Event occurrence detection method and apparatus

[0001] The present invention relates generally to detecting event occurrences, and more particularly to method and apparatus that detect when a certain number of events occur within a time frame.

[0002] Computer systems commonly need to perform actions in response to a defined condition being satisfied. In particular, a computer system may need to perform certain actions in response to a particular event occurring a certain number of times within a specified time frame. For example, it may be desirable for a computer system to deactivate a user account in response to detecting that more than five bad login attempts have been made within a ten minute time frame.

[0003] Some known computer systems detect whether a particular event occurs a certain number of times within set time intervals. To this end, these known computer systems define time intervals based upon a time frame of interest and count the number of events that occur within each defined time interval. For example, these known computer systems may split an hour into six separate 10 minute intervals and determine based upon the number of events within each 10 minute interval that the event occurred more than a desired amount of times within a single 10 minute interval.

[0004] While this scheme works well in some instances, the scheme does not detect whether the event occurred more than a desired number of times within a specified time frame. Referring to the above example of six 10 minute intervals, if the event occurred 3 times within the last 3 minutes of a first 10 minute interval and occurred 3 times within the first 3 minutes of a second 10 minute interval, the known computer systems would not detect that the event occurred more than 5 times within a 10 minute time frame that spanned the last 3 minutes of the first 10 minute interval and the first 3 minutes of the second 10 minute interval.

[0005] Moreover, known computer systems track event occurrences by maintaining software variables whose values are stored in volatile memory. Since it may be desirable to perform actions in response to a certain number of events occurring within a relatively long time frame that may spans days, weeks, or even months, there is a high likelihood that the known computer systems would lose count of events due to (i) the computer system being powered down or restarted, or (ii) the software service that tracks the events being shut down or restarted.

[0006] Accordingly, there is a need for a method and apparatus that determine whether a particular event has occurred a certain number of times within a specified time frame that is not limited to set time intervals. Moreover, there is a need for a method and apparatus that may reliably determine whether a particular event has occurred a certain number of times within a relatively long time frame.

[0007] In accordance with one embodiment of the present invention, there is provided a method of detecting when a certain number of events occur within a time frame. One step of the method includes causing a database having several event records to include a first event record in response to a first event occurring. Another step of the method includes updating the first database record in response to each event that occurs within a first period from the first event occurring. The first period being based upon the time frame. The method also includes the step of determining based upon the several event records that the certain number of events occurred within the time frame.

[0008] Pursuant to another embodiment of the present invention, there is provided a method of performing an action in response to a certain number of events of an event type occurring within a time frame. One step of the method includes updating a first count value in response to each event of the event type that occurs within a first period from a first event of the event type occurring. The first period is based upon the time frame. Another step of the method includes updating a second count value in response to each event to the event type that occurs within a second period from a second event of the event type ocurring. The second period is also based upon the time frame. The method also includes performing the action if (i) the first count value indicates that the certain number of events of the event type has occurred within the time frame, or (ii) the second count value indicates that the certain number of events of the event type has occurred within the time frame.

[0009] Pursuant to yet another embodiment of the present invention, there is provided a computer readable medium that configures a processor to perform an action in response to a certain number of events of an event type occurring within a time frame. The computer readable medium includes a plurality of instructions which when executed by the processor causes the processor to update a first count value in response to each event of the event type that occurs within a first period from a first event of the event type occurring. The first period based upon the time frame. The plurality of instructions which when executed by the processor also causes the processor to update a second count value in response to each event of the event type that occurs within a second period from a second event of the event type occurring. The second period based upon the time frame. The plurality of instructions which when executed by the processor further causes the processor to perform the action if (i) the first count value indicates that the certain number of events of the event type has occurred within the time frame, or (ii) the second count value indicates that the certain number of events of the event type has occurred within the time frame.

[0010] It is an object of the present invention to provide a new and useful method and apparatus for detecting event occurrence frequency.

[0011] It is another object of the present invention to provide an improved method and apparatus for detecting event occurrence frequency.

[0012] It is an additional object of the present invention to provide a method and apparatus that detect whether a particular event occurred more than a certain number of times within a time frame.

[0013] It is yet another object of the present invention to provide a method and apparatus that detect whether a particular event occurred more than a certain number of times within a time frame that may span days, weeks, or months.

[0014] The above and other objects, features, and advantages of the present invention will become apparent from the following description and the attached drawings.

