Typicality filtering of event indicators for information technology resources

• US 7,496,660 B2
• Filed: 03/16/2004
• Issued: 02/24/2009
• Est. Priority Date: 03/16/2004
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: MacLellan, Scot, Lake, John Michael, Blaisdell, Russell C.
• Primary Examiner(s): Etienne; Ario
• Assistant Examiner(s): Williams; Clayton R
• Application Number:
  US10/801,211
• Publication Number:
  US 20050210478A1
• Time in Patent Office: 1,806 Days
• Field of Search: None
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0622 based on time
• CPC Class Codes: H04L 41/0627 by acting on the notification or alarm source
• CPC Class Codes: H04L 43/16 Threshold monitoring

Abstract

A monitor for information technology resources improved by introducing typicality filters to analyze potential event indicators such as alerts. A typicality filter keeps a time-dependent history of the frequency of occurrence of an associated event, wherein time is segmented into monitoring periods. At the end of each monitoring period, a present count of occurrences of the event is determined, and compared with the numbers of occurrences of that event in a subset of monitoring periods read from the history. If the present count exceeds the number of occurrences of the event in a predetermined proportion of the subset of historical monitoring periods, a first action is invoked; otherwise, a second action is invoked.

Claims

1. A method suitable for filtering events in an information technology resource monitor, comprising the steps of:

determining by a typicality filter a present count of occurrences of an event for a present monitoring period;

comparing by the typicality filter the present count with numbers of occurrences of the event in a plurality of earlier monitoring periods;

invoking by the typicality filter a first action if the present count exceeds a predetermined proportion of the numbers of occurrences of the event in the plurality of earlier monitoring periods; and

invoking by the typicality filter a second action if the present count does not exceed the predetermined proportion of the numbers of occurrences of the event in the plurality of earlier monitoring periods;

wherein the plurality of earlier monitoring periods all begin at the same times on consecutive days previous to the present monitoring period.

2. The method of claim 1, wherein the predetermined proportion is a majority.

3. The method of claim 1, wherein the second action includes logging the present count without taking further corrective action.