Prioritized alert delivery in a distributed processing system

• US 9,246,865 B2
• Filed: 01/09/2013
• Issued: 01/26/2016
• Est. Priority Date: 10/18/2011
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Atkins, Mark G., Carey, James E., Sanders, Philip J.
• Primary Examiner(s): JEAN GILLES, JUDE
• Application Number:
  US13/737,298
• Publication Number:
  US 20150271124A1
• Time in Patent Office: 1,112 Days
• Field of Search: 709/217, 709/207, 709/201, 709/224, 709/223
• US Class Current: 1/1
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0781 Error filtering or prioritizing based on a policy defined by the user or on a policy defined by a hardware/software module, e.g. according to a severity level
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3072 where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
• CPC Class Codes: G06F 11/327 Alarm or error message display
• CPC Class Codes: H04L 51/226 Delivery according to priorities

Abstract

Methods, apparatuses, and computer program products for prioritized alert delivery in a distributed processing system are provided. Embodiments include receiving a plurality of events from a plurality of tiered event producing components in a distributed computing system; identifying a plurality of potential alerts in dependence upon the events; wherein each potential alert includes a priority and one or more condition events describing the event producing component creating the event; comparing the potential alerts and their condition events and priorities; identifying the highest priority potential alert having condition events whose event producing component is in a tier that is higher than the tier of condition events of one or more lower priority potential alerts; and creating an alert in dependence upon the identified highest priority potential alert and the condition events corresponding to the identified highest priority potential alert.

Claims

1. A method of prioritized alert delivery in a distributed processing system, the method comprising:

receiving, by an incident analyzer, a plurality of events from a plurality of tiered event producing components in a distributed computing system;

identifying, by the incident analyzer, a plurality of potential alerts in dependence upon the events;

wherein each potential alert includes a priority and one or more condition events describing the event producing component creating the event;

comparing, by the incident analyzer, the potential alerts and their condition events and priorities;

identifying, by the incident analyzer, the highest priority potential alert having condition events whose event producing component is in a tier that is higher than the tier of condition events of one or more lower priority potential alerts; and

creating, by the incident analyzer, an alert in dependence upon the identified highest priority potential alert and the condition events corresponding to the identified highest priority potential alert.

2. The method of claim 1 further comprising subsuming, by the incident analyzer, into the identified highest priority potential alert, the lower priority potential alerts whose condition events are a subset of the identified highest priority potential alert'"'"'s condition events.

3. The method of claim 1 wherein the condition event indicates a tier that a particular event corresponds with.

4. The method of claim 1 wherein the priorities of the potential alerts are assigned according to a predetermined usefulness of a corresponding alert as identified by alert consumer use.

5. The method of claim 1 wherein the event producing components are tiered according to the location and hierarchy of hardware components of the distributed processing system.

6. The method of claim 1 wherein the event producing components are tiered according to the relationship among hardware components of the distributed processing system.

7. The method of claim 1 wherein the event producing components are tiered according to the structure of software components of the distributed processing system.

8. An apparatus for prioritized alert delivery in a distributed processing system, the system comprising a computer processor, a computer memory operatively coupled to the computer processor, the computer memory having disposed within it computer program instructions capable, when executed by the computer processor, of causing the apparatus to carry out the steps of:

receiving, by an incident analyzer, a plurality of events from a plurality of tiered event producing components in a distributed computing system;

identifying, by the incident analyzer, a plurality of potential alerts in dependence upon the events;

wherein each potential alert includes a priority and one or more condition events describing the event producing component creating the event;

comparing, by the incident analyzer, the potential alerts and their condition events and priorities;

identifying, by the incident analyzer, the highest priority potential alert having condition events whose event producing component is in a tier that is higher than the tier of condition events of one or more lower priority potential alerts; and

creating, by the incident analyzer, an alert in dependence upon the identified highest priority potential alert and the condition events corresponding to the identified highest priority potential alert.

9. The apparatus of claim 8 further comprising computer program instructions capable, when executed by the computer processor, of causing the apparatus to carry out the steps of subsuming, by the incident analyzer, into the identified highest priority potential alert, the lower priority potential alerts whose condition events are a subset of the identified highest priority potential alert'"'"'s condition events.

10. The apparatus of claim 8 wherein the condition event indicates a tier that a particular event corresponds with.

11. The apparatus of claim 8 wherein the priorities of the potential alerts are assigned according to a predetermined usefulness of a corresponding alert as identified by alert consumer use.

12. The apparatus of claim 8 wherein the event producing components are tiered according to the location and hierarchy of hardware components of the distributed processing system.

13. The apparatus of claim 8 wherein the event producing components are tiered according to the relationship among hardware components of the distributed processing system.

14. The apparatus of claim 8 wherein the event producing components are tiered according to the structure of software components of the distributed processing system.

15. A computer program product for prioritized alert delivery in a distributed processing system, the computer program product disposed upon a non-transitory computer readable storage medium, the computer program product comprising computer program instructions that when executed by a processor cause the processor to carry out the steps of:

receiving, by an incident analyzer, a plurality of events from a plurality of tiered event producing components in a distributed computing system;

identifying, by the incident analyzer, a plurality of potential alerts in dependence upon the events;

wherein each potential alert includes a priority and one or more condition events describing the event producing component creating the event;

comparing, by the incident analyzer, the potential alerts and their condition events and priorities;

identifying, by the incident analyzer, the highest priority potential alert having condition events whose event producing component is in a tier that is higher than the tier of condition events of one or more lower priority potential alerts; and

creating, by the incident analyzer, an alert in dependence upon the identified highest priority potential alert and the condition events corresponding to the identified highest priority potential alert.

16. The computer program product of claim 15 further comprising subsuming, by the incident analyzer, into the identified highest priority potential alert, the lower priority potential alerts whose condition events are a subset of the identified highest priority potential alert'"'"'s condition events.

17. The computer program product of claim 15 wherein the condition event indicates a tier that a particular event corresponds with.

18. The computer program product of claim 15 wherein the priorities of the potential alerts are assigned according to a predetermined usefulness of a corresponding alert as identified by alert consumer use.

19. The computer program product of claim 15 wherein the event producing components are tiered according to the location and hierarchy of hardware components of the distributed processing system.

20. The computer program product of claim 15 wherein the event producing components are tiered according to the relationship among hardware components of the distributed processing system.