Administering incident pools for event and alert analysis

A method of administering incident pools for event and alert analysis in a distributed processing system, the method comprising:

• assigning, by the incident analyzer, an incident received from one or more components of the distributed processing system to a pool of incidents;
• assigning, by the incident analyzer, to each incident a particular combined minimum time for inclusion of the incident in the pool;
• in response to the pool closing, determining, by the incident analyzer, for each incident in the pool whether the incident has met its combined minimum time for inclusion in the pool;
• if the incident has been in the pool for its combined minimum time, including, by the incident analyzer, the incident in the closed pool;
• if the incident has not been in the pool for its combined minimum time, moving, by the incident analyzer, the incident to a next pool;
• applying, by the incident analyzer, incident suppression rules using the incidents assigned to the next pool;
• and
• applying, by the incident analyzer, incident creation rules to the incidents assigned to the next pool, while omitting any duplicate incidents caused by the assignment.