# US 2014/0195670 A1 · Automated alert management

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2014/0195670 A1
- Document ID: US20140195670A1
- Status: Published application
- Kind: A1
- Application number: 13/736,606
- Filed: 2013-01-08
- Published: 2014-07-10
- Earliest claimed: 2013-01-08
- Assignees: Bank of America Corporation
- Applicants: Bank of America
- Inventors: Rohit Jain; Vikas Dwivedi
- Web page: https://patentgrep.com/patent/US20140195670A1

## CPC

- H04L 41/0604: using filtering, e.g. reduction of information by using priority, element types, position or time
- G06F 11/00: Error detection; Error correction; Monitoring (error detection, correction or monitoring in information storage based on relative movement between record carrier and transducer G11B20/18; monitoring, i.e. supervising the progress of recording or reproducing G11B27/36; in static stores G11C29/00)
- G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems}
- G06F 11/0781: {Error filtering or prioritizing based on a policy defined by the user or on a policy defined by a hardware/software module, e.g. according to a severity level}
- G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)}
- G06F 11/3055: {Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available (error or fault processing without redundancy G06F11/0703; error detection or correction by redundancy in data representation G06F11/08; error detection or correction of the data by redundancy in operations G06F11/14; error detection or correction by redundancy in hardware G06F11/16)}
- G06F 11/3409: {for performance assessment}
- G06F 11/3495: {for systems}
- H04L 41/0686: Additional information in the notification, e.g. enhancement of specific meta-data
- H04L 41/069: using logs of notifications; Post-processing of notifications
- H04L 43/00: Arrangements for monitoring or testing data switching networks
- H04L 67/025: for remote control or remote monitoring of applications
- G06F 11/3476: {Data logging (G06F11/14, G06F11/2205 take precedence)}
- G06F 2201/86: Event-based monitoring
- Y02D 10/00: Energy efficient computing, e.g. low power processors, power management or thermal management
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- Y02D: CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE

## Abstract

Alerts may be received from an event monitoring system that monitors computing resources of a computer system. Based on an alert ruleset, an alert management module may determine whether to provide notification of the alert. If the alert management module decides to provide notification of the alert, then the alert management module may initiate the creation of an issue ticket corresponding to the alert in an issue tracking system. If the alert management module decides not to provide notification of the alert, then the alert management module may discard the alert.

## Claims

### Claim 1

A non-transitory computer-readable storage medium having computer-executable program instructions stored thereon that when executed by a processor cause the processor to perform steps for managing alerts generated by an event monitoring system, the steps comprising:
receiving from the event monitoring system an alert associated with a computing resource of a computer system monitored by the event monitoring system;
determining whether to provide notification of the alert based, at least in part, on an alert ruleset;
initiating creation of an issue ticket corresponding to the alert in an issue tracking system in response to a decision to provide notification of the alert; and
discarding the alert in response to a decision not to provide notification of the alert.

### Claim 2 (depends on 1)

The computer-readable storage medium of claim 1 wherein the alert is associated with an alert type and wherein determining whether to provide notification of the alert includes:
determining whether the alert type is listed in the alert ruleset;
providing notification of the alert in response to a determination that the alert type is listed in the alert ruleset; and
providing no notification of the alert in response to a determination that the alert type is not listed in the alert ruleset.

### Claim 3 (depends on 1)

The computer-readable storage medium of claim 1 wherein determining whether to provide notification of the alert includes:
determining whether the alert is a duplicate alert;
providing notification of the alert in response to a determination that the alert is not a duplicate alert; and
providing no notification of the alert in response to a determination that the alert is a duplicate alert.

### Claim 4 (depends on 3)

The computer-readable storage medium of claim 3 wherein determining whether the alert is a duplicate alert includes:
determining whether a previous alert associated with the computing resource of the computer system has been received within a predetermined time period prior to the alert;
determining that the alert is a duplicate alert in response to a determination that the previous alert has been received within the predetermined time period prior to the alert; and
determining that the alert is not a duplicate alert in response to a determination that the previous alert has not been received within the predetermined time period prior to the alert.

### Claim 5 (depends on 1)

The computer-readable storage medium of claim 1 wherein determining whether to provide notification of the alert includes:
determining whether the computing resource the alert is associated with is a first type of computing resource or a second type of computing resource;
providing notification of the alert in response to a determination that the computing resource the alert is associated with is the first type of computing resource; and
providing no notification of the alert in response to a determination that the computing resource the alert is associated with is the second type of computing resource.

### Claim 6 (depends on 1)

The computer-readable storage medium of claim 1 wherein determining whether to provide notification of the alert includes:
determining whether a secondary condition associated with the alert is satisfied;
providing notification of the alert in response to a determination that the secondary condition is satisfied; and
providing no notification of the alert in response to a determination that the secondary condition is not satisfied.

### Claim 7 (depends on 1)

The computer-readable storage medium of claim 1 further comprising:
determining whether the issue ticket was created in the issue tracking system;
updating an exception log to include a new exception that indicates the issue ticket was not created in response to a determination that the issue ticket was not created in the issue tracking system; and
providing notification to the support team member of the new exception in the exception log.

