Patent Document

FIELD 
     Aspects described herein relate to a computer system that manages its computer resources and system operation for computer applications according to a mapped policy based on a detected event pattern. 
     BACKGROUND 
     As modern software-based systems and applications proliferate, it is important to effectively manage dynamic computer resources and service-specific user requirements. An increasingly significant requisite for software-based systems is the ability to handle resource variability, ever-changing user needs, and system faults. However, the complexity of computer systems often presents difficulties for protecting a computer system. Rectifying faults and recovering from disasters in a timely manner is often error-prone, labor-intensive, and expensive. 
     According to traditional approaches, standard programming practices, such as capacitating extensive error handling capabilities through exception-catching schemes, contribute towards rendering systems fault-tolerant or self-adaptive. Traditional approaches are typically tightly coupled with software code and are highly application-specific. Designs that enable software systems to heal themselves of system faults and to survive malicious attacks may significantly improve the reliability and consistency of technology in the field. 
     BRIEF SUMMARY 
     The following presents a simplified summary in order to provide a basic understanding of some aspects of the disclosure. The summary is not an extensive overview of the disclosure. It is neither intended to identify key or critical elements of the disclosure nor to delineate the scope of the disclosure. The following summary merely presents some concepts of the disclosure in a simplified form as a prelude to the description below. 
     Aspects of the disclosure relate to methods, computer-readable media, and apparatuses that support self-management as a suite of processes by which a computer system manages its own operation, possibly without human intervention. The processes may enable the computer systems to become self-configuring (dynamic adaptation to changing environments), self-healing (the discovery and diagnosis of disruption and the corresponding reaction), self-optimizing (the monitoring and modulation of resources automatically), and self-protecting (where computer systems anticipate, detect, and protect themselves from attack). 
     In accordance with aspects of the embodiments, a complex event processing (CEP) system analyzes events on the fly and provides solutions that are directed to several areas within a computer system. An engine may be built from a complex array of algorithms that detects and captures events. The engine acts as a framework that may be situated in every platform upon which software applications are built. Interaction between the CEP engines from different software applications across a computer system yields high-throughput results for event analysis. This approach may consequently result in an ever-evolving, sustainable intelligent neural network that can predictive self-recuperate and withstand catastrophes. 
     In accordance with various aspects of the embodiments, an enterprise may deploy various agents that monitor the status and health of the computing resources of an enterprise-wide computing system. An analysis engine aggregates and analyzes monitoring information provided by monitoring agents, e.g., bandwidth/processor/memory utilization. If the analysis engine determines that a computing resource is approaching a critical status, the analysis engine may issue a command to that computing resource. The command may indicate how the computing resource should change its behavior so as to minimize downtime of an end-user service provided by that computing resource. 
     In accordance with various aspects of the embodiment, servers in a computer system monitor event activity for each software application that is executing on the respective server. An engine at a server monitors an event data stream for a software application as captured by agents and processes the event data stream by filtering the stream by a filter according to appropriate rules. The engine then determines the event pattern from the filtered stream, and if the determined (detected) event pattern matches one of previous (known) event patterns, the engines selects the corresponding policy to appropriately affect the server for supporting the application. 
     In accordance with various aspects of the embodiment, if an engine at a server is not able to match a detected event pattern from previous event patterns, the server notifies a central computer with the event information. The central computer queries other servers in the computer system to check whether the detected event pattern is known at any other server. If so, the central computer forwards returned event data (e.g., with the appropriate policy for the detected event pattern) from the positively responding server to the requesting server. 
     In accordance with various aspects of the embodiments, availability is achieved with a multi-layered effort. To increase the platform autonomy and overall availability, a computer system problem is identified and repaired. In order to identify and resolve problems and failures in a computer system and to increase availability and scalability, the state of the computer system is inferred from the way it looks to the outside, where agents are installed at the servers of the computer system. 
     In accordance with various aspects of the embodiments, an engine is built with several analytics algorithms. The engine is capable of discovering sophisticated patterns in an event stream. Based on the monitoring, the engine processes the information streams in near real-time, including and not limited to: aggregation of smaller events in order to provide a high-level view of a process such as statistics, summaries, and the like; correlation of events generated by different event sources; and long-term metrics/measurements. 