[0022] While the invention is susceptible to various modifications and alternative forms, a specific embodiment thereof has been shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that there is no intent to limit the invention to the particular form disclosed, but on the contrary, the intention is to cover all modifications, equivalents, and alternatives falling within the spirit and scope of the invention as defined by the appended claims.

[0023] FIG. 1 illustrates a computer network 8 upon which a management system 10 (see FIG. 2) may be implemented. The computer network 8 in a preferred embodiment includes client computers 12₁ . . . 12^x which are connected to a Microsoft Windows NT server 13_Y or a cluster 14 of Microsoft Windows NT servers 13₁ . . . 13_Z that execute various software routines.

[0024] A simplified functional diagram of the management system 10 is illustrated in FIG. 2. The various functional components illustrated in FIG. 2 may be (i) implemented upon a single server 13_y, (ii) distributed across the servers 13₁ . . . 13_Z of the cluster 14, or (iiii) distributed across the client computers 12₁ . . . 12_X and the servers 13₁ . . . 13_Z of the cluster 14. Moreover, while the invention is disclosed in a Microsoft Windows NT server environment, features of the present invention may be implemented in other environments.

[0025] As illustrated in FIG. 2, the management system 10 includes an event log 20, a user interface 21, an event log monitor 22, a database 24, and a rules processor 26. The event log 20 is operable to store event information obtained from event messages generated by event sources 28₁ . . . 28_N. Each event source 28_M is generally a software application that has registered with the management system 10. Moreover, each event source 28_M generally generates an event message after the event source 28_M (i) performs various functions, and/or (ii) encounters various conditions. For example, an event source 28_M may generate an event message in response to the event source 28_M encountering a disk error.

[0026] The user interface 21 provides a graphical interface that enables a user to (i) define rules, and (ii) associate an action or a group of actions to each defined rule. In particular, the user interface 21 allows a user to define a rule as a set of user established conditions that must be satisfied before the associated actions are executed. For example, a rule may establish (i) where a specific event must occur (e.g. a specified computer, work group, or domain), (ii) when a specific event must occur (e.g. a specified day, time, range of times, etc.), or (iii) a certain number of times a particular event must occur in a time frame before the event triggers an action.

[0027] The actions associated with the rules in the preferred embodiment may include notifying, logging, or running a pre-determined application. For example, execution of an action may cause the management system 10 to (i) send a page, (ii) send an e-mail, (iii) log an event to the printer, or (iv) run a diagnostic application. Moreover, an action may include several actions to be executed when the associated rule is satisfied. In other words, the rules processor 26 may cause several actions to occur such as notifying various applications, logging various information, and running various applications all in response to conditions of a single rule being satisfied.

[0028] The database 24 is operable to store event information and user defined rule information used by the management system 10. In particular, the database 24 is operable to store the information in response to database commands received from the event log monitor 22 and the user interface 21. Moreover, the database 24 (i) receives database queries that request information stored in the database 24, and (ii) generates database result tables that include the requested information in response to processing the received database queries.

[0029] In a preferred embodiment of the present invention, the database 24 utilizes non-volatile read/write storage (e.g. a disk drive, or RAID device) to store the various records of data in a persistent manner. Accordingly, the information remains stored in the database 24 even after (i) a computer system which is implementing the database 24 is shut down or restarted, or (ii) a computer process (i.e. a software application or service) that is implementing the interface to the database 24 is shut down or restarted. Moreover, in the preferred embodiment of the present invention, the database 24 is implemented as a Microsoft SQL (structured query language) database in which records of data are stored in a conventional manner; however, the database 24 of the management system 10 may be implemented to utilize a different database structure.

[0030] The event log monitor 22 is operable to monitor the contents of the event log 20. Moreover, the event log monitor 22 is operable to generate database commands in response to additional information being added to the event log 20. In particular, the event log monitor 22 is operable to generate database commands that cause event records 40₁ . . . 40_K to be added to an event frequency table 42 that is stored in the database 24.

[0031] As shown in FIG. 3, the event frequency table 42 includes event records 40₁ . . . 40_K that include information associated with an event logged in the event log 20. In particular, each event record 40_J represents a separate occurrence of an event and includes an event identifier field 44, an expiration field 46, and a count field 48. The event identifier field 44 is operable to store an event identifier idEvent that is representative of the event type for the event occurrence which caused the event record 40_J to be added to the event frequency table 42. The expiration field 46 is operable to store an expiration value dtExpire that is representative of the date and time when the event record 40_J will expire and be removed from the event frequency table 42. The count field 48 is operable to store a count value cCountDown that is representative of the number of event occurrences that must be recognized before an associated action is triggered.

