Deputizing agents to reduce a volume of event logs sent to a coordinator

Patent metadata

Field	Value
Publication number	US-10397164-B2
Application number	US-201815926915-A
Country	US
Kind code	B2
Filing date	Mar 20, 2018
Priority date	Feb 8, 2016
Publication date	Aug 27, 2019
Grant date	Aug 27, 2019

Abstract

Systems and techniques to deputize agents in a system to reduce a number of event logs received by a coordinator are described. An agent belonging to a group of agents may receive a request to select a deputized agent. The agent may determine data associated with a component hosting the agent and send the data to a selection agent. The agent may receive a message from the selection agent indicating that the agent is to be the deputized agent. The deputized agent may receive one or more event logs from other agents in the group, determine that at least one event log has a high priority, and send the at least one event log to the coordinator. The deputized agent may store the one or more event logs in a storage device accessible to the hardware component.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
determining, by a processor, that a coordinator is in an overloaded state;
responsive to determining that the coordinator is in the overloaded state, transitioning from a normal mode of operation to a deputized mode of operation;
identifying, by the processor, a plurality of software agents;
sending a first message to the plurality of software agents indicative of the coordinator being in the overloaded state; and
receiving, by the processor, a second message that an agent of the plurality of software agents has been selected to be a deputized agent for the plurality of software agents.

2. The computer-implemented method of claim 1 , wherein determining that the coordinator is overloaded comprises determining whether a time period between when an event log is generated and when the coordinator selects the event log for analysis exceeds a pre-determined time-period threshold value.

3. The computer-implemented method of claim 1 , wherein determining that the coordinator is overloaded comprises:
determining a number of event logs in an event log queue; and
determining whether the number of event logs in the event log queue exceeds a pre determined threshold value.

4. The computer-implemented method of claim 1 , wherein determining that the coordinator is overloaded comprises:
determining a number of event logs in an event log queue;
setting a maximum number of event logs allowable in the event log queue;
calculating a percentage of the event log queue that is occupied by the number of event logs in the event log queue, wherein the percentage of the event log queue that is occupied is calculated by dividing the number of event logs in the event log queue by a total number of event logs that the event log queue can contain;
calculating a percentage of the event log queue that is unoccupied, wherein the percentage of the event log queue that is unoccupied is calculated by subtracting the percentage of the event log queue that is occupied from one hundred percent; and
determining if the percentage of the event log queue that is occupied is greater than a pre-determined threshold percentage value or the percentage of the event log queue that is unoccupied is less than a pre-determined threshold percentage value.

5. The computer-implemented method of claim 1 , wherein selecting the at least one deputized agent in each of the plurality of groups comprises:
dividing the plurality of software agents into the plurality of groups; and
sending a message to a software agent in each of the plurality of groups indicating the software agent can perform the operations of a selection agent, wherein the selection agent selects at least one software agent in each of the plurality of groups to be the at least one deputized agent.

6. The computer-implemented method of claim 5 , wherein selecting the selection agent comprises:
determining a list of software agents ordered suitable for being the selection agents;
dividing the plurality of software agents into the plurality of groups;
sending a message to a software agent in each of the plurality of groups indicating that the software agent can perform the operations of the selection agent, wherein the software agent receiving the message from the coordinator is on the list of software agents;
receiving a message from each of the software agents that received the message from the coordinator indicating whether each of the software agents that received the message from the coordinator can perform the operations of the selection agent; and
selecting the software agent in each of the plurality of groups to be the selection agent based on the message received by the coordinator.

7. The computer-implemented method of claim 5 , wherein the weighted score of each of the software agents may be calculated based on an available drive space, an average peer latency, a processing capacity, an average ping latency to the coordinator, or some combination thereof of each of the software agents.

8. The computer-implemented method of claim 1 , wherein operations of the coordinator further comprise:
categorizing types of event logs as high priority or low priority;
instructing the deputized agents to send high priority event logs to the coordinator during the overloaded state;
instructing the deputized agents to locally store low priority event logs; and
instructing the deputized agents to periodically send a summary of the low priority event logs during the overloaded state.

9. The computer-implemented method of claim 1 , wherein determining that the coordinator is no longer in the overloaded state comprises:
dedeputizing the deputized agents; and
instructing the dedeputized agents to send locally stored event logs to a central server.

10. A system comprising:
a memory; and
one or more processors configured to execute instructions to cause the system to perform operations comprising:
determine that a coordinator is in an overloaded state;
responsive to determining that the coordinator is in the overloaded state, transition from a normal mode of operation to a deputized mode of operation;
identify a plurality of software agents;
send a first message to the plurality of software agents indicative of the coordinator being in the overloaded state; and
receive a second message that an agent of the plurality of software agents has been selected to be a deputized agent for the plurality of software agents.

11. The system of claim 10 , wherein the operations further comprise:
determine a number of event logs in an event log queue;
set a maximum number of event logs allowable in the event log queue;
calculate a percentage of the event log queue that is occupied by the number of event logs in the event log queue, wherein the percentage of the event log queue that is occupied is calculated by dividing the number of event logs in the event log queue by a total number of event logs that the event log queue can contain;
calculate a percentage of the event log queue that is unoccupied, wherein the percentage of the event log queue that is unoccupied is calculated by subtracting the percentage of the event log queue that is occupied from one hundred percent; and
determine if the percentage of the event log queue that is occupied is greater than a pre-determined threshold percentage value or the percentage of the event log queue that is unoccupied is less than a pre-determined threshold percentage value.

12. The system of claim 10 , wherein the operations further comprise:
divide the plurality of software agents into the plurality of groups; and
send a message to a software agent in each of the plurality of groups indicating the software agent is capable to perform the operations of a selection agent, wherein the selection agent selects at least one software agent in each of the plurality of groups to be the at least one deputized agent.

13. The system of claim 10 , wherein the operations further comprise:
determine a list of software agents that are capable to function as a selection agent;
divide the plurality of software agents into the plurality of groups;
send a message to a software agent in each of the plurality of groups indicating that the software agent is capable to perform the operations of the selection agent, wherein the software agent receiving the message from the coordinator is on the list of software agents;
receive a message from each of the software agents that received the message from the coordinator indicating whether each of the software agents that received the message from the coordinator can perform the operations

Assignees

• Quest Software Inc

Inventors

• Seigel Jake
• Jury Derek Alfred

Classifications

• H04L41/06

  Management of faults, events, alarms or notifications · CPC title

• H04L41/0609

  based on severity or priority · CPC title

• H04L41/0604

  using filtering, e.g. reduction of information by using priority, element types, position or time · CPC title

• H04L67/1097 Primary

  for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] · CPC title

• H04L51/26 Primary

  Electricity · mapped topic