Selected alert delivery in a distributed processing system

• US 9,178,936 B2
• Filed: 10/18/2011
• Issued: 11/03/2015
• Est. Priority Date: 10/18/2011
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Carey, James E., Sanders, Philip J.
• Primary Examiner(s): Srivastava, Vivek
• Assistant Examiner(s): Raza, Muhammad A
• Application Number:
  US13/275,530
• Publication Number:
  US 20130097216A1
• Time in Patent Office: 1,477 Days
• Field of Search: 709/224, 726/11
• US Class Current: 1/1
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0748 in a remote unit communicating with a single-box computer node experiencing an error/fault remote testing G06F11/2294
• CPC Class Codes: G06F 11/0781 Error filtering or prioritizing based on a policy defined by the user or on a policy defined by a hardware/software module, e.g. according to a severity level
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3055 Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available error or fault processing without redundancy G06F11/0703; error detection or correction by redundancy in data representation G06F11/08; error detection or correction by redundancy in operation G06F11/14; error detection or correction by redundancy in hardware G06F11/16
• CPC Class Codes: G06F 11/3058 Monitoring arrangements for monitoring environmental properties or parameters of the computing system or of the computing system component, e.g. monitoring of power, currents, temperature, humidity, position, vibrations thermal management in cooling arrangements of a computing system G06F1/206
• CPC Class Codes: G06F 11/3072 where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
• CPC Class Codes: H04L 41/0618 based on the physical or logical position
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal

Abstract

Methods, apparatuses, and computer program products for selected alert delivery in a distributed processing system are provided. Embodiments include receiving a plurality of events from one or more event producing components of the distributed processing system; creating, by an incident analyzer, in dependence upon the events a truth space representing events that make one or more conditional event processing rules true, the truth space including a set of truth points, each truth point including a set of events and a set of event locations; creating, by the incident analyzer, in dependence upon the truth space one or more alerts; and sending, by the incident analyzer, the alerts to at least one component of the distributed processing system.

Claims

1. An apparatus for selected alert delivery in a distributed processing system, the system comprising a computer processor, a computer memory operatively coupled to the computer processor, the computer memory having disposed within it computer program instructions capable, when executed by the computer processor, of causing the apparatus to carry out the steps of:

receiving a plurality of events from one or more event producing components of the distributed processing system, wherein each of the plurality of events is a notification of a particular occurrence on a component of the distributed processing system, each event producing component comprising an aggregation of computer hardware and software;

creating, by an incident analyzer in dependence upon the events, a truth space data structure representing events that make one or more conditional event processing rules true, wherein the one or more conditional event processing rules are rules indicating circumstances under which a condition is true, wherein creating the truth space data structure includes;

creating, in the truth space data structure, a set of truth point data structures, each truth point data structure including truth events and event locations, wherein creating each truth point data structure includes;

determining occurrences of events that make a particular conditional event processing rule true;

storing, as the truth events, the events that make the particular conditional event processing rule true;

determining the event location of event producing components that can generate the truth events; and

storing the truth events and the event location of the event producing components that can generate the truth events as the truth point data structure;

wherein creating the truth space data structure further comprises, for each truth event;

identifying one or more event locations associated with the truth event by examining metadata associated with the event to determine the location of the distributed processing system that produced the event;

determining a location scope using predetermined location selection rules and a particular location of the one or more event locations;

scoping, using the location scope, the truth space data structure, wherein the scope defines whether an event producing component is treated as hardware or software when applying the particular conditional event processing rule and the scope of the truth space data structure redefines the stored location of at least one truth point data structure to a location of a component of the distributed processing system other than the event producing component that produced the event that made the particular conditional event processing rule true and caused the creation of the truth point data structure;

creating, by the incident analyzer in dependence upon the truth space data structure, one or more alerts, wherein the one or more alerts are unique to the combination of the truth events and the event location of the event producing components that can generate the truth events; and

sending, by the incident analyzer, the alerts to at least one component of the distributed processing system.

2. The apparatus of claim 1, wherein the predetermined location selection rules dictate selecting no locations.

3. The apparatus of claim 1, wherein the predetermined location selection rules dictate selecting locations that match other events.

4. The apparatus of claim 1, wherein the predetermined location selection rules dictate selecting locations that are different from other events.

5. A computer program product for selected alert delivery in a distributed processing system, the computer program product disposed upon a computer readable storage medium, wherein the computer readable storage medium is not a signal, the computer program product comprising computer program instructions that when executed by a processor cause the processor to carry out the steps of:

receiving a plurality of events from one or more event producing components of the distributed processing system, wherein each of the plurality of events is a notification of a particular occurrence on a component of the distributed processing system, each event producing component comprising an aggregation of computer hardware and software;

creating, by an incident analyzer in dependence upon the events, a truth space data structure representing events that make one or more conditional event processing rules true, wherein the one or more conditional event processing rules are rules indicating circumstances under which a condition is true, wherein creating the truth space data structure includes;

creating, in the truth space data structure, a set of truth point data structures, each truth point data structure including truth events and event locations, wherein creating each truth point data structure includes;

determining occurrences of events that make a particular conditional event processing rule true;

storing, as the truth events, the events that make the particular conditional event processing rule true;

determining the event location of event producing components that can generate the truth events; and

storing the truth events and the event location of the event producing components that can generate the truth events as the truth point data structure;

wherein creating the truth space data structure further comprises, for each truth event;

identifying one or more event locations associated with the truth event by examining metadata associated with the event to determine the location of the distributed processing system that produced the event;

determining a location scope using predetermined location selection rules and a particular location of the one or more event locations;

scoping, using the location scope, the truth space data structure, wherein the scope defines whether an event producing component is treated as hardware or software when applying the particular conditional event processing rule and the scope of the truth space data structure redefines the stored location of at least one truth point data structure to a location of a component of the distributed processing system other than the event producing component that produced the event that made the particular conditional event processing rule true and caused the creation of the truth point data structure;

creating, by the incident analyzer in dependence upon the truth space data structure, one or more alerts, wherein the one or more alerts are unique to the combination of the truth events and the event location of the event producing components that can generate the truth events; and

sending, by the incident analyzer, the alerts to at least one component of the distributed processing system.

6. The computer program product of claim 5, wherein the predetermined location selection rules dictate selecting no locations.

7. The computer program product of claim 5, wherein the predetermined location selection rules dictate selecting locations that match other events.