[0032] In order to add an event record 40_J to the event frequency table 42, the event log monitor 22 is operable to execute a software routine EventFrequencyTable.AddRecord( ) in response to each event (i) logged to the event log 20 and (ii) required by a defined rule to occur a certain number of times within a specified time frame. A pseudo-code representation of the software routine EventFrequencyTable.AddRecord( ) is shown in FIG. 3. The software routine EventFrequencyTable.AddRecord( ) may be reduced to a set of instructions that may be (i) stored on or in a computer readable medium, and (ii) executed by a processor or a combination of processors of the management system 10. In particular, when a processor of the management system 10 executes the set of instructions, the management system 10 causes an event record 40_J to be added to the event frequency table 42 maintained in the database 24.

[0033] To this end, the software routine EventFrequencyTable.AddRecord( ) causes the management system 10 to add to the event frequency table 42 an event record 40_J whose contents are based upon an event identifier idEvent, a time frame cTimeFrame, and an occurrence value cOccurrences. The event identifier idEvent is obtained from the event log 20 and represents the event type for the event occurrence which caused the event to be logged in the event log 20. The time frame cTimeFrame is obtained from a defined rule and indicates a time span such as a span of seconds, minutes, days, weeks, months, years which is represented in standard units such as milliseconds, seconds, minutes, hours. For example, if the time frame cTimeFrame utilizes a standard unit of one second, then a value of 86,400 for the time frame cTimeFrame is indicative of a one day time span. The occurrence value cOccurrences is obtained from a defined rule and represents the number of events that must occur within the time fame cTimeFrame in order for the actions associated with the defined rule to be triggered.

[0034] In particular, execution of line 2 of the software routine EventFrequencyTable.AddRecord( ) causes a new event record 40_J to be generated. Moreover, execution of lines 3 through 5 of the software routine EventFrequencyTable.AddRecord( ) causes the management system 10 to store appropriate information in the event identifier field 44, the expiration field 46, and the count field 48 of the newly generated event record 40_J. More specifically, in response to executing line 3, the management system 10 stores the event identifier idEvent obtained from the event log 20 in the event identifier field 44. By storing the event identifier idEvent in the event identifier field 44, the management system 10 associates the information stored in the newly generated event record 40_J with events of the type represented by the event identifier idEvent.

[0035] Furthermore, execution of line 4 of the software routine EventFrequencyTable.AddRecord( ) causes the management system 10 to obtain a representation of the current date and time. Moreover, execution of line 4 causes the management system to (i) add the time frame cTimeFrame obtained from a defined rule to the obtained current date and time, and (ii) store the sum in the expiration field 46. Accordingly, the expiration field 46 contains an expiration value that represents when the time frame cTimeFrame no longer includes the event which caused the generation of the event record 40_J.

[0036] Execution of line 5 of the software routine EventFrequencyTable.AddRecord( ) causes the management system 10 to store the occurrence value cOccurrences obtained from a defined rule in the count field 48. By storing the occurrence value cOccurrences in the count field 48, the management system 10 causes the newly generated event record 40_J to contain a count value that is representative of the number of times the event must occur before triggering an action. Finally, the management system 10 by executing line 6 of the software routine EventFrequencyTable.AddRecord( ) causes the database 24 to store the newly generated event record 40_J in the event frequency table 42.

[0037] Referring back to FIG. 2, the rules processor 26 of the management system 10 is operable to process user defined rules. In particular, the rules processor 26 is operable to (i) determine whether the conditions of a defined rule have been satisfied, and (ii) trigger the actions associated with the defined rule in response to determining that the defined rule has been satisfied. Since the rules processed by the rules processor 26 may include conditions that require a particular event to occur a certain number of times within a specified time frame, the rules processor 26 must be able to determine whether a particular event has occurred the certain number of times within the specified time frame.

[0038] To this end, the rules processor 26 is operable to cause the software function EventFrequencyTest( ) to be executed in order to determine based upon an event identifier idEvent whether a particular event has occurred a certain number of times within a specified time frame. In particular, the software function EventFrequencyTest( ) is a Boolean function that (i) updates information contained in the event frequency table 42, and (ii) generates a truth value of either true or false based upon the information contained in the event frequency table 42. In the preferred embodiment of the present invention, the rules processor 26 is operable to execute the software function EventFrequencyTest( ) in response to each time the event log monitor 22 causes an event record 40_J to be added to the event frequency table 42.

