Administering incident pools for incident analysis

• US 8,954,811 B2
• Filed: 08/06/2012
• Issued: 02/10/2015
• Est. Priority Date: 08/06/2012
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Carey, James E., Sanders, Philip J.
• Primary Examiner(s): Baderman, Scott
• Assistant Examiner(s): KUDIRKA, JOSEPH R
• Application Number:
  US13/567,601
• Publication Number:
  US 20140040673A1
• Time in Patent Office: 918 Days
• Field of Search: 714/25, 714/26, 714/37, 714/47.1, 714/47.2, 714/47.3, 714/48, 714/57, 709/223, 709/224
• US Class Current: 714/47.2
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/076 by exceeding a count or rate limit, e.g. word- or bit count limit
• CPC Class Codes: G06F 11/0784 Routing of error reports, e.g. with a specific transmission path or data flow
• CPC Class Codes: G06F 11/3055 Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available error or fault processing without redundancy G06F11/0703; error detection or correction by redundancy in data representation G06F11/08; error detection or correction by redundancy in operation G06F11/14; error detection or correction by redundancy in hardware G06F11/16
• CPC Class Codes: G06F 11/3082 the data filtering being achieved by aggregating or compressing the monitored data
• CPC Class Codes: G06F 2201/81 Threshold
• CPC Class Codes: G06F 2201/86 Event-based monitoring

Abstract

Methods, apparatuses, and computer program products for administering incident pools for incident analysis in a distributed processing system are provided. Embodiments include an incident analyzer receiving a plurality of incidents from an incident queue. The incident analyzer also assigns each received incident to an incident pool having a predetermined initial period of time. The predetermined initial period of time is the time within which the incident pool is open to the assignment of incidents. The incident analyzer calculates an arrival rate that incidents are assigned to the incident pool. The incident analyzer also extends based on the arrival rate, for each incident assigned to the incident pool, the predetermined initial period of time by a particular period of time.

Claims

1. A method of administering incident pools for incident analysis in a distributed processing system, the method comprising:

receiving, by an incident analyzer, a plurality of incidents from an incident queue;

assigning, by the incident analyzer, each received incident to an incident pool, the incident pool having a predetermined initial period of time within which the incident pool is open to assignment of incidents;

calculating, by the incident analyzer, an arrival rate that incidents are assigned to the incident pool, including;

calculating a number of incidents that are assigned to the incident pool within a predefined time period;

determining whether the calculated number of incidents exceeds a predetermined maximum threshold;

if the calculated number of incidents exceeds the predetermined maximum threshold, using, as the arrival rate, a predetermined maximum arrival rate; and

if the calculated number of incidents does not exceed the predetermined maximum threshold, calculating the arrival rate by dividing the calculated number of incidents by the predefined time period; and

extending based on the arrival rate, for each incident assigned to the incident pool, the predetermined initial period of time by a particular period of time.

2. The method of claim 1 wherein calculating the arrival rate that incidents are assigned to the incident pool includes:

calculating a number of incidents that are assigned to the incident pool;

determining whether the calculated number of incidents exceeds a predetermined maximum threshold;

if the calculated number of incidents exceeds the predetermined maximum threshold, using, as the arrival rate, a predetermined maximum arrival rate; and

if the calculated number of incidents does not exceed the predetermined maximum threshold, calculating the arrival rate based on durations between last incidents assigned to the incident pool.

3. The method of claim 2 wherein calculating the arrival rate based on durations between last incidents assigned to the incident pool includes:

calculating for each incident assigned to the incident pool, a duration between assignments of the incident and another incident immediately previously assigned to the pool;

calculating a last duration between a close of the incident pool and an assignment of a last incident to the incident pool before the close of the incident pool;

identifying a predetermined number of last incidents assigned to the incident pool;

calculating a sum total of the last duration and all of the durations associated with the identified last incidents; and

using as the arrival rate, a quotient of the predetermined number of the last incidents minus one and the sum total.

4. The method of claim 1 further comprising:

calculating a number of incidents that are assigned to the incident pool; and

determining that the calculated number of incidents exceeds a predetermined minimum threshold,

wherein calculating an arrival rate that incidents are assigned to the incident pool is in response to determining that the calculated number of incidents exceeds the predetermined minimum threshold,

wherein extending based on the arrival rate, for each incident assigned to the incident pool, the predetermined initial period of time by a particular period of time is in response to determining that the calculated number of incidents exceeds the predetermined minimum threshold.

5. The method of claim 1 further comprising:

determining that the predetermined initial period of time and any extensions of time associated with any incidents assigned to the incident pool have elapsed before another incident is assigned to the incident pool; and

closing the incident pool in response to determining that predetermined initial period of time and any extensions of time associated with any incidents assigned to the incident pool have elapsed before another incident is assigned to the incident pool.

6. The method of claim 1 further comprising:

determining that a maximum time for the incident pool has elapsed; and

closing the incident pool in response to determining that the maximum time for the incident pool has elapsed.

