Administering checkpoints for incident analysis

• US 8,943,366 B2
• Filed: 08/09/2012
• Issued: 01/27/2015
• Est. Priority Date: 08/09/2012
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Carey, James E., Sanders, Philip J.
• Primary Examiner(s): LE, DIEU MINH T
• Application Number:
  US13/570,819
• Publication Number:
  US 20140047273A1
• Time in Patent Office: 901 Days
• Field of Search: 714/37, 714/39, 714/40, 714/46, 714/47.1, 714/51
• US Class Current: 714/37
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: H04L 41/0604 using filtering, e.g. reduction of information by using priority, element types, position or time
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications

Abstract

Methods, apparatuses, and computer program products for administering checkpoints for incident analysis are provided. Embodiments include a checkpoint manager receiving from each incident analyzer of a plurality of incident analyzers, a checkpoint indicating an incident having the oldest identification number still in analysis by the incident analyzer at the time associated with the checkpoint. The checkpoint manager examines each received checkpoint to identify, as a restore incident, an incident having the oldest identification number indicated in any of the received checkpoints. A monitor sends to the incident analyzers, a stream of incidents beginning with the identified restore incident and continuing with any incidents having a newer identification number than the identified restore incident. Each incident analyzer processes from the stream of incidents only the incident indicated in the last checkpoint of the incident analyzer and any subsequent incidents having a newer identification number than the indicated incident.

Claims

1. A method of administering checkpoints for incident analysis in a distributed processing system, the method comprising:

receiving, by a checkpoint manager of the distributed processing system, from each incident analyzer of a plurality of incident analyzers, a checkpoint indicating an incident having the oldest identification number still in analysis by the incident analyzer at the time associated with the checkpoint;

examining each received checkpoint by the checkpoint manager, to identify, as a restore incident, an incident having the oldest identification number indicated in any of the received checkpoints;

sending, by a monitor of the distributed processing system, to the plurality of incident analyzers, a stream of incidents beginning with the identified restore incident and continuing with any incidents having a newer identification number than the identified restore incident; and

for each incident analyzer of the plurality of incident analyzers, processing from the stream of incidents, by the incident analyzer, only the incident indicated in the last checkpoint of the incident analyzer and any subsequent incidents having a newer identification number than the indicated incident.

2. The method of claim 1 wherein processing from the stream of incidents, only the incident indicated in the last checkpoint of the incident analyzer and any subsequent incidents having a newer identification number than the indicated incident includes moving into an incident pool the incident indicated in the last checkpoint of the incident analyzer and any relevant subsequent incidents having a newer identification number than the indicated incident.

3. The method of claim 1 further comprising for each incident analyzer of the plurality of incident analyzers, identifying an incident having the oldest identification number still in analysis by the incident analyzer at a particular time and sending to the checkpoint manager, a checkpoint identifying the identified incident, the checkpoint associated with the particular time.

4. The method of claim 3 wherein sending to the checkpoint manager, a checkpoint identifying the identified incident is in response to closing an incident pool.

5. The method of claim 3 wherein sending to the checkpoint manager, a checkpoint indicating the identified incident is in response to completion by the incident analyzer of analysis of a particular incident.

6. The method of claim 1 further comprising sending to each incident analyzer of the plurality of incident analyzers, by the checkpoint manager, recovery data including an indication of a recovery mode and an indication of the identified restore incident.

7. The method of claim 1 wherein the checkpoint includes at least one of:

an identification of a last incident in a last incident pool;

a list of incident identifications that were moved forward to a next incident pool;

a list of identifications of suppressed incidents; and

a minimum time needed to move incidents in the next incident pool.

8. The method of claim 1 further comprising sending to each incident analyzer of the plurality of incident analyzers, by one of the checkpoint manager and the monitor, a request to update a checkpoint of each incident analyzer to a particular current incident.

