US 12,468,573 B2
Adaptive resource provisioning for a multi-tenant distributed event data store
Jun He, San Jose, CA (US); Partha Bhattacharya, Cupertino, CA (US); and Jae Yoo, Morgan Hill, CA (US)
Assigned to Fortinet, Inc., Sunnyvale, CA (US)
Filed by Fortinet, Inc., Sunnyvale, CA (US)
Filed on Dec. 2, 2022, as Appl. No. 18/074,254.
Application 18/074,254 is a continuation of application No. 16/815,172, filed on Mar. 11, 2020, granted, now 11,531,570.
Prior Publication US 2023/0124404 A1, Apr. 20, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 9/50 (2006.01); G06F 9/38 (2018.01); G06F 9/48 (2006.01); G06F 9/54 (2006.01); G06F 16/182 (2019.01); G06F 16/27 (2019.01); H04L 9/40 (2022.01)
CPC G06F 9/5027 (2013.01) [G06F 9/3856 (2023.08); G06F 9/4837 (2013.01); G06F 9/4881 (2013.01); G06F 9/541 (2013.01); G06F 16/182 (2019.01); G06F 16/278 (2019.01); H04L 63/0272 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by one or more processing resources, causes the one or more processing resources to:
maintain on behalf of each tenant of a plurality of tenants of a managed security service provider (MSSP), a distributed event data store, wherein for a given tenant of the plurality of tenants, the distributed event data store includes a plurality of partitions operable to store event data for a plurality of computer systems of a private network of the given tenant over a predetermined window of time, wherein each partition of the plurality of partitions includes a number of resource provision units (RPUs), each RPU providing a predefined amount of storage and a predefined processing throughput;
for the given tenant of the plurality of tenants, periodically determine a provisioning status prior to closing a current partition of the plurality of partitions of the distributed event data store of the given tenant;
when the provisioning status indicates an over-provisioning condition exists for the current partition, dynamically decreasing, with the one or more processing resources, a number of RPUs to be used for a new partition to be later added to the plurality of partitions for the given tenant by an adjustment ratio, wherein the adjustment ratio is based on the predetermined window of time for the current partition divided by an estimated amount of time to fill the current partition with the event data of the given tenant, wherein the number of RPUs for the new partition is less than a number of RPUs for the current partition; and
store the event data of the given tenant in the new partition.