### Claim 8 (depends on 1)

The computer-readable storage medium of claim 1 wherein a priority is respectively associated with individual alert types included in the alert ruleset.

### Claim 9

A computer-assisted method for managing alerts generated by an event monitoring tool comprising:
receiving from the event monitoring tool an alert associated with a computing resource of a computer system monitored by the event monitoring tool;
storing the received alert in computer memory;
determining, by a processor, whether to provide notification of the alert based, at least in part, on whether an alert type associated with the alert is listed in an alert ruleset;
initiating, by the processor, creation in the computer memory of an issue ticket corresponding to the alert in an issue tracking system in response to a decision to provide notification of the alert;
discarding, by the processor, the alert in response to a decision not to provide notification of the alert;
transmitting the issue ticket to a display device for display to a user.

### Claim 10 (depends on 9)

The method of claim 9 wherein determining whether to provide notification of the alert includes:
determining, at the processor, whether the alert type is listed in the alert ruleset;
providing notification of the alert in response to a determination that the alert type is listed in the alert ruleset; and
providing no notification of the alert in response to a determination that the alert type is not listed in the alert logic resource.

### Claim 11 (depends on 9)

The method of claim 9 wherein determining whether to provide notification of the alert includes:
determining, at the processor, whether the alert is a duplicate alert;
providing notification of the alert in response to a determination that the alert is not a duplicate alert; and
providing no notification of the alert in response to a determination that the alert is a duplicate alert.

### Claim 12 (depends on 11)

The method of claim 11 wherein determining whether the alert is a duplicate alert includes:
determining, at the processor, whether a previous alert associated with the computing resource of the computer system has been received within a predetermined time period prior to receipt of the alert;
determining that the alert is a duplicate alert in response to a determination that the previous alert has been received within the predetermined time period prior to receipt of the alert; and
determining that the alert is not a duplicate alert in response to a determination that the previous alert has not been received within the predetermined time period prior to receipt of the alert.

### Claim 13 (depends on 9)

The method of claim 9 wherein determining whether to provide notification of the alert includes:
determining, at the processor, whether the computing resource the alert is associated with is a first type of computing resource or a second type of computing resource;
providing notification of the alert in response to a determination that the computing resource the alert is associated with is the first type of computing resource; and
providing no notification of the alert in response to a determination that the computing resource the alert is associated with is the second type of computing resource.

### Claim 14 (depends on 9)

The method of claim 9 wherein determining whether to provide notification of the alert includes:
determining, at the processor, whether a secondary condition associated with the alert is satisfied;
providing notification of the alert in response to a determination that the secondary condition is satisfied; and
providing no notification of the alert in response to a determination that the secondary condition is not satisfied.

### Claim 15 (depends on 9)

The method of claim 9 further comprising:
determining, at the processor, whether the issue ticket was created in the issue tracking system;
updating, using the processor, an exception log to include a new exception that indicates the issue ticket was not created in response to a determination that the issue ticket was not created in the issue tracking system; and
providing, using the processor, notification to the support team member of the new exception in the exception log.

### Claim 16

An apparatus for managing alerts comprising:
a processor; and
a memory configured to store computer-readable instructions that, when executed by the processor, cause the processor to perform a method comprising:
receiving from an event monitoring tool an alert associated with a computing resource of a computer system monitored by the event monitoring tool;
determining whether to provide notification of the alert based, at least in part, on an alert ruleset, on whether the alert is a duplicate alert, and on a type of computer resource the alert is associated with;
initiating creation of an issue ticket corresponding to the alert in an issue tracking system in response to a decision to provide notification of the alert; and
discarding the alert in response to a decision not to provide notification of the alert.

### Claim 17 (depends on 16)

The apparatus of claim 16 wherein the alert is associated with an alert type and wherein determining whether to provide notification of the alert includes:
determining whether the alert type is listed in the alert ruleset;
providing notification of the alert in response to a determination that the alert type is listed in the alert ruleset; and
providing no notification of the alert in response to a determination that the alert type is not listed in the alert ruleset.

### Claim 18 (depends on 16)

The apparatus of claim 16 wherein determining whether to provide notification of the alert includes:
determining whether the alert is a duplicate alert;
providing notification of the alert in response to a determination that the alert is not a duplicate alert; and
providing no notification of the alert in response to a determination that the alert is a duplicate alert.

### Claim 19 (depends on 18)

The apparatus of claim 18 wherein determining whether the alert is a duplicate alert includes:
determining whether a previous alert associated with the computing resource of the computer system has been received within a predetermined time period prior to receipt of the alert;
determining that the alert is a duplicate alert in response to a determination that the previous alert has been received within the predetermined time period prior to receipt of the alert; and
determining that the alert is not a duplicate alert in response to a determination that the previous alert has not been received within the predetermined time period prior to receipt of the alert.

### Claim 20 (depends on 16)

The apparatus of claim 16 wherein determining whether to provide notification of the alert includes:
determining, at the processor, whether the computing resource the alert is associated with is a first type of computing resource or a second type of computing resource;
providing notification of the alert in response to a determination that the computing resource the alert is associated with is the first type of computing resource; and
providing no notification of the alert in response to a determination that the computing resource the alert is associated with is the second type of computing resource.