Determining whether to send an alert in a distributed processing system

• US 9,256,482 B2
• Filed: 08/23/2013
• Issued: 02/09/2016
• Est. Priority Date: 08/23/2013
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Boger, Lynn A., Carey, James E., Davis, Kristan D., Sanders, Philip J.
• Primary Examiner(s): LE, DIEU MINH T
• Application Number:
  US13/974,829
• Publication Number:
  US 20150058676A1
• Time in Patent Office: 900 Days
• Field of Search: 714/57, 714/4.1
• US Class Current: 1/1
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3055 Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available error or fault processing without redundancy G06F11/0703; error detection or correction by redundancy in data representation G06F11/08; error detection or correction by redundancy in operation G06F11/14; error detection or correction by redundancy in hardware G06F11/16
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications

Abstract

Methods, apparatuses, and computer program products for determining whether to send an alert are provided. Embodiments include a voting manager receiving from a plurality of alert analyzers, one or more delivery codes associated with an alert. In dependence upon the one or more delivery codes, the voting manager determines whether to suppress the alert, to close the alert, or to report the alert.

Claims

1. A method of determining whether to send an alert in a distributed event processing environment, the distributed event processing environment including an event analyzer, a plurality of alert analyzers, and a voting manager, the event analyzer receiving events and creating alerts to be provided to the plurality of alert analyzers and each alert analyzer analyzing each alert, the method comprising:

for each alert;

receiving from the plurality of alert analyzers, by the voting manager, one or more delivery codes associated with the alert; and

determining in dependence upon the one or more delivery codes, by the voting manager, whether to suppress the alert, to close the alert, or to report the alert, including

if the one or more delivery codes do not include at least one report instruction, one suppress instruction, or one close instruction, calculating totals of each type of voting instruction included in the one or more delivery codes;

based on the calculated totals of each type of voting instruction, assigning a result instruction to the alert; and

performing the result instruction.

2. The method of claim 1 wherein determining in dependence upon the one or more delivery codes, by the voting manager, whether to suppress the alert, to close the alert, or to report the alert includes:

determining whether the one or more delivery codes include at least one report instruction;

if the one or more delivery codes include at least one report instruction, reporting the alert.

3. The method of claim 1 wherein determining in dependence upon the one or more delivery codes, by the voting manager, whether to suppress the alert, to close the alert, or to report the alert includes:

if the one or more delivery codes do not include at least one report instruction, determining whether the one or more delivery codes includes at least one suppress instruction; and

if the one or more delivery codes include at least one suppress instruction, suppressing the alert.

4. The method of claim 1 wherein determining in dependence upon the one or more delivery codes, by the voting manager, whether to suppress the alert, to close the alert, or to report the alert includes:

if the one or more delivery codes do not include at least one report instruction and one suppress instruction, determining whether the one or more delivery codes includes at least one close instruction; and

if the one or more delivery codes include at least one close instruction, closing the alert.

5. The method of claim 1, wherein types of voting instruction include a vote to report instruction, a vote to suppress instruction, a vote to close instruction, and a vote to abstain instruction;

and wherein the result instruction is one of a report instruction, a suppress instruction, and a close instruction.

6. The method of claim 1 further comprising:

identifying any alert analyzers of the plurality of alert analyzers that have not provided a delivery code within a predetermined time period; and

for each identified alert analyzer, creating a delivery code that includes a vote to abstain instruction.

7. The method of claim 1 further comprising transmitting to the voting manager, by the event analyzer, a particular delivery code.

8. An apparatus for determining whether to send an alert in a distributed event processing environment, the distributed event processing environment including an event analyzer, a plurality of alert analyzers, and a voting manager, the event analyzer receiving events and creating alerts to be provided to the plurality of alert analyzers and each alert analyzer analyzing each alert, the apparatus comprising a computer processor and a computer memory operatively coupled to the computer processor, the computer memory having disposed within it computer program instructions that when executed by the computer processor cause the apparatus to carry out the steps of:

for each alert;

receiving from the plurality of alert analyzers, by the voting manager, one or more delivery codes associated with the alert; and

determining in dependence upon the one or more delivery codes, by the voting manager, whether to suppress the alert, to close the alert, or to report the alert, including

if the one or more delivery codes do not include at least one report instruction, one suppress instruction, or one close instruction, calculating totals of each type of voting instruction included in the one or more delivery codes;

based on the calculated totals of each type of voting instruction, assigning a result instruction to the alert; and

performing the result instruction.

