Patent ID: 8887175
Filing Date: 2014-11-11
Classification: G06F,G06Q

Abstract:
1. An apparatus for administering incident pools for event and alert analysis in a distributed processing system, the apparatus comprising: assigning, by the incident analyzer, an incident received from one or more components of the distributed processing system to a pool of incidents; assigning, by the incident analyzer, to each incident assigned to the pool of incidents, a particular combined minimum time for inclusion of the incident in one or more pools; in response to a determination that the pool of incidents is closing, determining, by the incident analyzer, for each incident in the pool of incidents, whether the incident has met its combined minimum time for inclusion in one or more pools; if the incident has been in one or more pools for its combined minimum time, including, by the incident analyzer, the incident in the closed pool that results from the pool of incidents closing; if the incident has not been in one or more pools for its combined minimum time, moving, by the incident analyzer, the incident to a next pool including forwarding to the next pool, by the incident analyzer, any associations between the incident and any other incidents that are included in the pool; applying, by the incident analyzer, incident suppression rules using the incidents moved to the next pool, including preventing, in the next pool alerts that are only generated based on incidents that generated previous alerts in the closed pool by: applying, by the incident analyzer, incident creation rules to the incidents moved to the next pool, while omitting any duplicate incidents caused by moving the incident to the next pool.