The present invention relates to a technique of detecting events which have occurred in an information system. Particularly, the present invention relates to a technique of detecting if events have occurred in a predetermined occurrence pattern.
A computer system not only may face a problem, such as an operational failure or a performance failure, but also may need to change the system setting when the setting does not match with the purpose of the computer system. The occurrence of such a problem or the need to change the setting is called “symptom”. Detecting and attending to a symptom can ensure efficient and safe management of a computer system. Because recent computer systems are complex, however, it is not easy to detect and attend to a symptom when occurred therein. There has been proposed a technique of allowing a computer to detect and attend to a symptom occurred therein.
In autonomic computing, a system of detecting and attending to symptoms is called an autonomic manager, which includes analysis, plan and execution functions (see pp. 10-11 of the above article). To add a new function to the autonomic manager to be able to, for example, detect a new symptom, a knowledge base is used (see p. 12 of the above article). To adequately function the system, therefore, it is desirable to sufficiently collect information of events needed for analysis first, then permit the use of a sufficient processing capability to achieve a plan and execution thereof, and further to provide a sufficient storage area for storing the knowledge base.
Recent devices, such as cellular phones, PDAs (Personal Data Assistants) and home appliances, are equipped with various functions of a computer. However, those devices do not have a sufficient processing capability or a sufficient storage area, thus making it difficult to allow those devices to adequately operate an autonomic manager. It is also difficult to detect occurrence of a specific symptom from the operation of a device itself. Such a specific symptom may occur due to complex factors including a server which communicates with the device. Even with a sufficient processing capability, therefore, it may not be proper for each device to operate an autonomic manager.
Because such devices are becoming exceedingly popular recently, a server may not be able to intensively manage symptoms occurred in individual devices due to the insufficient processing capability of the server. Those devices often suffer an unstable communication state, so that the server may not adequately collect the statuses of the individual devices even if it tries. Further, a system which allows each device to request the server to detect and attend to a symptom takes a longer process time by the time needed for a communication process, as compared with a case where a device itself detects and attends to a symptom. This is likely to reduce the operability and convenience.
Accordingly, it is an object of the present invention to provide a system, an information processing apparatus, a method and a program which can solve the foregoing problems. The object is achieved by combinations of the features described in independent claims in the appended claims. Dependent claims define further advantageous specific examples of the present invention.
To solve the problems, according to a first aspect of the present invention, there is provided a system that has a plurality of information processing apparatuses and detects if events have occurred in the plurality of information processing apparatuses in a predetermined occurrence pattern, each of the plurality of information processing apparatuses comprising a storage device where at least one piece of pattern data indicating an occurrence pattern of events to be detected in that information processing apparatus is stored; a generation section that specifies a collection of events to be detected in the occurrence pattern based on the pattern data read from the storage device and generates necessary event data indicating the specified collection of events; a selection section that selects an event included in the necessary event data from events which have occurred in that information processing apparatus and events transferred from another information processing apparatus; and a detection section that detects if the selected event matches with the occurrence pattern indicated by the pattern data, and outputs a detection result. There are also provided an information processing apparatus provided in the system, a method for allowing the information processing apparatus to detect events, and a program that allows the information processing apparatus to detect events.
According to a second aspect of the present invention, there is provided a system that has a plurality of information processing apparatuses and allows the plurality of information processing apparatuses to transfer events to one another to detect if events have occurred in a predetermined occurrence pattern, each of the plurality of information processing apparatuses comprising a storage device where necessary event data indicating a collection of events included in any one of occurrence patterns of events to be detected in that information processing apparatus is stored; a request reception section that receives, from another information processing apparatus adjacent to that information processing apparatus, requested event data indicating a collection of events requested by the adjacent other information processing apparatus to transfer; a request transmission section that generates requested event data of that information processing apparatus by combining the received requested event data with the necessary event data read from the storage device, and sends the requested event data to still another information processing apparatus adjacent to that information processing apparatus; and a transfer section that transfers, to another information processing apparatus adjacent to that information processing apparatus, an event included in the requested event data received from the adjacent other information processing apparatus from events which have occurred in that information processing apparatus and events transferred from another information processing apparatus. There are also provided an information processing apparatus provided in the system, a method for allowing the information processing apparatus to transfer events, and a program that allows the information processing apparatus to transfer events.
