Efficiently delivering event messages using compiled indexing and paginated reporting

• US 8,738,583 B2
• Filed: 02/09/2011
• Issued: 05/27/2014
• Est. Priority Date: 02/09/2011
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Zhang, Roulei, Desai, Sohag, Patel, Hemant
• Primary Examiner(s): Ehichioya, Fred I
• Assistant Examiner(s): Mobin, Hasanul
• Application Number:
  US13/024,218
• Publication Number:
  US 20120203794A1
• Time in Patent Office: 1,203 Days
• Field of Search: None
• US Class Current: 707/661
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 16/24539 using cached or materialised query results

Abstract

Techniques for compiled indexing and paginated reporting are described. Event messages, having sequential identifiers, are received and stored in a working table. The working table is renamed as a rollover table upon receiving a threshold number of the event messages and a new working table is created. A reference to the rollover table is stored in a management table. Summary data which summarizes each rollover table according to predetermined criteria is stored in a summary table with the reference to the corresponding rollover table. When a query to the event messages is received, a response to the query is generated based on the contents of the summary table and management table. The response may also include a predetermined quantity of event messages based on a dimension of a window of a graphical user interface of a client computer which issued the query.

Claims

1. A data processing method comprising:

receiving a plurality of event messages from internetworking devices, each of the event messages including a sequential identifier identifying a time at which a device generated and sent the event message;

storing the event messages in a working table in a data storage unit;

when a number of the event messages exceeds a specified threshold number of messages, determining a particular range of sequential identifiers of the event messages stored in the working table, renaming the working table as a rollover table, and creating a new working table to receive a plurality of subsequent event messages;

wherein the particular range of sequential identifiers indicates a minimum value and a maximum value determined from the sequential identifiers;

wherein the minimum value corresponds to a first event message timestamp associated with a first event message stored in the rollover table;

wherein the maximum value corresponds to a last event message timestamp associated with a last event message stored in the rollover table;

repeating the preceding receiving, storing, and creating as additional event messages are received and for additional rollover tables each storing the specified threshold number of messages;

storing a reference, to a particular rollover table, in a management table, a wherein the reference identifies the particular range of sequential identifiers included in the rollover table;

generating summary data that summarizes at least a subset of the event messages included in the rollover tables according to one or more criteria;

storing, in a summary table, the summarized data in association with the reference to the rollover tables;

wherein the method is performed by one or more computing devices.

2. The method of claim 1, wherein the one or more criteria identify information which was requested by a previously received query for at least a subset of the event messages included in the rollover tables.

3. The method of claim 1, wherein the one or more criteria identify information anticipated to be requested in a future query for at least a subset of the event messages included in the rollover tables.

4. The method of claim 1, further comprising:

receiving, from a client computer, a query which identifies a subset of the event messages in any of the rollover tables and the one or more criteria;

generating a response to the query based, at least in part, on the reference to the rollover table.

5. The method of claim 4, wherein the response to the query is based at least in part on the summary data according to the one or more criteria.

6. The method of claim 4, wherein the response includes at least a portion of the subset of the event messages identified by the query.

7. The method of claim 6, wherein the portion is a page of data based on a dimension of a window of a graphical user interface of the client computer.

8. The method of claim 1, further comprising:

receiving, from a client computer over a network, a query identifying a subset of the plurality of event messages;

in response to receiving the query from the client,

determining, based on references in the management table, a range of rollover tables that store the subset of the plurality of event messages;

determining a total count of records relevant to the query, wherein the determination is based, at least in part, on the references stored in the management table, and summary data stored in the summary table.

9. The method of claim 8, further comprising:

determining a first count of records relevant to the query based on a count of the relevant records in a first rollover table and a last rollover table, the first and last rollover tables corresponding to the first and last rollover tables in the range of rollover tables identified by the query;

determining a second count of records relevant to the query based on a sum of at least a subset of the summary data in the summary table;

determining the total count of records relevant to the query based, at least in part, on the first count and the second count;

sending, to the client computer, a predetermined quantity of the subset of the event messages identified by the query and the total count of records.

10. The method of claim 9, wherein the predetermined quantity is based on a dimension of a window of a graphical user interface of the client computer.

11. A non-transitory computer-readable storage medium storing one or more sequences of instructions which, when executed by one or more processors, cause the one or more processors to perform:

receiving a plurality of event messages from internetworking devices, each of the event messages including a sequential identifier identifying a time at which a device generated and sent the event message;

storing the event messages in a working table in a data storage unit;

when a number of the event messages exceeds a specified threshold number of messages, determining a particular range of sequential identifiers of the event messages stored in the working table, renaming the working table as a rollover table and creating a new working table to receive a plurality of subsequent event messages;

wherein the particular range of sequential identifiers indicates a minimum value and a maximum value determined from the sequential identifiers;

wherein the minimum value corresponds to a first event message timestamp associated with a first event message stored in the rollover table;

wherein the maximum value corresponds to a last event message timestamp associated with a last event message stored in the rollover table;

repeating the preceding receiving, storing, and creating as additional event messages are received and for additional rollover tables each storing the specified threshold number of messages;

storing a reference, to a particular rollover table, in a management table, wherein the reference identifies the particular range of sequential identifiers included in the rollover table;

generating summary data that summarizes at least a subset of the event messages included in the rollover tables according to one or more criteria;

storing, in a summary table, the summarized data in association with the reference to the rollover tables.

12. The non-transitory computer-readable storage medium of claim 11, wherein the one or more criteria identify information which was requested by a previously received query for at least a subset of the event messages included in the rollover tables.

13. The non-transitory computer-readable storage medium of claim 11, wherein the one or more criteria identify information anticipated to be requested in a future query for at least a subset of the event messages included in the rollover tables.

14. The non-transitory computer-readable storage medium as recited in claim 11, further comprising instructions for carrying out the steps of:

receiving, from a client computer, a query which identifies a subset of the event messages in any of the rollover tables and the one or more criteria;

generating a response to the query based, at least in part, on the reference to the rollover table.

15. The non-transitory computer-readable storage medium as recited in claim 14, wherein the response to the query is based at least in part on the summary data according to the one or more criteria.

16. The non-transitory computer-readable storage medium as recited in claim 14, wherein the response includes at least a portion of the subset of the event messages identified by the query.

17. The non-transitory computer-readable storage medium as recited in claim 16, wherein the portion is a page of data based on a dimension of a window of a graphical user interface of the client computer.

18. The non-transitory computer-readable storage medium as recited in claim 11, further comprising instructions for carrying out the steps of:

receiving, from a client computer over a network, a query identifying a subset of the plurality of event messages;

in response to receiving the query from the client,

determining, based on references in the management table, a range of rollover tables that store the subset of the plurality of event messages;

determining a total count of records relevant to the query, wherein the determination is based, at least in part, on the references stored in the management table, and summary data stored in the summary table.

19. The non-transitory computer-readable storage medium as recited in claim 18, further comprising instructions for carrying out the steps of:

determining a first count of records relevant to the query based on a count of the relevant records in a first rollover table and a last rollover table, the first and last rollover tables corresponding to the first and last rollover tables in the range of rollover tables identified by the query;

determining a second count of records relevant to the query based on a sum of at least a subset of the summary data in the summary table;

determining the total count of records relevant to the query based, at least in part, on the first count and the second count;

sending, to the client computer, a predetermined quantity of the subset of the event messages identified by the query and the total count of records.

20. The non-transitory computer-readable storage medium as recited in claim 19, wherein the predetermined quantity is based on a dimension of a window of a graphical user interface of the client computer.