| CPC G06F 9/542 (2013.01) [G06F 11/006 (2013.01); G06F 2201/86 (2013.01)] | 17 Claims |
|
1. A method, comprising:
receiving, from a computing environment with a plurality of devices, an event stream comprising a plurality of events, a respective device installed with hardware, software, and firmware;
monitoring the events by tracking a context in which the events are received based on at least one of:
a number of events received;
a first predetermined period of time;
an average rate indicating a number of events received over the first predetermined time period calculated over a second predetermined time period;
a current rate indicating a number of events received over the first predetermined time period calculated over a third predetermined time period, the third predetermined time period occurring more recently than the second predetermined time period; or
a predetermined event threshold;
determining whether to suppress a respective event based on a frequency of arrival of events in an event queue without performance of a first operation which generates the respective event and further based on the context in which the respective event is received, a first number of one or more actions triggered by the respective event, and a suppression rule corresponding to an operation which generates the respective event;
performing, by a device, the respective action by collecting details associated with hardware, software, and firmware installed and updated on the device in response to determining not to suppress the respective event;
responsive to receiving the events, displaying, on a user interface, the respective event, the one or more actions triggered by the respective event, and the corresponding suppression rule, the suppression rule displayed for approval by a user via the user interface and the suppression rule corresponding to the operation which generates the respective displayed event;
performing, by the computing entity, the one or more actions displayed on the user interface;
receiving, from the user interface, a modification to the suppression rule;
performing the respective action based on the modified suppression rule;
determining, based on the context, that performance of a first operation generates a first set of events and that performance of a second operation generates a second set of events;
designating the first set of events as a first cluster based on the a first event pattern identified for the first cluster;
designating the second set of events as a second cluster based on a second event pattern identified for the second cluster;
determining intermediate events occurring in the event stream between the first cluster and the second cluster, the first cluster and the second cluster each including a number of events greater than a second predetermined threshold; and
preventing system overloading by suppressing the intermediate events.
|