Observability platform service for operational environment

Patent metadata

Field	Value
Publication number	US-12537734-B2
Application number	US-202318537968-A
Country	US
Kind code	B2
Filing date	Dec 13, 2023
Priority date	Dec 13, 2023
Publication date	Jan 27, 2026
Grant date	Jan 27, 2026

Abstract

Provided are systems and methods that facilitates cross-correlation among alerts within different systems in a complex operating environment. In one example, a method may include receiving a plurality of alert messages generated by a plurality of systems within a distributed and shared operating environment and storing the plurality of alert messages, identifying a subset of alert messages among the plurality of alert messages that are correlated based on relationships identified from the subset of alert messages, generating a description of a root cause of the subset of alert messages based on execution of an artificial intelligence (AI) model on the identified subset of alert messages, and displaying the description of the root cause via a user interface.

First claim

What is claimed is:

1 . A computing system comprising:
a storage; and a processor configured to:
receive a plurality of alert messages generated by a plurality of systems within a distributed and shared operating environment and store the plurality of alert messages in the storage, each individual alert message of the plurality of alert messages including an identifier of a location where a performance issue for at least one of the plurality of systems has been detected and an identity of a server where the performance issue was detected;
identify a subset of alert messages in the storage that are correlated based at least in part on attributes within the alert messages, the attributes indicating one or more of: geographic locations, virtual machine locations, routers, switches, load balancers, or server locations identified from the subset of the alert messages;
execute a large language model (LLM) on the subset of alert messages;
generate a request for information based on the execution of the LLM on the subset of the alert messages, display the request for information via the user interface, receive a response to the request for information via the user interface, and determine a description of the root cause based on execution of the LLM on the request for information and the response to the request for information; and
display the description of the root cause via a user interface.

2 . The computing system of claim 1 , wherein the processor is configured to receive the plurality of the alert messages from a plurality of heterogeneous systems, respectively, within an operating environment of a wide area network (WAN).

3 . The computing system of claim 1 , wherein the processor is further configured to enrich the plurality of alert messages with additional context of the distributed and shared operating environment based on one or more data feeds, prior to the execution of the LLM.

4 . The computing system of claim 1 , wherein the processor is further configured to determine an area of impact within the distributed and shared operating environment based on execution of the LLM on the subset of the alert messages, and display a map of the distributed and shared operating environment including the area of impact via the user interface.

5 . The computing system of claim 1 , wherein the processor is further configured to generate a description of a strategy for triaging the root cause based on execution of the LLM on the subset of the alert messages, and display the description of the strategy via the user interface.

6 . A method comprising:
receiving a plurality of alert messages generated by a plurality of systems within a distributed and shared operating environment and storing the plurality of alert messages, each individual alert message of the plurality of alert messages including an identifier of a location where a performance issue for at least one of the plurality of systems has been detected and an identity of a server where the performance issue was detected; identifying a subset of alert messages among the plurality of alert messages that are correlated at least in part on attributes within the alert messages, the attributes indicating one or more of: geographic locations, virtual machine locations, routers, switches, load balancers, or server locations identified from the subset of the alert messages; executing a large language model (LLM) on the subset of alert messages; generating a request for information based on the execution of the LLM on the subset of the alert messages, display the request for information via the user interface, receive a response to the request for information via the user interface, and determining a description of the root cause based on execution of the LLM on the request for information and the response to the request for information; and displaying the description of the root cause via a user interface.

7 . The method of claim 6 , wherein the receiving comprises receiving the plurality of alert messages from a plurality of heterogeneous systems, respectively, within an operating environment of a wide area network (WAN).

8 . The method of claim 6 , wherein the method further comprises enriching the plurality of alert messages with additional context of the distributed and shared operating environment based on one or more data feeds, prior to the execution of the LLM.

9 . The method of claim 6 , wherein the method further comprises determining an area of impact within the distributed and shared operating environment based on execution of the LLM on the subset of the alert messages, and displaying a map of the distributed and shared operating environment including the area of impact via the user interface.

10 . The method of claim 6 , wherein the method further comprises generating a description of a strategy for triaging the root cause based on execution of the LLM on the subset of the alert messages, and displaying the description of the strategy via the user interface.

11 . A non-transitory computer-readable storage medium comprising instructions which when executed by a processor cause a computer to perform:
receiving a plurality of alert messages generated by a plurality of systems within a distributed and shared operating environment and storing the plurality of alert messages, each individual alert message of the plurality of alert messages including an identifier of a location where a performance issue for at least one of the plurality of systems has been detected and an identity of a server where the performance issue was detected; identifying a subset of alert messages among the plurality of alert messages that are correlated based at least in part on attributes within the alert messages, the attributes indicating one or more of: geographic locations, virtual machine locations, routers, switches, load balancers, or server locations identified from the subset of the alert messages; executing a large language model (LLM) on the subset of alert messages; generating a request for information based on the execution of the LLM on the subset of the alert messages, display the request for information via the user interface, receive a response to the request for information via the user interface, and determining a description of the root cause based on execution of the LLM on the request for information and the response to the request for information; and displaying the description of the root cause via a user interface.

12 . The non-transitory computer-readable storage medium of claim 11 , wherein the receiving comprises receiving the plurality of the alert messages from a plurality of heterogeneous systems, respectively, within an operating environment of a wide area network (WAN).

Assignees

• Sap Se

Inventors

• Sanchez Anthony
• Kaszonyi Gabor
• Romero Mario Eduardo
• Melasecca Gregory
• Chen Yu
• Martens Shea
• Kertesz Jozsef
• Adige Vittalraya Shenoy
• Hiu Yen Onn
• Petrov Petar
• Toth Balint Janos
• Ruiz Ismael

Classifications

• H04L41/22

  comprising specially adapted graphical user interfaces [GUI] · CPC title

• H04L41/0686

  Additional information in the notification, e.g. enhancement of specific meta-data · CPC title

• H04L41/0654 Primary

  using network fault recovery (ring fault isolation or reconfiguration in loop networks without recovery actions by a network management system H04L12/437) · CPC title

• H04L41/0631 Primary

  using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis · CPC title

• H04L41/16

  using machine learning or artificial intelligence · CPC title