Adaptive alert monitoring

Patent metadata

Field	Value
Publication number	US-2020252261-A1
Application number	US-201916264369-A
Country	US
Kind code	A1
Filing date	Jan 31, 2019
Priority date	Jan 31, 2019
Publication date	Aug 6, 2020
Grant date	—

Abstract

Various embodiments provide for alert generation based on alert dependency. For some embodiments, the alert dependency checking facilitates alert noise reduction. Various embodiments described herein dynamically find or discover alert dependencies based on one or more alerts currently active, one or more active alerts generated in the past, or some combination of both. Various embodiments described herein provide alert monitoring that adapts based on an alert state of a machine. Various embodiments described herein generate a health score for a machine based on an alert state of the machine. Various embodiments described herein provide a tool for managing definitions of one or more alerts that can be identified as an active alert for a machine.

First claim

What is claimed is:

1 . A method comprising:
periodically monitoring, by one or more hardware processors, a machine for a set of active alerts based on a monitoring frequency; generating, by the one or more hardware processors, an alert state for the machine based on the set of active alerts, the alert state describing the set of active alerts with respect to a set of identifiable alerts for the machine; and adjusting, by the one or more hardware processors, the monitoring frequency based on the alert state.

2 . The method of claim 1 , wherein the adjusting the monitoring frequency based on the alert state comprises:
determining whether the alert state represents a change in comparison to a prior determined alert state; and adjusting the monitoring frequency based on the determining of whether the alert state represents the change.

3 . The method of claim 2 , wherein the adjusting the monitoring frequency based on the determining of whether the alert state represents the change comprises:
increasing the monitoring frequency in response to the change indicating an increase in active alerts.

4 . The method of claim 2 , wherein the adjusting the monitoring frequency based on the determining of whether the alert state represents the change comprises:
decreasing the monitoring frequency in response to the change indicating a decrease in active alerts.

5 . The method of claim 1 , wherein the alert state comprises a vector representing a plurality of statuses corresponding to the set of identifiable alerts for the machine.

6 . The method of claim 5 , wherein each status of the plurality of statuses comprises a value of on or off.

7 . The method of claim 1 , further comprising:
generating, by the one or more hardware processors, a health score for the machine based on the alert state.

8 . The method of claim 7 , wherein the generating the health score comprises:
applying to the alert state a set of weights that corresponds to the set of identified alerts to generate intermediate alert state data; and calculating a dot product of the alert state based on the intermediate alert state data to generate the health score.

9 . The method of claim 1 , wherein the periodically monitoring the machine for the set of active alerts based on the monitoring frequency comprises:
accessing telemetry data associated with the machine; and evaluating the telemetry data to identify a set of triggered alerts triggered by the machine; accessing alert dependency data that describes a set of dependencies between a plurality of alerts; and filtering the set of triggered alerts based on the alert dependency data to generate the set of active alerts.

10 . The method of claim 9 , wherein the evaluating the telemetry data to identify the set of triggered alerts for the machine comprises:
generating time-series alert data based on the telemetry data to identify the set of triggered alerts, the generating the time-series alert data based on the telemetry data to identify the set of triggered alerts comprising:
for a given identifiable alert in the set of identifiable alerts, recording a time for each time a given metric associated the given identifiable alert surpasses a threshold value.

11 . The method of claim 10 , further comprising:
adjusting, by the one or more hardware processors, the threshold value based on the alert state.

12 . The method of claim 10 , further comprising:
adjusting, by the one or more hardware processors, the threshold value based on a temporary override.

13 . A system comprising:
a memory storing instructions; and one or more hardware processors communicatively coupled to the memory and configured by the instructions to perform operations comprising:
periodically monitoring a machine for a set of active alerts based on a monitoring frequency;
generating an alert state for the machine based on the set of active alerts, the alert state describing the set of active alerts with respect to a set of identifiable alerts for the machine; and
adjusting the monitoring frequency based on the alert state.

14 . The system of claim 13 , wherein the adjusting the monitoring frequency based on the alert state comprises:
determining whether the alert state represents a change in comparison to a prior determined alert state; and adjusting the monitoring frequency based on the determining of whether the alert state represents the change.

15 . The system of claim 13 , wherein the alert state comprises a vector representing a plurality of statuses corresponding to the set of identifiable alerts for the machine.

16 . The system of claim 13 , wherein the periodically monitoring the machine for the set of active alerts based on the monitoring frequency comprises:
accessing telemetry data associated with the machine; and evaluating the telemetry data to identify a set of triggered alerts triggered by the machine; accessing alert dependency data that describes a set of dependencies between a plurality of alerts; and filtering the set of triggered alerts based on the alert dependency data to generate the set of active alerts.

17 . The system of claim 16 , wherein the evaluating the telemetry data to identify the set of triggered alerts for the machine comprises:
generating time-series alert data based on the telemetry data to identify the set of triggered alerts, the generating the time-series alert data based on the telemetry data to identify the set of triggered alerts comprising:
for a given identifiable alert in the set of identifiable alerts, recording a time for each time a given metric associated the given identifiable alert surpasses a threshold value.

18 . The system of claim 17 , wherein the operations further comprises:
adjusting the threshold value based on the alert state.

19 . The system of claim 17 , wherein the operations further comprises:
adjusting the threshold value based on a temporary override.

20 . A non-transitory computer-readable storage medium comprising instructions that, when executed by a processing device, cause the processing device to perform operations comprising:
periodically monitoring a machine for a set of active alerts based on a monitoring frequency; generating an alert state for the machine based on the set of active alerts, the alert state describing the set of active alerts with respect to a set of identifiable alerts for the machine; and adjusting the monitoring frequency based on the alert state.

Assignees

• Rubrik Inc

Inventors

• Arora Gurjeet S
• Bavishi Karan Jayesh
• Talamas Cano Daniel
• Louie John
• Joshi Chetas
• Noe Matthew Edward

Classifications

• H04L43/20

  the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV · CPC title

• H04L41/40

  using virtualisation of network functions or resources, e.g. SDN or NFV entities · CPC title

• H04L43/0817

  by checking functioning · CPC title

• H04L43/16

  Threshold monitoring · CPC title

• H04L41/5019

  Ensuring fulfilment of SLA · CPC title