The present invention will be described below by way of the best mode of carrying out the invention (hereinafter called “embodiment”). However, an embodiment and modifications thereof described below do not limit the scope of the invention recited in the appended claims, or all the combinations of the features of the embodiment to be described should not necessarily be the means for solving the invention.
Each of the information processing apparatuses 100A to 100E has a storage device, a communication interface and a CPU (Central Processing Unit) as the basic hardware configuration. With processing by the CPU, each of the information processing apparatuses 100A to 100E runs at least one application program and an autonomic manager. The storage device and the communication interface provided in the information processing apparatus 100A are shown at 104A and 106A, respectively, the application program which runs on the information processing apparatus 100A is shown at 108A, and the autonomic manager provided in the information processing apparatus 100A is shown at 102A. The information processing apparatuses 100B to 100E have similar hardware and software components which are given with reference symbols respectively having suffixes “B” to “E” added to corresponding numerals of the components.
While the information processing apparatus 100A is directly connected to each of the information processing apparatuses 100C and 100D, the information processing apparatus 100A is not directly connected to the information processing apparatuses 100B and 100E. While the information processing apparatus 100B is directly connected to each of the information processing apparatuses 100D and 100E, the information processing apparatus 100B is not directly connected to the information processing apparatuses 100A and 100C. The information processing apparatus 100D is directly connected to each of the information processing apparatuses 100A, 100B, 100C and 100E. The connection may be achieved by wired or wireless connection, or a combination thereof. The term “connection” should not necessarily mean establishment of a physical communication path, and may, in practice, mean a logical communication path over a broadcast type network. The communication interfaces 106A to 106E provided in the information processing apparatuses 100A to 100E communicate with one another through those physical or logical communication paths. Because the information processing apparatuses are connected in a graphical fashion, each information processing apparatus may be referred to as “node” as if it were treated as a node in a graph.
Since the individual information processing apparatuses operate in approximately the same way, the information processing apparatus 100C will be described in detail below as a representative apparatus. The information processing apparatus 100C has an autonomic manager 102C, a storage device 104C, a communication interface 106C, and an application program 108C. The autonomic manager 102C detects if events have occurred in the information system 10 in a predetermined occurrence pattern. To achieve the detection, first, pattern data indicating an occurrence pattern to be detected is stored in the storage device 104C. The autonomic manager 102C acquires an event which has occurred in the application program 108C therefrom, or acquires an event which has occurred in another information processing apparatus via the communication interface 106C. Then, the autonomic manager 102C determines whether an occurrence pattern for the acquired events matches with the pattern data stored in the storage device 104C.
When there is a match, the autonomic manager 102C notifies a user of the occurrence of a predetermined symptom in the information system 10, or changes the setting in a predetermined manner. Each of the autonomic managers 102A, 102B, 102D and 102E, like the autonomic manager 102C, detects the occurrence of an event and attends to the event individually. It is to be noted that each of the storage devices 104A to 104E may store pattern data different from those of the other storage devices. Each of the storage devices 104A to 104E should desirably store only an occurrence pattern which is adequately detected in the information processing apparatus that has the storage device. Accordingly, occurrence patterns to be detected in the information processing apparatuses 100A to 100E can be made different from one another, so that the overall pattern detection process can be distributed to a plurality of apparatuses.
The information system 10 according to the embodiment is configured to detect and process patterns of events in a distributed way, so that events which have occurred at the respective locations in the information system 10 are adequately and efficiently transferred to the information processing apparatus that should detect the events.
