Generating problem signatures from snapshots of time series data

Patent metadata

Field	Value
Publication number	US-9632859-B2
Application number	US-201514736514-A
Country	US
Kind code	B2
Filing date	Jun 11, 2015
Priority date	Jun 11, 2015
Publication date	Apr 25, 2017
Grant date	Apr 25, 2017

Abstract

Software that generates statistical models of events impacting computer systems and uses those models to detect similar events in the future. The software performs the following operations: (i) receiving a snapshot of a first event impacting a computer system, where the snapshot includes a first set of values for a plurality of metrics occurring over a first time period corresponding to the first event; (ii) extracting a first set of feature vectors from the first set of values; (iii) generating a first statistical model representing the first event based, at least in part, on the extracted first set of feature vectors; and (iv) determining that a second event is similar to the first event by comparing the first statistical model to a second set of values for the plurality of metrics occurring over a second time period corresponding to the second event.

First claim

What is claimed is:

1. A method comprising:
receiving, by one or more processors, a snapshot of a first event impacting a computer system, where the snapshot includes a first set of values for a plurality of metrics occurring over a first time period corresponding to the first event;
extracting, by one or more processors, a first set of feature vectors from the first set of values for the plurality of metrics occurring over the first time period;
generating, by one or more processors, a first statistical model representing the first event based, at least in part, on the extracted first set of feature vectors; and
determining, by one or more processors, that a second event is similar to the first event by comparing the first statistical model to a second set of values for the plurality of metrics occurring over a second time period corresponding to the second event.

2. The method of claim 1 , wherein the plurality of metrics and the first time period for the snapshot are selected by a human user.

3. The method of claim 1 , further comprising:
generating, by one or more processors, a second statistical model representing the second event based, at least in part, on the second set of values;
wherein determining that the second event is similar to the first event by comparing the first statistical model to the second set of values includes comparing the first statistical model to the second statistical model.

4. The method of claim 3 , wherein comparing the first statistical model to the second statistical model includes calculating a Kullback-Leibler distance.

5. The method of claim 1 , wherein determining that the second event is similar to the first event by comparing the first statistical model to the second set of values comprises:
generating, by one or more processors, a similarity score for the second set of values, wherein the similarity score represents an amount of likelihood that the second set of values could result from the first statistical model;
determining, by one or more processors, that the similarity score for the second set of values is above a predetermined threshold; and
responsive to determining that the similarity score for the second set of values is above the predetermined threshold, determining, by one or more processors, that the second event is similar to the first event.

6. The method of claim 1 , wherein the comparing of the first statistical model to the second set of values utilizes a distance metric.

7. The method claim 1 , further comprising:
informing a user, by one or more processors, that an event similar to the first event has occurred.

8. A computer program product comprising a computer readable storage medium, wherein the computer readable storage medium is not a transitory signal per se, the computer readable storage medium having stored thereon:
first program instructions programmed to receive a snapshot of a first event impacting a computer system, where the snapshot includes a first set of values for a plurality of metrics occurring over a first time period corresponding to the first event;
second program instructions programmed to extract a first set of feature vectors from the first set of values for the plurality of metrics occurring over the first time period;
third program instructions programmed to generate a first statistical model representing the first event based, at least in part, on the extracted first set of feature vectors; and
fourth program instructions programmed to determine that a second event is similar to the first event by comparing the first statistical model to a second set of values for the plurality of metrics occurring over a second time period corresponding to the second event.

9. The computer program product of claim 8 , wherein the plurality of metrics and the first time period for the snapshot are selected by a human user.

10. The computer program product of claim 8 , further comprising:
fifth program instructions programmed to generate a second statistical model representing the second event based, at least in part, on the second set of values;
wherein determining that the second event is similar to the first event by comparing the first statistical model to the second set of values includes comparing the first statistical model to the second statistical model.

11. The computer program product of claim 10 , wherein comparing the first statistical model to the second statistical model includes calculating a Kullback-Leibler distance.

12. The computer program product of claim 8 , wherein determining that the second event is similar to the first event by comparing the first statistical model to the second set of values comprises:
generating, by one or more processors, a similarity score for the second set of values, wherein the similarity score represents an amount of likelihood that the second set of values could result from the first statistical model;
determining, by one or more processors, that the similarity score for the second set of values is above a predetermined threshold; and
responsive to determining that the similarity score for the second set of values is above the predetermined threshold, determining, by one or more processors, that the second event is similar to the first event.

13. The computer program product of claim 8 , wherein the comparing of the first statistical model to the second set of values utilizes a distance metric.

14. The computer program product of claim 8 , further comprising:
fifth program instructions programmed to inform a user that an event similar to the first event has occurred.

15. A computer system comprising:
a processor(s) set; and
a computer readable storage medium;
wherein:
the processor set is structured, located, connected and/or programmed to run program instructions stored on the computer readable storage medium; and
the program instructions include:
first program instructions programmed to receive a snapshot of a first event impacting a computer system, where the snapshot includes a first set of values for a plurality of metrics occurring over a first time period corresponding to the first event;
second program instructions programmed to extract a first set of feature vectors from the first set of values for the plurality of metrics occurring over the first time period;
third program instructions programmed to generate a first statistical model representing the first event based, at least in part, on the extracted first set of feature vectors; and
fourth program instructions programmed to determine that a second event is similar to the first event by comparing the first statistical model to a second set of values for the plurality of metrics occurring over a second time period corresponding to the second event.

16. The computer system of claim 15 , wherein the plurality of metrics and the first time period for the snapshot are selected by a human user.

17. The computer system of claim 15 , wherein the program instructions further include:
fifth program instructions programmed to generate a second statistical model representing the second event based, at least in part, on the second set of values;
wherein determining that the second event is similar to the first event by comparing the first statistical model to the second set of values includes comparing the first statistical model to the second statistical model.

18. The computer system of claim 17 , wherein comparing the first statistical model to the second statistical model includes calculating a Kullback-Leibler distance.

Assignees

• IBM

Inventors

• Brew Anthony T
• Horgan Donagh S
• Nestor Louise K
• Thai Vinh Tuan

Classifications

• G06F11/3495

  for systems · CPC title

• G06F11/3452

  Performance evaluation by statistical analysis · CPC title

• G06F11/3006

  where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50) · CPC title

• G06F11/3447

  Performance evaluation by modeling · CPC title

• G06F11/076

  by exceeding a count or rate limit, e.g. word- or bit count limit · CPC title