[0039] A pseudo-code representation of the software function EventFrequencyTest( ) is shown in FIG. 5. The software function EventFrequencyTest( ) may be reduced to a set of instructions that may be (i) stored on or in a computer readable medium, and (ii) executed by a processor or a combination of processors of the management system 10. In particular, when a processor of the management system 10 executes the set of instructions, the management system 10 determines whether events of a particular event type represented by an event identifier idEvent has occurred a certain number of times within a specified time frame as defined by a rule of the management system 10.

[0040] In general, the management system 10 in response to executing the software function EventFrequencyTest( ) causes (i) each event record 40₁ . . . 40_K that has expired to be removed from the event frequency table 42, and (ii) the count value stored in each event record 40₁ . . . 40_K to be updated for each event record 40₁ . . . 40_K that is associated with events of the particular event type. More specifically, as a result of executing line 4 of the software function EventFrequencyTest( ), the management system 10 determines whether the expiration value dtExpire stored in each event record 40₁ . . . 40_K is less than a current date and time value returned by the function DateTimeNow( ).

[0041] If the expiration value dtExpire is less than the current date and time value, then the management system 10 executes line 5 of the software function EventFrequencyTest( ) which causes the expired event record 40_J to be removed from the event frequency table 42. However, if the expiration value dtExpire is not less than the current date and time value, then the management system 10 determines for each non-expired event record 40₁ . . . 40_K whether the event record corresponds to an event of the same event type as the current event that caused the software function EventFrequencyTest( ) to be executed. Specifically, the management system 10 by executing line 6 of the software function EventFrequencyTest( ) determines that an event record 40_J corresponds to an event of the same event type as the current event if the event identifier idEvent stored in the event field 44 of the event record 40_J is equal to the event identifier idEvent of the current event.

[0042] If the event record 40_J does not correspond to an event of the same event type as the current event, then the management system 10 proceeds to processing the next event record 40_J+1of the event frequency table 42. However, if the event record 40_J does correspond to an event of the same event type as the current event, then the management system 10 (i) updates the count value cCountDown stored in the count field 48 of the event record 40_J, and (ii) determines whether the updated count value has reached a threshold value.

[0043] To this end, the management system 10 executes line 7 of the software function EventFrequencyTest( ) in order to decrease the count value cCountDown stored in the count field 48 of the event record 40_J by one. It should be appreciated that the software function could utilize other manners of updating the count value. For example, the software function EventFrequencyTest( ) could be altered to (i) decrease the count value cCountDown by a different amount, or (ii) increase the count value cCountDown by 1 or another incremental value. Moreover, it should be appreciated that altering the manner in which the count value cCountDown is updated would likely require a change to the threshold value, and/or the initial value used for the count value cCountDown.

[0044] By executing line 8, the management system 10 determines that the updated count value cCountDown' has satisfied a predetermined relationship to the threshold value if the updated count value cCountDown' is equal to zero. It should be appreciated that while the software function EventFrequencyTest( ) is described utilizing a threshold value of zero, the management system 10 may be modified to utilize a threshold value of a different magnitude. The management system 10 could be modified to adjust the initial count values cCountDown stored in the event records in order to accommodate for the threshold value having the different magnitude. Alternatively, each event type may have a separate threshold value that is stored in an additional field of the event records 40₁ . . . 40_K and compared to the corresponding count values in order to determine whether the event has occurred the required number of times.

[0045] If the rules processor 26 determines that the count value cCountDown has reached the threshold value, then the rules processor causes (i) the event record 40_J to be removed from the event frequency table 42 (line 9), and (ii) update the status value Status returned by the software function EventFrequencyTest( ) to a truth value of true (line 9).

[0046] After processing each event record 40₁ . . . 40_K in the event frequency table 42, the management system 10 upon executing line 14 of the software function EventFrequencyTest( ) returns the status value Status. Since the management system 10 in line 2 of the software function EventFrequencyTest( ) initially sets the status value Status to a truth value of false, the management system 10 returns a status value Status of false unless the management system 10 updates the status value Status to a truth value of true in response to executing line 10. As stated above, the management system 10 only executes line 10 of the software function EventFrequencyTest( ) if the count value cCountDown of one of the event records 40₁ . . . 40_K reaches the threshold value. Accordingly, execution of the software function EventFrequencyTest( ) only returns a true value if the count value cCountDown of one of the event records 40₁ . . . 40_K reaches the threshold value. The rules processor 26 may use the status of the returned value to determine whether a condition has been satisfied that requires events of a particular event type to occur a certain number of times within a specified time frame.