     In accordance with various aspects of the embodiments, a computer system may evolve and become smarter over time as more and more events are captured. Frequent event patterns in sessions are found using a priori algorithm. A new event pattern that doesn&#39;t fall under any existing pattern may be identified as a potential new event pattern. For example, access patterns may be clustered into use cases based on similarity, and a change in usage patterns may be studied. Also, user process events may be processed and correlated with other events occurring across a computer system. This approach may result in disaster recovery, system self-management, and self-healing systems in real-time or in near real-time. 
     In accordance with various embodiments of the disclosure, an engine monitors the patterns of system events across computer domains. Frequency of events such as central process unit (CPU) usage at a certain time of the day, logs for a failure of a process, and glitches in data center performance for a significant amount of time may be captured as events with a certain statistical probability and score. The computer system diagnoses faulty components, potentially reducing analysis time from days to seconds. Once diagnosed, the computer system may quickly take corrective action and automatically restore application services. This approach may ensure that business-critical applications and essential system services can continue uninterrupted in the event of software failures, major hardware component failures, and even software misconfiguration problems 
     Various aspects described herein may be embodied as a method, an apparatus, or as one or more computer-readable media storing computer-executable instructions. Accordingly, those aspects may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Any and/or all of the method steps described herein may be implemented as computer-readable instructions stored on a computer-readable medium, such as a non-transitory computer-readable medium. In addition, various signals representing data or events as described herein may be transferred between a source and a destination in the form of light and/or electromagnetic waves traveling through signal-conducting media such as metal wires, optical fibers, and/or wireless transmission media (e.g., air and/or space). 
     Aspects of the disclosure have been described in terms of illustrative embodiments thereof. Numerous other embodiments, modifications, and variations within the scope and spirit of the disclosure will occur to persons of ordinary skill in the art from a review of this disclosure. For example, one of ordinary skill in the art will appreciate that the steps illustrated herein may be performed in other than the recited order, and that one or more steps illustrated may be optional in accordance with aspects of the disclosure. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       The present disclosure is illustrated by way of example and not limited in the accompanying figures in which like reference numerals indicate similar elements and in which: 
         FIG. 1  shows an agent-based architecture for managing a computer system according to one or more aspects of the present architecture. 
         FIG. 2  shows a computer system for managing computer resources and system operation according to one or more aspects of the present disclosure. 
         FIG. 3  shows a computing device environment for managing a computer system according to one or more aspects of the present disclosure. 
         FIG. 4  shows a software architecture for managing computer resources and operation of the computer systems illustrated in  FIGS. 1-2  according to one or more illustrative embodiments. 
         FIG. 5  shows a flowchart with a generic approach of supporting self-configuration, self-healing, self-optimization, and/or self-protection processes illustrated in  FIG. 4  according to one or more aspects of the present disclosure. 
         FIG. 6  shows a process supporting self-healing and/or self-protection in the computer systems illustrated in  FIGS. 1-2  according to one or more aspects of the present disclosure. 
         FIG. 7  shows a process supporting self-optimization and/or self-configuration in the computer systems illustrated in  FIGS. 1-2  according to one or more aspects of the present disclosure. 
         FIG. 8  shows a dynamic view of event information inputs and corresponding results presented to a monitoring and control system according to one or more aspects of the present disclosure. 
         FIG. 9  shows event inputs that are filtered and processed by an agent according to one or more aspects of the present disclosure. 
         FIG. 10  shows an agent responsive to a data query for filtered event data according to one or more aspects of the present disclosure. 
         FIG. 11  shows queried data that is sent by the agent through a data interface to specific targets according to one or more aspects of the present disclosure. 
         FIG. 12  shows output event data from an engine that is input event data to itself according to one or more aspects of the present disclosure. 
     
    
    
     DETAILED DESCRIPTION 
     In the following description of the various embodiments, reference is made to the accompanying drawings, which form a part hereof, and in which is shown by way of illustration various embodiments in which the disclosure may be practiced. It is to be understood that other embodiments may be utilized and structural and functional modifications may be made without departing from the scope and spirit of the present disclosure. 
