Scaling event processing in a network environment

Non-transitory tangible media encoding logic that includes instructions for execution, which when executed by a processor of a first processing engine executing at a first server, is operable to perform operations comprising:

• maintaining, by the first processing engine a first portion of a decision tree at the first server in a network environment, wherein the decision tree comprises a data structure that uses tree-like graphs to model and evaluate discrete functions;
• delegating, by the first processing engine, a second portion of the decision tree from the first server to a second processing engine executing at a second server;
• and
• processing event data simultaneously at the first server by the first processing engine using the first portion of the decision tree and at the second server by the second processing engine using the second portion of the decision tree, wherein the processing comprises determining a match between the event data and information stored at nodes in the decision tree, wherein event data is associated with at least one event occurring at one or more network devices within the network to one or more event data collectors, wherein the simultaneous processing enables fast throughput through multiple processors in the network improving functioning of servers in the network.

A first server, comprising:

• a distributer;
• a first processing engine;
• a memory element for storing data;
• and
• a processor that executes instructions associated with the data, wherein the processor and the memory element cooperate such that the first server is configured for:
• maintaining, by the first processing engine, a first portion of a decision tree at the first server in a network environment, wherein the decision tree comprises a data structure that uses tree-like graphs to model and evaluate discrete functions;
• delegating, by the first processing engine, a second portion of the decision tree from the first server to a second processing engine executing at a second server;
• and
• processing event data simultaneously at the first server by the first processing engine using the first portion of the decision tree and at the second server by the second processing engine using the second portion of the decision tree, wherein the processing comprises determining a match between the event data and information stored at nodes in the decision tree, wherein event data is associated with at least one event occurring at one or more network devices within the network to one or more event data collectors, wherein the simultaneous processing enables fast throughput through multiple processors in the network improving functioning of servers in the network.