Maintaining temporal associations for event data in an event database

1. A method comprising steps of:

detecting a plurality of events, each of the events being associated with one of a plurality of assets of an enterprise system;

generating a plurality of database record structures based at least in part on the detected events, each of the database record structures comprising a first field storing an association key identifying one of the plurality of assets, a second field storing a first timestamp associated with a first detected event stored in that database record structure for its identified asset, and at least a third field storing a value associated with a second detected event stored in that database record structure for its identified asset;

maintaining indexing structures for at least the first field, the second field and the third field of the plurality of database record structures;

receiving a query to resolve a temporal association for a queried one of the plurality of assets at a specified time; and

utilizing the indexing structures to locate a particular one of the plurality of database record structures storing the temporal association for the queried asset at the specified time;

wherein each of at least a subset of the plurality of database record structures comprises one of:

an open database record structure where the value stored in the third field comprises a predetermined value indicating that the database record structure is an open database record structure; and

a closed database record structure where the value stored in the third field comprises a second timestamp associated with the second detected event;

wherein the plurality of database record structures comprises two or more database record structures for a given one of the plurality of assets;

wherein the two or more database record structures for the given one of the plurality of assets comprise at least one closed database record structure for the given one of the plurality of assets, and at least one open database record structure for the given one of the plurality of assets; and

wherein the method is performed by at least one processing device comprising a processor coupled to a memory.

2. A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device to perform steps of:

detecting a plurality of events, each of the events being associated with one of a plurality of assets of an enterprise system;

generating a plurality of database record structures based at least in part on the detected events, each of the database record structures comprising a first field storing an association key identifying one of the plurality of assets, a second field storing a first timestamp associated with a first detected event stored in that database record structure for its identified asset, and at least a third field storing a value associated with a second detected event stored in that database record structure for its identified asset;

maintaining indexing structures for at least the first field, the second field and the third field of the plurality of database record structures;

receiving a query to resolve a temporal association for a queried one of the plurality of assets at a specified time; and

utilizing the indexing structures to locate a particular one of the plurality of database record structures storing the temporal association for the queried asset at the specified time;

wherein each of at least a subset of the plurality of database record structures comprises one of:

an open database record structure where the value stored in the third field comprises a predetermined value indicating that the database record structure is an open database record structure; and

a closed database record structure where the value stored in the third field comprises a second timestamp associated with the second detected event;

wherein the plurality of database record structures comprises two or more database record structures for a given one of the plurality of assets; and

wherein the two or more database record structures for the given one of the plurality of assets comprise at least one closed database record structure for the given one of the plurality of assets, and at least one open database record structure for the given one of the plurality of assets.

3. An apparatus comprising:

at least one processing device comprising a processor coupled to a memory;

the at least one processing device being configured to perform steps of:

detecting a plurality of events, each of the events being associated with one of a plurality of assets of an enterprise system;

generating a plurality of database record structures based at least in part on the detected events, each of the database record structures comprising a first field storing an association key identifying one of the plurality of assets, a second field storing a first timestamp associated with a first detected event stored in that database record structure for its identified asset, and at least a third field storing a value associated with a second detected event stored in that database record structure for its identified asset;

maintaining indexing structures for at least the first field, the second field and the third field of the plurality of database record structures;

receiving a query to resolve a temporal association for a queried one of the plurality of assets at a specified time; and

utilizing the indexing structures to locate a particular one of the plurality of database record structures storing the temporal association for the queried asset at the specified time;

wherein each of at least a subset of the plurality of database record structures comprises one of:

an open database record structure where the value stored in the third field comprises a predetermined value indicating that the database record structure is an open database record structure; and

a closed database record structure where the value stored in the third field comprises a second timestamp associated with the second detected event;

wherein the plurality of database record structures comprises two or more database record structures for a given one of the plurality of assets; and

wherein the two or more database record structures for the given one of the plurality of assets comprise at least one closed database record structure for the given one of the plurality of assets, and at least one open database record structure for the given one of the plurality of assets.

4. The method of claim 1 wherein, in each of the plurality of database record structures, the first detected event comprises an earliest detected event stored in that database record structure for its identified asset and the second detected event comprises a most recent detected event stored in that database record structure for its identified asset.

5. The method of claim 1 wherein the queried asset comprises a computing device, the detected events comprise one or more login and logout events for the computing device, and the query comprises determining a user logged in to the computing device at the specified time.

6. The method of claim 1 wherein the queried asset comprises an Internet Protocol (IP) address, the detected events comprise Dynamic Host Configuration Protocol (DHCP) lease assignments, and the query comprises determining a computing device assigned the IP address at the specified time.