     In accordance with various aspects of the embodiments, computer devices in a computer system monitor event activity for each software application that is executing on the respective computing device. An engine at a computing device monitors an event data stream for a software application as captured by agents and processes the event data stream by filtering the stream by a filter according to appropriate rules. The computing device then determines the event pattern from the filtered stream, and if the detected event pattern matches one of previous event patterns, the engine selects the corresponding policy to appropriately affect the computing device for supporting the application. If the computing device is not able to match a detected event pattern from previous event patterns, the computing device notifies a central computing device with the event information. The central computing device queries other computing devices in the computer system to check whether the detected event pattern has occurred at any other computing device in the system. If so, the central computing device forwards returned event data (e.g., with the appropriate policy for the detected event pattern) from the positively responding computing device to the requesting computing device. 
       FIG. 1  shows an agent-based architecture for managing computer system  100  according to one or more aspects of the present architecture. Computer system  100  includes centralized complex event processing (CEP) engine (hub)  101  that interacts with end points  102 - 104 , which may include application servers, desktop, mobile or back end systems. End points  102 - 104  are equipped with CEP agents  110 - 112 , respectively, that execute for every action. CEP engine  101  may process event streams as sets and perform set type operations, typically using continuous queries (e.g., a structured query language (SQL) in which SQL-type queries can operate over time and buffer windows). 
     The multi-agent redundancy shown in computer system  100  may facilitate software adaptation with a dynamic environment. Hardware and software layers may cooperatively adapt to the changing demands of system resources and software applications to develop an integrated cross-layer adaptive system. 
     There may be a number of benefits for using software agents as building blocks within computer system  100 , where a software agent may comprise a computer program that acts with CEP engine  101  in a relationship of agency. For example, agents may dynamically compose in system  100  when components of the system  100  are unknown until runtime. Agents can then be added to a system in runtime. Also, software can be customized over its lifetime, even by the end-users too. These and other benefits contribute to more robust systems 
     With an aspect of the embodiments, different degrees of distributed processing in a computer system may be supported. For example, processing of event data streams from agents may be concentrated at centralized CEP engine  101  as shown in  FIG. 1 . However, as will be discussed with  FIG. 2 , event data streams may be processed at servers that interact with a centralized CEP engine according to aspect of the disclosures. 
       FIG. 2  shows computer system  200  for managing computer resources according to one or more aspects of the present disclosure. According to aspects of the disclosure, computer system  200  addresses deficiencies of traditional systems including weak or no analytics, limited capabilities for detection and refinable situations, lack of standard generated alerts and automated responses, weak or no reporting (where dashboards and reports tend to be “event aggregators” and do not filter out “noise”), unscaleable centralized architecture that may be unable to manage millions of events in a heterogeneous distributed system, non-real time operation, and reactive responsiveness (i.e., not proactive). 
     Computer system  200  supports different software applications  250   a ,  250   b  (application a) and  251   a ,  251   b  (application b) spanning servers  202 - 204  that interact with central computer  201  (particularly central CEP engine  210 ) as will be discussed in further detail. Computer system  200  may support a software application through one or more servers. Also, while not explicitly shown, a plurality of software applications may be executed to support a client. 
     Software applications  250   a,b  and  251   a,b  may be directed a variety of different areas such as banking, retail, manufacturing, education, and the like. For example, software applications may support financial trading, auditing entries, order management, account management, and presenting financial information for clients  240   a , 240   b  (client A) and  241   a , 241   b  (client B). As will be further discussed, computer system  200  monitor event information associated with the different applications and may modify allocation of computer resources (e.g., computing resource  252  at server  202  according to the appropriate policy  224 ) for the different applications. While not explicitly shown in  FIG. 2 , additional computing resources (e.g., network, memory allocation of random access memory, disk storage, and the like, processing (CPU) bandwidth, and/or process queue length,) may be located at any server  202 - 204  in order to support software applications at the server. 
