Anomaly detection and alarming based on capacity and placement planning

Patent metadata

Field	Value
Publication number	US-2016112245-A1
Application number	US-201414518811-A
Country	US
Kind code	A1
Filing date	Oct 20, 2014
Priority date	Oct 20, 2014
Publication date	Apr 21, 2016
Grant date	—

Abstract

Operational parameters of a running multiserver data processing system are automatically and repeatedly sampled and compared with constraints defined in a capacity and placement planning specification of the multiserver data processing system. Constraint violations are automatically declared as operational anomalies and, if serious enough, corresponding alarm signals are automatically produced.

First claim

What is claimed is:

1 . A machine-implemented anomaly detecting process comprising:
accessing a pre-planned multiserver data processing system comprising a plurality of servers within which there are disposed a plurality of data processing units and a plurality of nonvolatile data storage units; accessing a pre-recorded capacity and placement planning specification for one or more operational layers of the accessed multiserver data processing system, where the operational layers include a physical resources layer comprised of the plurality of servers having disposed therein the data processing units and the nonvolatile data storage units, where the pre-recorded planning specification specifies respective capacity and placement planning constraints respectively for respective components of the one or more operational layers including capacity and placement constraints for components of the physical resources layer; while the multiserver data processing system is running within a pre-planned operational environment and for a given component and a corresponding constraint specified for the component in the accessed capacity and placement planning specification, automatically and repeatedly determining whether the corresponding constraint is violated by a corresponding operational attribute of the given component while the multiserver data processing system is running; and in response to a determined constraint violation, automatically generating and storing a corresponding constraint violation report which identifies the detected constraint violation and identifies a location of the detected constraint violation to a specified degree of location resolution.

2 . The machine-implemented process of claim 1 wherein:
the determining of whether the corresponding constraint is violated by the corresponding operational attribute of the given component comprises determining whether the corresponding operational attribute exceeds a specified maximum constraint for that operational attribute of the given component.

3 . The machine-implemented process of claim 1 wherein:
the determining of whether the corresponding constraint is violated by the corresponding operational attribute of the given component comprises determining whether the corresponding operational attribute is less than a specified minimum constraint for that operational attribute of the given component.

4 . The machine-implemented process of claim 1 wherein:
the determining of whether the corresponding constraint is violated by the corresponding operational attribute of the given component comprises determining whether the corresponding operational attribute is not compliant with an inclusion or exclusion constraint for that operational attribute of the given component.

5 . The machine-implemented process of claim 1 wherein:
the determining of whether the corresponding constraint is violated by the corresponding operational attribute of the given component comprises determining whether the corresponding operational attribute is not compliant with a placement constraint for that operational attribute of the given component.

6 . The machine-implemented process of claim 1 wherein:
the operational layers of the multiserver data processing system comprise a virtual components layer, and wherein components of the virtual components layer consume resources of the physical components layer.

7 . The machine-implemented process of claim 6 wherein:
the components of the virtual components layer are each assigned respective operational constraints by the pre-recorded capacity and placement planning specification.

8 . The machine-implemented process of claim 1 and further comprising:
while the multiserver data processing system is running, automatically aggregating together predetermined subsets of the operational attributes observed in the running multiserver data processing system; and
automatically comparing the aggregated together subsets with correspondingly aggregated constraints of the pre-recorded capacity and placement planning specification.

9 . The machine-implemented process of claim 8 wherein the aggregated constraints include specified maximums for corresponding operational parameters.

10 . The machine-implemented process of claim 9 wherein the aggregated constraints include specified minimums for corresponding operational parameters.

11 . The machine-implemented process of claim 1 and further comprising:
automatically generating a string of binary compliance indicators obtained from sensing in respective sample areas of the running multiserver data processing system, corresponding operational attributes and testing them against their respective constraints, the binary compliance indicators respectively indicating a logic true if there is compliance by respective ones of the corresponding operational attributes sensed in the sample areas with the corresponding constraints of the capacity and placement planning specification;
automatically generating a first Boolean product of the generated string of binary status indicators;
in response to the first Boolean product being a logic zero, automatically splitting the string into a plurality of substrings and obtaining a respective second Boolean product of at least a respective one of the substrings so as to thereby better localize the cause of the first Boolean product being a logic zero; and
after better localizing of the cause for the first Boolean product being a logic zero, generating and storing a corresponding constraint violation report which identifies the detected constraints violation and identifies a location of the detected constraints violation to a specified degree of location resolution.

12 . A pre-planned multiserver data processing system that is configured in accordance with a capacity and placement planning specification and where the multiserver data processing system comprises:
a plurality of servers within which there are disposed a plurality of data processing units and a plurality of nonvolatile data storage units; and an anomaly declaring and alarming subsystem implemented as part of the multiserver data processing system and configured to automatically and repeatedly compare against constraints defined in the capacity and placement planning specification, corresponding operational samples observed during a running of the multiserver data processing system; wherein the anomaly declaring and alarming subsystem is configured to automatically generate, in response to a determined constraint violation, a corresponding constraint violation report.

13 . The multiserver data processing system of claim 12 wherein:
the anomaly declaring and alarming subsystem is configured to automatically assign respective weights to determined constraint violations; and
the anomaly declaring and alarming subsystem is configured to output alarm signals in response to determined constraint violations whose assigned weights exceed predetermined and corresponding thresholds.

14 . The multiserver data processing system of claim 12 wherein:
the capacity and placement planning specification is hierarchically organized according to at least one of: constraint type, constraint subtype, a layer among operational layers of the multiserver data processing system and fractional portions of the operational layers.

15 . The multiserver data processing system of claim 12 in a running operational state and in an operational environment that comprises plural client machines operatively coupled to the multiserver data processing system by way of a network and wherein:
t

Assignees

• Ca Inc

Inventors

• Mankovskii Serge

Classifications

• H04L41/069 Primary

  using logs of notifications; Post-processing of notifications · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• H04L41/40

  using virtualisation of network functions or resources, e.g. SDN or NFV entities · CPC title

• H04L67/131

  Protocols for games, networked simulations or virtual reality · CPC title

• H04L41/0631

  using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis · CPC title