[0047] FIG. 6 illustrates a sequence of events of two different event types. In particular, FIG. 6 illustrates four events E1, E4, E5, and E7 that are of a first event type represented by an event identifier idEvent equal to 1. Moreover, FIG. 6 illustrates five events E2, E3, E6, E8, and E9 of a second event type represented by an event identifier idEvent equal to 2. The sequence of events occur in a span of time running from a first time represented by 125 time units to a second time represented by 150 time units. It should be appreciated that the illustrated time values are merely exemplary and that in practice the time values are typically much larger.

[0048] FIG. 7 shows the status of the event frequency table 42 and the values returned by the software function EventFrequencyTest( ) in response to processing the sequence of events shown in FIG. 6. In particular, FIG. 7 shows the information stored in the event frequency table 42 due to the management system 10 executing the software routine EventFrequencyTable.AddRecord( ) and the software function EventFrequencyTest( ) in response to each event E1 . . . E9 of FIG. 6. The information depicted in FIG. 7 assumes that the rules of the management system 10 define two conditions that require events of a particular event type to occur a certain number of time within a specified time frame. The first condition requires that events of the first event type represented by an event identifier idEvent of 1 to occur 2 times in a time frame cTimeFrame of 5 units. The second condition requires that events of the second event type represented by the event identifier idEvent of 2 to occur 3 times in a time frame cTimeFrame of 10 units.

[0049] For example, event frequency table 42_E4 illustrates the contents of the event frequency table 42 after the management system 10 processes the event E4, and the event frequency table 42_E5 illustrates the contents of the event frequency table 42 after the management system 10 processes the event E5 of FIG. 6. In particular, the management system 10 executes the software routine EventFrequencyTable.AddRecord( ) in order to process the event E5. As a result of executing the software routine EventFrequencyTable.AddRecord ( ), the management system 10 adds an event record to the event frequency table 42.

[0050] In particular, the added event record includes an event identifier idEvent of 1 since the event E5 has an event type represented by the event identifier idEvent of 1. Moreover, since the event E5 occurred at a time of 137 units and the first condition defines a time frame cTimeFrame of 5 units for events represented by the event identifier idEvent of 1, the added event record includes an expiration value dtExpire of 142 units. The added event record also includes an initial count value cCountDown of 2 since the first condition defines an occurrence value cOccurrences of 2 for events represented by the event identifier idEvent of 1. The second event record 40_E52 of the event frequency table 42_E5 illustrates the added event record after the count value cCountDown is updated by the software function EventFrequenctTest( ).

[0051] After executing the software routine EventFrequencyTable.AddRecord( ), the management system 10 executes the software function EventFrequenctTest( ) to determine whether events of the event type represented by the event identifier idEvent of 1 have occurred 2 times within a time frame cTimeFrame of 5 units. To this end, the management system removes each event record from the event frequency table 42_E4 that has expired. Specifically, the management system 10 removes the first event record 40_E41 from the event frequency table 42_E4 because the expiration value dtExpire (i.e. 136) of the first event record 40_E41 is less than the time value (i.e. 137) at which the event E5 occurred.

[0052] After removing the first event record 40_E41, the management system 10 updates the count value cCountDown of each event record corresponding to an event of the event type represented by the event identifier idEvent of 1. Specifically, the management system 10 decreases the count value cCountDown of the third event record 40_E43 by 1 and decreases the count value cCountDown of the newly added event record by 1. (See second event record 40_E52 of the event frequency table 42_E5)

[0053] As a result of decreasing the count value cCountDown of the third event record 40_E43, the count value cCountDown equals the threshold value of 0. Accordingly, the management system 10 (i) removes the third event record 40_E43 from the event frequency table 42_E4, and (ii) sets the status value Status to a truth value of true. As a result of the status value Status having a truth value of true, the management system 10 determines that events of the event type represented by the event identifier idEvent of 1 have occurred the specified occurrence value cOccurrences of times within the specified time frame cTimeFrame. Accordingly, the management system 10 may trigger actions associated with the condition being met.

[0054] While the invention has been illustrated and described in detail in the drawings and foregoing description, such illustration and description is to be considered as exemplary and not restrictive in character, it being understood that only a preferred embodiment has been shown and described and that all changes and modifications that come within the spirit of the invention are desired to be protected.