Abstract: If an event management system or component within an event management system fails, events generated by systems and applications monitored by the event management system may not be processed or analyzed. As a result, the performance and health of the systems and applications may be unknown. To reduce the impact of a failure, an event management system can include at least two event managers: a primary event manager and one or more standby event managers. The standby event managers are configured to handle event processing tasks upon a failure of the primary event manager. To be prepared for a failure of the primary event manager, the standby event manager receives state data and copies of events. After determining that the primary event manager has failed, the standby event manager can begin processing events.

Abstract: A method includes receiving, for each of a plurality of entities in a network, device information associated with the entity, and network traffic information regarding data packets associated with the entity. The method also includes determining, using a processor, a priority score for each of the plurality of entities in the network based on the device information and the traffic information. The method additionally includes determining a polling frequency for each of the plurality of entities based on each priority score, wherein the polling frequency for a first entity having a first priority score is greater than the polling frequency for a second entity having a second priority score that is lower than the first priority score. The method further includes polling each of the plurality of entities at its polling frequency.

Abstract: An alarm might not have information helpful to resolve the alarm to its contributing events. Thousands of events can occur in a system in a relatively short period of time, and any number of those events can contribute to various alarms. Tracing contributing events to an alarm can provide some helpful insight or at least efficiently provide a starting point for resolving or investigating an alarm. A system can determine, maintain, and persist associations at least among events, rule instances, and alarms to allow alarm-to-contributory event tracing.

Abstract: A method includes polling a plurality of entities in a network for status information at a first polling frequency and receiving a fault indicator associated with an entity in the network. The method additionally includes mapping the fault indicator to a particular node in a network topology, the network topology comprising nodes corresponding to entities in the plurality of entities and edges describing relationships and dependencies between the plurality of entities, wherein the particular node corresponds to the associated entity for the fault indicator. The method further includes determining a set of related nodes based on connections to the particular node in the network topology, and polling corresponding entities for the set of related nodes for status information at a second polling frequency, the second polling frequency being greater than the first polling frequency.

Abstract: A first event indication is received. In response to receiving the first event indication, it is determined that the first event indication has not been tagged. In response to determining that the first event indication has not been tagged, the first event indication is tagged as comprising an event chain. It is also determined that an event count associated with the event chain does not exceed a threshold. In response to determining that the event count does not exceed the threshold, the first event indication is processed.

Abstract: A first event indication is received. In response to receiving the first event indication, it is determined that the first event indication has not been tagged. In response to determining that the first event indication has not been tagged, the first event indication is tagged as comprising an event chain. It is also determined that an event count associated with the event chain does not exceed a threshold. In response to determining that the event count does not exceed the threshold, the first event indication is processed.

Abstract: An alarm might not have information helpful to resolve the alarm to its contributing events. Thousands of events can occur in a system in a relatively short period of time, and any number of those events can contribute to various alarms. Tracing contributing events to an alarm can provide some helpful insight or at least efficiently provide a starting point for resolving or investigating an alarm. A system can determine, maintain, and persist associations at least among events, rule instances, and alarms to allow alarm-to-contributory event tracing.

Abstract: A method includes receiving historical monitoring data for components of a system, the historical monitoring data comprising a plurality of events, each triggered by an associated component, and a plurality of alarms, each triggered by detection of a particular type of condition in the components. The method also includes determining common event sequences in the plurality of events, each event sequence culminating in one of the plurality of alarms. The method further includes correlating the common event sequences into an event pattern. The method also includes receiving a plurality of real-time events triggered by the components. The method additionally includes detecting the event pattern in the plurality of real-time events to predict a potential future instance of the particular type of condition in the components of the system.

Abstract: If an event management system or component within an event management system fails, events generated by systems and applications monitored by the event management system may not be processed or analyzed. As a result, the performance and health of the systems and applications may be unknown. To reduce the impact of a failure, an event management system can include at least two event managers: a primary event manager and one or more standby event managers. The standby event managers are configured to handle event processing tasks upon a failure of the primary event manager. To be prepared for a failure of the primary event manager, the standby event manager receives state data and copies of events. After determining that the primary event manager has failed, the standby event manager can begin processing events.

Abstract: A method includes receiving, for each of a plurality of entities in a network, device information associated with the entity, and network traffic information regarding data packets associated with the entity. The method also includes determining, using a processor, a priority score for each of the plurality of entities in the network based on the device information and the traffic information. The method additionally includes determining a polling frequency for each of the plurality of entities based on each priority score, wherein the polling frequency for a first entity having a first priority score is greater than the polling frequency for a second entity having a second priority score that is lower than the first priority score. The method further includes polling each of the plurality of entities at its polling frequency.

Abstract: A method includes receiving historical monitoring data for components of a system, the historical monitoring data comprising a plurality of events, each triggered by an associated component, and a plurality of alarms, each triggered by detection of a particular type of condition in the components. The method also includes determining common event sequences in the plurality of events, each event sequence culminating in one of the plurality of alarms. The method further includes correlating the common event sequences into an event pattern. The method also includes receiving a plurality of real-time events triggered by the components. The method additionally includes detecting the event pattern in the plurality of real-time events to predict a potential future instance of the particular type of condition in the components of the system.

Abstract: A method includes polling a plurality of entities in a network for status information at a first polling frequency and receiving a fault indicator associated with an entity in the network. The method additionally includes mapping the fault indicator to a particular node in a network topology, the network topology comprising nodes corresponding to entities in the plurality of entities and edges describing relationships and dependencies between the plurality of entities, wherein the particular node corresponds to the associated entity for the fault indicator. The method further includes determining a set of related nodes based on connections to the particular node in the network topology, and polling corresponding entities for the set of related nodes for status information at a second polling frequency, the second polling frequency being greater than the first polling frequency.