Location-independent service for monitoring and alerting on an event log

Claim 3

The method of claim 1 , wherein the event log resides on a first computer and the filtering step is performed on a second computer.

Claim 8

The method of claim 4 , wherein the Alert Any flag indicates that an alert is to be raised when the count of event messages in the event log equals or exceeds the Event Count within the Event Period for any combination of qualified Event IDs.

Claim 9

The method of claim 4 , wherein the Alert Any flag indicates that an alert is to be raised when the count of event messages in the event log equals or exceeds the Event Count within the Event Period and there has been at least one occurrence of each Event ID in the event messages.

Claim 10

The method of claim 4 , wherein a refresh rate determines how often the alert policies are checked for updates.

Claim 11

The method of claim 4 , wherein a refresh rate determines how often the event log is queried for the event messages.

Claim 14

The method of claim 9 , wherein the alert action comprises a plurality of individual alert actions.

Claim 15

The method of claim 9 , wherein each rule specifies a period that must expire before an alert action is repeated.

Claim 18

A computer-implemented apparatus for monitoring and alerting on an event log, comprising: (a) means for accessing one or more alert policies comprised of one or more rules stored on a computer; (b) means for accessing an event log stored on a computer in a location-independent manner to gather one or more event messages stored therein; (c) means for filtering the event messages by comparing the event messages to the rules of the alert policies to raise an alert and determine whether an alert action should be invoked; and (d) means for periodically checking the alert policies to dynamically adopt updated ones of the alert policies.

Claim 19

A computer-implemented apparatus for monitoring and alerting on an event log, comprising: (a) means for accessing one or more alert policies comprised of one or more rules stored on a computer; (b) means for accessing an event log stored on a computer in a location-independent manner to gather one or more event messages stored therein; (c) means for filtering the event messages by comparing the event messages to the rules of the alert policies to raise an alert and determine whether an alert action should be invoked; and (d) means for periodically checking the alert policies to dynamically adopt updated ones of the alert policies.

Claim 20

The apparatus of claim 13 , wherein the event log resides on a first computer and the filtering step is performed on a second computer.

Claim 21

A computer-implemented apparatus for monitoring and alerting on an event log, comprising: (a) means for accessing one or more alert policies comprised of one or more rules stored on a computer; (b) means for accessing an event log stored on a computer in a location-independent manner to gather one or more event messages stored therein; and (c) means for filtering the event messages by comparing the event messages to the rules of the alert policies to raise an alert and determine whether an alert action should be invoked; and wherein the alert policies contain criteria by which the event log is searched, the alerts are raised, and the alert actions are invoked.

Claim 22

A computer-implemented apparatus for monitoring and alerting on an event log, comprising: (a) means for accessing one or more alert policies comprised of one or more rules stored on a computer; (b) means for accessing an event log stored on a computer in a location-independent manner to gather one or more event messages stored therein; and (c) means for filtering the event messages by comparing the event messages to the rules of the alert policies to raise an alert and determine whether an alert action should be invoked; and wherein the alert policies contain criteria by which the event log is searched, the alerts are raised, and the alert actions are invoked.

Claim 23

A computer-implemented apparatus for monitoring and alerting on an event log, comprising: (a) means for accessing one or more alert policies comprised of one or more rules stored on a computer; (b) means for accessing an event log stored on a computer in a location-independent manner to gather one or more event messages stored therein; and (c) means for filtering the event messages by comparing the event messages to the rules of the alert policies to raise an alert and determine whether an alert action should be invoked; and wherein each rule includes one or more defined criteria selected from a group comprising: one or more Event IDs, an Event Period indicating a period within which the event messages must occur in the event log for an alert to be raised and an alert action to be invoked, an Event Count indicating a count of the event messages that must occur within the event log within the Event Period and corresponding to the Event IDs to raise an alert and trigger an alert action, a Search Phrase that specifies one or more words that must be included within the event messages, and an Alert Any flag that determines whether or not there must be at least one occurrence of each and every Event ID that is specified by the rule.

Claim 24

A computer-implemented apparatus for monitoring and alerting on an event log, comprising: (a) means for accessing one or more alert policies comprised of one or more rules stored on a computer; (b) means for accessing an event log stored on a computer in a location-independent manner to gather one or more event messages stored therein; and (c) means for filtering the event messages by comparing the event messages to the rules of the alert policies to raise an alert and determine whether an alert action should be invoked; and wherein each rule includes one or more defined criteria selected from a group comprising: one or more Event IDs, an Event Period indicating a period within which the event messages must occur in the event log for an alert to be raised and an alert action to be invoked, an Event Count indicating a count of the event messages that must occur within the event log within the Event Period and corresponding to the Event IDs to raise an alert and trigger an alert action, a Search Phrase that specifies one or more words that must be included within the event messages, and an Alert Any flag that determines whether or not there must be at least one occurrence of each and every Event ID that is specified by the rule.

