Persistent alert notes

Patent metadata

Field	Value
Publication number	US-11336505-B2
Application number	US-201615179656-A
Country	US
Kind code	B2
Filing date	Jun 10, 2016
Priority date	Jun 10, 2016
Publication date	May 17, 2022
Grant date	May 17, 2022

Abstract

The present disclosure is related to devices, systems, and methods for persistent alert notes. An example method can include receiving an alert message via a log management server, wherein the alert message indicates a current alert instance particular to a class of alerts, retrieving, in response to receiving the alert message, a note stored in association with the class of alerts via the log management server, wherein the note includes resolution information corresponding to a previous alert instance particular to the class of alerts, and providing the retrieved note via a user interface of the log management server.

First claim

What is claimed is:

1. A method for persistent alert notes, comprising:
receiving an alert message via a log management server, wherein the log management server is to monitor logs from one or more log sources in a software defined data center, wherein at least one of the logs include event information that causes a triggering of an alert which is communicated as the alert message, and wherein the alert message indicates a current alert instance to be resolved, particular to a class of alerts;
retrieving, in response to receiving the alert message, a plurality of notes stored in association with the class of alerts via the log management server, wherein the plurality of notes includes resolution information corresponding to a previous resolved alert instance particular to the class of alerts, and wherein the resolution information includes information relevant to a resolution of the previous resolved alert instance; and
providing the plurality of retrieved notes, in a list of retrieved notes, via a user interface of the log management server, wherein the list is sorted by a respective quantity of views.

2. The method of claim 1 , wherein the method includes retrieving a different note comprising a last note occurring before the previous alert instance was resolved.

3. The method of claim 1 , wherein retrieving the plurality of notes comprises retrieving the plurality of notes, which are stored in association with the class of alerts from a storage storing the plurality of notes, each stored in association with a respective class of alerts.

4. The method of claim 1 , wherein the method includes storing the plurality of notes, each in association with a respective class of alerts, in a storage functionality in communication with the log management server.

5. The method of claim 4 , wherein the method includes receiving a new note corresponding to the current alert instance and storing the new note in association with the particular class of alerts in the storage functionality.

6. The method of claim 1 , wherein the method includes providing the plurality of retrieved notes in the list of retrieved notes, wherein the list is sorted according to an indicated user evaluation of at least one of the retrieved notes.

7. A system for persistent alert notes, comprising:
a processor; and
memory configured to store instructions which, when executed by the processor, cause the processor to:
provide an interface to:
receive a plurality of notes, wherein each note comprises resolution information corresponding to a resolved alert instance, wherein the resolved alert instance is particular to a class of alerts from a log management server, and wherein the resolution information includes information relevant to a resolution of the resolved alert instance;
receive an input causing the plurality of notes to be associated with the class;
display the plurality of notes responsive to an occurrence of a subsequent alert instance particular to the class of alerts, wherein the log management server is to monitor logs from one or more log sources in a software defined data center, and wherein at least one of the logs include event information that causes a triggering of an alert which is communicated as the subsequent alert instance; and
receive a user evaluation of the plurality of notes;

store the plurality of notes in association with the class of alerts; and
store the evaluation in association with the plurality of notes,
wherein the interface is configured to display the plurality of notes in a particular order based on the user evaluation of the plurality of notes without user input responsive to the occurrence of the subsequent alert instance.

8. The system of claim 7 , wherein each of the plurality of notes includes steps for resolving the alert instance.

9. The system of claim 8 , wherein the evaluation of the plurality of notes is an indication of a utility of the plurality of notes.

10. The system of claim 8 , wherein the interface is configured to:
receive second plurality of notes corresponding to a second resolved alert instance particular to the class of alerts;
receive a second input causing the second plurality of notes to be associated with the class of alerts;
display the second plurality of notes responsive to the occurrence of the subsequent alert instance particular to the class of alerts; and
receive a second evaluation of the second plurality of notes.

11. The system of claim 10 , wherein the interface is configured to display the plurality of notes and the second plurality of notes responsive to the occurrence of the subsequent alert instance particular to the class in an order determined based on the evaluation and the second evaluation.

12. A non-transitory machine-readable medium storing instructions for persistent alert notes executable by a processor to cause a computing system to:
receive a plurality of notes, wherein each note comprises resolution information corresponding to an alert instance, the alert instance having been resolved, and wherein the resolution information includes information relevant to a resolution of the resolved alert instance;
pin the plurality of notes to a class of alerts to which the resolved alert instance belongs responsive to an input; and
provide the pinned plurality of notes, sorted according to a priority level of the pinned plurality of notes, with art alert message that corresponds to an unresolved alert instance of the class of alerts, wherein the alert message is received via a log management server, wherein the log management server is to monitor logs from one or more log sources in a software defined data center, and wherein at least one of the logs include event information that causes a triggering of an alert which is communicated as the alert message.

13. The medium of claim 12 , wherein the priority level is determined based, at least in part, on whether the correlated plurality of notes includes steps for resolving the unresolved alert instance.

14. The medium of claim 13 , wherein the instructions include instructions to determine that the correlated plurality of notes includes steps for resolving the unresolved alert instance based on an input indicating that the correlated plurality of notes includes steps for resolving the unresolved alert instance.

15. The medium of claim 13 , wherein the instructions include instructions to determine that the correlated plurality of notes includes steps for resolving the unresolved alert instance without user input based on a text content of the con-elated plurality of notes.

Assignees

• Vmware Inc

Inventors

• Movsisyan Vardan
• Flanders Steven

Classifications

• H04L41/0631 Primary

  using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis · CPC title

• H04L41/0686

  Additional information in the notification, e.g. enhancement of specific meta-data · CPC title

• H04L41/069

  using logs of notifications; Post-processing of notifications · CPC title

• H04L41/22

  comprising specially adapted graphical user interfaces [GUI] · CPC title

• H04L41/046

  comprising network management agents or mobile agents therefor · CPC title