9. The apparatus of claim 8 wherein determining in dependence upon the one or more delivery codes, by the voting manager, whether to suppress the alert, to close the alert, or to report the alert includes:

determining whether the one or more delivery codes include at least one report instruction;

if the one or more delivery codes include at least one report instruction, reporting the alert.

10. The apparatus of claim 8 wherein determining in dependence upon the one or more delivery codes, by the voting manager, whether to suppress the alert, to close the alert, or to report the alert includes:

if the one or more delivery codes do not include at least one report instruction, determining whether the one or more delivery codes includes at least one suppress instruction; and

if the one or more delivery codes include at least one suppress instruction, suppressing the alert.

11. The apparatus of claim 8 wherein determining in dependence upon the one or more delivery codes, by the voting manager, whether to suppress the alert, to close the alert, or to report the alert includes:

if the one or more delivery codes do not include at least one report instruction and one suppress instruction, determining whether the one or more delivery codes includes at least one close instruction; and

if the one or more delivery codes include at least one close instruction, closing the alert.

12. A computer program product for determining whether to send an alert in a distributed event processing environment, the distributed event processing environment including an event analyzer, a plurality of alert analyzers, and a voting manager, the event analyzer receiving events and creating alerts to be provided to the plurality of alert analyzers and each alert analyzer analyzing each alert, the computer program product disposed upon a computer readable storage medium, wherein the computer readable storage medium is not a signal, the computer program product comprising computer program instructions that when executed by a computer cause the computer to carry out the steps of:

for each alert;

receiving from the plurality of alert analyzers, by the voting manager, one or more delivery codes associated with the alert; and

determining in dependence upon the one or more delivery codes, by the voting manager, whether to suppress the alert, to close the alert, or to report the alert, including

if the one or more delivery codes do not include at least one report instruction, one suppress instruction, or one close instruction, calculating totals of each type of voting instruction included in the one or more delivery codes;

based on the calculated totals of each type of voting instruction, assigning a result instruction to the alert; and

performing the result instruction.

13. The computer program product of claim 12 wherein determining in dependence upon the one or more delivery codes, by the voting manager, whether to suppress the alert, to close the alert, or to report the alert includes:

determining whether the one or more delivery codes include at least one report instruction;

if the one or more delivery codes include at least one report instruction, reporting the alert.

14. The computer program product of claim 12 wherein determining in dependence upon the one or more delivery codes, by the voting manager, whether to suppress the alert, to close the alert, or to report the alert includes:

if the one or more delivery codes do not include at least one report instruction, determining whether the one or more delivery codes includes at least one suppress instruction; and

if the one or more delivery codes include at least one suppress instruction, suppressing the alert.

15. The computer program product of claim 12 wherein determining in dependence upon the one or more delivery codes, by the voting manager, whether to suppress the alert, to close the alert, or to report the alert includes:

if the one or more delivery codes do not include at least one report instruction and one suppress instruction, determining whether the one or more delivery codes includes at least one close instruction; and

if the one or more delivery codes include at least one close instruction, closing the alert.

16. The computer program product of claim 12, wherein types of voting instruction include a vote to report instruction, a vote to suppress instruction, a vote to close instruction, and a vote to abstain instruction;

and wherein the result instruction is one of a report instruction, a suppress instruction, and a close instruction.

17. The computer program product of claim 12 further comprising computer program instructions that when executed by a computer cause the computer to carry out the steps of:

identifying any alert analyzers of the plurality of alert analyzers that have not provided a delivery code within a predetermined time period; and

for each identified alert analyzer, creating a delivery code that includes a vote to abstain instruction.