Dynamic administration of event pools for relevant event and alert analysis during event storms

• US 8,737,231 B2
• Filed: 12/07/2010
• Issued: 05/27/2014
• Est. Priority Date: 12/07/2010
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Carey, James E., Markland, Matthew W., Sanders, Philip J.
• Primary Examiner(s): Thompson, Jr., Otis L
• Assistant Examiner(s): PANCHOLI, RINA C
• Application Number:
  US12/961,687
• Publication Number:
  US 20120144020A1
• Time in Patent Office: 1,267 Days
• Field of Search: None
• US Class Current: 370/237
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: H04L 43/0823 Errors, e.g. transmission errors

Abstract

Dynamic administration of event pools for relevant event and alert analysis during event storms including receiving, by an events analyzer from an events queue, a plurality of events from one or more components of the distributed processing system, each event including an occurred time and a logged time; creating, by the event analyzer, an events pool; determining whether an arrival rate of the events from the components of the distributed processing system is greater than a predetermined threshold; if the arrival rate is greater than the predetermined threshold, assigning, by the events analyzer, a plurality of events to the events pool in dependence upon their occurred time; and if the arrival rate is not greater than the predetermined threshold, assigning, by the events analyzer, a plurality of events to the events pool in dependence upon their logged time.

Claims

1. A system for dynamic administration of event pools for relevant event and alert analysis during event storms in a distributed processing system, the system comprising a computer processor, a computer memory operatively coupled to the computer processor, the computer memory having disposed within it computer program instructions capable, when executed by the computer processor, of causing the system to carry out the steps of:

receiving, by an events analyzer, a plurality of events from a plurality of components of the distributed processing system, each event including an occurred time and a logged time,

wherein the occurred time is a time the event was generated as a result of an occurrence that cause the event, and

wherein the logged time is a time the event is included in the events queue;

creating, by the events analyzer, an events pool;

determining whether an arrival rate of the events from the components of the distributed processing system is greater than a predetermined threshold;

if the arrival rate is greater than the predetermined threshold, assigning, by the events analyzer, a plurality of events to the events pool, each of the assigned plurality of events having a respective occurred time after a start time of the pool and before a close time of the pool; and

if the arrival rate is not greater than the predetermined threshold, assigning, by the events analyzer, a plurality of events to the events pool, each of the assigned plurality of events having a respective a logged time after a start time of the pool and before a close time of the pool.

2. The system of claim 1 wherein the start time of the pool comprises the time a first event is assigned to the pool.

3. The system of claim 1 wherein the close time of the pool comprises a predetermined initial period of time after the start time and any extensions of time associated with any events assigned to the pool.

4. The system of claim 1 wherein the close time of the pool comprises a maximum duration of time after the start time.

5. The system of claim 1 wherein the computer memory has disposed within it computer program instructions capable, when executed by the computer processor, of causing the system to carry out the steps of:

determining that a new arrival rate of the events from the components of the distributed processing system is less than the predetermined threshold; and

assigning, by the events analyzer, a plurality of events to the events pool in dependence upon their logged time.

6. A computer program product for dynamic administration of event pools for relevant event and alert analysis during event storms in a distributed processing system, the computer program product disposed upon a computer readable storage medium, wherein the computer readable storage medium is not a signal, the computer program product comprising computer program instructions for:

receiving, by an events analyzer, a plurality of events from a plurality of components of the distributed processing system, each event including an occurred time and a logged time,

wherein the occurred time is a time the event was generated as a result of an occurrence that cause the event, and

wherein the logged time is a time the event is included in the events queue;

creating, by the events analyzer, an events pool;

determining whether an arrival rate of the events from the components of the distributed processing system is greater than a predetermined threshold;

if the arrival rate is greater than the predetermined threshold, assigning, by the events analyzer, a plurality of events to the events pool, each of the assigned plurality of events having a respective occurred time after a start time of the pool and before a close time of the pool; and

if the arrival rate is not greater than the predetermined threshold, assigning, by the events analyzer, a plurality of events to the events pool, each of the assigned plurality of events having a respective logged time after a start time of the pool and before a close time of the pool.

7. The computer program product of claim 6 wherein the start time of the pool comprises the time a first event is assigned to the pool.

8. The computer program product of claim 6 wherein the close time of the pool comprises a predetermined initial period of time after the start time and any extensions of time associated with any events assigned to the pool.

9. The computer program product of claim 6 wherein the close time of the pool comprises a maximum duration of time after the start time.

10. The computer program product of claim 6 further comprising computer program instructions for:

determining that a new arrival rate of the events from the components of the distributed processing system is less than the predetermined threshold; and

assigning, by the events analyzer, a plurality of events to the events pool in dependence upon their logged time.