US 7,475,150 B2
Method of generating a common event format representation of information from a plurality of messages using rule-based directives and computer keys
Genady Grabarnik, Scarsdale, N.Y. (US); Sheng Ma, Briarcliff, N.Y. (US); Abdolreza Salahshour, Raleigh, N.C. (US); and Balan Subramanian, Morrisville, N.C. (US)
Assigned to International Business Machines Corporation, Armonk, N.Y. (US)
Filed on Sep. 07, 2004, as Appl. No. 10/935,035.
Prior Publication US 2006/0053477 A1, Mar. 09, 2006
Int. Cl. G06F 15/16 (2006.01); G06F 15/173 (2006.01); G06F 9/54 (2006.01)
U.S. Cl. 709—228  [709/223; 709/246; 709/313; 709/318] 1 Claim
OG exemplary drawing
 
1. A method of generating a common event format representation of information from a plurality of messages, comprising:
parsing a rule associated with a current message to determine if a property of a common event format representation for the current message is to be populated with a property value from a previous message;
obtaining the property value from the previous message if the rule specifies to obtain the property value from the previous message, wherein obtaining the property value from the previous message comprises:
generating a computed key based on properties of the current message, wherein generating the computed key further includes:
identifying properties in the current message that are common to the previous message;
combining the identified properties to generate the computed key; and
generating only a portion of the computed key sufficient to identify a previous message;
wherein obtaining the property value from the previous message comprises obtaining the property value from an immediately preceding message if the rule specifies to obtain the property value from the immediately preceding message or if obtaining the property value from the previous message is unsuccessful;
wherein the obtained property value from the previous message provides further directives for determining the property of the common event format representation for the current message;
identifying the previous message based on the key of the current message, wherein identifying the previous message comprises:
identifying the previous message based on a portion of the key;
generating a key for the previous message based on properties of the previous message; and
comparing the key for the previous message with the key for the current message;
populating the common event format representation for the current message with the obtained property value from the previous message;
parsing the rule associated with the current message to determine if the property of the common event format representation for the current message is to be populated with a property value determined by a specified code;
obtaining the property value using the specified code if the rule specifies to obtain the property value using the specified code;
populating the common event format representation for the current message with the obtained property value obtained using the specified code;
storing the populated common event format representation as the current message;
wherein the rule specifies obtaining the property value from the specified code if obtaining the property value from the previous message is unsuccessful;
wherein the specified code calls a class and a particular method within the class to determine the property value;
wherein obtaining the property value from the specified code comprises re-using a property value from a previous execution of the specified code if the same class, method, and parameters as the previous execution are specified;
wherein the specified code creates a new object to call a method to determine the property value;
storing the new object against a called class, method, and parameters;
wherein the steps of parsing, obtaining, and populating includes:
parsing a rule associated with a current message to determine if a property of a common event format representation for the current message is to be populated with a property value from a previous message or if the property of the common event format representation for the current message is to be populated with a property value determined by specified code;
obtaining the property value from the previous message if the rule specifies obtaining the property value from the previous message, wherein obtaining the property value comprises:
generating a computed key based on properties of the current message that are common to the previous message; and
identifying the previous message based on the computed key of the current message;
obtaining the property value from the specified code if the rule specifies to obtain the property value from the specified code, wherein the specified code calls a class and a particular method within the class to determine the property value; and
populating the common event format representation for the current message with the obtained property value.