9. An apparatus for administering checkpoints for incident analysis in a distributed processing system, the system comprising a computer processor, a computer memory operatively coupled to the computer processor, the computer memory having disposed within it computer program instructions that when executed by the computer processor cause the apparatus to carry out the steps of:

receiving, by a checkpoint manager of the distributed processing system, from each incident analyzer of a plurality of incident analyzers, a checkpoint indicating an incident having the oldest identification number still in analysis by the incident analyzer at the time associated with the checkpoint;

examining each received checkpoint by the checkpoint manager, to identify, as a restore incident, an incident having the oldest identification number indicated in any of the received checkpoints;

sending, by a monitor of the distributed processing system, to the plurality of incident analyzers, a stream of incidents beginning with the identified restore incident and continuing with any incidents having a newer identification number than the identified restore incident; and

for each incident analyzer of the plurality of incident analyzers, processing from the stream of incidents, by the incident analyzer, only the incident indicated in the last checkpoint of the incident analyzer and any subsequent incidents having a newer identification number than the indicated incident.

10. The apparatus of claim 9 wherein processing from the stream of incidents, only the incident indicated in the last checkpoint of the incident analyzer and any subsequent incidents having a newer identification number than the indicated incident includes moving into an incident pool the incident indicated in the last checkpoint of the incident analyzer and any relevant subsequent incidents having a newer identification number than the indicated incident.

11. The apparatus of claim 9 further comprising computer program instructions that when executed by the computer processor cause the apparatus to carry out the steps of:

for each incident analyzer of the plurality of incident analyzers, identifying an incident having the oldest identification number still in analysis by the incident analyzer at a particular time and sending to the checkpoint manager, a checkpoint identifying the identified incident, the checkpoint associated with the particular time.

12. The apparatus of claim 11 wherein sending to the checkpoint manager, a checkpoint identifying the identified incident is in response to closing an incident pool.

13. The apparatus of claim 11 wherein sending to the checkpoint manager, a checkpoint indicating the identified incident is in response to completion by the incident analyzer of analysis of a particular incident.

14. The apparatus of claim 9 further comprising computer program instructions that when executed by the computer processor cause the apparatus to carry out the steps of sending to each incident analyzer of the plurality of incident analyzers, by the checkpoint manager, recovery data including an indication of a recovery mode and an indication of the identified restore incident.

15. A computer program product for administering checkpoints for incident analysis in a distributed processing system, the computer program product disposed upon a computer readable storage medium, wherein the computer readable storage medium is not a signal, the computer program product comprising computer program instructions that when executed by a computer cause the computer to carry out the steps of:

receiving, by a checkpoint manager of the distributed processing system, from each incident analyzer of a plurality of incident analyzers, a checkpoint indicating an incident having the oldest identification number still in analysis by the incident analyzer at the time associated with the checkpoint;

examining each received checkpoint by the checkpoint manager, to identify, as a restore incident, an incident having the oldest identification number indicated in any of the received checkpoints;

sending, by a monitor of the distributed processing system, to the plurality of incident analyzers, a stream of incidents beginning with the identified restore incident and continuing with any incidents having a newer identification number than the identified restore incident; and

for each incident analyzer of the plurality of incident analyzers, processing from the stream of incidents, by the incident analyzer, only the incident indicated in the last checkpoint of the incident analyzer and any subsequent incidents having a newer identification number than the indicated incident.

16. The computer program product of claim 15 wherein processing from the stream of incidents, only the incident indicated in the last checkpoint of the incident analyzer and any subsequent incidents having a newer identification number than the indicated incident includes moving into an incident pool the incident indicated in the last checkpoint of the incident analyzer and any relevant subsequent incidents having a newer identification number than the indicated incident.

17. The computer program product of claim 15 further comprising for each incident analyzer of the plurality of incident analyzers, identifying an incident having the oldest identification number still in analysis by the incident analyzer at a particular time and sending to the checkpoint manager, a checkpoint identifying the identified incident, the checkpoint associated with the particular time.

18. The computer program product of claim 17 wherein sending to the checkpoint manager, a checkpoint identifying the identified incident is in response to closing an incident pool.

19. The computer program product of claim 17 wherein sending to the checkpoint manager, a checkpoint indicating the identified incident is in response to completion by the incident analyzer of analysis of a particular incident.

20. The computer program product of claim 15 further comprising computer program instructions that when executed by the computer cause the computer to carry out the step of sending to each incident analyzer of the plurality of incident analyzers, by the checkpoint manager, recovery data including an indication of a recovery mode and an indication of the identified restore incident.