Abstract: Methods, apparatuses, and computer program products for event and alert analysis are provided. Embodiments include a local event analyzer embedded in an alert analyzer receiving events from an event queue. Embodiments also include the local event analyzer creating, based on the received events and local event analysis rules specific to the alert analyzer, a temporary alert for the alert analyzer. Embodiments also include the alert analyzer analyzing the temporary alert based on alert analysis rules.

Abstract: Methods, apparatuses, and computer program products for event and alert analysis are provided. Embodiments include a local event analyzer embedded in an alert analyzer receiving events from an event queue. Embodiments also include the local event analyzer creating, based on the received events and local event analysis rules specific to the alert analyzer, a temporary alert for the alert analyzer. Embodiments also include the alert analyzer analyzing the temporary alert based on alert analysis rules.

Abstract: Methods, apparatuses, and computer program products for event and alert analysis are provided. Embodiments include a local event analyzer embedded in an alert analyzer receiving events from an event queue. Embodiments also include the local event analyzer creating, based on the received events and local event analysis rules specific to the alert analyzer, a temporary alert for the alert analyzer. Embodiments also include the alert analyzer analyzing the temporary alert based on alert analysis rules.

Abstract: Methods, apparatuses, and computer program products for determining a number of unique incidents in a plurality of incidents for incident processing in a distributed processing system are provided. Embodiments include an incident analyzer identifying within the plurality of incidents, attribute combination entries of location identifications and incident types and analyzing each location identification in each attribute combination entry according to a sequence of the attribute combination entries including creating attribute pairs. The incident analyzer is also configured to count the attribute pairs. The number of attribute pairs is the number of unique incidents in the plurality of incidents.

Abstract: Methods, apparatuses, and computer program products for determining a number of unique incidents in a plurality of incidents for incident processing in a distributed processing system are provided. Embodiments include an incident analyzer identifying within the plurality of incidents, attribute combination entries of location identifications and incident types and analyzing each location identification in each attribute combination entry according to a sequence of the attribute combination entries including creating attribute pairs. The incident analyzer is also configured to count the attribute pairs. The number of attribute pairs is the number of unique incidents in the plurality of incidents.

Abstract: Methods, apparatuses, and computer program products for determining whether to send an alert are provided. Embodiments include a voting manager receiving from a plurality of alert analyzers, one or more delivery codes associated with an alert. In dependence upon the one or more delivery codes, the voting manager determines whether to suppress the alert, to close the alert, or to report the alert.

Abstract: Methods, apparatuses, and computer program products for checkpointing for delayed alert creation are provided. Embodiments include applying a checkpoint to an events pool having events with corresponding alerts that have been generated and not delivered and following a crash and loss of the corresponding alerts not recorded in an alert database, generating new alerts based on the events in the events pool having the checkpoint. In response to completing processing of a new alert, embodiments include determining whether the alert database has an entry corresponding to the processed new alert. If the alert database has an entry corresponding to the processed new alert, embodiments include delivering the processed new alert without reporting the processed new alert to the alert database. If the alert database does not have an entry corresponding to the processed new alert, embodiments include reporting the processed new alert to an alert database.

Abstract: Methods, apparatuses, and computer program products for determining a number of unique incidents in a plurality of incidents for incident processing in a distributed processing system are provided. Embodiments include an incident analyzer identifying within the plurality of incidents, attribute combination entries of location identifications and incident types and analyzing each location identification in each attribute combination entry according to a sequence of the attribute combination entries including creating attribute pairs. The incident analyzer is also configured to count the attribute pairs. The number of attribute pairs is the number of unique incidents in the plurality of incidents.

Abstract: Methods, apparatuses, and computer program products for determining a number of unique incidents in a plurality of incidents for incident processing in a distributed processing system are provided. Embodiments include an incident analyzer identifying within the plurality of incidents, attribute combination entries of location identifications and incident types and analyzing each location identification in each attribute combination entry according to a sequence of the attribute combination entries including creating attribute pairs. The incident analyzer is also configured to count the attribute pairs. The number of attribute pairs is the number of unique incidents in the plurality of incidents.

Abstract: Methods, apparatuses, and computer program products for event and alert analysis are provided. Embodiments include a local event analyzer embedded in an alert analyzer receiving events from an event queue. Embodiments also include the local event analyzer creating, based on the received events and local event analysis rules specific to the alert analyzer, a temporary alert for the alert analyzer. Embodiments also include the alert analyzer analyzing the temporary alert based on alert analysis rules.

Abstract: Methods, apparatuses, and computer program products for checkpointing for delayed alert creation are provided. Embodiments include applying a checkpoint to an events pool having events with corresponding alerts that have been generated and not delivered and following a crash and loss of the corresponding alerts not recorded in an alert database, generating new alerts based on the events in the events pool having the checkpoint. In response to completing processing of a new alert, embodiments include determining whether the alert database has an entry corresponding to the processed new alert. If the alert database has an entry corresponding to the processed new alert, embodiments include delivering the processed new alert without reporting the processed new alert to the alert database. If the alert database does not have an entry corresponding to the processed new alert, embodiments include reporting the processed new alert to an alert database.

Abstract: Methods, apparatuses, and computer program products for determining whether to send an alert are provided. Embodiments include a voting manager receiving from a plurality of alert analyzers, one or more delivery codes associated with an alert. In dependence upon the one or more delivery codes, the voting manager determines whether to suppress the alert, to close the alert, or to report the alert.

Abstract: Call history data is sampled at fixed intervals during run-time, each sample representing only a limited portion of the stack. These data samples are subsequently automatically analyzed by merging overlapping sampled call history sequences to build larger call graphs, according to some pre-specified merge criterion. Preferably, the call history graphs are annotated with counts of the execution frequency (number of times a particular procedure was executing when the sample was collected) and the stack frequency (number of times the procedure appeared in the sampled stack portion) associated with each respective called procedure. Preferably, a graphical user interface presents the user with a graphical representation of the call graph(s) and annotations.