Patent ID: 8880943

Claim:
A system for restarting event and alert analysis after a shutdown in a distributed processing system, the system comprising a computer processor, a computer memory operatively coupled to the computer processor, the computer memory having disposed within it computer program instructions capable, when executed by the computer processor, of causing the system to carry out the steps of: identifying, by an incident analyzer, a shutdown condition of the distributed processing system, the incident analyzer including a plurality of event analyzers and a monitor that monitors the plurality of event analyzers, and each event analyzer corresponding to a plurality of event pools; upon determining, by the incident analyzer, that the shutdown was an unplanned shutdown: for each event analyzer, identifying the last event included in the last event pool that the event analyzer closed, by: identifying a last pool closed by the particular event analyzer by comparing the time log for each of the plurality of event pools; examining the events in the last pool closed to identify a last event in the last pool closed; wherein each event pool comprises a collection of events organized by time and each event in the plurality of event pools comprises an indication of a particular occurrence in or on a component of the distributed processing system; and restarting, by the incident analyzer, event and alert analysis at the event analyzer using the next event received by the event analyzer after the identified last event.