# US 8,150,862 B2 · Multiple related event handling based on XML encoded event handling definitions > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,150,862 B2 - Document ID: US8150862B2 - Status: Granted - Kind: B2 - Application number: 12/722,416 - Filed: 2010-03-11 - Published: 2010-09-16 - Granted: 2012-04-03 - Earliest claimed: 2009-03-13 - Assignees: Accelops, Inc. - Inventors: Partha Bhattacharya; Sheng Chen; Hongbo Zhu - Web page: https://patentgrep.com/patent/US8150862B2 ## CPC - G06F 40/154: Tree transformation for tree-structured or markup documents, e.g. XSLT, XSL-FO or stylesheets - G06F 40/143: Markup, e.g. Standard Generalized Markup Language [SGML] or Document Type Definition [DTD] - G06F 11/3466: {Performance evaluation by tracing or monitoring} - G06F 2201/86: Event-based monitoring - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract In a method and system for collecting event information, XML documents specifying event parsing logic for respective groups of related events are loaded. Representations for the parsing logic contained in the plurality of XML documents are stored in one or more parsing trees. Events are received, including events in a plurality of groups of events. The received events are processed in accordance with the event parsing logic in the one or more parsing trees. The received events are also processed in accordance with stored program instructions that are independent of the parsing logic for the plurality of groups of events. Event information for the received events is stored. The stored event information includes information determined in accordance with the event parsing logic in at least one or more parsing trees. ## Claims ### Claim 1 A computer-implemented method for collecting event information, comprising: on a server system having one or more processors for executing one or more programs stored in memory of the server system so as to perform the method: loading a plurality of XML documents, each XML document specifying event parsing logic for a respective group of related events; storing in one or more parsing trees a representation of the event parsing logic in the plurality of XML documents, the one or more parsing trees including event parsing logic for parsing events in a plurality of groups of events; receiving events, including events in the plurality of groups of events; and processing the received events in the plurality of groups of events in accordance with the event parsing logic in the one or more parsing trees, wherein the processing of the received events in the plurality of groups of events is performed in accordance with stored program instructions that are independent of the parsing logic for the plurality of groups of events, the processing including storing event information for the received events, wherein the stored event information for at least a subset of the received events includes information determined in accordance with the event parsing logic in at least one of the one or more parsing trees; wherein the event parsing logic in the one or more parsing trees includes event parsing logic for a respective group of events, and processing the received events includes producing enhanced information for a respective event, and wherein producing enhanced information includes supplementing the information for the respective event with information from events in a respective group of events that includes the respective event. ### Claim 2 A computer-implemented method for collecting event information, comprising: on a server system having one or more processors for executing one or more programs stored in memory of the server system so as to perform the method: loading a plurality of XML documents, each XML document specifying event parsing logic for a respective group of related events; storing in one or more parsing trees a representation of the event parsing logic in the plurality of XML documents, the one or more parsing trees including event parsing logic for parsing events in a plurality of groups of events; receiving events, including a first event and a second event; processing the second event in accordance the event parsing logic for a first group of events that includes both the first event and second event, the processing of the second event including: extracting information from the first event in accordance with the event parsing logic for the first group of events; extracting information from the second event in accordance with the event parsing logic for the first group of events; supplementing at least a portion of the information extracted from the second event with at least a portion of the information extracted from the first event, in accordance with the event parsing logic for the first group of events, to produce enhanced information for the second event; and storing the enhanced information for the second event in computer readable memory. ### Claim 3 (depends on 2) The method of claim 2, including adding a new XML document to the plurality of XML documents, the new XML document specifying event parsing logic for an additional group of events; and storing in a parsing tree a representation of the event parsing logic contained in the new XML document. ### Claim 4 (depends on 2) The method of claim 2, including storing a respective parsing tree for each group of related events, the respective parsing tree for controlling parsing of events in the respective group of related events. ### Claim 5 (depends on 2) The method of claim 2, wherein the processing of the second event is performed in accordance with stored program instructions that are independent of the parsing logic for the first group of events. ### Claim 6 (depends on 5) The method of claim 5, including processing additional events from additional groups of events for which event parsing logic has been stored in the one or more parsing trees, wherein the processing of the additional events is performed in accordance with said stored program instructions, which are independent of the parsing logic for the additional groups of events. ### Claim 7 (depends on 2) The method of claim 2, wherein the information extracted from the first event that is used to supplement the information extracted from the second event includes at least one of: source IP address, destination IP address, source port, destination port, protocol, source Interface, destination interface, file name, source user name, and source computer name. ### Claim 8 (depends on 2) The method of claim 2, wherein the event parsing logic specified by a respective XML document includes conditional logic for conditionally revising information in the second event in accordance with information in at the first event and second event. ### Claim 9 (depends on 2) The method of claim 2, wherein the event parsing logic specified by a respective XML document includes conditional logic for conditionally supplementing the information extracted from the second event with information extracted from the first event in accordance with when a condition specified in the XML document is satisfied. ### Claim 10 (depends on 2) The method of claim 2, the parsing tree including a respective portion corresponding to the event parsing logic in a respective XML document, the respective portion of the parsing tree including a plurality of ordered sibling nodes, representing a sequence of operations to be performed, in an order corresponding to the ordered sibling nodes, when processing a respective event in the group of related events corresponding to the respective XML document. ### Claim 11 (depends on 2) The method of claim 2, including executing an analysis procedure on the server system to analyze stored event information, including the stored enhanced information for the second event, to determine an operational status of a device or subsystem of the server system. ### Claim 12 (depends on 2) The method of claim 2, including executing an analysis procedure on the server system to analyze stored event information, including the stored enhanced information for the second event, to predict future problems with the operational status of the server system. ### Claim 13 (depends on 2) The method of claim 2, including executing an analysis procedure on the server system to analyze stored event information, including the stored enhanced information for the second event, to determine the operational status of a network device connected to the server. ### Claim 14 (depends on 2) The method of claim 2, wherein the events