Claim 25

The apparatus of claim 16 , wherein the Alert Any flag indicates that an alert is to be raised when the count of event messages in the event log equals or exceeds the Event Count within the Event Period for any combination of qualified Event IDs.

Claim 26

The apparatus of claim 16 , wherein the Alert Any flag indicates that an alert is to be raised when the count of event messages in the event log equals or exceeds the Event Count within the Event Period and there has been at least one occurrence of each Event ID in the event messages.

Claim 27

The apparatus of claim 16 , wherein a refresh rate determines how often the alert policies are checked for updates.

Claim 28

The apparatus of claim 16 , wherein a refresh rate determines how often the event log is queried for the event messages.

Claim 29

A computer-implemented apparatus for monitoring and alerting on an event log, comprising: (a) means for accessing one or more alert policies comprised of one or more rules stored on a computer; (b) means for accessing an event log stored on a computer in a location-independent manner to gather one or more event messages stored therein; and (c) means for filtering the event messages by comparing the event messages to the rules of the alert policies to raise an alert and determine whether an alert action should be invoked; and wherein each rule specifies an alert action selected from a group comprising sending an email to a user-defined address, sending a page with a user-defined message to a user-defined paging service, generating a trap, running a user-specified program, writing a message to log, and executing a script of database commands.

Claim 30

A computer-implemented apparatus for monitoring and alerting on an event log, comprising: (a) means for accessing one or more alert policies comprised of one or more rules stored on a computer; (b) means for accessing an event log stored on a computer in a location-independent manner to gather one or more event messages stored therein; and (c) means for filtering the event messages by comparing the event messages to the rules of the alert policies to raise an alert and determine whether an alert action should be invoked; and wherein each rule specifies an alert action selected from a group comprising sending an email to a user-defined address, sending a page with a user-defined message to a user-defined paging service, generating a trap, running a user-specified program, writing a message to log, and executing a script of database commands.

Claim 31

The apparatus of claim 21 , wherein the alert action comprises a plurality of individual alert actions.

Claim 32

The apparatus of claim 21 , wherein each rule specifies a period that must expire before an alert action is repeated.

Claim 33

A computer-implemented apparatus for monitoring and alerting on an event log, comprising: (a) means for accessing one or more alert policies comprised of one or more rules stored on a computer; (b) means for accessing an event log stored on a computer in a location-independent manner to gather one or more event messages stored therein; and (c) means for filtering the event messages by comparing the event messages to the rules of the alert policies to raise an alert and determine whether an alert action should be invoked; and (d) means for defining the alert policies using an alert policy editor.

Claim 34

A computer-implemented apparatus for monitoring and alerting on an event log, comprising: (a) means for accessing one or more alert policies comprised of one or more rules stored on a computer; (b) means for accessing an event log stored on a computer in a location-independent manner to gather one or more event messages stored therein; and (c) means for filtering the event messages by comparing the event messages to the rules of the alert policies to raise an alert and determine whether an alert action should be invoked; and (d) means for defining the alert policies using an alert policy editor.

Claim 35

An article of manufacture embodying logic for monitoring and alerting on an event log, the logic comprising: (a) accessing one or more alert policies comprised of one or more rules stored on a computer; (b) accessing an event log stored on a computer in a location-independent manner to gather one or more event messages stored therein; (c) filtering the event messages by comparing the event messages to the rules of the alert policies to raise an alert and determine whether an alert action should be invoked; and (d) periodically checking the alert policies to dynamically adopt updated ones of the alert policies.

Claim 36

An article of manufacture embodying logic for monitoring and alerting on an event log, the logic comprising: (a) accessing one or more alert policies comprised of one or more rules stored on a computer; (b) accessing an event log stored on a computer in a location-independent manner to gather one or more event messages stored therein; (c) filtering the event messages by comparing the event messages to the rules of the alert policies to raise an alert and determine whether an alert action should be invoked; and (d) periodically checking the alert policies to dynamically adopt updated ones of the alert policies.

Claim 37

The article of manufacture of claim 25 , wherein the event log resides on a first computer and the filtering step is performed on a second computer.

Claim 38

An article of manufacture embodying logic for monitoring and alerting on an event log, the logic comprising: (a) accessing one or more alert policies comprised of one or more rules stored on a computer; (b) accessing an event log stored on a computer in a location-independent manner to gather one or more event messages stored therein; and (c) filtering the event messages by comparing the event messages to the rules of the alert policies to raise an alert and determine whether an alert action should be invoked; and wherein the alert policies contain criteria by which the event log is searched, the alerts are raised, and the alert actions are invoked.

Claim 39

An article of manufacture embodying logic for monitoring and alerting on an event log, the logic comprising: (a) accessing one or more alert policies comprised of one or more rules stored on a computer; (b) accessing an event log stored on a computer in a location-independent manner to gather one or more event messages stored therein; and (c) filtering the event messages by comparing the event messages to the rules of the alert policies to raise an alert and determine whether an alert action should be invoked; and wherein the alert policies contain criteria by which the event log is searched, the alerts are raised, and the alert actions are invoked.