7. The method of claim 1 wherein at least one of the plurality of database record structures further comprises a fourth field storing a set of resolved values for its identified asset from at least one closed database record structure for its identified asset, a fifth field storing modifications to temporal associations of its identified asset maintained in said at least one database record structure, and a sixth field storing a modification count specifying a number of modifications to the temporal association of its identified asset maintained in said at least one database record structure.

8. The method of claim 1 wherein each of the detected events associates or disassociates one of the plurality of assets with one or more values, and at least one additional field of each of the plurality of database record structures stores modifications to the temporal associations of its identified asset by recording association and disassociation of its identified asset with the one or more values.

9. The method of claim 1 wherein generating the plurality of database record structures comprises:

detecting a given event associated with least one of the plurality of assets;

determining whether an open database record structure exists for said at least one of the plurality of assets;

responsive to determining that the open database record structure exists, modifying the open database record structure; and

responsive to determining that no open database record structure exists for said at least one of the plurality of assets, creating a new database record structure for said at least one of the plurality of assets.

10. The method of claim 1 wherein utilizing the indexing structures to locate the particular one of the plurality of database record structures storing the temporal association for the queried asset at the specified time comprises:

utilizing the indexing structure maintained for the first field to identify a set of database record structures having a value in the first field identifying the queried asset, the identified set of database record structures comprising an open database record structure and one or more closed database record structures; and

utilizing the indexing structures maintained for the second field and the third field to identify a given database record structure storing the temporal association for the queried asset at the specified time from the identified set of database record structures.

11. The computer program product of claim 2 wherein, in each of the plurality of database record structures, the first detected event comprises an earliest detected event stored in that database record structure for its identified asset and the second detected event comprises a most recent detected event stored in that database record structure for its identified asset.

12. The computer program product of claim 2 wherein at least one of the plurality of database record structures further comprises a fourth field storing a set of resolved values for its identified asset from at least one closed database record structure for its identified asset, a fifth field storing modifications to temporal associations of its identified asset maintained in said at least one database record structure, and a sixth field storing a modification count specifying a number of modifications to the temporal association of its identified asset maintained in said at least one database record structure.

13. The apparatus of claim 3 wherein, in each of the plurality of database record structures, the first detected event comprises an earliest detected event stored in that database record structure for its identified asset and the second detected event comprises a most recent detected event stored in that database record structure for its identified asset.

14. The apparatus of claim 3 wherein at least one of the plurality of database record structures further comprises a fourth field storing a set of resolved values for its identified asset from at least one closed database record structure for its identified asset, a fifth field storing modifications to temporal associations of its identified asset maintained in said at least one database record structure, and a sixth field storing a modification count specifying a number of modifications to the temporal association of its identified asset maintained in said at least one database record structure.

15. The apparatus of claim 3 wherein generating the plurality of database record structures comprises:

detecting a given event associated with at least one of the plurality of assets;

determining whether an open database record structure exists for said at least one of the plurality of assets;

responsive to determining that the open database record structure exists, modifying the open database record structure; and

responsive to determining that no open database record structure exists for said at least one of the plurality of assets, creating a new database record structure for said at least one of the plurality of assets.

16. The method of claim 9 wherein an open database record structure for said at least one of the plurality of assets comprises a given database record structure having:

a value in its first field matching a given association key identifying said at least one of the plurality of assets; and

a value in at least one additional field comprising a modification count indicating that a number of association modifications maintained in the given database record structure is below a designated threshold number of modifications.

17. The method of claim 9 wherein creating the new database record structure comprises:

populating the first field of the new database record structure with the given association key;

populating the second field of the new database record structure with a timestamp of the given event;

populating the third field of the new database record structure with the predetermined value indicating an open database record structure;

populating at least one additional field of the new database record structure with an association or disassociation corresponding to the given event; and

incrementing a modification count of the new database record structure, the modification count indicating a number of association modifications stored in the at least one additional field in the new database record structure.

18. The method of claim 16 wherein modifying the open database record structure comprises appending the given event in the at least one additional field of the open database record structure and incrementing the modification count.

19. The method of claim 17 wherein creating the new database record structure further comprises, responsive to determining that a closed database record structure exists for said at least one of the plurality of assets, populating the at least one additional field of the new database record structure with at least one previously resolved association for said at least one of the plurality of assets from the closed database record structure for said at least one of the plurality of assets.

20. The method of claim 18 wherein modifying the open database record structure further comprises:

determining whether the incremented modification count is equal to the designated threshold number of modifications; and

responsive to determining that the incremented modification count is equal to the designated threshold number of modifications, closing the open database record structure by updating the third field of the open database record structure from the predetermined value indicating an open database record structure to a given timestamp associated with the given event.