Code-Based Event Grouping for Critical Alert Prioritization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing event monitoring systems burden administrators with indiscriminate notifications of numerous events, leading to inefficiencies and potential overlooking of critical events.
Innovation Solution
An event processing system that collects and groups events based on code values associated with originating devices or services, regenerates events into single events, filters unnecessary events, and performs automatic actions or closures, using predefined rules and machine learning models to streamline event processing and reduce notifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If administrators are notified of all events, then complete event information is provided, but administrator workload increases and efficiency decreases
Solution Approach 1:
The patent segments events into different categories (normal events, abnormal events, critical events) based on their code values and characteristics. This segmentation allows the system to selectively notify administrators only about events that require attention, thereby maintaining information completeness for important events while reducing overall notification volume and improving administrator efficiency.
Solution Approach 2:
The patent changes the parameter of event notification by introducing event grading and filtering based on code values. Instead of notifying all events uniformly, the system applies parameter-based filtering (event type, severity, source device) to determine which events should trigger notifications, thus reducing unnecessary notifications while ensuring critical events are communicated.
2Measurement precision
If multiple events are processed individually, then each event is handled accurately, but processing time and system complexity increase
Solution Approach 1:
The patent merges multiple events into aggregated event groups based on their code values and characteristics. Events with similar codes are combined into single representative events, reducing the total number of processing operations. This merging maintains accuracy by preserving essential event information while significantly reducing processing time and system complexity.
Solution Approach 2:
The patent creates a universal event processing mechanism that handles different event types through a common code-based classification system. By defining standardized code values and grouping rules that apply across all event types, the system achieves multi-functional event handling that is both accurate and efficient, avoiding the need for separate processing logic for each event type.
3Reliability
If all events are notified to administrators, then no critical events are missed, but notification frequency becomes excessive and burdensome
Solution Approach 1:
The patent applies local quality by differentiating notification requirements for different event types and severity levels. Critical and abnormal events receive high-priority notifications with detailed information, while normal events are either grouped or suppressed. This localized approach ensures reliable detection of critical events while making notification management easier by reducing noise and focusing administrator attention on what truly matters.
Solution Approach 2:
The patent changes notification parameters by introducing severity-based filtering and event grading. Notifications are selectively generated based on event code values, types, and characteristics, transforming the uniform notification approach into a parameter-driven selective notification system. This ensures critical events are reliably communicated while reducing overall notification frequency to manageable levels.
Data Source
AI summary
An event processing method performed by at least one computing device is provided. The method may include collecting a plurality of events; grouping at least some of the collected plurality of events based on code values respectively associated with the collected plurality of events, wherein the code values indicate at least one of originating service devices in which the plurality of events have occurred or services provided by the originating service devices; and regenerating the grouped events into a single event.