Reporting results of processing of continuous event streams

• US 9,299,246 B2
• Filed: 07/19/2014
• Issued: 03/29/2016
• Est. Priority Date: 07/19/2014
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Advani, Pavan
• Primary Examiner(s): Nguyen, Hung T
• Application Number:
  US14/335,879
• Publication Number:
  US 20160019776A1
• Time in Patent Office: 619 Days
• Field of Search: 340/500, 340/506, 340/521, 340/526, 340/531, 340/573.1
• US Class Current: 1/1
• CPC Class Codes: G06F 16/24568 Data stream processing; Continuous queries

Abstract

An aspect of the present disclosure facilitates reporting results of processing of continuous event streams. In one embodiment, a matching condition indicating a pattern of interest as a part of an alert definition in relation to a set of continuous event streams is received, with the occurrences of said pattern of interest being desirable to be reported as corresponding alert instances. Also, a suppression condition associated with the pattern of interest is received, with the suppression condition indicating the specific occurrences of the pattern of interest that are not to be reported as corresponding alert instances. Accordingly, a sequence of occurrences of the pattern of interest is determined in the set of continuous event streams. For each occurrence in the sequence of occurrences, an alert instance corresponding to the occurrence is generated only if the suppression condition is not satisfied for the occurrence.

Claims

1. A method of reporting results of processing of continuous event streams, said method being executed by one or more processors, said method comprising:

receiving a matching condition indicating a pattern of interest as a part of an alert definition in relation to a set of continuous event streams, wherein occurrences of said pattern of interest are desirable to be reported as corresponding alert instances;

receiving a suppression condition associated with said pattern of interest, wherein said suppression condition indicates the specific occurrences of said pattern of interest that are not to be reported as corresponding alert instances;

determining, in said set of continuous event streams, a sequence of occurrences of said pattern of interest; and

for each occurrence in said sequence of occurrences, generating an alert instance corresponding to the occurrence only if said suppression condition is not satisfied for the occurrence.

2. The method of claim 1, wherein said determining comprises:

obtaining a sequence of results of execution of a continuous query on said set of continuous event streams, said continuous query indicating a selection criteria and a moving time window, said selection criteria corresponding to said matching condition,

wherein said each of said sequence of results is obtained based on data values of said set of continuous event streams in a corresponding duration determined by said moving time window; and

identifying each of said sequence of results as corresponding to one of said sequence of occurrences of said pattern of interest in said set of continuous event streams,

wherein said generating generates said alert instance corresponding to each result only if said suppression condition is not satisfied for the result.

3. The method of claim 2, wherein said generating skips the alert instance corresponding to a result if said suppression condition is satisfied for the result.

4. The method of claim 3, wherein said suppression condition specifies a timing pattern for prior alert instances and a suppression duration,

wherein said generating, for each occurrence, skips the alert instance for the occurrence if the timing of alert instances prior to the occurrence satisfies said timing pattern and the timing of the occurrence is within said suppression duration.

5. The method of claim 4, wherein said timing pattern is specified in the form of a threshold number of prior alert instances in a prior duration, wherein subsequent alert instances are suppressed for said suppression duration upon generation of the threshold number of prior alert instances in said prior duration thereby avoiding repetition of the alert instances beyond said threshold number in a duration of a sum of said prior duration and said suppression duration.

6. The method of claim 4, wherein said alert definition indicates that alert instances are to be sent to a first user and a second user, wherein said suppression condition is specified associated with said second user but not said first user,

wherein for each occurrence determined within said suppression duration, the corresponding alert instance is sent to said first user, but is skipped for said second user.

7. The method of claim 6, wherein said alert definition indicates that alert instances are to be sent to a third user also, wherein said generating sends said alert instance to said third user at a first time instance,

wherein a second suppression duration is received at a second time instance after said first time instance,

wherein, for each occurrence determined within said second suppression duration after said second time instance, the corresponding alert instance is sent to said first user but skipped for said third user.

8. The method of claim 7, wherein said continuous query is specified according to CQL (continuous query language).

9. A non-transitory machine readable medium storing one or more sequences of instructions for enabling a system to report results of processing of continuous event streams, wherein execution of said one or more instructions by one or more processors contained in said system enables said system to perform the actions of:

receiving a matching condition indicating a pattern of interest as a part of an alert definition in relation to a set of continuous event streams, wherein occurrences of said pattern of interest are desirable to be reported as corresponding alert instances;

receiving a suppression condition associated with said pattern of interest, wherein said suppression condition indicates the specific occurrences of said pattern of interest that are not to be reported as corresponding alert instances;

determining, in said set of continuous event streams, a sequence of occurrences of said pattern of interest; and

for each occurrence in said sequence of occurrences, generating an alert instance corresponding to the occurrence only if said suppression condition is not satisfied for the occurrence.