     Managing computer system  200  may be categorized in three stages. First, events are detected across computer system  200  in near real-time and are normalized and contextualized. Second, events are aggregated across multiple sources, correlated with historical data, and refined. Third, in response to the above event analysis, computer system  200  manages resources and processes by invoking actions in near real-time. For example, engine  211  may process event information  270  when monitoring usage of resource  252  by for application  250   a  at server  202  and generate control data  271  to affect the behavior of resource  252  with respect to application  250   a  . Similarly, engine  211  may process event information  270  for other applications and other computing resources. 
     According to an aspect of the disclosure, computer system  200  distributes the processing of event information and control of computer resources at servers  202 - 204  to provide semi-autonomous self-management. Consequently, each server monitors event data generated at the server and controls computing resources located at the server. If server  202 ,  203 , or  204  cannot complete the self-management operations by itself, the server interacts with central computer  201  by providing event information  260 ,  262 ,  264  and receiving control data  261 ,  263 ,  265 , respectively. This operation is further discussed with flowcharts  500 - 700  as shown in  FIGS. 5-7 , respectively. 
     However, in accordance with aspects of the disclosure, processing of all event information may be performed by centralize engine  210  rather than by engines  211 - 213 . This approach typically trades response time to manage resources for the amount of distributed processing at servers  202 - 204 . For example, as central engine assumes more responsibility for self-management, messaging between servers  202 - 204  and central computer  201  (e.g., event information messages  260 ,  262 ,  264  and control data  261 ,  263 ,  265 ) increases. 
     In addition to monitoring and control of computing resources (denoted as self-optimization), computer system  200  may support other self-management processes including automatic configuration of software components (denoted as self-configuration), automatic discovery and correction of faults in computer system  200 , and proactive identification and protection from arbitrary attacks (denoted as self-protection). 
     Achieving availability may be a multi-layered effort. To increase the platform autonomy and overall availability, computer system  200  may need to identify and repair the problem and to be able to notify its environment about the system&#39;s current status. In order to identify and attend to problems and failures in the computer system and increase availability and scalability, there is a need to infer the state of the system from the way it looks to the outside, install agents on the system&#39;s servers, and actively question the service about its state. Computer system  200  may have the capability of auto-installing agents, verifying installation of agents, removing corrupted installation of agents, and upgrading installed versions of agents as computer system  200  changes its configuration (e.g., adding servers and/or software applications). This capability may be performed without human intervention and may have essentially no impact on a user. 
     Engines  210 - 213  may be is built with several analytics algorithms with the capability of discovering sophisticated event patterns in an event stream. An event pattern may comprise an ordered or unordered sequence (collection) of events, where an event may be internal or external to computer system  200 , separate from other events, aggregated with other events, or correlated with other events. Applied to monitoring, computer system  200  supports near real-time processing of monitoring information streams, including among others: (1) aggregation of smaller events in order to provide a high-level view of a process such as statistics, summaries, and the like; (2) correlation of events generated by different event sources; and (3) long-term metrics/measurements. For example, if the change in the Federal funds is accompanied by other significant events at ten or more per hour in a specific region, computer system  200  may invoke self-optimization and/or self-configuration procedures for the servers in that region. 
     Computer system  200  may be an ever-evolving system that gets smarter over time as more and more events are captured. Frequent patterns in sessions are found using an a priori algorithm. With an aspect of the embodiments, computer system  200  may use a neural network to recognize different event patterns. A new event pattern that doesn&#39;t fall under any existing event pattern is identified as a potential new event pattern. For example, event patterns categorized as access patterns are clustered into use cases based on similarity. Over time, the change in usage patterns may be studied. 
     User process events can be processed and easily correlated with other events occurring across an enterprise. With respect to traditional approaches, this capability may lead to many new possibilities in disaster recovery, system self-management, and self-healing systems in real-time or in near real-time. CEP engine  210  may monitor the patterns of system events across domains. Frequency of events like CPU usage at a certain time of the day, logs for a failure of a process, glitches in data center performance for a significant amount of time are captured as events with a certain statistical probability and score. Computer system  200  diagnoses faulty components, a function that, in some cases, can reduce analysis time from days to seconds. Once diagnosed, computer system  200  may quickly take corrective action and automatically restore application services. This approach ensures that business-critical applications and essential system services can continue uninterrupted in the event of software failures, major hardware component failures, and even software misconfiguration problems. 
