Log-based diagnosis for declarative-deployed applications

• US 10,642,677 B2
• Filed: 11/02/2017
• Issued: 05/05/2020
• Est. Priority Date: 11/02/2017
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Chen, Peng Fei, Meng, Fan Jing, Xu, Jing Min, Yang, Lin
• Primary Examiner(s): Kudirka, Joseph R
• Application Number:
  US15/802,108
• Publication Number:
  US 20190129829A1
• Time in Patent Office: 915 Days
• Field of Search: 714 26, 714 37, 714 381
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/3604 Software analysis for verifying properties of programs byte-code verification G06F9/44589
• CPC Class Codes: G06N 20/10 using kernel methods, e.g. support vector machines [SVM]
• CPC Class Codes: G06N 20/20 Ensemble learning
• CPC Class Codes: G06N 3/045 Combinations of networks
• CPC Class Codes: G06N 5/01 Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound
• CPC Class Codes: G06N 5/048 Fuzzy inferencing
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks

Abstract

Techniques for log-based diagnosis for declarative-deployed applications can comprise: based on a labeled deployment declaration, classifying, by a device operatively coupled to a processor, a runtime log associated with an application, resulting in a classified runtime log. Techniques can also comprise: based on the classified runtime log, training, by the device, an aggregation model to represent a defined state of the application.

Claims

1. A system, comprising:

a memory that stores computer executable components; and

a processor that executes the computer executable components stored in the memory, wherein the computer executable components comprise;

a classification component that;

based on a labeled deployment declaration of an application, classifies a runtime log associated with the application, resulting in a classified runtime log; and

a training component that;

based on the classified runtime log, trains an aggregation model to represent a defined state of the application, wherein the runtime log is a first runtime log, wherein the deployment declaration is a first deployment declaration; and

;

a clustering component that;

based on a similarity between the first deployment declaration and a second deployment declaration, groups the first runtime log with a second runtime log.

2. The system of claim 1, wherein the computer executable components further comprise:

a comparison component that compares the aggregation model to a log sample to identify a root cause of a problem, wherein the problem is a configuration problem associated with the application.

3. The system of claim 2, wherein the application is a first application, wherein the problem is a first problem, and wherein the comparison component compares the first runtime log to a second runtime log associated with a second application based on a second problem the second application has been determined to have encountered.

4. The system of claim 2, wherein the application is a first application, and wherein the comparison component compares the first deployment declaration to a second deployment declaration associated with the aggregation model to generate root cause analysis data associated with a potential root cause of the problem experienced by a second application.

5. The system of claim 1, wherein the labeled deployment declaration comprises a token for use in classification of the runtime log.

6. The system of claim 5, wherein the classification of the runtime log comprises utilizing a Naï

ve Bayesian classifier to generate a deployment label.

7. A computer program product that facilitates log-based diagnosis for declarative-deployed applications, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to:

based on a labeled deployment declaration, classify a runtime log associated with the application, resulting in a classified runtime log; and

based on the classified runtime log, train an aggregation model to represent a defined state of the application, wherein the runtime log is a first runtime log, wherein the deployment declaration is a first deployment declaration; and

based on a similarity between the first deployment declaration and a second deployment declaration, group the first runtime log with a second runtime log.

8. The computer program product of claim 7, wherein the program instructions are further executable by the processor to cause the processor to:

compare the aggregation model to a log sample to identify a potential root cause of a problem, wherein the problem is a configuration problem associated with the application.

9. The computer program product of claim 8, wherein the application is a first application, and wherein the program instructions are further executable by the processor to cause the processor to:

compare the first runtime log to a second runtime log associated with a second application based on the problem the second application has been determined to have encountered.

10. The computer program product of claim 8, wherein the application is a first application, and wherein the program instructions are further executable by the processor to cause the processor to:

compare the first deployment declaration to a second deployment declaration associated with the aggregation model to generate root cause analysis data associated with the potential root cause of the problem experienced by a second application.

11. The computer program product of claim 8, wherein the program instructions are further executable by the processor to cause the processor to:

store the runtime log and an operation log associated with the application in a database for access by a comparison component.

12. The computer program product of claim 7, wherein the labeled deployment declaration comprises a token for use in classifying the runtime log.

13. A computer-implemented method, comprising:

based on a labeled deployment declaration, classifying, by a device operatively coupled to a processor, a runtime log associated with an application, resulting in a classified runtime log;

based on the classified runtime log, training, by the device, an aggregation model to represent a defined state of the application, wherein the runtime log is a first runtime log, wherein the deployment declaration is a first deployment declaration; and

based on a similarity between the first deployment declaration and a second deployment declaration, grouping, by the device, the first runtime log with a second runtime log.

14. The computer-implemented method of claim 13, further comprising:

comparing, by the device, the aggregation model to a log sample to identify a potential root cause of a problem, wherein the problem is a configuration problem associated with the application.

15. The computer-implemented method of claim 14, wherein the application is a first application, wherein the runtime log is a first runtime log, and further comprising:

comparing, by the device, the first runtime log to a second runtime log associated with a second application based on the problem the second application has been determined to have encountered.

16. The computer-implemented method of claim 14, wherein the application is a first application, and further comprising:

comparing, by the device, the first deployment declaration to a second deployment declaration associated with the aggregation model to generate root cause analysis data associated with the potential root cause of the problem experienced by a second application.

17. The computer-implemented method of claim 13, wherein the application is a first application, and further comprising:

comparing, by the device, the first deployment declaration to a second deployment declaration associated with the aggregation model to generate root cause analysis data associated with a potential root cause of a problem experienced by a second application.