyzer, a checkpoint to each last event included in the event pool that is closed by the event analyzer; and

determining, by the monitor, for each event analyzer, the last checkpoint assigned.

9. The computer program product of claim 8, wherein restarting event and alert analysis at the event analyzer using the next event received after by the event analyzer after the identified last event includes identifying, by the incident analyzer, the next event in dependence upon the last assigned checkpoint.

10. The computer program product of claim 7, wherein restarting event and alert analysis at the event analyzer using the next event after the identified last event includes:

identifying, by the incident analyzer, all events that were not included in the last pool that is closed by the event analyzer; and

including, by the incident analyzer, the identified events in a next pool.

11. The computer program product of claim 10, wherein identifying all events that were not included in the last pool that is closed by the event analyzer includes receiving from each event analyzer, by the monitor, a list of events that were moved forward.

12. The computer program product of claim 10, wherein restarting event and alert analysis at the event analyzer using the next event after the identified last event includes:

identifying, by the incident analyzer, any events in the identified events that have already been processed; and

ignoring, by the incident analyzer, the identified already processed events.