Methods and apparatus for analyzing system events
AssigneeJerome Naifeh
InventorsTim Shelton, David Harris, James McFadyen, Charles Van Niman
Life of this patent
Estimating the term…
Abstract
Apparatus and methods facilitate analysis of events associated with a plurality of computer systems. Event occurrence items are compared with event rules of event rule sets associated with each computer system to determine whether the items are potentially significant as determined by matching with the event rule sets. A scorer associated with each computer system assigns a score to each event occurrence item to provide a relative indication of the potential significance of the event occurrence item. An interface is used to query the scored event occurrence items from each of the plurality of computer systems.
Claims19
An apparatus for facilitating analysis of system events for a plurality of computer systems, the apparatus comprising:
- a plurality of collected-event matchers each configured to identify collected system-event information items that match at least an event rule of an event-rule set in a respective computer system;
- a plurality of scorers each configured to score each system-event information item identified by a respective collected-event matcher using at least a scoring rule of a scoring-rule set, the score of each scored system-event information item used to prioritize the scored system-event information items;
- and
- an interface configured to query in parallel scored system-event information items from each of the plurality of scorers.
A method for facilitating analysis of system events for a plurality of computer systems, the method comprising:
- identifying collected system-event information items over a plurality of computer systems that match at least an event rule of an event-rule set in a respective computer system of the plurality of computer systems;
- scoring system-event information item identified using one or more scorers each associated with a respective computer system using at least a scoring rule of a scoring-rule set, the score of each scored system-event information item used to prioritize the scored system-event information items;
- and
- querying the one or more scorers in parallel for scored system-event information items from each of the plurality of computer systems.
A computer program product, comprising:
- a non-transitory computer-readable medium comprising:
- code for causing a computer to identify collected system-event information items over a plurality of computer systems that match at least an event rule of an event-rule set in a respective computer system of the plurality of computer systems;
- code for causing a computer to score system-event information item identified using one or more scorers each associated with a respective computer system using at least a scoring rule of a scoring-rule set, the score of each scored system-event information item used to prioritize the scored system-event information items;
- and
- code for causing a computer to query the one or more scorers in parallel for scored system-event information items from each of the plurality of computer systems.
Dependencies are inferred from the claim text.