Administering checkpoints for incident analysis

An apparatus for administering checkpoints for incident analysis in a distributed processing system, the system comprising a computer processor, a computer memory operatively coupled to the computer processor, the computer memory having disposed within it computer program instructions that when executed by the computer processor cause the apparatus to carry out the steps of:

• receiving, by a checkpoint manager of the distributed processing system, from each incident analyzer of a plurality of incident analyzers, a checkpoint indicating an incident having the oldest identification number still in analysis by the incident analyzer at the time associated with the checkpoint;
• examining each received checkpoint by the checkpoint manager, to identify, as a restore incident, an incident having the oldest identification number indicated in any of the received checkpoints;
• sending, by a monitor of the distributed processing system, to the plurality of incident analyzers, a stream of incidents beginning with the identified restore incident and continuing with any incidents having a newer identification number than the identified restore incident;
• and
• for each incident analyzer of the plurality of incident analyzers, processing from the stream of incidents, by the incident analyzer, only the incident indicated in the last checkpoint of the incident analyzer and any subsequent incidents having a newer identification number than the indicated incident.

A computer program product for administering checkpoints for incident analysis in a distributed processing system, the computer program product disposed upon a computer readable storage medium, wherein the computer readable storage medium is not a signal, the computer program product comprising computer program instructions that when executed by a computer cause the computer to carry out the steps of:

• receiving, by a checkpoint manager of the distributed processing system, from each incident analyzer of a plurality of incident analyzers, a checkpoint indicating an incident having the oldest identification number still in analysis by the incident analyzer at the time associated with the checkpoint;
• examining each received checkpoint by the checkpoint manager, to identify, as a restore incident, an incident having the oldest identification number indicated in any of the received checkpoints;
• sending, by a monitor of the distributed processing system, to the plurality of incident analyzers, a stream of incidents beginning with the identified restore incident and continuing with any incidents having a newer identification number than the identified restore incident;
• and
• for each incident analyzer of the plurality of incident analyzers, processing from the stream of incidents, by the incident analyzer, only the incident indicated in the last checkpoint of the incident analyzer and any subsequent incidents having a newer identification number than the indicated incident.