Administering Incident Pools For Event And Alert Analysis

An apparatus for administering incident pools for event and alert analysis in a distributed processing system, the system comprising a computer processor, a computer memory operatively coupled to the computer processor, the computer memory having disposed within it computer program instructions capable, when executed by the computer processor, of causing the apparatus to carry out the steps of:

• assigning, by the incident analyzer, an incident received from one or more components of the distributed processing system to a pool of incidents;
• assigning, by the incident analyzer, to each incident a particular combined minimum time for inclusion of the incident in the pool;
• in response to the pool closing, determining, by the incident analyzer, for each incident in the pool whether the incident has met its combined minimum time for inclusion in the pool;
• if the incident has been in the pool for its combined minimum time, including, by the incident analyzer, the incident in the closed pool;
• if the incident has not been in the pool for its combined minimum time, moving, by the incident analyzer, the incident to a next pool;
• applying, by the incident analyzer, incident suppression rules using the incidents assigned to the next pool;
• and
• applying, by the incident analyzer, incident creation rules to the incidents assigned to the next pool, while omitting any duplicate incidents caused by the assignment.

A computer program product for administering incident pools for event and alert analysis in a distributed processing system, the computer program product disposed upon a computer readable storage medium, the computer program product comprising computer program instructions for:

• assigning, by the incident analyzer, an incident received from one or more components of the distributed processing system to a pool of incidents;
• assigning, by the incident analyzer, to each incident a particular combined minimum time for inclusion of the incident in the pool;
• in response to the pool closing, determining, by the incident analyzer, for each incident in the pool whether the incident has met its combined minimum time for inclusion in the pool;
• if the incident has been in the pool for its combined minimum time, including, by the incident analyzer, the incident in the closed pool;
• if the incident has not been in the pool for its combined minimum time, moving, by the incident analyzer, the incident to a next pool;
• applying, by the incident analyzer, incident suppression rules using the incidents assigned to the next pool;
• and
• applying, by the incident analyzer, incident creation rules to the incidents assigned to the next pool, while omitting any duplicate incidents caused by the assignment.