10. The machine readable medium of claim 9, wherein said determining comprises one or more instructions for:

obtaining a sequence of results of execution of a continuous query on said set of continuous event streams, said continuous query indicating a selection criteria and a moving time window, said selection criteria corresponding to said matching condition,

wherein said each of said sequence of results is obtained based on data values of said set of continuous event streams in a corresponding duration determined by said moving time window; and

identifying each of said sequence of results as corresponding to one of said sequence of occurrences of said pattern of interest in said set of continuous event streams,

wherein said generating generates said alert instance corresponding to each result only if said suppression condition is not satisfied for the result.

11. The machine readable medium of claim 10, wherein said generating skips the alert instance corresponding to a result if said suppression condition is satisfied for the result.

12. The machine readable medium of claim 11, wherein said suppression condition specifies a timing pattern for prior alert instances and a suppression duration,

wherein said generating, for each occurrence, skips the alert instance for the occurrence if the timing of alert instances prior to the occurrence satisfies said timing pattern and the timing of the occurrence is within said suppression duration.

13. The machine readable medium of claim 12, wherein said timing pattern is specified in the form of a threshold number of prior alert instances in a prior duration, wherein subsequent alert instances are suppressed for said suppression duration upon generation of the threshold number of prior alert instances in said prior duration thereby avoiding repetition of the alert instances beyond said threshold number in a duration of a sum of said prior duration and said suppression duration.

14. The machine readable medium of claim 12, wherein said alert definition indicates that alert instances are to be sent to a first user and a second user, wherein said suppression condition is specified associated with said second user but not said first user,

wherein for each occurrence determined within said suppression duration, the corresponding alert instance is sent to said first user, but is skipped for said second user.

15. The machine readable medium of claim 14, wherein said alert definition indicates that alert instances are to be sent to a third user also, wherein said generating sends said alert instance to said third user at a first time instance,

wherein a second suppression duration is received at a second time instance after said first time instance,

wherein, for each occurrence determined within said second suppression duration after said second time instance, the corresponding alert instance is sent to said first user but skipped for said third user.

16. A digital processing system comprising:

a processor;

a random access memory (RAM);

a machine readable medium to store one or more instructions, which when retrieved into said RAM and executed by said processor causes said digital processing system to report results of processing of continuous event streams, said digital processing system performing the actions of;

receiving a matching condition indicating a pattern of interest as a part of an alert definition in relation to a set of continuous event streams, wherein occurrences of said pattern of interest are desirable to be reported as corresponding alert instances;

receiving a suppression condition associated with said pattern of interest, wherein said suppression condition indicates the specific occurrences of said pattern of interest that are not to be reported as corresponding alert instances;

determining, in said set of continuous event streams, a sequence of occurrences of said pattern of interest; and

for each occurrence in said sequence of occurrences, generating an alert instance corresponding to the occurrence only if said suppression condition is not satisfied for the occurrence.

17. The digital processing system of claim 16, wherein said determining comprises:

obtaining a sequence of results of execution of a continuous query on said set of continuous event streams, said continuous query indicating a selection criteria and a moving time window, said selection criteria corresponding to said matching condition,

wherein said each of said sequence of results is obtained based on data values of said set of continuous event streams in a corresponding duration determined by said moving time window; and

identifying each of said sequence of results as corresponding to one of said sequence of occurrences of said pattern of interest in said set of continuous event streams,

wherein said generating generates said alert instance corresponding to each result only if said suppression condition is not satisfied for the result.

18. The digital processing system of claim 17, wherein said generating skips the alert instance corresponding to a result if said suppression condition is satisfied for the result.

19. The digital processing system of claim 18, wherein said suppression condition specifies a timing pattern for prior alert instances and a suppression duration,

wherein said generating, for each occurrence, skips the alert instance for the occurrence if the timing of alert instances prior to the occurrence satisfies said timing pattern and the timing of the occurrence is within said suppression duration.

20. The digital processing system of claim 19, wherein said timing pattern is specified in the form of a threshold number of prior alert instances in a prior duration, wherein subsequent alert instances are suppressed for said suppression duration upon generation of the threshold number of prior alert instances in said prior duration thereby avoiding repetition of the alert instances beyond said threshold number in a duration of a sum of said prior duration and said suppression duration.