The event storage section 210 is a storage area provided in the storage device 104C to store an event which has occurred in the application program 108C and an event acquired externally. The node information storage section 220 stores a collection of events needed for the detection by the information processing apparatus 100C itself, and events requested by another information processing apparatus to transfer which needs the events. Specific examples of the event storage section 210 and the node information storage section 220 will also be described later referring to
In addition, the generation section 230 may specify an occurrence pattern of events detectable in the information processing apparatus 100C based on the processing capability and process load of the information processing apparatus 100C. In this case, the generation section 230 generates detectable event data indicating a collection of events included in any one of the specified occurrence patterns, and stores the detectable event data in the node information storage section 220. In this case, further, the generation section 230 may update the generated detectable event data based on changes in the processing capability and process load of the information processing apparatus 100C. In accordance with the update of the detectable event data, the generation section 230 sends the updated detectable event data to another information processing apparatus 100 adjacent to the information processing apparatus 100C so that the adjacent information processing apparatus 100 updates necessary event data.
The event handler unit determines whether an event which has occurred in the information processing apparatus 100C (i.e., application program 108C) and an event transferred from another information processing apparatus are to be processed by the information processing apparatus 100C or to be transferred to another information processing apparatus to be processed therein. Specifically, the event handler unit has a selection section 240 and a transfer section 250. The selection section 240 acquires an event which has occurred in the information processing apparatus 100C (i.e., application program 108C) and an event transferred from another information processing apparatus. It is desirable that the selection section should acquire an event only from an information processing apparatus adjacent to the information processing apparatus 100C (i.e., connected directly to the information processing apparatus 100C without intervening any other information processing apparatus). In the embodiment, for example, the information processing apparatus 100C acquires an event from the information processing apparatus 100A or the information processing apparatus 100D. Data indicating the acquired event is event data 30.
The selection section 240 selects an event included in the necessary event data or detectable event data generated by the generation section 230 from occurred/acquired events. Then, the selection section 240 stores the selected event in the event storage section 210, and notifies a process determination section 260 of the selected event. Under a condition that a free space of the event storage section 210 is equal to or larger than a predetermined size, the selection section 240 may store even an event not included in necessary/detectable event data in the event storage section 210.
The transfer section 250 transfers an event which is included in neither the necessary event data nor the detectable event data to another information processing apparatus, e.g., the information processing apparatus 100A or the information processing apparatus 100D. Instead or in addition, the transfer section 250 may select and transfer an occurred event, if included in requested event data corresponding to another information processing apparatus, to the other information processing apparatus, regardless of whether the occurred event is included in the necessary event data or the like.
Based on the selected event, the correlation unit determines whether an occurrence pattern of events including the event matches with a predetermined pattern, and outputs a determination result. Specifically, the determination on pattern matching is made based on the degree of correlation when a pattern including a newly occurred event is compared with the history of occurrence of events, as well as on perfect matching. The determination technology is known as, for example, ACT (Active Correlation Technology). The correlation unit has an additional function of realizing the pattern detection process in cooperation with another information processing apparatus. Specifically, the correlation unit has the process determination section 260, a process execution section 270 and a detection section 280.
Upon reception of notification of the occurrence of an event from the selection section 240, the process determination section 260 searches the symptom storage section 200 for an occurrence pattern including the occurred event, and reads a plurality of tasks corresponding to the found occurrence pattern from the symptom storage section 200. Then, the process determination section 260 determines which information processing apparatus should process each of the tasks read. The determination may be made based on data that indicates, for each task, which information processing apparatus should process that task, or on a transfer record for events necessary for the processing of the task.
The process execution section 270 processes a task which is determined to be processed by the information processing apparatus 100C. The process execution section 270 also instructs another information processing apparatus to process a task which is determined to be processed by that information processing apparatus. The detection section 280 detects if the events notified by the selection section 240 match with an occurrence pattern indicated by the pattern data, and outputs a detection result. The detection process is realized by determining whether each condition determined by each task is fulfilled. Accordingly, the detection section 280 determines whether the detection is possible or not based on the result of the task executed by another information processing apparatus in addition to the result of the process executed by the process execution section 270. Under a condition that the events have occurred in the occurrence pattern, the countermeasure execution section 285 reads a countermeasure process stored in the symptom storage section 200 in association with the pattern data, and executes the countermeasure process. The countermeasure process is, for example, alteration of the setting in the application program 108C or the like.
