Generating runbooks for problem events

Patent metadata

Field	Value
Publication number	US-2020004618-A1
Application number	US-201816020026-A
Country	US
Kind code	A1
Filing date	Jun 27, 2018
Priority date	Jun 27, 2018
Publication date	Jan 2, 2020
Grant date	—

Abstract

Generation, by machine logic, of runbooks for problem events. Generation of runbooks including the following operations: receiving operator commands in a command line interface for an event group relating to an issue, wherein the operator commands resolve the issue; and storing the operator commands as related artifacts of the event group with mapping to affected resources. The method may match arguments of the operator commands to event metadata fields of events in the event group to generalize the arguments to the event metadata and to generate a runbook of generalized operator commands for future instances of an event group of a similar type.

First claim

What is claimed is:

1 . A computer-implemented method for generating runbooks for problem events, comprising:
receiving operator commands in a command line interface for an event group relating to an issue, wherein the operator commands resolve the issue; storing the operator commands as related artifacts of the event group with mapping to affected resources; matching arguments of the operator commands to event metadata fields of events in the event group to generalize the arguments to the event metadata; and generating a runbook of generalized operator commands for future instances of an event group of a similar type.

2 . The method as claimed in claim 1 , wherein generalizing the arguments to event metadata includes checking if an argument matches a metadata field of event metadata and, if there is no match, keeping the argument static whereas, if there is a match, replacing the argument with parameters allowing the operator command to be used for other resources.

3 . The method as claimed in claim 1 , wherein generating the runbook includes analyzing event group types and collating generalized commands run in the context of an event group type.

4 . The method as claimed in claim 1 , including:
applying a resolution weighting to generalized operator commands in a runbook based on a number of times the operator commands result in resolution of an issue; and enabling automatic selection of operator commands with a predefined threshold weighting.

5 . The method as claimed in claim 1 , including:
identifying an event group relating to an issue and receiving operator connection to a host to resolve the issue; and extracting resource details from event metadata and connecting to affected resources.

6 . The method as claimed in claim 5 , wherein receiving operator commands receives operator commands from multiple command line interface sessions with operator commands including configuration change events.

7 . The method as claimed in claim 1 , including:
filtering the operator commands to remove non-system affecting commands by comparing to known system affecting sets of commands.

8 . The method as claimed in claim 7 , wherein, if the operator commands do not match known system affecting sets of commands, calculating a confidence of each command being system affecting based on a combination of sources.

9 . The method as claimed in claim 4 , including:
receiving an event group for an issue and comparing it to similar event group types with generated runbooks of generalized operator commands; and automatically applying generalized operator commands if their resolution weighting is above a predefined threshold weighting.

10 . The method as claimed in claim 9 , including:
increasing the resolution weighting for generalized operator commands if the issue is successfully resolved.

11 . A computer program product (CPP) for generating runbooks for problem events, the computer program product comprising:
a computer readable storage medium; and computer code stored on the computer readable storage medium, with the computer code including program instructions executable by a processor(s) set to cause the processor(s) set to perform at least the following operations:
receive operator commands in a command line interface for an event group relating to an issue, wherein the operator commands resolve the issue,
store the operator commands as related artifacts of the event group with mapping to affected resources,
match arguments of the operator commands to event metadata fields of events in the event group to generalize the arguments to the event metadata, and
generate a runbook of generalized operator commands for future instances of an event group of a similar type.

12 . The CPP of claim 11 wherein the CPP is in the form of a computer system, and with the computer system further comprising:
the processor(s) set operatively connected in communication with the computer readable storage medium so that the processor(s) set can execute the program instructions.

13 . The CPP as claimed in claim 11 , wherein the command generalizing program instructions for generalizing the arguments to event metadata includes program instructions checking if an argument matches a metadata field of event metadata and, if there is no match, keeping the argument static whereas, if there is a match, replacing the argument with parameters allowing the operator command to be used for other resources.

14 . The CPP as claimed in claim 11 , wherein the runbook generating program instructions for generating the runbook includes an event group type program instructions for analyzing event group types and collating generalized commands run in the context of an event group type.

15 . The CPP as claimed in claim 11 , wherein the computer code further comprises program instructions for causing the processor(s) set to perform the following operations:
applying a resolution weighting to generalized operator commands in a runbook based on a number of times the operator commands result in resolution of an issue; and enabling automatic selection of operator commands with a predefined threshold weighting.

16 . The CPP as claimed in claim 11 , wherein the computer code further comprises program instructions for causing the processor(s) set to perform the following operations:
identifying an event group relating to an issue and receiving operator connection to a host to resolve the issue; and extracting resource details from event metadata and connecting to affected resources.

17 . The CPP as claimed in claim 11 , wherein the command receiving program instructions for receiving operator commands receives operator commands from multiple command line interface sessions with operator commands including configuration change events.

18 . The CPP as claimed in claim 11 , wherein the computer code further comprises program instructions for causing the processor(s) set to perform the following operation:
filtering the operator commands to remove non-system affecting commands by comparing to known system affecting sets of commands.

19 . The CPP as claimed in claim 18 , wherein the filtering program instructions include a confidence program instructions that, responsive to the operator commands not matching known system affecting sets of commands, calculate a confidence of each command being system affecting based on a combination of sources.

20 . A method comprising:
receiving a problem-resolution command data set including information indicative of: (i) a plurality of commands used to resolve a first occurrence of a problem event that occurred in operation of a first computer system, and (ii) each given command of the plurality of commands, argument value data respectively corresponding to value(s) of argument(s) of the given command; for each given argument value of each given argument data of each given command of the plurality of commands, determining, by machine logic, a machine logic formula for determining the given argument value based on characteristics and/or operational parameter values of computer systems other than the first computer system; and creating a first script for handling the problem event, the first script including: (i) the plurality of commands, and (ii) the machine logic formulas for given argument value.

Assignees

• IBM

Inventors

• Thornhill Matthew R J
• Griffin David
• Taher Luke

Classifications

• G06F9/542

  Event management; Broadcasting; Multicasting; Notifications · CPC title

• G06F9/45512 Primary

  Command shells · CPC title

• G06F16/907

  Retrieval characterised by using metadata, e.g. metadata not derived from the content or metadata generated manually · CPC title

• G06F11/0754 Primary

  by exceeding limits · CPC title

• G06F2201/86

  Event-based monitoring · CPC title