7. An apparatus for administering incident pools for incident analysis in a distributed processing system, the apparatus comprising a computer processor, a computer memory operatively coupled to the computer processor, the computer memory having disposed within it computer program instructions that when executed by the computer processor cause the apparatus to carry out the steps of:

receiving, by an incident analyzer, a plurality of incidents from an incident queue;

assigning, by the incident analyzer, each received incident to an incident pool, the incident pool having a predetermined initial period of time within which the incident pool is open to assignment of incidents;

calculating, by the incident analyzer, an arrival rate that incidents are assigned to the incident pool, including;

calculating a number of incidents that are assigned to the incident pool within a predefined time period;

determining whether the calculated number of incidents exceeds a predetermined maximum threshold;

if the calculated number of incidents exceeds the predetermined maximum threshold, using, as the arrival rate, a predetermined maximum arrival rate; and

if the calculated number of incidents does not exceed the predetermined maximum threshold, calculating the arrival rate by dividing the calculated number of incidents by the predefined time period; and

extending based on the arrival rate, for each incident assigned to the incident pool, the predetermined initial period of time by a particular period of time.

8. The apparatus of claim 7 wherein calculating the arrival rate that incidents are assigned to the incident pool includes:

calculating a number of incidents that are assigned to the incident pool;

determining whether the calculated number of incidents exceeds a predetermined maximum threshold;

if the calculated number of incidents exceeds the predetermined maximum threshold, using, as the arrival rate, a predetermined maximum arrival rate; and

if the calculated number of incidents does not exceed the predetermined maximum threshold, calculating the arrival rate based on durations between last incidents assigned to the incident pool.

9. The apparatus of claim 8 wherein calculating the arrival rate based on durations between last incidents assigned to the incident pool includes:

calculating a last duration between a close of the incident pool and an assignment of a last incident to the incident pool before the close of the incident pool;

calculating a last duration between the close of the incident pool and the assignment of the last incident to the incident pool before the close of the incident pool;

identifying a predetermined number of last incidents assigned to the incident pool;

calculating a sum total of the last duration and all of the durations associated with the identified last incidents; and

using as the arrival rate, a quotient of the predetermined number of the last incidents minus one and the sum total.

10. The apparatus of claim 7 further comprising computer program instructions that when executed by the computer processor cause the apparatus to carry out the steps of:

calculating a number of incidents that are assigned to the incident pool; and

determining that the calculated number of incidents exceeds a predetermined minimum threshold,

wherein calculating an arrival rate that incidents are assigned to the incident pool is in response to determining that the calculated number of incidents exceeds the predetermined minimum threshold,

wherein extending based on the arrival rate, for each incident assigned to the incident pool, the predetermined initial period of time by a particular period of time is in response to determining that the calculated number of incidents exceeds the predetermined minimum threshold.

11. The apparatus of claim 7 further comprising computer program instructions that when executed by the computer processor cause the apparatus to carry out the steps of:

determining that the predetermined initial period of time and any extensions of time associated with any incidents assigned to the incident pool have elapsed before another incident is assigned to the incident pool; and

closing the incident pool in response to determining that predetermined initial period of time and any extensions of time associated with any incidents assigned to the incident pool have elapsed before another incident is assigned to the incident pool.

12. A computer program product for administering incident pools for incident analysis in a distributed processing system, the computer program product disposed upon a computer readable storage medium, the computer program product comprising computer program instructions that when executed by a computer cause the computer to carry out the steps of:

receiving, by an incident analyzer, a plurality of incidents from an incident queue;

assigning, by the incident analyzer, each received incident to an incident pool, the incident pool having a predetermined initial period of time within which the incident pool is open to assignment of incidents;

calculating, by the incident analyzer, an arrival rate that incidents are assigned to the incident pool, including;

calculating a number of incidents that are assigned to the incident pool within a predefined time period;

determining whether the calculated number of incidents exceeds a predetermined maximum threshold;

if the calculated number of incidents exceeds the predetermined maximum threshold, using, as the arrival rate, a predetermined maximum arrival rate; and

if the calculated number of incidents does not exceed the predetermined maximum threshold, calculating the arrival rate by dividing the calculated number of incidents by the predefined time period; and

extending based on the arrival rate, for each incident assigned to the incident pool, the predetermined initial period of time by a particular period of time.

13. The computer program product of claim 12 wherein calculating the arrival rate that incidents are assigned to the incident pool includes:

calculating a number of incidents that are assigned to the incident pool;

determining whether the calculated number of incidents exceeds a predetermined maximum threshold;

if the calculated number of incidents exceeds the predetermined maximum threshold, using, as the arrival rate, a predetermined maximum arrival rate; and

if the calculated number of incidents does not exceed the predetermined maximum threshold, calculating the arrival rate based on durations between last incidents assigned to the incident pool.

14. The computer program product of claim 13 wherein calculating the arrival rate based on durations between last incidents assigned to the incident pool includes:

calculating for each incident assigned to the incident pool, a duration between assignments of the incident and another incident immediately previously assigned to the pool;

calculating a last duration between a close of the incident pool and an assignment of a last incident to the incident pool before the close of the incident pool;

identifying a predetermined number of last incidents assigned to the incident pool;

calculating a sum total of the last duration and all of the durations associated with the identified last incidents; and

using as the arrival rate, a quotient of the predetermined number of the last incidents minus one and the sum total.

15. The computer program product of claim 12 further comprising computer program instructions that when executed by a computer cause the computer to carry out the steps of:

calculating a number of incidents that are assigned to the incident pool; and

determining that the calculated number of incidents exceeds a predetermined minimum threshold,

wherein calculating an arrival rate that incidents are assigned to the incident pool is in response to determining that the calculated number of incidents exceeds the predetermined minimum threshold,

wherein extending based on the arrival rate, for each incident assigned to the incident pool, the predetermined initial period of time by a particular period of time is in response to determining that the calculated number of incidents exceeds the predetermined minimum threshold.