Anomaly classification, analytics and resolution based on annotated event logs

Patent metadata

Field	Value
Publication number	US-2016283310-A1
Application number	US-201514666665-A
Country	US
Kind code	A1
Filing date	Mar 24, 2015
Priority date	Mar 24, 2015
Publication date	Sep 29, 2016
Grant date	—

Abstract

Operational event loggings and operational alarm productions within a running multiserver data processing system are automatically and repeatedly sampled and co-associated with one another so as to build annotated logs that can be used by post-process analytics for filling in mappings thereof into an anomalies versus parameters mapping space and for keeping track of unusual changes in the mappings or their rates where the unusual changes can be indicative of emerging new problems of significance within the system.

First claim

What is claimed is:

1 . A machine-implemented method for keeping track in an anomalies versus parameters mapping space of previously identified and emerging anomalies of a data processing system, the method comprising:
running a first section of the data processing system where the first section includes a section alarming subsystem and a section behaviors logging subsystem, the section alarming subsystem being configured to generate alarms for alarm-worthy events within the first section, the section behaviors logging subsystem being configured to generate a log of monitored behaviors within the first section; logically co-associating recently logged behaviors of the generated log produced by the section behaviors logging subsystem with substantially cotemporaneous alarms generated by the section alarming subsystem and recording the logical associations; building an annotated log comprised of the logically co-associated logged behaviors and substantially cotemporaneous alarms; using the annotated log to keep track in a corresponding first anomalies versus parameters mapping space of previously identified as routine and emerging anomalies of the first section of the data processing system; and automatically repeating said co-associating building and using steps while the first section of the data processing system continues to run.

2 . The machine-implemented method of claim 1 and further comprising:
creating a behavior mimicking copy of the section alarming subsystem, the behavior mimicking copy having accessible internal logic structures configured to mimic output behaviors of the section alarming subsystem;

3 . The machine-implemented method of claim 1 wherein:
the first anomalies versus parameters mapping space is defined by a database storing alarmed sample points (ASP's) as points within a multi-parameters coordinate space where each alarmed sample point (ASP) correlates to one or more of cotemporaneous ones of the temporally corresponding generatings of alarms by the section alarming subsystem.

4 . The machine-implemented method of claim 3 wherein:
the first anomalies versus parameters mapping space is further defined by the database further storing non-alarmed sample points (NASP's) as points within the multi-parameters coordinate space where each non-alarmed sample point (NASP) correlates to an event logged time when there are no generatings of alarms by the section alarming subsystem.

5 . The machine-implemented method of claim 3 wherein:
the first section of the data processing system includes a first data processing unit, a first data storage unit and a first data input/output communicating unit; and
the recently logged behaviors of the generated log include a data processing rate of the first data processing unit, a data access rate of the first data storage unit and a data communicating rate of the first data input/output communicating unit.

6 . The machine-implemented method of claim 5 wherein:
the section alarming subsystem of the first section generates a low storage access rate alarm when the data access rate of the first data storage unit is below a predetermined first storage access rate threshold.

7 . The machine-implemented method of claim 6 wherein:
the section alarming subsystem of the first section generates a high storage access rate alarm when the data access rate of the first data storage unit is above a predetermined second storage access rate threshold.

8 . The machine-implemented method of claim 7 wherein:
the section alarming subsystem of the first section does not generate a storage access rate alarm when the data access rate of the first data storage unit is between the predetermined first and second storage access rate thresholds; and
in response to the section alarming subsystem not generating the storage access rate alarms, the first anomalies versus parameters mapping space is defined within the database by corresponding storing of non-alarmed data access sample points (daNASP's) as points within the multi-parameters coordinate space where each non-alarmed data access sample point (daNASP) correlates to a time when there are no generatings of data access alarms by the section alarming subsystem.

9 . The machine-implemented method of claim 8 wherein:
an emerging data access anomaly is flagged for an area of the first anomalies versus parameters mapping space when that area was previously mapped as having non-alarmed data access sample points (daNASP's) and there is a current change wherein the area starts being filled with alarmed data access sample points (daASP's) indicative of generatings of data access alarms by the section alarming subsystem for that previously not-alarmed area.

10 . The machine-implemented method of claim 3 and further comprising:
cotemporaneous with the running of the first section, running a second section of the data processing system where the first and second sections are operatively influential one at least on the other or the first and second sections are operatively influenced by a third section of the data processing system and where the second section includes a corresponding second section alarming subsystem and a corresponding second section behaviors logging subsystem, the second section alarming subsystem being configured to generate alarms for alarm-worthy events within the second section, the second section behaviors logging subsystem being configured to generate a corresponding second log of monitored behaviors within the second section;
logically co-associating recently logged behaviors of the generated second log produced by the second section behaviors logging subsystem with substantially cotemporaneous alarms generated by the second section alarming subsystem and recording the logical associations of the second section;
building an annotated second log that correlates the recently logged behaviors of the second section to temporally corresponding generatings and non-generatings of alarms by the second section alarming subsystem;
using the second annotated log for keeping track in a corresponding second anomalies versus parameters mapping space of previously identified and emerging anomalies of the second section of the data processing system;
automatically repeating said co-associating, building and using steps for the second section while the second section of the data processing system continues to run; and
automatically correlating changes in one of the first and second anomalies versus parameters mapping spaces with cotemporaneous changes in the other of the anomalies versus parameters mapping spaces.

11 . A data processing system configured to keep track in an anomalies versus parameters mapping space of previously identified and emerging anomalies of the data processing system, the data processing system comprising:
a plurality of sections including a first section having a section alarming subsystem and a section behaviors logging subsystem, the section alarming subsystem being configured to generate alarms for alarm-worthy events within the first section, the section behaviors logging subsystem being configured to generate a log of monitored behaviors within the first section; an annotated log storing database that is configured to indicate correlations for respective ones of the system sections between the recently logged behaviors and temporally corresponding generatings and non-generatings of alarms by the respective section alarming subsystem; an annotated log builder, coupled to the database and configured to automatically repeatedly for respective ones of the system sections, add to the stored and annotated log additional samples of correlations betw

Assignees

• Ca Inc

Inventors

• Mankovskii Serguei
• Greenspan Steven
• Velez-Rojas Maria

Classifications

• G06F11/0721

  within a central processing unit [CPU] · CPC title

• G06F11/0772 Primary

  Means for error signaling, e.g. using interrupts, exception flags, dedicated error registers · CPC title

• H04L41/00

  Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks · CPC title

• G06F2201/86

  Event-based monitoring · CPC title

• G06F2201/81

  Threshold · CPC title