The request reception section 290 and the request transmission section 295 serve to distribute necessary event data. Specifically, the distribution is carried out as follows. The request reception section 290 receives, from another information processing apparatus adjacent to the information processing apparatus 100C, requested event data indicating a collection of events requested by the adjacent other information processing apparatus to transfer. Then, the request transmission section 295 combines the received requested event data with necessary event data of the information processing apparatus 100C read from the node information storage section 220 and detectable event data to generate event data requested by the information processing apparatus 100C. The requested event data indicates a collection of events that the information processing apparatus 100C requests another information processing apparatus adjacent thereto to transfer. The request transmission section 295 sends the requested event data to the adjacent information processing apparatus. The sender of the original requested event data is excluded from a list of receivers. That is, when the information processing apparatus 100C receives the requested event data from the information processing apparatus 100A, for example, the information processing apparatus 100C transfers the requested event data to the information processing apparatus 100D.
The event body 300 includes at least an event ID 305, an event source 310 and an event content 320. As shown on line 3 in
For an event deleted from the event storage section 210, the transfer section 250 stores the identification information of the event in association with the information processing apparatus to which the event has been transferred. Specifically, the event storage section 210 deletes the content of an event 2345, sets the deletion flag and stores the identification information of the receiver's information processing apparatus. Even in this case, the transfer section 250 may keep storing least necessary information to identify the category of the event, such as the event source or the time of occurrence of the event. As another example, the transfer section 250 may transfer an event regardless of whether the event has been deleted. In this case, the deletion flag is kept reset and the identification information of the receiver is stored in the event storage section 210 as is the case for an event 3456.
Requested event data of another information processing apparatus adjacent to the information processing apparatus 100C indicates a collection of events included in necessary event data or detectable event data of that adjacent other information processing apparatus, or included in requested event data of still another information processing apparatus adjacent to that adjacent other information processing apparatus. For example, the requested event data of the information processing apparatus 100D includes necessary event data of the information processing apparatus 100B and information processing apparatus 100E as well as necessary event data of the information processing apparatus 100D. Such structure of requested event data can allow an event to adequately reach an information processing apparatus which needs the event through an adequate path passing adjacent information processing apparatuses in order. The technique of transferring requested event data to the individual apparatuses will be described later referring to
The node information storage section 220 further stores necessary event data and detectable event data of the information processing apparatus 100C itself. Because necessary event data is a collection of events needed to detect an occurrence pattern in the information processing apparatus 100C as mentioned above, it is also called interest data to mean a collection of events in which the information processing apparatus 100C is interested. In spite of the meaning, necessary event data may be determined arbitrarily according to the policy of an administrator of the information processing apparatus 100. Because detectable event data is a collection of events detectable from the viewpoint of the processing capability or the like of the information processing apparatus 100C as mentioned above, it is also called capability data. As various kinds of data are stored in the node information storage section 220, the selection section 240 can adequately determine an event to be stored in the event storage section 210 by referring to the node information storage section 220.
Next, symptom data 60-1 as a representative of those pieces of symptom data 60-1 to 60-N will be described. The symptom data 60-1 includes pattern data 600, symptom detailed data 610 and countermeasure process data 620. The pattern data 600 indicates an occurrence pattern of events to be detected in the information processing apparatus 100C. Specifically, the pattern data 600 includes a plurality of tasks (e.g., tasks 605-1 to 605-M) respectively associated with identification information (e.g., identification information 608-1 to 608-M) of information processing apparatuses which are allowed to process the tasks.
As one example, the task 605-1 is a task to determine a condition, and is associated with identification information 608-1 of the information processing apparatus that is allowed to execute the process. There may be a task like the task 605-2, which is not associated with identification information of the information processing apparatus that is allowed to execute the process. The symptom detailed data 610 indicates a symptom which appears in the information system 10 when the condition determined by each task is fulfilled. The symptom detailed data 610 may be output when the condition is fulfilled or may be referable even if it is not used in any process when the system administrator maintains or checks the symptom data 60-1.
