Restarting event and alert analysis after a shutdown in a distributed processing system

摘要

Restarting event and alert analysis after a shutdown in a distributed processing system, including: identifying a shutdown condition of the distributed processing system, the incident analyzer including a plurality of event analyzers and a monitor that monitors the plurality of event analyzers; and determining whether the shutdown was a planned shutdown or an unplanned shutdown; if the shutdown was planned, storing an identification of the last event in an event log that was injected in an event queue at the time of the planned shutdown and restarting event and alert analysis using the next event identified in the event log; and if the shutdown was unplanned, for each event analyzer, identifying the last event included in the last event pool that the event analyzer closed; and restarting event and alert analysis at the event analyzer using the next event received by the event analyzer after the identified last event.

主权项

1. A system for restarting event and alert analysis after a shutdown in a distributed processing system, the system comprising a computer processor, a computer memory operatively coupled to the computer processor, the computer memory having disposed within it computer program instructions capable, when executed by the computer processor, of causing the system to carry out the steps of:
identifying, by an incident analyzer, a shutdown condition of the distributed processing system, the incident analyzer including a plurality of event analyzers and a monitor that monitors the plurality of event analyzers, and each event analyzer corresponding to a plurality of event pools; upon determining, by the incident analyzer, that the shutdown was an unplanned shutdown:
for each event analyzer, identifying the last event included in the last event pool that the event analyzer closed, by:
identifying a last pool closed by the particular event analyzer by comparing the time log for each of the plurality of event pools;examining the events in the last pool closed to identify a last event in the last pool closed;wherein each event pool comprises a collection of events organized by time and each event in the plurality of event pools comprises an indication of a particular occurrence in or on a component of the distributed processing system; andrestarting, by the incident analyzer, event and alert analysis at the event analyzer using the next event received by the event analyzer after the identified last event.