Programmatic computer problem diagnosis and resolution and automated reporting and updating of the same

• US 20040225381A1
• Filed: 08/30/2003
• Published: 11/11/2004
• Est. Priority Date: 05/07/2003
• Status: Active Grant

• Current Assignee: Rovi Technologies Corporation (Adeia Inc.)
• Original Assignee: Microsoft Corporation
• Inventors: Pang, Jee Fung, Judge, Nicholas Stephen, Smith, Jonathan Vines, Ritz, Andrew, Fortin, Michael Richard
• Granted Patent: US 7,263,632 B2
• Time in Patent Office: Days
• US Class Current: 700/26
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0781 Error filtering or prioritizing based on a policy defined by the user or on a policy defined by a hardware/software module, e.g. according to a severity level
• CPC Class Codes: G06F 11/0784 Routing of error reports, e.g. with a specific transmission path or data flow
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40

Abstract

Programmatically diagnosing the root cause of a problem in a computing system. Events are monitored within an operating system, and at least a subset of the events are logged to a log file. In response to the detection of error condition(s), a diagnostics module is invoked. The diagnostics module queries the log file to correlate events relevant to diagnosis of the problem, and identifies the root cause by evaluating the results of the query. Once the root cause of the problem is diagnosed, a resolution module corresponding to that root cause may be invoked to programmatically resolve the problem. The invocation of the diagnostic and resolution modules may be subject to policy rules. Furthermore, the logging, diagnostics and resolution modules may be automatically updated as needed.

Claims

1. In a computing system that executes an operating system, a method for programmatically diagnosing the root cause of a problem in the computing system, the method comprising the following:

an act of generating events within an operating system;

an act of logging at least a subset of the events to a log file;

an act of detecting one or more error conditions;

an act of invoking a diagnostic module in response to the act of detecting one or more error conditions, wherein the diagnostic module is configured to do the following when invoked;

an act of querying the log file to correlate events relevant to diagnosis of the problem evidenced by the one or more error conditions;

an act of evaluating the results of the query; and

an act of identifying the root cause of the one or more error conditions in response to the evaluation.

2. A method in accordance with claim 1, further comprising the following after the act of detecting one or more error conditions:

an act of consulting rules to determine that the diagnostic module should be invoked according to the rules.

3. A method in accordance with claim 2, further comprising the following:

an act of receiving user input to set the rules.

4. A method in accordance with claim 1, further comprising the following:

an act of sending at least a subset of the results of the query to an error reporting service.

5. A method in accordance with claim 4, further comprising the following:

an act of receiving one or more updates, wherein the updates modify which events are logged.

6. A method in accordance with claim 5, wherein the updates further alter how the diagnostic module diagnoses.

7. A method in accordance with claim 4, further comprising the following:

an act of receiving one or more updates, wherein the updates alter how the diagnostics module diagnoses.

8. A method in accordance with claim 1, further comprising the following:

an act of invoking a resolution module in response to the act of identifying the root cause of the one or more error conditions, the resolution module configured to do the following when invoked;

an act of resolving the root cause of the one or more error conditions.

9. A method in accordance with claim 8, further comprising the following after the act of detecting one or more error conditions:

an act of consulting rules to determine that the resolution module should be invoked according to the rules.

10. A method in accordance with claim 9, further comprising the following:

an act of receiving user input to set the rules.

11. A method in accordance with claim 8, further comprising the following:

an act of sending at least a subset of the results of the query to an error reporting service.

12. A method in accordance with claim 11, further comprising the following:

an act of receiving one or more updates, wherein the updates modify which events are logged.

13. A method in accordance with claim 12, wherein the updates further alter how the diagnostic module diagnoses.

14. A method in accordance with claim 13, wherein the updates further alter how the resolution module resolves.

15. A method in accordance with claim 11, wherein the updates alter how the diagnostic module diagnoses.

16. A method in accordance with claim 15, wherein the updates further alter how the resolution module resolves.

17. A method in accordance with claim 11, wherein the updates alter how the resolution module resolves.

18. A method in accordance with claim 17, wherein the updates further alter which events are logged.

19. A method in accordance with claim 4, further comprising the following:

an act of receiving one or more updates, wherein the updates alter how the diagnostics module diagnoses.

20. A method in accordance with claim 1, further comprising the following:

an act of determining that the root cause of the one or more error conditions cannot be programmatically resolved; and

an act of engaging a user interface module to prompt the user to enter additional information to be used by the diagnostic or resolution module to attempt to identify or resolve the problem.

21. A method in accordance with claim 1, wherein the user interface module is a trouble shooting wizard.

27. A computer program product in accordance with claim 21, wherein the one or more computer-readable media further having thereon computer-executable instructions that, when executed by the one or more processors, cause the computing system to performing the following:

an act of determining that the root cause of the one or more error conditions cannot be programmatically resolved; and

an act of engaging a user interface module to prompt the user to enter additional information to be used by the resolution module to attempt to identify or resolve the problem.