The countermeasure process data 620 indicates a process which is executed when an event occurs in the occurrence pattern. In this example, the details of a specific setting work, e.g., “set the operational priority of component A to 2”, are recorded. The countermeasure process data 620 may indicate a process which calls a user's attention like “display information on an occurred event” besides such a specific setting work. Although the content of a setting process is described by a natural language for the sake of descriptive convenience in the embodiment, the content may, in practice, include a specific command (e.g., a method to be invoked) to make such setting and a parameter thereof. Further, the symptom storage section 200 may store identification information 622 indicating identification information of the information processing apparatus that is allowed to execute the process, in association with the countermeasure process data 620. This can allow the information processing apparatus which has finished executing all tasks to determine where to execute a later countermeasure process.
The task 605-2 includes a partial expression 650. The partial expression 650, like the partial expression 630, determines the ID and attribute of each of a plurality of events, and evaluates a logical expression based on the determination result. The partial expression 650 indicates that an output value computed in the output definition 640 should be referred to in the determination process.
Conditions that each task determines are not limited to those based on the ID and attribute of each event. For example, each task may determine based on the number of times of occurrence of one event, the order of occurrence of a plurality of events, whether a combination of events has occurred in a predetermined period, whether one event has not occurred, or a combination thereof.
Next, the selection section 240 determines whether the received event is included in the necessary event data or detectable event data of the information processing apparatus 100C (S710). Under a condition that the event is included in such event data, the selection section determines whether the event can be stored, e.g., whether there is a sufficient space available in the storage device 104C to store the event (S720). When the event is storable (S720: YES), the selection section 240 selects the event as a target for event pattern detection and stores the event in the event storage section 210 (S730). As an example, because the received event 1234 is included in the necessary event data of the information processing apparatus 100C as shown in
Then, the detection section 280 reads pattern data from the symptom storage section 200 and detects if the occurred event matches with the pattern data based on the events stored in the event storage section 210 (S735). For example, the detection section 280 itself may execute the detection process in cooperation with the process determination section 260 and the process execution section 270, or, with the function of the process execution section 270, may cause another information processing apparatus to execute at least a part of the detection process. There is a case where the apparatus that executes the detection process has been determined statically and a case where this apparatus is determined dynamically. In the case of the static determination, the task 605 is associated with the identification information 608 in the symptom data 60. In this case, the detection section 280 instructs the information processing apparatus identified by the identification information 608 to execute the task 605.
In the case of the dynamic determination, the task 605 is not associated with the identification information 608. In this case, first, the process execution section 270 attempts to execute the task 605 by itself. However, there may be a case where an event to be used in the determination process of the task is not stored in the event storage section 210, disabling the process execution section 270 to execute the task. In this case, the process execution section 270 determines whether identification information of the event is stored in the event storage section 210 and identification information of the receiving information processing apparatus to which the event has been transferred is stored in association with the identification information of the event. When such identification information is stored, the process execution section 270 instructs the detection section of the receiving information processing apparatus to execute the process of detecting the occurrence pattern.
In this case, the process execution section 270 may send the detection process instruction associated with symptom data on the occurrence pattern to be detected to the receiving information processing apparatus. This allows the information processing apparatus having received the detection process instruction to adequately detect even an occurrence pattern whose detection by the information processing apparatus is not predetermined. The result of the detection process which is executed this way may be output to the user. The countermeasure execution section 285 may further execute a countermeasure process based on the detection result.
After the detection process (S735) or when no event is storable in the event storage section 210 (S720: NO), the transfer section 250 determines whether the received event is included in requested event data corresponding to another information processing apparatus adjacent to the information processing apparatus 100C (S740, S770). When the received event is included in the requested event data (S740: YES, S770: YES), the transfer section 250 selects such an event and transfers the event to the adjacent other information processing apparatus (S750). It is to be noted that this process is carried out under a condition that identification information of the information processing apparatus to which the event is to be transferred is not included in the transfer path information received in association with the event. As shown in
In this case, the transfer section 250 adds the identification information of the information processing apparatus 100C to the transfer path information, and sends the resultant information in association with the event to be transferred. For example, the path information associated with the event includes the identification information of the information processing apparatus 100C in addition to the identification information of the information processing apparatus 100D. When the information processing apparatus 100C is temporarily uncommunicatable with the transfer destination, the transfer section 250 may sequentially buffer events to be transferred and send those events together when the information processing apparatus 100C becomes communicatable. The transfer section 250 may send buffered events only in a predetermined period, such as a maintenance time for the information system 10, so as not to interfere with the process of the application program 108C or the like.
