Monitoring event streams in parallel through data slicing
AssigneeNEC Corporation
InventorFelix Klaedtke
Life of this patent
Estimating the term…
Abstract
A method for checking policy compliance of events of an event stream includes receiving the events; grouping a plurality of the received events into a plurality of slices based upon a policy specification and an event classification; determining whether a policy violation has occurred by concurrently evaluating at least two of the slices according to the policy specification; and in a case in which the policy violation is determined, reporting the policy violation.
Claims12
A method for checking policy compliance of events of an event stream, the method comprising:
- receiving the events;
- grouping a plurality of the received events into a plurality of slices based upon a policy specification and an event classification;
- determining whether a policy violation has occurred by concurrently evaluating at least two of the slices according to the policy specification;
- and
- in a case in which the policy violation is determined, reporting the policy violation,
- wherein the grouping includes transforming the event classification, including data values with the received events, determined by constraints extracted from the policy specification and guard requirements on correlations between the received events,
- wherein the policy specification is guarded and closed, and
- wherein the policy specification comprises one or more policies that are specified as a formal specification language based on temporal logic with quantifiers.
A log analyzer for determining incorrect behavior of components in an information technology system, the log analyzer comprising one or more hardware processors, which alone or together, are configured to provide for execution of the following operations:
- receiving a plurality of events from the components;
- grouping a plurality of the received events into a plurality of slices based upon a policy specification and an event classification;
- determining whether a policy violation has occurred by concurrently evaluating at least two of the slices according to the policy specification;
- and
- in a case in which the policy violation is determined, reporting the policy violation,
- wherein the grouping includes transforming the event classification, including data values with the received events, determined by constraints extracted from the policy specification and guard requirements on correlations between the received events,
- wherein the policy specification is guarded and closed, and
- wherein the policy specification comprises one or more policies that are specified as a formal specification language based on temporal logic with quantifiers.
Dependencies are inferred from the claim text.