22. A computer program product for use in a computing system that executes an operating system, the computer program product for implementing a method for programmatically diagnosing the root cause of a problem in the computing system, the computer program product comprising one or more computer-readable media having thereon computer-executable instructions that, when executed by one or more processors of the computing system, cause the computing system to perform the following:

an act of generating events within an operating system;

an act of logging at least a subset of the events to a log file;

an act of detecting one or more error conditions;

an act of invoking a diagnostic module in response to the act of detecting one or more error conditions, wherein the diagnostic module is configured to do the following when invoked;

an act of querying the log file to correlate events relevant to diagnosis of the problem evidenced by the one or more error conditions; and

an act of evaluating the results of the query; and

identifying the root cause of the one or more error conditions in response to the evaluation.

23. A computer program product in accordance with claim 22, wherein the one or more computer-readable media are physical memory media.

24. A computer program product in accordance with claim 22, wherein the one or more computer-readable media further having thereon computer-executable instructions that, when executed by the one or more processors, cause the computing system to performing the following:

an act of sending at least a subset of the results of the query to an error reporting service; and

an act of receiving one or more updates that modify which events are logged or alters how the diagnostic module diagnoses.

25. A computer program product in accordance with claim 22, wherein the one or more computer-readable media further having thereon computer-executable instructions that, when executed by the one or more processors, cause the computing system to performing the following:

an act of invoking a resolution module in response to the act of identifying the root cause of the one or more error conditions, the resolution module configured resolving the root cause of the one or more error conditions when invoked.

26. A computer program product in accordance with claim 22, wherein the one or more computer-readable media further having thereon computer-executable instructions that, when executed by the one or more processors, cause the computing system to performing the following:

an act of sending at least a subset of the results of the query to an error reporting service; and

an act of receiving one or more updates that modify which events are logged, alters how the diagnostic module diagnoses, or alters how the resolution module resolves.

28. In a computing system that executes an operating system, a method for programmatically diagnosing the root cause of a problem in the computing system, the method comprising the following:

an act of generating events within an operating system;

an act of logging at least a subset of the events to a log file;

an act of detecting one or more error conditions; and

a step for programmatically diagnosing a problem evidenced by the one or more error conditions.

29. A method in accordance with claim 28, wherein the step for programmatically diagnosing a problem evidenced by the one or more error conditions comprises the following:

an act of invoking a diagnostic module in response to the act of detecting one or more error conditions, wherein the diagnostic module is configured to do the following when invoked;

an act of querying the log file to correlate events relevant to diagnosis of the problem evidenced by the one or more error conditions; and

an act of evaluating the results of the query; and

an act of identifying the root cause of the one or more error conditions in response to the evaluation.

30. A computer-readable media having thereon computer-executable instructions that, when executed by one or more processors of a computing system, cause the computing system to instantiate in memory the following:

an event logger configured to log events in a log file;

a problem detection module configured to detect a problem when one or more error conditions occur, and configured to cause a resolution module to be invoked in at least some circumstances when the problem is detected; and

a diagnosis module configured to query the log file, evaluate the results of the query, and diagnose the problem based on the evaluation.

31. A computer-readable media in accordance with claim 30, further having thereon computer-executable instructions that, when executed by the one or more processors cause the computing system to further instantiate in memory the following:

a monitoring module that maintains rules regarding when the diagnosis module should be invoked, wherein the monitoring module causes the diagnosis module to be invoked in response to the problem detection module detecting the problem if the rules so permit.

32. A computer-readable media in accordance with claim 30, further having thereon computer-executable instructions that, when executed by the one or more processors cause the computing system to further instantiate in memory the following:

a resolution module configured to resolve the problem when invoked, wherein the diagnosis module is further configured to cause the resolution module to be invoked in at least some circumstances when the diagnosis module diagnoses the problem.

33. A computer-readable media in accordance with claim 32, further having thereon computer-executable instructions that, when executed by the one or more processors cause the computing system to further instantiate in memory the following:

a monitoring module that maintains rules regarding when the resolution module should be invoked, wherein the monitoring module causes the resolution module to be invoked in response to the diagnosis module diagnosing the problem if the rules so permit.

34. In a computing system that executes an operating system and that is network connected to an error reporting service, a method for determining the root cause of a problem in the computing system, the method comprising the following:

an act of generating events within an operating system;

an act of logging at least a subset of the events to a log file;

an act of detecting one or more error conditions, and in response thereto;

an act of querying the log file to correlate relevant events,

an act of sending at least a subset of the results of the query to an error reporting service; and

an act of receiving one or more updates, wherein the updates modify which events are logged, what diagnostic steps are to be taken, or what resolution steps are taken by the computer system'"'"'s operating system or recommended to the end user.

35. A computer program product for use in a computing system that executes an operating system and that is network connected to an error reporting service, the computer program product for implementing a method for determining the root cause of a problem in the computing system, the computer program product comprising one or more computer-readable media having thereon computer-executable instructions that, when executed by one or more processors of the computing system, cause the computing system to perform the following:

an act of generating events within an operating system;

an act of logging at least a subset of the events to a log file;

an act of detecting one or more error conditions, and in response thereto;

an act of querying the log file to correlate relevant events,

an act of sending at least a subset of the results of the query to an error reporting service; and

an act of receiving one or more updates, wherein the updates modify which events are logged, what diagnostic steps are to be taken, or what resolution steps are taken by the computer.