     This approach is amenable service-level agreement (SLA) contract monitoring, real-time system misuse detection, failure detection, and/or real-time monitoring of resource utilization for the purpose of steering and adaptive algorithms, such as job rescheduling. 
     Referring to  FIG. 2 , each server  202 ,  203 , and  204  monitors event activity for each application  250   a,b  and  251   a,b  that is executing on the respective server for clients  240   a,b  and  241 . In order to do so, Engines  211 - 213  monitor event data streams  270 ,  272 , and  274  (as captured by agents  253 - 255 , respectively) for applications executing on servers  202 ,  203 , and  204 , respectively. (With some embodiments, separate event data streams may be generated for each application executing on a server.) Engines  211 - 213  processes each event data stream by filtering the stream by an appropriate filter selected from filters  225 ,  228 , and  231 , respectively, according to rules selected from rules  223 ,  226 , and  229 , respectively, to obtain a filtered stream (not explicitly shown in  FIG. 2 .) . Engines  211 - 213  then determines the event pattern from the filtered stream. If the detected event pattern matches one of the event patterns identifiable at servers  202 - 204 , engines  211 - 213  selects the corresponding policy to appropriately affect the operation of the application executing on servers  202 - 204 , respectively via control data  271 ,  273 , and  275 , respectively. 
     If engines  211 - 213  cannot match the detected event pattern, event information  260 ,  262 , or  264 , respectively, is sent to central computer  201 for further processing of the detected event pattern. For example, central engine  210  may query central storage device  215  about the detected event pattern. With some embodiments, central engine may query other servers whether the detected event pattern previously occurred at other servers. If a match occurs, central engine  210  returns the corresponding policy to the requesting server  202 - 204  so that operation at the server can be appropriated affected by returning control data  261 ,  263 , or  265  to servers  201 ,  202 , or  203 , respectively. However, if a match does not occur, a new pattern is created with the corresponding policies. A new pattern and a corresponding policy may be created based on the events captured. The events are inputs to engine  210 ,  211 ,  212 , or  213  that queries for an existing pattern. If no results are returned, the engine captures the pattern as a new pattern with the adhered policy. Servers  202 - 204  are then updated with the new pattern and policy information. With an aspect of the disclosure, preliminary rules, policies, and filters are built on a knowledge inference engine of central engine  210 . Central engine  210  becomes smarter based on the outputs received from the agents so that rules, policies and filters evolve accordingly. 
       FIG. 3  illustrates an example of a suitable computing system environment  300  for managing computer system  200  that may be used according to one or more illustrative embodiments. For example, as will be further discussed, computing system environment  300  may support processes  500 ,  600 , and  700  as shown in  FIGS. 5-7 , respectively, to support managing computer resources (self-optimization) and system operation (self-configuration, self-protection, and self-healing) in computer system  200 . The computing system environment  300  is only one example of a suitable computing environment and is not intended to suggest any limitation as to the scope of use or functionality contained in the disclosure. The computing system environment  300  should not be interpreted as having any dependency or requirement relating to any one or combination of components shown in the illustrative computing system environment  300 . 
     The disclosure is operational with numerous other general purpose or special purpose computing system environments or configurations. Examples of well-known computing systems, environments, and/or configurations that may be suitable for use with the disclosed embodiments include, but are not limited to, personal computers (PCs), server computers, hand-held or laptop devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like. 
     With reference to  FIG. 3 , the computing system environment  300  may include a computing device  301  wherein the processes discussed herein may be implemented. The computing device  301  may have a processor  303  for controlling overall operation of the computing device  301  and its associated components, including random-access memory (RAM)  305 , read-only memory (ROM)  307 , communications module  309 , and memory  315 . Computing device  301  typically includes a variety of computer readable media. Computer readable media may be any available media that may be accessed by computing device  301  and include both volatile and nonvolatile media, removable and non-removable media. By way of example, and not limitation, computer readable media may comprise a combination of computer storage media and communication media. 