In addition, the transfer section 250 may send only an event whose priority previously associated with each event is equal to or greater than a reference value, thereby reducing the communication traffic and process load. The terms “transfer”, “transmission” and the like indicate transfer/transmission of an event as a consequence, and does not restrictively indicate a specific process of the information processing apparatus 100C to send data from another information processing apparatus. When the information processing apparatus 100C has server software components in a server-client model installed therein and the information processing apparatus at the transfer destination has client software components installed therein, for example, the information processing apparatus 100C may carry out the transfer process by instructing the information processing apparatus at the transfer destination to acquire an event. When the transfer is completed, the transfer section stores the identification information of the transferred event in the event storage section 210 in association with the identification information of the information processing apparatus at the transfer destination for the event (S760).
When the received event is not storable in the information processing apparatus 100C (S720: NO) and is not included in requested event data corresponding to any adjacent information processing apparatus (S770: NO), the transfer section 250 determines whether the received event is storable in any one of the adjacent information processing apparatuses (S780). The determination may be achieved as the transfer section 250 inquires each adjacent information processing apparatus about a free space of the storage area. For example, the determination may be achieved by acquiring detectable event data of the adjacent information processing apparatuses. This is because detectable event data indicates that the corresponding event can be detected, and thus indicates that, if possible, at least an associated event can be stored.
When the received event is storable in any one of the adjacent information processing apparatuses (S780: YES), the transfer section 250 proceeds to the process of step S750 of transferring the event to that information processing apparatus. When the received event is not storable in any adjacent information processing apparatus (S780: NO), the transfer section 250 executes a process of expanding the storage area of the event storage section 210 in the storage device 104C so as to be able to store the event and events to occur later (S790).
When such an event is found (S820: YES), the transfer section 250 deletes the event from the event storage section 210 (S825). When the deleted event is the one transferred from another information processing apparatus (e.g., information processing apparatus 100D) and stored in the event storage section 210, the transfer section 250 notifies the information processing apparatus 100D of the deletion of the event. Determination of whether that another information processing apparatus is the information processing apparatus 100D may be achieved by referring to the identification information of the sending information processing apparatus associated with the event in the event storage section 210. In the notified information processing apparatus 100D, the transfer section 250 deletes the identification information of the event associated with the receiving information processing apparatus 100C from the storage device of the information processing apparatus 100D. Then, the transfer section 250 of the information processing apparatus 100C stores the new event received in the event storage section 210 (S810). When the event is the one transferred from another information processing apparatus, the transfer section 250 stores the identification information of that another information processing apparatus, as information indicating the information processing apparatus that has sent the event, in the event storage section 210 in association with the event.
When no such event is found (S820: NO), the transfer section 250 determines whether there is any adjacent information processing apparatus which accepts transfer of any event stored in the event storage section 210 (S830). This determination may be achieved by inquiring another information processing apparatus adjacent to the information processing apparatus 100C about information, such as detectable event data, as done in the foregoing example. When there is an information processing apparatus which accepts event transfer (S830: YES), the transfer section 250 transfers the event read from the event storage section 210 to the information processing apparatus (S840). The event to be transferred is, first of all, an event not included in the necessary event data or detectable event data of the information processing apparatus 100C. When there is no such event or when there are a plurality of such events, an event may be selected based on the priority of the event, the time of occurrence thereof or the like. Then, the transfer section 250 stores a flag indicating that the event is to be deleted and the identification information of the information processing apparatus at the transfer destination in the event storage section 210 in association with the identification information of the event (S850), and proceeds to the process of S825 to delete the event.
When there is no information processing apparatus which accepts event transfer (S830: NO), the transfer section 250 deletes some event already stored in the event storage section 210 according to a predetermined policy (S860), and stores the received event in the event storage section 210 (S810).
