Patent ID: 8880944

Claim:
A method of restarting event and alert analysis after a shutdown in a distributed processing system, the method comprising: identifying, by an incident analyzer, a shutdown condition of the distributed processing system, the incident analyzer including a plurality of event analyzers and a monitor that monitors the plurality of event analyzers, and each event analyzer corresponding to a plurality of event pools; upon determining, by the incident analyzer, that the shutdown was an unplanned shutdown: for each event analyzer, identifying the last event included in the last event pool that the event analyzer closed, by: identifying a last pool closed by the particular event analyzer by comparing the time log for each of the plurality of event pools; examining the events in the last pool closed to identify a last event in the last pool closed; wherein each event pool comprises a collection of events organized by time and each event in the plurality of event pools comprises an indication of a particular occurrence in or on a component of the distributed processing system; and restarting, by the incident analyzer, event and alert analysis at the event analyzer using the next event received by the event analyzer after the identified last event.