US 12,072,884 B2
Alert rule evaluation for monitoring of late arriving data
Yaniv Lavi, Tel Aviv (IL); Rachel Lemberg, Herzliya (IL); Anton Vasserman, Herzliya (IL); Yair Yizhak Ripshtos, Tel Aviv (IL); Dor Bank, Tel Aviv (IL); Ofri Kleinfeld, Tel Aviv (IL); Raphael Fettaya, Tel Aviv (IL); and Linoy Liat Barel, Tel Aviv (IL)
Assigned to MICROSOFT TECHNOLOGY LICENSING, LLC, Redmond, WA (US)
Filed by MICROSOFT TECHNOLOGY LICENSING, LLC, Redmond, WA (US)
Filed on Apr. 12, 2023, as Appl. No. 18/299,253.
Application 18/299,253 is a division of application No. 16/988,960, filed on Aug. 10, 2020, granted, now 11,640,401.
Claims priority of provisional application 63/033,677, filed on Jun. 2, 2020.
Prior Publication US 2023/0359625 A1, Nov. 9, 2023
Int. Cl. G06F 7/00 (2006.01); G06F 11/30 (2006.01); G06F 11/34 (2006.01); G06F 16/2455 (2019.01); G06N 5/01 (2023.01); G06N 5/04 (2023.01); G06N 20/20 (2019.01)
CPC G06F 16/2455 (2019.01) [G06F 11/302 (2013.01); G06F 11/3495 (2013.01); G06N 5/01 (2023.01); G06N 5/04 (2013.01); G06N 20/20 (2019.01)] 20 Claims
OG exemplary drawing
 
1. A method for alert rule evaluation in a monitoring system, comprising:
receiving an alert rule, the alert rule comprising a query and a condition;
determining that the alert rule is variant;
in response to determining that the alert rule is variant:
executing, at a start time, the query against a data store for an evaluation time window to obtain a query result for the evaluation time window;
determining that the query result for the evaluation time window satisfies the condition;
in response to determining that the query result for the evaluation time window satisfies the condition:
re-executing, in accordance with a fixed time interval and after the start time, the query against the data store for the evaluation time window to obtain the query result for the evaluation time window;
determining a number of consecutive times the query result for the evaluation time window remains unchanged;
determining that the number of consecutive times equals a predetermined number; and
generating an alert for the evaluation time window in response to determining that the number of consecutive times equals the predetermined number.