According to the embodiment described above referring to
Next, referring to
Every time the processing capability and process load of the information processing apparatus 100C are changed (S910: YES), the generation section 230 generates detectable event data based on the changed processing capability and process load (S915). The processing capability is determined based on software components as well as hardware components of the information processing apparatus 100C. For example, the processing capability indicates an event detecting function provided in the autonomic manager 102C besides the computing power of the CPU and the storage capacity of the storage device. For example, a sub component provided beforehand for each detection function, called an event detecting engine, can be added to the autonomic manager 102C. The generation section 230 may update detectable event data according to the addition of such a sub component.
The request reception section 290 determines whether a notification to update requested event data indicative of a collection of events requested by another information processing apparatus adjacent to the information processing apparatus 100C to transfer has been received therefrom (S920). This notification may be updated requested event data itself or may be a difference between collections of events before and after the update. Under a condition that the notification has been received (S920: YES), the request transmission section 295 combines requested event data indicated by the received notification with necessary event data and detectable event data generated by the generation section 230 to generate requested event data of the information processing apparatus 100C (S930).
Specifically, the request transmission section 295 computes a union of the requested event data of the adjacent information processing apparatus, the necessary event data of the information processing apparatus 100C and the detectable event data of the information processing apparatus 100C, as updated requested event data. Upon reception of the collection of the events 1234 and 2345 as requested event data in the example of
Then, the request transmission section 295 sends the generated requested event data to an adjacent information processing apparatus to update requested event data stored in the adjacent information processing apparatus (S940). Note that the sending information processing apparatus that has sent the update notification received in S920 is excluded from transfer destinations. The request transmission section 295 may sequentially buffer requested event data to be transmitted, and transmit the requested event data with predetermined timing, e.g., regularly. The request transmission section 295 may achieve the transmission of requested event data by sending an instruction to acquire the requested event data to another information processing apparatus like the above-described example of the event transfer. When the requested event data generated in S930 is identical to the requested event data before generation, the requested event data may not be transmitted.
As described above referring to
When a server with an extremely high processing capability is provided in the network, however, the server may carry out centralized management of requested event data. One example of the case is shown as a modified embodiment in
The host controller 1082 connects the RAM 1020 to the CPU 1000 and the graphics controller 1075, which access the RAM 1020 at a high transfer rate. The CPU 1000 operates to control the individual sections based on programs stored in the ROM 1010 and the RAM 1020. The graphics controller 1075 acquires image data which is generated by the CPU 1000 or the like on a frame buffer provided in the RAM 1020. Instead, the graphics controller 1075 may include a frame buffer inside to store image data generated by the CPU 1000 or the like.
The input/output controller 1084 connects the host controller 1082 to the communication interface 1030, the hard disk drive 1040 and the CD-ROM drive 1060, which are relatively fast input/output devices. The communication interface 1030 communicates with an external device over a network. The hard disk drive 1040 stores programs and data which the information processing apparatus 100C uses. The CD-ROM drive 1060 reads programs and data from a CD-ROM 1095, and provides the RAM 1020 or the hard disk drive 1040 with the programs and data.
The input/output controller 1084 is connected with relatively slow input/output devices, such as the flexible disk drive 1050 and the input/output chip 1070. The ROM 1010 stores a boot program which is executed by the CPU 1000 when the information processing apparatus 100C is activated, and programs which depend on the hardware of the information processing apparatus 100C. The flexible disk drive 1050 reads programs and data from a flexible disk 1090, and provides the RAM 1020 or the hard disk drive 1040 with the programs and data via the input/output chip 1070. The input/output chip 1070 connects flexible disk 1090 and various kinds of input/output devices via, for example, a parallel port, a serial port, a keyboard port, a mouse port and so forth.
