Dynamic Administration Of Event Pools For Relevant Event And Alert Analysis During Event Storms

• US 20120144020A1
• Filed: 12/07/2010
• Published: 06/07/2012
• Est. Priority Date: 12/07/2010
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Carey, James E., Markland, Matthew W., Sanders, Philip J.
• Granted Patent: US 8,737,231 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: H04L 43/0823 Errors, e.g. transmission errors

Abstract

Dynamic administration of event pools for relevant event and alert analysis during event storms including receiving, by an events analyzer from an events queue, a plurality of events from one or more components of the distributed processing system, each event including an occurred time and a logged time; creating, by the event analyzer, an events pool; determining whether an arrival rate of the events from the components of the distributed processing system is greater than a predetermined threshold; if the arrival rate is greater than the predetermined threshold, assigning, by the events analyzer, a plurality of events to the events pool in dependence upon their occurred time; and if the arrival rate is not greater than the predetermined threshold, assigning, by the events analyzer, a plurality of events to the events pool in dependence upon their logged time.

Claims

1. A method of dynamic administration of event pools for relevant event and alert analysis during event storms, the method comprising:

receiving, by an events analyzer from an events queue, a plurality of events from one or more components of the distributed processing system, each event including an occurred time and a logged time;

creating, by the event analyzer, an events pool;

determining whether an arrival rate of the events from the components of the distributed processing system is greater than a predetermined threshold;

if the arrival rate is greater than the predetermined threshold, assigning, by the events analyzer, a plurality of events to the events pool in dependence upon their occurred time; and

if the arrival rate is not greater than the predetermined threshold, assigning, by the events analyzer, a plurality of events to the events pool in dependence upon their logged time.

2. The method of claim 1 wherein assigning, by the events analyzer, a plurality of events to the events pool in dependence upon their occurred time further comprises determining whether the occurred time of the event is after a start time of the pool and before a close time of the pool.

3. The method of claim 2 wherein the start time of the pool comprises the time a first event is assigned to the pool.

4. The method of claim 2 wherein the close time of the pool comprises a predetermined initial period of time after the start time and any extensions of time associated with any events assigned to the pool.

5. The method of claim 2 wherein the close time of the pool comprises a maximum duration of time after the start time.

6. The method of claim 1 further comprising:

determining that a new arrival rate of the events in the database is less than the predetermined threshold; and

assigning, by the events analyzer, a plurality of events to the events pool in dependence upon their logged time.

7. A system for dynamic administration of event pools for relevant event and alert analysis during event storms, the system comprising a computer processor, a computer memory operatively coupled to the computer processor, the computer memory having disposed within it computer program instructions capable, when executed by the computer processor, of causing the system to carry out the steps of:

receiving, by an events analyzer from an events queue, a plurality of events from one or more components of the distributed processing system, each event including an occurred time and a logged time;

creating, by the event analyzer, an events pool;

determining whether an arrival rate of the events from the components of the distributed processing system is greater than a predetermined threshold;

if the arrival rate is greater than the predetermined threshold, assigning, by the events analyzer, a plurality of events to the events pool in dependence upon their occurred time; and

if the arrival rate is not greater than the predetermined threshold, assigning, by the events analyzer, a plurality of events to the events pool in dependence upon their logged time.

8. The system of claim 7 wherein assigning, by the events analyzer, a plurality of events to the events pool in dependence upon their occurred time further comprises determining whether the occurred time of the event is after a start time of the pool and before a close time of the pool.

9. The system of claim 8 wherein the start time of the pool comprises the time a first event is assigned to the pool.

10. The system of claim 8 wherein the close time of the pool comprises a predetermined initial period of time after the start time and any extensions of time associated with any events assigned to the pool.

11. The system of claim 8 wherein the close time of the pool comprises a maximum duration of time after the start time.

12. The system of claim 8 wherein the computer memory has disposed within it computer program instructions capable, when executed by the computer processor, of causing the system to carry out the steps of:

determining that a new arrival rate of the events in the database is less than the predetermined threshold; and

assigning, by the events analyzer, a plurality of events to the events pool in dependence upon their logged time.

13. A computer program product for dynamic administration of event pools for relevant event and alert analysis during event storms, the computer program product disposed upon a computer readable medium, the computer program product comprising computer program instructions for:

receiving, by an events analyzer from an events queue, a plurality of events from one or more components of the distributed processing system, each event including an occurred time and a logged time;

creating, by the event analyzer, an events pool;

determining whether an arrival rate of the events from the components of the distributed processing system is greater than a predetermined threshold;

if the arrival rate is greater than the predetermined threshold, assigning, by the events analyzer, a plurality of events to the events pool in dependence upon their occurred time; and

if the arrival rate is not greater than the predetermined threshold, assigning, by the events analyzer, a plurality of events to the events pool in dependence upon their logged time.

14. The computer program product of claim 13 wherein computer program instructions for assigning, by the events analyzer, a plurality of events to the events pool in dependence upon their occurred time further comprise computer program instructions for determining whether the occurred time of the event is after a start time of the pool and before a close time of the pool.

18. The computer program product of claim 13 further comprising computer program instructions for:

determining that a new arrival rate of the events in the database is less than the predetermined threshold; and

assigning, by the events analyzer, a plurality of events to the events pool in dependence upon their logged time.

19. The computer program product of claim 13 wherein the computer readable medium further comprises a recording medium.

20. The computer program product of claim 13 wherein the computer readable medium further comprises a transmission medium.

16. The computer program product of claim 16 wherein the close time of the pool comprises a predetermined initial period of time after the start time and any extensions of time associated with any events assigned to the pool.

15. The computer program product of claim 16 wherein the start time of the pool comprises the time a first event is assigned to the pool.

17. The computer program product of claim 16 wherein the close time of the pool comprises a maximum duration of time after the start time.