Sorted event monitoring by context partition

• US 9,584,379 B2
• Filed: 06/20/2013
• Issued: 02/28/2017
• Est. Priority Date: 06/20/2013
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Klimov, Aleksandr, Filimonov, Vitaly, Zakonov, Alexandre
• Primary Examiner(s): KATSIKIS, KOSTAS J
• Application Number:
  US13/923,095
• Publication Number:
  US 20140379892A1
• Time in Patent Office: 1,349 Days
• Field of Search: 709/224
• US Class Current: 1/1
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3072 where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: G06F 2201/865 Monitoring of software
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation

Abstract

An event monitoring system that includes two stages, an event sorting stage and an event processing stage. The event sorting stage receives events provided by at least one application, and includes multiple event sorting systems. The event processing stage includes at least one event processing system that processes events forwarded by the event sorting stage. The event processing system(s) is/are capable of processing events that fall within a particular set of one or more context partitions that correspond to the respective event processing system. As the event sorting system receives an event, the event sorting system identifies which context partition the event falls within. The event sorting system then identifies the event processing system that corresponds to the identified context partition of the event, and then forwards the event to the identified event processing system. The event processing system then applies the set of one or more monitoring rules.

Claims

1. A system for monitoring and processing computer-generated events, the system comprising:

one or more computer processors; and

computer readable data storage having stored therein computer executable instructions which, when executed upon the one or more processors, cause the system to instantiate;

an event sorting stage comprising a plurality of event sorting systems; and

an event processing stage comprising a plurality of distinct event processing systems, each of the event processing systems being configured to process events that fall within one of a plurality of distinct context partitions, each context partition being defined by a particular and distinct set of characteristics;

wherein each of the plurality of event sorting systems are configured to receive one or more events from one or more applications and each event sorting system is configured, in response to receiving at least one of the one or more events, to;

identify a set of characteristics possessed by the at least one received event;

based on the identified set of characteristics possessed by the at least one received event, identify a context partition corresponding to the identified set of characteristics possessed by the at least one received event;

identify the event processing system that corresponds to the identified context partition of the at least one received event; and

forward the at least one received event to the identified event processing system; and

wherein each of the event processing systems is configured to;

process events received from an event sorting stage and falling within the particular context partition that corresponds to the each event processing system by applying monitoring rules to the events received from the event sorting stage.

2. The system in accordance with claim 1, wherein a particular application of the one or more applications is a distributed application.

3. The system in accordance with claim 2, wherein the event sorting stage is distributed such that a first plurality of events generated by a first part of the distributed particular application are received at a first event sorting system of the plurality of event sorting systems and a second plurality of events generated by a second part of the particular distributed application are received at a second event sorting system of the plurality of event sorting systems.

4. The system in accordance with claim 1, wherein the event processing stage is distributed.

5. The system in accordance with claim 4, wherein the event processing stage comprises at least a first event processing system and a second event processing system, wherein the first event processing system processes events that fall within a first set of one or more context partitions, and the second event processing system processes events that fall within a second set of one or more context partitions.

6. The system in accordance with claim 5, wherein the first event processing system has a first processor-addressable data vessel usable by code executing on the first event processing system, and wherein the second event processing system has a second processor-addressable data vessel usable by code executing on the second event processing system.

7. The system in accordance with claim 1, wherein a context partition of an event is identified using at least a customer identifier.

8. The system in accordance with claim 1, wherein a context partition of an event is identified using at least an application identifier.

9. The system in accordance with claim 1, wherein a context partition of an event is identified using at least hosted service name.

10. The system in accordance with claim 1, wherein a context partition of an event is identified using at least a role identifier.

11. The system in accordance with claim 1, wherein a context partition of an event is identified using at least a namespace.

12. The system in accordance with claim 1, wherein a context partition of an event is identified using at least a network site identifier.

13. The system in accordance with claim 1, wherein a context partition of an event is identified using at least a time identifier.

14. The system in accordance with claim 1, wherein applying monitoring rules to events received from the event sorting stage comprises:

accessing an input event;

using the input event to generate an output event; and

taking action upon the generated output event.

15. The system in accordance with claim 14, wherein taking action upon the output event comprises:

saving the output event to a data store.

16. The system in accordance with claim 14, wherein taking action upon the output event comprises:

looping back the output event to an output context partition such that the output event is treated as an new input event to an event processing system that corresponds to the output context partition.

17. The system in accordance with claim 16, wherein the output context partition of the output event is different than the context partition of the original input event.

18. The system in accordance with claim 14, wherein taking action upon the output event comprises:

transmitting the output event outside of the system.

19. A method for an event processing system to process an input event, the method comprising:

executing computer-executable instructions upon one or more processors of the event processing system, thereby causing the event processing system to;

receiving an input event originating from a distributed application, the input event forwarded from an event sorting stage which identifies a set of characteristics possessed by the input event and, based on the identified set of characteristics possessed by the input event, identifies a corresponding context partition and forwards the input event to the event processing system associated with the corresponding context partition; and

applying a monitoring rule to the input event by;

generating a new event based on the monitoring rule as applied to the input event;

determining whether the input event has one or more particular characteristics; and

in response to determining that the input event has the one or more particular characteristics;

using the input event to generate an output event which has an output context partition; and

performing one or more of;

saving the output event to a data store;

looping back the output event such that the output event is treated as an input event to another event processing system that corresponds to the output context partition;

or

transmitting the output event outside of the system.

20. A computer program product comprising one or more computer-readable storage devices having stored thereon computer-executable instructions that, when executed by one or more processors of an event processing system, cause the event processing system to perform a method for processing an input event, the method comprising:

receiving an input event originating from a distributed application, the input event forwarded from an event sorting stage which identifies a set of characteristics possessed by the input event and, based on the identified set of characteristics possessed by the input event, identifies a corresponding context partition and forwards the input event to the event processing system, the context partition having been determined by the event sorting stage based on at least one of a customer identifier, an application identifier, hosted service name, a role identifier, a namespace, a network site identifier, or a time identifier;

applying a monitoring rule to the event by;

determining whether the input event has one or more particular characteristics;

in response to determining that the event has the one or more particular characteristics, using the input event to generate an output event; and

processing the generated output event.