System and method for optimizing event alerts in an information technology (IT) infrastructure management system

Patent metadata

Field	Value
Publication number	US-10142205-B2
Application number	US-201514946191-A
Country	US
Kind code	B2
Filing date	Nov 19, 2015
Priority date	Oct 7, 2015
Publication date	Nov 27, 2018
Grant date	Nov 27, 2018

Abstract

System and method for optimizing event alerts in an information technology (IT) infrastructure management system are disclosed. In one embodiment, the method comprises tracking one or more event alerts triggered by monitoring tools. The method further comprises determining a probable usage for at least one configuration item associated with the one or more event alerts. The method further comprises determining a probable threshold value for each of the at least one configuration item based on the probable usage and capacity data. The method further comprises computing a final threshold value for each of the at least one configuration item based on the probable threshold value, seasonality data, or semantic context data. The method further comprises optimizing the event alerts by filtering at least one unwanted event alert from the one or more event alerts based on at least one of the final threshold value and filtering rules.

First claim

What is claimed is:

1. A method for optimizing event alerts in an information technology (IT) infrastructure management system, comprising:
tracking, by a processor of an alert optimization system, one or more event alerts, triggered by monitoring tools, in the IT infrastructure management system;
determining, by the processor, a probable usage for at least one configuration item associated with the one or more event alerts based on the tracking;
determining, by the processor, a probable threshold value for each of the at least one configuration item based on the probable usage and capacity data;
creating, by the processor, a mapping of at least one season to each of the at least one configuration item;
computing, by the processor, a final threshold value for each of the at least one configuration item based on the probable threshold value, seasonality data, the mapping of the at least one season to each of the at least one configuration item, and semantic context data, wherein the final threshold value for each of the at least one configuration item is within a predefined feasibility range for the probable threshold value determined for each of the at least one configuration item, and wherein the predefined feasibility range associated with each of the at least one configuration item is determined based on maximum processing capacity and processing capacity currently utilized by a background program for an associated configuration item from the at least one configuration item;
determining, by the processor, a time interval based on the number of event alerts generated in the past for the at least one configuration item, wherein the time interval is associated with the final threshold value based on the probable threshold value and the seasonality data; and
optimizing, by the processor, the event alerts by filtering at least one unwanted event alert from the one or more event alerts based on the final threshold value and the time interval.

2. The method as claimed in claim 1 , further comprises:
dynamically ascertaining at least one new filtering rule based on at least one of the final threshold value, seasonality data, or the semantic context data;
adding the at least one new filtering rule to an event correlation engine of the alert optimization system, wherein the event correlation engine comprises predefined filtering rules; and
optimizing, by the event correlation engine, the event alerts by filtering at least one unwanted event alert from a first set of filtered event alerts, based on at least one of the predefined filtering rules and the at least one new filtering rule, wherein the first set of filtered event alerts is obtained upon filtering based on the final threshold value.

3. The method as claimed in claim 2 further comprises reporting optimized event alerts to an information technology service management (ITSM) system for resolving.

4. The method as claimed in claim 1 , wherein the capacity data, seasonality data, and the semantic data are obtained from a sematic and contextual knowledge (SCK) database.

5. The method as claimed in claim 1 further comprises updating at least one of the final threshold value, the at least one new filtering rule, optimized event alerts in the SCK database.

6. The method as claimed in claim 1 , wherein the probable usage is determined based on at least one of the seasonality data, the semantic and context data, and down-time data associated with the at least one configuration item.

7. The method as claimed in claim 1 , wherein the probable usage for the at least one configuration item is determined based on percentage of participation of the at least one configuration item with respect to probable total usage, wherein the probable total usage is determined as summation of the probable usage of each of the at least one configuration items.

8. An alert optimization system for optimizing event alerts in an information technology (IT) infrastructure management system, comprising: a processor; and
a memory communicatively coupled to the processor, wherein the memory stores processor-executable instructions, which, on execution, causes the processor to perform operations comprising:
tracking one or more event alerts, triggered by monitoring tools, in the IT infrastructure management system;
determining a probable usage for at least one configuration item associated with the one or more event alerts based on the tracking;
determining a probable threshold value for each of the at least one of configuration item based on the probable usage and capacity data;
creating a mapping of at least one season to each of the at least one configuration item;
computing a final threshold value for each of the at least one configuration item based on the probable threshold value, seasonality data, the mapping of the at least one season to each of the at least one configuration item, and semantic context data, wherein the final threshold value for each of the at least one configuration item is within a predefined feasibility range for the probable threshold value determined for each of the at least one configuration item, and wherein the predefined feasibility range associated with each of the at least one configuration item is determined based on maximum processing capacity and processing capacity currently utilized by a background program for an associated configuration item from the at least one configuration item;
determining a time interval based on the number of event alerts generated in the past for the at least one configuration item, wherein the time interval is associated with the final threshold value based on the probable threshold value and the seasonality data; and
optimizing the event alerts by filtering at least one unwanted event alert from the one or more event alerts based on the final threshold value and the time interval.

9. The system as claimed in claim 8 , wherein operations further comprise:
dynamically ascertaining at least one new filtering rule based on at least one of the final threshold value, seasonality data, or the semantic context data;
adding the at least one new filtering rule to an event correlation engine of the alert optimization system, wherein the event correlation engine comprises predefined filtering rules; and
optimizing, by the event correlation engine, the event alerts by filtering at least one unwanted event alert from a first set of filtered event alerts, based on at least one of the predefined filtering rules and the at least one new filtering rule, wherein the first set of filtered event alerts is obtained upon filtering based on the final threshold value.

10. The system as claimed in claim 8 , wherein operations further comprise reporting optimized event alerts to an information technology service management (ITSM) system for resolving.

11. The system as claimed in claim 8 , wherein the capacity data, seasonality data, and the semantic data are obtained from a sematic and contextual knowledge (SCK) database.

12. The system as claimed in claim 11 , wherein the SCK database is created by natural language processing (NLP) techniques to aggregate events, seasonality data, semantic context data, one or more predefined rules for generating event alerts, and patterns obtained from raw data pertaining to the IT infrastructure management system.

13. The system as claimed in claim 8 , wherein operations further comprise updating at least one of the final threshold value, the at least one new filtering rule, optimized event alerts in the SCK database.

14. The system as claimed in claim 8 , wherein the probable usage is determined based on at least one of the seas

Assignees

• Wipro Ltd

Inventors

• Balasubramanian Ramkumar
• Ryali Premchand
• Guruswamappa Shivamurthy Harave

Classifications

• H04L41/12

  Discovery or management of network topologies · CPC title

• H04L43/16

  Threshold monitoring · CPC title

• H04L41/065 Primary

  involving logical or physical relationship, e.g. grouping and hierarchies · CPC title

• H04L43/0823 Primary

  Errors, e.g. transmission errors · CPC title

• H04L41/0631

  using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis · CPC title