Claim 40

An article of manufacture embodying logic for monitoring and alerting on an event log, the logic comprising: (a) accessing one or more alert policies comprised of one or more rules stored on a computer; (b) accessing an event log stored on a computer in a location-independent manner to gather one or more event messages stored therein; and (c) filtering the event messages by comparing the event messages to the rules of the alert policies to raise an alert and determine whether an alert action should be invoked; and wherein each rule includes one or more defined criteria selected from a group comprising: one or more Event IDs, an Event Period indicating a period within which the event messages must occur in the event log for an alert to be raised and an alert action to be invoked, an Event Count indicating a count of the event messages that must occur within the event log within the Event Period and corresponding to the Event IDs to raise an alert and trigger an alert action, a Search Phrase that specifies one or more words that must be included within the event messages, and an Alert Any flag that determines whether or not there must be at least one occurrence of each and every Event ID that is specified by the rule.

Claim 41

An article of manufacture embodying logic for monitoring and alerting on an event log, the logic comprising: (a) accessing one or more alert policies comprised of one or more rules stored on a computer; (b) accessing an event log stored on a computer in a location-independent manner to gather one or more event messages stored therein; and (c) filtering the event messages by comparing the event messages to the rules of the alert policies to raise an alert and determine whether an alert action should be invoked; and wherein each rule includes one or more defined criteria selected from a group comprising: one or more Event IDs, an Event Period indicating a period within which the event messages must occur in the event log for an alert to be raised and an alert action to be invoked, an Event Count indicating a count of the event messages that must occur within the event log within the Event Period and corresponding to the Event IDs to raise an alert and trigger an alert action, a Search Phrase that specifies one or more words that must be included within the event messages, and an Alert Any flag that determines whether or not there must be at least one occurrence of each and every Event ID that is specified by the rule.

Claim 42

The article of manufacture of claim 28 , wherein the Alert Any flag indicates that an alert is to be raised when the count of event messages in the event log equals or exceeds the Event Count within the Event Period for any combination of qualified Event IDs.

Claim 43

The article of manufacture of claim 28 , wherein the Alert Any flag indicates that an alert is to be raised when the count of event messages in the event log equals or exceeds the Event Count within the Event Period and there has been at least one occurrence of each Event ID in the event messages.

Claim 44

The article of manufacture of claim 28 , wherein a refresh rate determines how often the alert policies are checked for updates.

Claim 45

The article of manufacture of claim 28 , wherein a refresh rate determines how often the event log is queried for the event messages.

Claim 46

An article of manufacture embodying logic for monitoring and alerting on an event log, the logic comprising: (a) accessing one or more alert policies comprised of one or more rules stored on a computer; (b) accessing an event log stored on a computer in a location-independent manner to gather one or more event messages stored therein; and (c) filtering the event messages by comparing the event messages to the rules of the alert policies to raise an alert and determine whether an alert action should be invoked; and wherein each rule specifies an alert action selected from a group comprising sending an email to a user-defined address, sending a page with a user-defined message to a user-defined paging service, generating a trap, running a user-specified program, writing a message to log, and executing a script of database commands.

Claim 47

An article of manufacture embodying logic for monitoring and alerting on an event log, the logic comprising: (a) accessing one or more alert policies comprised of one or more rules stored on a computer; (b) accessing an event log stored on a computer in a location-independent manner to gather one or more event messages stored therein; and (c) filtering the event messages by comparing the event messages to the rules of the alert policies to raise an alert and determine whether an alert action should be invoked; and wherein each rule specifies an alert action selected from a group comprising sending an email to a user-defined address, sending a page with a user-defined message to a user-defined paging service, generating a trap, running a user-specified program, writing a message to log, and executing a script of database commands.

Claim 48

The article of manufacture of claim 33 , wherein the alert action comprises a plurality of individual alert actions.

Claim 49

The article of manufacture of claim 33 , wherein each rule specifies a period that must expire before an alert action is repeated.

Claim 50

An article of manufacture embodying logic for monitoring and alerting on an event log, the logic comprising: (a) accessing one or more alert policies comprised of one or more rules stored on a computer; (b) accessing an event log stored on a computer in a location-independent manner to gather one or more event messages stored therein; and c) filtering the event messages by comparing the event messages to the rules of the alert policies to raise an alert and determine whether an alert action should be invoked; and (d) logic for defining the alert policies using an alert policy editor.

Claim 51

An article of manufacture embodying logic for monitoring and alerting on an event log, the logic comprising: (a) accessing one or more alert policies comprised of one or more rules stored on a computer; (b) accessing an event log stored on a computer in a location-independent manner to gather one or more event messages stored therein; and c) filtering the event messages by comparing the event messages to the rules of the alert policies to raise an alert and determine whether an alert action should be invoked; and (d) logic for defining the alert policies using an alert policy editor.