Leveraging user-to-tool interactions to automatically analyze defects in IT services delivery

Patent metadata

Field	Value
Publication number	US-9459950-B2
Application number	US-201414514029-A
Country	US
Kind code	B2
Filing date	Oct 14, 2014
Priority date	Jan 31, 2012
Publication date	Oct 4, 2016
Grant date	Oct 4, 2016

Abstract

An approach is presented for identifying related problem tickets in an information technology (IT) environment. A pattern of actions included in interactions with a computer program is determined to be effective at proactively preventing a problem in the IT environment based on a frequency at which user(s) performed the interactions which perform text and statistical analyses of content of historical problem tickets. A script based on the pattern of actions is generated. A root cause of the problem is determined based on the text and statistical analyses. Responsive to a receipt of a new problem ticket, the script is executed to automatically perform the pattern of actions. The new problem ticket is classified as being in a group of problem tickets which are related to the problem and included in the historical problem tickets. The new problem ticket is determined to specify the problem which has the root cause.

First claim

The invention claimed is:

1. A method of identifying related problem tickets in an information technology (IT) environment, the method comprising the steps of:
a computer determining that a pattern of actions is effective at proactively preventing a problem in the IT environment based on a frequency at which one or more users performed interactions with a computer program, the interactions:
including the pattern of actions,
including a performance of a text analysis of content of the plurality of historical problem tickets,
including a statistical analysis of the content of the plurality of historical problem tickets, and
causing a determination that a plurality of historical problem tickets includes a group of problem tickets which is related to the problem;

the computer generating an executable script based on the pattern of actions;
based at least in part on the text analysis and the statistical analysis included in the interactions, the computer determining a root cause of the problem;
in response to a receipt of a new problem ticket, the computer executing the script, which automatically performs the pattern of actions; and
in response to executing the script, the computer classifying the new problem ticket as being included in the group of problem tickets related to the problem and determining the new problem ticket specifies the problem which has the root cause.

2. The method of claim 1 , further comprising the step of the computer capturing in the interactions an application of a first filtering constraint to the plurality of historical problem tickets having respective severities before an application of a second filtering constraint, the first filtering constraint being a selection in a user interface of the computer program of a severity from the severities, and the second filtering constraint being a selection in a user interface of one or more attributes of the plurality of historical problem tickets other than the severity, wherein the step of determining the root cause is based in part on the applications of the first and second filtering constraints and the application of the first filtering constraint being before the application of the second filtering constraint.

3. The method of claim 1 , further comprising the step of the computer generating and presenting to a user a visualization of behavior of the group of problem tickets in which the new problem ticket is classified.

4. The method of claim 1 , further comprising the steps of:
based on the interactions, the computer determining a group signature that includes the pattern of actions;
the computer storing the group signature, a specification of the root cause of the group of problem tickets, and a preventive action implemented to prevent the root cause;
the computer registering the group signature for trend analysis of incoming problem tickets;
the computer retrieving incoming problem tickets based on the group signature;
the computer performing a time-series analysis of the retrieved problem tickets;
based on the time-series analysis, the computer determining a volume of incoming problem tickets related to the problem is decreasing over a time period; and
based on the group signature and the volume of the incoming problem tickets related to the problem decreasing over the time period, the computer determining the preventive action is effective at preventing the root cause.

5. The method of claim 2 , further comprising the steps of:
based on the interactions, the computer determining a group signature that includes the pattern of actions and is associated with a first country from which the problem tickets in the group of problem tickets are extracted;
the computer storing the group signature, a specification of the root cause of the group of problem tickets, and a preventive action implemented to prevent the root cause;
the computer determining a similarity index based on a search for keywords in the content of the plurality of historical problem tickets and the first and second filtering constraints, and retrieving second and third group signatures that are similar to the group signature based on the similarity index and that are associated with problem tickets from second and third countries, respectively, which are different from the first country;
the computer assigning weights to the retrieved second and third group signatures and ranking the retrieved group signatures based on the similarity index and the weights assigned to the retrieved group signatures;
the computer determining the second and third group signatures have top ranks based on the step of ranking the retrieved group signatures and extracting second problem tickets for the second group signature and third problem tickets for the third group signature;
the computer performing a time-series analysis of the extracted second problem tickets and in response, expanding the group of problem tickets to include the second problem tickets;
the computer performing a time-series analysis of the extracted third problem tickets and in response, determining the extracted third problem tickets are not candidates to be added to the group of problem tickets; and
based on the group of problem tickets being expanded with the extracted second problem tickets, the computer determining the preventive action specified by the group signature prevents a root cause of the extracted second problem tickets from the second country.

6. The method of claim 1 , further comprising the step of the computer capturing in the interactions attributes of the historical problem tickets that are co-selected by a user in a user interface of the computer program to determine the root cause, wherein the step of determining the root cause is based in part on the co-selected attributes.

7. The method of claim 1 , further comprising the step of:
providing at least one support service for at least one of creating, integrating, hosting, maintaining, and deploying computer-readable program code in the computer, the program code being executed by a processor of the computer to implement the steps of extracting, receiving, monitoring and storing interactions, identifying, determining the pattern of actions, generating, determining the root cause, executing the script, and classifying and determining the new problem ticket.

8. A computer system comprising:
a central processing unit (CPU);
a memory coupled to the CPU of the computer system;
a computer-readable, tangible storage device coupled to the CPU of the computer system, the storage device containing instructions that, when carried out by the CPU via the memory, implement a method of identifying related problem tickets in an information technology (IT) environment, the method comprising the steps of:
the computer system determining that a pattern of actions is effective at proactively preventing a problem in the IT environment based on a frequency at which one or more users performed interactions with a computer program, the interactions:
including the pattern of actions,
including a performance of a text analysis of content of the plurality of historical problem tickets,
including a statistical analysis of the content of the plurality of historical problem tickets, and
causing a determination that a plurality of historical problem tickets includes a group of problem tickets which is related to the problem;
the computer system generating an executable script based on the pattern of actions;
based at least in part on the text analysis and the statistical analysis included in the interactions, the computer system determining a root cause of the problem;
in response to a receipt of a new problem ticket, the computer system executing the script, which automatically performs the

Assignees

• IBM

Inventors

• Bhamidipaty Anuradha
• Cheng Winnie Wing-Yee
• Heching Aliza R
• Jain Anshu N
• Liu Jia
• Moulic James R
• Rosu Daniela
• Smadi Mithkal M
• Tamilselvam Srikanth G

Classifications

• G06F3/04847

  Interaction techniques to control parameter settings, e.g. interaction with sliders or dials · CPC title

• H04L41/0631

  using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis · CPC title

• G06F11/0751

  Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06) · CPC title

• G06F11/079 Primary

  Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36) · CPC title

• H04L41/069

  using logs of notifications; Post-processing of notifications · CPC title