     In reference to  FIG. 2 , central computer  201  or server  202 ,  203 , or  204  may comprise computing device  301 . 
     Computer storage media include volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer storage media include, but is not limited to, random access memory (RAM), read only memory (ROM), electronically erasable programmable read only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and that can be accessed by computing device  301 . 
     Communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media. Modulated data signal includes a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared and other wireless media. 
     Computing system environment  300  may also include optical scanners (not shown). Exemplary usages include scanning and converting paper documents, e.g., correspondence and receipts to digital files. 
     Although not explicitly shown, RAM  305  may include one or more are applications representing the application data stored in RAM  305  while the computing device is on and corresponding software applications (e.g., software tasks), are running on the computing device  301 . 
     Communications module  309  may include a microphone, keypad, touch screen, and/or stylus through which a user of computing device  301  may provide input, and may also include one or more of a speaker for providing audio output and a video display device for providing textual, audiovisual and/or graphical output. 
     Software may be stored within memory  315  and/or storage to provide instructions to processor  303  for enabling computing device  301  to perform various functions. For example, memory  315  may store software used by the computing device  301 , such as an operating system  317 , application programs  319 , and an associated database  321 . Also, some or all of the computer executable instructions for computing device  301  may be embodied in hardware or firmware. 
     Computing device  301  may operate in a networked environment supporting connections to one or more remote computing devices, such as computing devices  341 ,  351 , and  361 . The computing devices  341 ,  351 , and  361  may be personal computing devices or servers that include many or all of the elements described above relative to the computing device  301 . Computing device  361  may be a mobile device communicating over wireless carrier channel  371 . 
     The network connections depicted in  FIG. 3  include a local area network (LAN)  325  and a wide area network (WAN)  329 , but may also include other networks. When used in a LAN networking environment, computing device  301  may be connected to the LAN  325  through a network interface or adapter in the communications module  309 . When used in a WAN networking environment, the computing device  301  may include a modem in the communications module  309  or other means for establishing communications over the WAN  329 , such as the Internet  331  or other type of computer network. It will be appreciated that the network connections shown are illustrative and other means of establishing a communications link between the computing devices may be used. Various well-known protocols such as TCP/IP, Ethernet, FTP, HTTP and the like may be used, and the system can be operated in a client-server or in Distributed Computing configuration to permit a user to retrieve web pages from a web-based server. Any of various conventional web browsers can be used to display and manipulate data on web pages. 
     Additionally, one or more application programs  319  used by the computing device  301 , according to an illustrative embodiment, may include computer executable instructions for invoking user functionality related to communication including, for example, email, short message service (SMS), and voice input and speech recognition applications. 
     Embodiments of the disclosure may include forms of computer-readable media. Computer-readable media include any available media that can be accessed by a computing device  301 . Computer-readable media may comprise storage media and communication media and in some examples may be non-transitory. Storage media include volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer-readable instructions, object code, data structures, program modules, or other data. Communication media include any information delivery media and typically embody data in a modulated data signal such as a carrier wave or other transport mechanism. 
     Although not required, various aspects described herein may be embodied as a method, a data processing system, or a computer-readable medium storing computer-executable instructions. For example, a computer-readable medium storing instructions to cause a processor to perform steps of a method in accordance with aspects of the disclosed embodiments is contemplated. For example, aspects of the method steps disclosed herein may be executed on a processor on a computing device  301 . Such a processor may execute computer-executable instructions stored on a computer-readable medium. 
       FIG. 4  shows an approach for managing computer resources and system operation of computer systems  100  and  200  illustrated in  FIGS. 1-2 , respectively, according to one or more illustrative embodiments. Management may be partitioned into components  401 - 404  corresponding to different management functions. Self-Configuration component  401  provides automatic configuration of components. Self-Healing component  402  supports automatic discovery and correction of faults and automatically applies necessary actions to bring a computer system back to normal operation. (A corresponding process supporting self-configuration and/or self-healing is shown in  FIG. 6  as will be discussed.) Self-Optimization component  403  supports automatic monitoring and control of computer resources to ensure the optimal functioning with respect to the defined requirements. Self-Protection component  404  supports proactive identification and protection from arbitrary attacks on computer system  100 . (A corresponding process supporting self-optimization and/or self-protection is shown in  FIG. 7  as will be discussed.) 