contain network traffic information. ### Claim 15 (depends on 2) The method of claim 2, wherein the first event contains an identifier that corresponds to an identifier in the second event. ### Claim 16 (depends on 15) The method of claim 15, wherein the identifier is an application level identifier, server level identifier, system level identifier, hardware identifier, software identifier, or operating system identifier. ### Claim 17 (depends on 2) The method of claim 2, wherein each XML document specifies one or more event attributes to be included in the enhanced information for the second event when a predefined precondition is met. ### Claim 18 (depends on 17) The method of claim 17, the first group of events corresponding to a respective XML document of the plurality of XML documents; the information extracted from the first event corresponding to event attributes defined in the respective XML file. ### Claim 19 (depends on 18) The method of claim 18, wherein the information extracted from the second event corresponds to event attributes defined in the XML file. ### Claim 20 (depends on 2) The method of claim 2, wherein the processing further includes: extracting from both the first event and second event direction information, the extracted direction information including a respective event direction and a respective security level from both the first event and the second event, and generating a value to be included in the enhanced information for the second event in accordance with extracted event direction information. ### Claim 21 (depends on 20) The method of claim 20, further comprising determining a source of the second event based on the event direction and event security level of the first event and the event direction and event security level of the second event. ### Claim 22 (depends on 20) The method of claim 20, further comprising determining a destination event based on the event direction and event security level of the first event and the event direction and event security level of the second event. ### Claim 23 A server system, comprising: one or more processors; memory storing one or more programs, the one or more programs including instructions, which when executed by the one or more processors, cause the server system to: load a plurality of XML documents, each XML document specifying event parsing logic for a respective group of related events; store in one or more parsing trees a representation of the event parsing logic in the plurality of XML documents, the one or more parsing trees including event parsing logic for parsing events in a plurality of groups of events; receive events, including events in the plurality of groups of events; and process the received events in the plurality of groups of events in accordance with the event parsing logic in the one or more parsing trees, wherein the received events in the plurality of groups of events are processed in accordance with stored program instructions that are independent of the parsing logic for the plurality of groups of events, the processing of the received events includes storing event information for the received events, wherein the stored event information for at least a subset of the received events includes information determined in accordance with the event parsing logic in at least one of the one or more parsing trees; wherein the instructions for processing the received events includes instructions for producing enhanced information for a respective event and wherein producing enhanced information includes supplementing the information for the respective event with information from events in a respective group of events that includes the respective event. ### Claim 24 A computer readable storage medium storing the one or more programs including instructions, which when executed by one or more processors of a computer system, cause the computer system to: load a plurality of XML documents, each XML document specifying event parsing logic for a respective group of related events; store in one or more parsing trees a representation of the event parsing logic in the plurality of XML documents, the one or more parsing trees including event parsing logic for parsing events in a plurality of groups of events; receive events, including events in the plurality of groups of events; and process the received events in the plurality of groups of events in accordance with the event parsing logic in the one or more parsing trees, wherein the received events in the plurality of groups of events are processed in accordance with stored program instructions that are independent of the parsing logic for the plurality of groups of events, the processing of the received events includes storing event information for the received events, wherein the stored event information for at least a subset of the received events includes information determined in accordance with the event parsing logic in at least one of the one or more parsing trees; wherein the instructions for processing the received events includes instructions for producing enhanced information for a respective event, and wherein producing enhanced information includes supplementing the information for the respective event with information from events in a respective group of events that includes the respective event. ### Claim 25 A server system, comprising: one or more processors; memory storing one or more programs, the one or more programs including instructions, which when executed by the one or more processors, cause the server system to: load a plurality of XML documents, each XML document specifying event parsing logic for a respective group of related events; store in one or more parsing trees a representation of the event parsing logic in the plurality of XML documents, the one or more parsing trees including event parsing logic for parsing events in a plurality of groups of events; receive events, including a first event and a second event; and process the second event in accordance the event parsing logic for a first group of events that includes both the first event and second event, wherein the instructions, which when executed by the one or more processors, cause the server system to process the second event include instructions, which when executed by the one or more processors, cause the server system to: extract information from the first event in accordance with the event parsing logic for the first group of events; extract information from the second event in accordance with the event parsing logic for the first group of events; supplement at least a portion of the information extracted from the second event with at least a portion of the information extracted from the first event, in accordance with the event parsing logic for the first group of events, to produce enhanced information for the second event; and store the enhanced information for the second event in computer readable memory. ### Claim 26 A computer readable storage medium storing the one or more programs including instructions, which when executed by one or more processors of a computer system, cause the computer system to: load a plurality of XML documents, each XML document specifying event parsing logic for a respective group of related events; store in one or more parsing trees a representation of the event parsing logic in the plurality of XML documents, the one or more parsing trees including event parsing logic for parsing events in a plurality of groups of events; receive events, including a first event and a second event; process the second event in accordance the event parsing logic for a first group of events that includes both the first event and second event, wherein the instructions, which when executed by the one or more processors, cause the server system to process the second event include instructions, which when executed by the one or more processors, cause the server system to: extract information from the first event in accordance with the event parsing logic for the first group of events; extract information from the second event in accordance with the event parsing logic for the first group of events; supplement at least a portion of the information extracted from the second event with at least a portion of the information extracted from the first event, in accordance with the event parsing logic for the first group of events, to produce enhanced information for the second event; and store the enhanced information for the second event in computer readable memory.