Alert dependency discovery

Patent metadata

Field	Value
Publication number	US-2020250062-A1
Application number	US-201916264264-A
Country	US
Kind code	A1
Filing date	Jan 31, 2019
Priority date	Jan 31, 2019
Publication date	Aug 6, 2020
Grant date	—

Abstract

Various embodiments provide for alert generation based on alert dependency. For some embodiments, the alert dependency checking facilitates alert noise reduction. Various embodiments described herein dynamically find or discover alert dependencies based on one or more alerts currently active, one or more active alerts generated in the past, or some combination of both. Various embodiments described herein provide alert monitoring that adapts based on an alert state of a machine. Various embodiments described herein generate a health score for a machine based on an alert state of the machine. Various embodiments described herein provide a tool for managing definitions of one or more alerts that can be identified as an active alert for a machine.

First claim

What is claimed is:

1 . A method comprising:
accessing, by one or more hardware processors, historical active alert data describing previous occurrences of a plurality of active alerts for a machine; selecting, by the one or more hardware processors, a set of candidate active alerts for correlation with respect to a particular active alert in the plurality of active alerts, the set of candidate active alerts being selected from the plurality of active alerts based on the historical active alert data; for each candidate active alert in the set of candidate active alerts:
generating, by the one or more hardware processors, a score for the candidate active alert based on a metric associated with the candidate active alert and the particular active alert; and
determining, by the one or more hardware processors, whether the particular active alert is dependent on the candidate active alert based on the score generated for the candidate active alert; and
in response to determining that the particular active alert depends on the candidate active alert based on the score, storing, by the one or more hardware processors, a dependency of the particular active alert on the candidate active alert, the storing the dependency comprising storing the dependency in alert dependency data that describes a set of dependencies between a plurality of alerts.

2 . The method of claim 1 , wherein the selecting the set of candidate active alerts for correlation with respect to the particular active alert comprises:
selecting the set of candidate active alerts, from the historical active alert data, based on a time criterion defined with respect to the particular active alert.

3 . The method of claim 2 , wherein the time criterion defines a time window preceding the particular active alert.

4 . The method of claim 1 , wherein the metric associated with the candidate active alert and the particular active alert comprises a value representing an amount of time the candidate active alert precedes the particular active alert.

5 . The method of claim 4 , wherein the value is determined based on the historical active alert data.

6 . The method of claim 1 , wherein the alert dependency data comprises a directed acyclic graph that describes a dependency between two or more alerts.

7 . The method of claim 1 , further comprising:
accessing, by the one or more hardware processors, telemetry data associated with the machine; evaluating, by the one or more hardware processors, the telemetry data to identify a set of triggered alerts triggered by the machine; and filtering, by the one or more hardware processors, the set of triggered alerts based on the alert dependency data to generate a set of active alerts.

8 . The method of claim 1 , wherein the determining whether the particular active alert is dependent on the candidate active alert based on the score generated for the candidate active alert comprises:
determining that the particular active alert is dependent on the candidate active alert in response to the score surpassing a score threshold.

9 . A system comprising:
a memory storing instructions; and one or more hardware processors communicatively coupled to the memory and configured by the instructions to perform operations comprising:
accessing historical active alert data describing previous occurrences of a plurality of active alerts for a machine;
selecting a set of candidate active alerts for correlation with respect to a particular active alert in the plurality of active alerts, the set of candidate active alerts being selected from the plurality of active alerts based on the historical active alert data;
for each candidate active alert in the set of candidate active alerts:
generating a score for the candidate active alert based on a metric associated with the candidate active alert and the particular active alert; and
determining whether the particular active alert is dependent on the candidate active alert based on the score generated for the candidate active alert; and
in response to determining that the particular active alert depends on the candidate active alert based on the score, storing a dependency of the particular active alert on the candidate active alert, the storing the dependency comprising storing the dependency in alert dependency data that describes a set of dependencies between a plurality of alerts.

10 . The system of claim 9 , wherein the selecting the set of candidate active alerts for correlation with respect to the particular active alert comprises:
selecting the set of candidate active alerts, from the historical active alert data, based on a time criterion defined with respect to the particular active alert.

11 . The system of claim 10 , wherein the time criterion defines a time window preceding the particular active alert.

12 . The system of claim 9 , wherein the metric associated with the candidate active alert and the particular active alert comprises a value representing an amount of time the candidate active alert precedes the particular active alert.

13 . The system of claim 12 , wherein the value is determined based on the historical active alert data.

14 . The system of claim 9 , wherein the alert dependency data comprises a directed acyclic graph that describes a dependency between two or more alerts.

15 . The system of claim 9 , wherein the operations further comprise:
accessing telemetry data associated with the machine; evaluating the telemetry data to identify a set of triggered alerts triggered by the machine; and filtering the set of triggered alerts based on the alert dependency data to generate a set of active alerts.

16 . The system of claim 9 , wherein the determining whether the particular active alert is dependent on the candidate active alert based on the score generated for the candidate active alert comprises:
determining that the particular active alert is dependent on the candidate active alert in response to the score surpassing a score threshold.

17 . A non-transitory computer-readable storage medium comprising instructions that, when executed by a processing device, cause the processing device to perform operations comprising:
accessing historical active alert data describing previous occurrences of a plurality of active alerts for a machine; selecting a set of candidate active alerts for correlation with respect to a particular active alert in the plurality of active alerts, the set of candidate active alerts being selected from the plurality of active alerts based on the historical active alert data; for each candidate active alert in the set of candidate active alerts:
generating a score for the candidate active alert based on a metric associated with the candidate active alert and the particular active alert; and
determining whether the particular active alert is dependent on the candidate active alert based on the score generated for the candidate active alert; and
in response to determining that the particular active alert depends on the candidate active alert based on the score, storing a dependency of the particular active alert on the candidate active alert, the storing the dependency comprising storing the dependency in alert dependency data that describes a set of dependencies between a plurality of alerts.

18 . The non-transitory computer-readable storage medium of claim 17 , wherein the selecting the set of candidate active alerts for correlation with respect to the particular active alert comprises:
selecting the set of candidate activ

Assignees

• Rubrik Inc

Inventors

• Arora Gurjeet S
• Bavishi Karan Jayesh
• Talamas Cano Daniel
• Louie John
• Joshi Chetas
• Noe Matthew Edward

Classifications

• G06F11/0766

  Error or fault reporting or storing · CPC title

• G06F2201/815

  Virtual · CPC title

• G06F11/3495

  for systems · CPC title

• G06F11/3476

  Data logging (G06F11/14, G06F11/2205 take precedence) · CPC title

• G06F11/327 Primary

  Alarm or error message display · CPC title