       FIG. 5  shows flowchart  500  with a generic approach of supporting self-configuration, self-healing, self-optimization, and/or self-protection processes illustrated in  FIG. 4  and further discussed in  FIGS. 6 and 7  according to one or more aspects of the present disclosure. Process  500  may be executed in a distributed fashion by engines  201 - 204 ; however, process  500  may be executed in a centralized by central engine  201  or may be executed in a combined distributed/centralized approach. 
     With the following discussion, process  500  is performed at “server  1 ” (e.g., by engine  211 ) but may be performed at other servers (e.g., by engines  212  and  213  at servers  203  and  204 , respectively) in reference to  FIG. 2 . “Central CEP” may refer to central computer  201  and/or central engine  210 . 
     Event information is collected at block  502  for an event occurring at block  501 . The event information is filtered at block  503  according to filters, rules, and policies based on the characteristics of the occurring event. At blocks  504  and  505 , based on the processing of the event information at block  503 , process  500  attempts to match the detected event pattern (i.e., for the event that occurred at block  501 ) with previous event patterns that are known (e.g., previously occurring) by engine  211 . If so, the other servers are notified at blocks  514  and  515 . 
     If a match is not detected at block  505 , server  202  requests central computer  201  to further process the detected event pattern at block  506 . At block  507  central engine  210  consequently queries the other servers whether the detected event previously occurred at the other servers. If a match occurs at block  508 , server  202  is provided the appropriate policy information for the detected event pattern at blocks  511 - 513 . However, if a match does occur for the detected event pattern, server  202  is informed at blocks  509 - 510 . With some embodiments, a new pattern may be generated with the appropriate policy information at block  509 . 
       FIG. 6  shows process  600  supporting self-healing and/or self-protection in computer systems  100  and  200  illustrated in  FIGS. 1-2 , respectively, and follows a similar approach as generic process  500  as shown in  FIG. 5  according to one or more aspects of the present disclosure. 
     At block  601  an error occurs in the server that leads to system failure, and an engine situated at the server captures the event and runs rules, filters, and knowledge inference sensors at blocks  602 - 603 . 
     At block  604  the engine checks for previous patterns captured by complex event processing. If the event pattern is found at block  605 , the self-recovery/self-protection policy is applied at block  614  so that the system recovers at block  613 . For example, the self-recovery/self-protection policy may shut down a server before it reaches  100 % CPU utilization or may turn on a higher performance machine to overcome the load when a server is at 80% utilization. If pattern is not found, the engine at the server from sends an event information message to the central engine at block  606 . 
     At block  607  the central engine triggers to check for similar patterns in different servers and may assume the form of asynchronous calls. 
     If any servers have similar patterns found at any servers at block  608 , the central engine passes the information obtained at block  611  to the requesting server with the appropriate self-healing/self-protection policy at block  612 . If no patterns are found at block  608 , new event is created at block  609  and knowledge inference engine captures it for future incidents and updates the engines in the computer system at block  610 . 
       FIG. 7  shows process  700  supporting self-optimization and/or self-configuration in computer systems  100  and  200  illustrated in  FIGS. 1-2 , respectively, and follows a similar approach as with generic process as shown in  FIG. 5  according to one or more aspects of the present disclosure. 
     At block  701  an application executing at a server experiences a high load after an external event (e.g., a large drop in Dow Jones index or a change in the Federal Funds Rate). For example, if a large drop in the Dow Jones index causes a spike in load, computer system  200  separately captures the events and creates a corresponding rule and policy. If a subsequent drop in the Dow Jones Index drop occurs, computer system  200  foresees the consequences and increases the memory of servers  202 - 204  by a determined fold based on the previous events. The engine at the captures the event and executes rules, filters, and knowledge inference sensors at blocks  702 - 703 . 
