Event cascade

Abstract: An event management system including an event manager (310), an alarm rule store (340), an event correlator (330), and a response engine (350). The event manager (310) provides and receives events. The event correlator (330) correlates at least one of the events provided by the event manager (310) based on the alarm rules stored in the alarm rule store (340). The response engine (350) executes a response policy based on the correlation of events by the event correlator (330).

Abstract: Given a system which detects simple events, one can define a complex event by constructing a list of sub-events. In order to recognize a complex event, the system keeps a record of the sub-events that have occurred thus far and the objects involved in these sub-events. Whenever the first sub-event in a complex event's sequence is recognized, an activation for that complex event is created. The activation contains an indication of the identity of the object involved in the event. The activation also includes an index initialized to one. If a newly detected event matches the next sub-event in any of the currently open complex events, the index for that complex event is incremented. If the index reaches the total number of sub-events in that complex event, the complete complex event is recognized. Thus any desired alarm is generated. Since the complex event that was just recognized may also be a sub-event of another complex event, the activation lists are consulted again to see if the indices of any other complex event activations can be advanced.

Abstract: An event alerter system for notifying one application or process of a change in a database. A database management system includes an event generator that defines events to be reported, such as a change in a particular field of the database. Each time an change occurs, the event generator notifies an event manager of the name of the event. Whenever an event dependent process indicates an interest in a change in a field in a particular record or records in a database, it transfers a command to the event manager identifying each such record and change. When the event dependent process issues such a command, it enters a wait state to process the occurrence of an event in either a synchronous or asynchronous mode. The event manager converts such a command into entries in an event table that identifies, for that and other event dependent processes, the list of events in which a process has an interest. Thereafter, each time the event generator signals a change, the event manager examines the event table to determine which, if any, event dependent processes have an interest in that particular change and only three event dependent processes that have requests for being notified of the change pending. Then the event dependent process can obtain a message containing the status of each event in which it has an interest.

Abstract: A computer operating system manages events. An application program or another part of the operating system defines an event monitor to monitor one or more types of events on its behalf. When each of the monitored events occurs, the event monitor is signalled and stores the event signal. Under certain conditions, the event monitor can notify an event handler, and the event handler can access the stored event signals. The event monitor can be defined and established dynamically, i.e. throughout operation of the computer without stopping or relinking the computer system. In the absence of an event monitor which is interested in an event, signals of the event are nevertheless stored. When an interested event monitor is subsequently established, the previously stored event signals are transferred to the interested event monitor. Thus, the event handler has the benefit of previous event signals. The event can be a trace event, and the event handler associated with each event monitor can receive and handle the trace events in real time.