Cross-correlation of metrics for anomaly root cause identification

Patent metadata

Field	Value
Publication number	US-11392446-B2
Application number	US-201916355042-A
Country	US
Kind code	B2
Filing date	Mar 15, 2019
Priority date	Mar 15, 2019
Publication date	Jul 19, 2022
Grant date	Jul 19, 2022

Abstract

Technologies are disclosed herein for cross-correlating metrics for anomaly root cause detection. Primary and secondary metrics associated with an anomaly are cross-correlated by first using the derivative of an interpolant of data points of the primary metric to identify a time window for analysis. Impact scores for the secondary metrics can be then be generated by computing the standard deviation of a derivative of data points of the secondary metrics during the identified time window. The impact scores can be utilized to collect data relating to the secondary metrics most likely to have caused the anomaly. Remedial action can then be taken based upon the collected data in order to address the root cause of the anomaly.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
retrieving a primary dataset and a plurality of secondary datasets, the primary dataset comprising data points for a primary metric, and the plurality of secondary datasets comprising data points for a plurality of secondary metrics;
computing an interpolant for data points in the primary dataset;
identifying a time window by analyzing the interpolant for the primary dataset;
computing interpolants for data points in the time window for the plurality of secondary datasets;
computing an impact score for each of the plurality of secondary metrics by analyzing the interpolants for the plurality of secondary datasets;
collecting data based on the impact scores;
identifying a cause of an anomaly detected at a computing system based on the collected data; and
performing a remedial action for the anomaly detected at the computing system based on the cause, the remedial action including at least one of restoring, rebooting, reconfiguring, or initializing the computing system.

2. The computer-implemented method of claim 1 , wherein:
the interpolant for the primary dataset is computed by fitting a cubic polynomial through the data points for the primary metric; and
the interpolants for the plurality of secondary datasets are computed by fitting a cubic polynomial through the data points for the plurality of secondary metrics.

3. The computer-implemented method of claim 1 , wherein analyzing the interpolant for the primary dataset to identify the time window comprises evaluating roots of a derivative of the interpolant for the primary dataset to identify the time window.

4. The computer-implemented method of claim 1 , wherein the data points for the primary metric and the data points for the plurality of secondary metrics are collected during a time period corresponding to the anomaly detected at the computing system.

5. The computer-implemented method of claim 1 , wherein the impact score comprises a standard deviation of derivatives of the interpolants for the plurality of secondary metrics during the time window.

6. The computer-implemented method of claim 1 , wherein the primary metric and the plurality of secondary metrics comprise business metrics.

7. The computer-implemented method of claim 1 , wherein the primary metric and the plurality of secondary metrics comprise machine metrics.

8. The computer-implemented method of claim 1 , further comprising:
selecting secondary metrics of the plurality of secondary metrics based on the impact scores; and
collecting the data from data stores that correspond to the selected secondary metrics.

9. The computer-implemented method of claim 1 , further comprising:
receiving an indication of the anomaly at the computing system; and
retrieving the primary dataset and the plurality of secondary datasets based on the indication.

10. A computing system, comprising:
one or more processors; and
a computer-readable storage medium having computer-executable instructions stored thereupon which, when executed by the one or more processors, cause the one or more processors to:
compute an interpolant for data points in a primary dataset, the primary dataset comprising data points for a first metric;
identify a time window based on a derivative of the interpolant;
compute interpolants for data points in the time window for a plurality of secondary datasets, the secondary datasets comprising data points for a plurality of second metrics;
compute impact scores for the plurality of second metrics based on the interpolants for the data points in the time window for the plurality of secondary datasets;
obtain data, the data being selected based upon the impact scores;
identifying a cause of an anomaly detected at the computing system based on the obtained data; and
perform a remedial action for the anomaly based on the cause, the remedial action including at least one of restoring, rebooting, reconfiguring, or initializing the computing system.

11. The computing system of claim 10 , wherein the interpolant for the data points in the primary dataset is computed by fitting a cubic polynomial through the data points for the first metric.

12. The computing system of claim 10 , wherein the interpolants for the data points in the time window for the plurality of secondary datasets are computed by fitting a cubic polynomial through the data points for the plurality of second metrics.

13. The computing system of claim 10 , wherein identifying the time window comprises evaluating roots of a derivative of the interpolant for the data points in the primary dataset to identify the time window.

14. The computing system of claim 10 , wherein the data points for the first metric and the data points for the plurality of second metrics are collected during a time period corresponding to the anomaly detected at the computing system.

15. The computing system of claim 10 , wherein the impact score comprises a standard deviation of derivatives of the interpolants for the plurality of second metrics during the time window.

16. The computing system of claim 10 , wherein the first metric and the plurality of second metrics comprise business metrics or machine metrics.

17. A computer-readable storage medium having computer-executable instructions stored thereupon which, when executed by a processor, cause the processor to:
retrieve a primary dataset and a plurality of secondary datasets, the primary dataset comprising data points for a primary metric, and the plurality of secondary datasets comprising data points for a plurality of secondary metrics;
compute an interpolant for data points in the primary dataset by fitting a cubic polynomial through the data points for the primary metric;
identify a time window by analyzing the interpolant for the primary dataset;
compute interpolants for data points in the time window for the plurality of secondary datasets by fitting a cubic polynomial through the data points for the plurality of secondary metrics;
compute an impact score for each of the plurality of secondary metrics by analyzing the interpolants for the plurality of secondary datasets;
collect data based on the impact scores;
identify a cause of an anomaly detected at a computing system based on the collected data; and
perform a remedial action for the anomaly detected at the computing system based on the cause, the remedial action including at least one of restoring, rebooting, reconfiguring, or initializing the computing system.

18. The computer-readable storage medium of claim 17 , wherein analyzing the interpolant for the primary dataset comprises evaluating roots of a derivative of the interpolant for the primary dataset.

19. The computer-readable storage medium of claim 17 , wherein the impact score comprises a standard deviation of derivatives of the interpolants for the plurality of secondary metrics during the time window.

20. The computer-readable storage medium of claim 17 , wherein the primary metric and the plurality of secondary metrics comprise business metrics or machine metrics.

Assignees

• Ebay Inc

Inventors

• Poole Maxwell Henry
• Sambasivan Satish
• Kaushik Vivek Siva

Classifications

• G06F11/0706

  the processing taking place on a specific hardware platform or in a specific software environment · CPC title

• G06F11/0793 Primary

  Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40) · CPC title

• G06F11/079

  Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36) · CPC title

• G06F17/18 Primary

  for evaluating statistical data {, e.g. average values, frequency distributions, probability functions, regression analysis (forecasting specially adapted for a specific administrative, business or logistic context G06Q10/04)} · CPC title

• G06F11/1441

  Resetting or repowering · CPC title