The program to be provided to the information processing apparatus 100C is stored in a recording medium, such as the flexible disk 1090, the CD-ROM 1095 or an IC card, and provided by a user. The program is read from the recording medium via the input/output chip 1070 and/or the input/output controller 1084, and is installed and executed on the information processing apparatus 100C. Because the operations which the program allow the information processing apparatus 100C or the like to execute are the same as the operations of the information processing apparatus 100C which have been explained referring to
The program described above may be stored in an external storage medium. An optical recording medium, such as DVD or PD, a magnetooptical recording medium, such as MD, a tape medium, a semiconductor memory, such as an IC card, and the like can be used as storage media in addition to the flexible disk 1090 and the CD-ROM 1095. A storage device, such as a hard disk or RAM, provided at a server system connected to a private communication network or the Internet can be used as a recording medium to provide the information processing apparatus 100C with the program over the network. Because the hardware configuration of each of the information processing apparatus 100A, the information processing apparatus 100B, the information processing apparatus 100D and the information processing apparatus 100E is substantially identical to the information processing apparatus 100C, its description will be omitted.
Although the embodiment of the present invention has been described above, the technical scope of the invention is not limited to the scope of the above-described embodiment. It should be apparent to those skilled in the art that various changes and improvements can be made to the embodiment. It is apparent from the description of the appended claims that such changed or improved embodiments are encompassed in the technical scope of the invention.
Number | Date | Country | Kind |
---|---|---|---|
2007-161154 | Jun 2007 | JP | national |
This application is a continuation of U.S. patent application Ser. No. 12/133,516, which has a U.S. filing date of Jun. 5, 2008 and is entitled “Detecting Patterns of Events in Information Systems.” The '516 application is incorporated in its entirety by reference hereto into this application.
Number | Name | Date | Kind |
---|---|---|---|
5692156 | Bahls et al. | Nov 1997 | A |
6049776 | Donnelly et al. | Apr 2000 | A |
6189141 | Benitez et al. | Feb 2001 | B1 |
7840575 | Chandrasekaran | Nov 2010 | B2 |
7992053 | Akiyama et al. | Aug 2011 | B2 |
20010049713 | Arnold et al. | Dec 2001 | A1 |
20040193923 | Hammond et al. | Sep 2004 | A1 |
20050073992 | Lee et al. | Apr 2005 | A1 |
20050078660 | Wood | Apr 2005 | A1 |
20050091167 | Moore et al. | Apr 2005 | A1 |
20050102312 | Ohya et al. | May 2005 | A1 |
20050166072 | Converse | Jul 2005 | A1 |
20050172162 | Takahashi et al. | Aug 2005 | A1 |
20060206882 | Illowsky et al. | Sep 2006 | A1 |
20060206900 | Ooyama et al. | Sep 2006 | A1 |
20070088914 | Soman et al. | Apr 2007 | A1 |
20070168743 | Ramamurthy et al. | Jul 2007 | A1 |
20070168789 | Udell | Jul 2007 | A1 |
20080320326 | Akiyama et al. | Dec 2008 | A1 |
20090113250 | Meijer et al. | Apr 2009 | A1 |
20090132203 | Shimada et al. | May 2009 | A1 |
20090172034 | Aoyama et al. | Jul 2009 | A1 |
Number | Date | Country |
---|---|---|
08331125 | Dec 1996 | JP |
09265460 | Oct 1997 | JP |
10269252 | Oct 1998 | JP |
10334058 | Dec 1998 | JP |
11224214 | Aug 1999 | JP |
2000330912 | Nov 2000 | JP |
2001101108 | Apr 2001 | JP |
2003296129 | Oct 2003 | JP |
2005222216 | Aug 2005 | JP |
2005251207 | Sep 2005 | JP |
2006209206 | Aug 2006 | JP |
2006261804 | Sep 2006 | JP |
Entry |
---|
NIWS Corp.; What is Autonomic Computing?; First edition, Softbank Publishing Inc.; Feb. 19, 2005. |
Biazetti; Realizing Compound Event Processing Using Active Correlation Technology; Jun. 16, 2009. |
“An Architectural Blueprint For Automatic Computing”, Autonomic Computing White Pages, G507-2065-00, IBM Corporation, Fourth Edition, Jun. 2006. |
Number | Date | Country | |
---|---|---|---|
20140195677 A1 | Jul 2014 | US |
Number | Date | Country | |
---|---|---|---|
Parent | 12133516 | Jun 2008 | US |
Child | 14209256 | US |