     At block  704  the engine checks for previous patterns captured by complex event processing. If an event pattern is found at block  705 , the self-optimization/self-configuration policy is applied at block  715 . For example, the policy may intelligently increase the memory allocated for the application x fold to optimize the system performance at block  714 . 
     If pattern is not found at block  705 , the engine from at the server sends event information to the central engine at block  706 . The central engine triggers to check for similar patterns at different server at block  707 . If any servers have similar patterns found as detected at block  708 , the central engine passes the information obtained at block  711  to the requesting server with the self-optimization/self-configuration policy at blocks  712 - 713 . 
     If no patterns are found at block  708 , a new event pattern is created at block  709  and knowledge inference engine captures it for future incidents at block  710 . 
       FIG. 8  shows a dynamic view of event information inputs and corresponding results presented to a monitoring and control system according to one or more aspects of the present disclosure. Event notifications  801 , logs  802 , manifests  803 , and the like are sources of event information that may be combined into event data stream  804  to the CEP engine  805  (e.g., corresponding to engines  210 - 214  as shown in  FIG. 2 ). Engine  805  triggers the corresponding rules  806 /policies  807 /filters  808  to process event data stream  804  and send meaningful solution to the end system/user via monitoring and control system  809 . For example, engine  805  may select portions of event data stream  804  according the filter  808  and correlate different event data according to rules  806 . Monitoring and control system  809  may present processed event information to a user (e.g., via computer  341  or  351  or via wireless device  361  as shown in  FIG. 3 ) and/or determine the appropriate policy to affect operation of the computer system as previously discussed. For example, monitoring and control system  809  may comprise key performance indicator (KPI) dashboards, pagers, and monitoring devices that may be configured as targets in computer system  200 . 
       FIG. 9  shows event inputs (client input  910 , system input  911 , and event logs  912 ) that are filtered by filter  902  and processed by agent  901  according to one or more aspects of the present disclosure. With some embodiments, filter  902  is implemented in the engine (e.g., engine  210 ,  211 ,  212 , or  213 ) in which rules are triggered to obtain filtered input  903 . For example, the rules may invoke a selection of inputs and portions of inputs  910 - 912 , a correlation between inputs  910 - 912 , and statistic characterization of inputs  910 - 912 . 
       FIG. 10  shows agent  901  responsive to a data query for filtered event data  903  according to one or more aspects of the present disclosure. Filtered input request  903  flows through query execution component  1001  to obtain query output  1002 . Rules  1010 - 1012  and policies  1003  are applied and create meaningful data. 
       FIG. 11  shows queried data  1002  that is sent by agent  901  that is forwarded to specific targets  1110 - 1114  through data interface  1101  according to one or more aspects of the present disclosure. Queried data  1002  assists in providing creates meaningful data that is sent as output  1002  from agent  901 . Interface  1101  picks up and sends the data to specific targets  1110 - 1114 . For example, CEP engine  101  (as shown in  FIG. 1 ) may process event streams as sets and perform set type operations, typically using continuous queries (e.g., a structured query language (SQL) in which SQL-type queries can operate over time and buffer windows). 
       FIG. 12  shows output event data  1201  from an engine  211  that is input event data  1202  to itself according to one or more aspects of the present disclosure. For example, if the CPU usage at engine  211  is greater than 60%, engine  211  raises an occurrence of a significant event at output  1201  that is indicated at input  1202 . If engine  211  experiences significant events at a rate of 10 per hour or more, engine  211  shuts down server  202  and brings the next in queue into operation. 
     Aspects of the embodiments have been described in terms of illustrative embodiments thereof. Numerous other embodiments, modifications and variations within the scope and spirit of the appended claims will occur to persons of ordinary skill in the art from a review of this disclosure. For example, one of ordinary skill in the art will appreciate that the steps illustrated in the illustrative figures may be performed in other than the recited order, and that one or more steps illustrated may be optional in accordance with aspects of the embodiments. They may determine that the requirements should be applied to third party service providers (e.g., those that maintain business processes on behalf of the company).

Technology Category: 5