Automatic classification of event data

• US 20050066236A1
• Filed: 06/30/2004
• Published: 03/24/2005
• Est. Priority Date: 05/24/2001
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Reus, Edward, Goeller, Sunni K.
• Granted Patent: US 7,237,137 B2
• Time in Patent Office: Days
• US Class Current: 714/39
• CPC Class Codes: G06F 11/0748 in a remote unit communicating with a single-box computer node experiencing an error/fault remote testing G06F11/2294
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3072 where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
• CPC Class Codes: G06F 11/3089 Monitoring arrangements determined by the means or processing involved in sensing the monitored data, e.g. interfaces, connectors, sensors, probes, agents software debugging using additional hardware using a specific debug interface G06F11/3656; performance evaluation by tracing or monitoring G06F11/3466
• CPC Class Codes: G06F 11/3452 Performance evaluation by statistical analysis
• CPC Class Codes: G06F 2201/86 Event-based monitoring

Abstract

A method and computer-readable medium for providing electronic support and assistance from a server to a client are disclosed. An agent residing on the client monitors events requiring support, such as faults and error messages. When an event requiring support occurs, the client agent collects data associated with the event, formulates a message, and transmits the message to the server. The server applies the event data to support vector machines that classify the data into categories and produce probability scores for each category. Category probability scores that exceed a threshold value cause the server to formulate and transmit a response containing category-specific resolution information to the client. When no matching categories are identified, the response so indicates. After receiving the response, the client automatically provides support to resolve the event.

Claims

1. A method of providing electronic support from a server to a client comprising:

at the client;

(a) monitoring the client for events requiring support;

(b) upon the occurrence of an event requiring support, obtaining user authority to transmit data associated with the event requiring support to the server;

(c) gathering data associated with the event requiring support;

(d) generating a message containing the event data; and

(e) transmitting the message to the server;

at the server;

(f) receiving the event data from the client;

(g) extracting the event data from the message;

(h) applying the event data to support vector machines to obtain probability scores;

(i) using the probability scores to identify which, if any, categories are probable causes of the event requiring support;

(j) formulating a response containing resolution information based on the category or categories, if any, that were identified as probable causes of the event requiring support; and

(k) transmitting the response to the client; and

at the client;

(l) receiving the response formulated by the server; and

(m) providing support based on the response from the server.

2. The method of claim 1, wherein the events requiring support are selected from the group of events consisting of:

(a) an error message,

(b) a kernel mode fault,

(c) a device error,

(d) a user mode application fault,

(e) an application incompatibility,

(f) an access denied to file/share/directory,

(g) a spontaneous reboot,

(h) an abnormal shutdown,

(i) a logon failure,

(j) a hung application,

(k) low resources,

(l) a defragmentation error,

(m) a disk check error,

(n) an application installation failure, and

(o) low disk space.

3. The method of claim 1, wherein a category is identified as a probable cause of the event requiring support when the probability score of the category is above a threshold value.

4. The method of claim 1, wherein obtaining user authority to transmit data associated with the event requiring support further includes obtaining user authority to apply the support automatically.

5. The method of claim 1, wherein the response includes user-understandable instructions.

6. The method of claim 1, wherein the response includes a software update.

7. The method of claim 1, wherein the response includes a change to the system settings.

8. The method of claim 1, wherein the support is applied automatically when authorized by the user.

9. A computer-readable medium containing computer-readable instructions that, when executed by a computer, perform the method of claim 1.

10. A method of providing electronic support from a server to a client comprising at the client:

(a) monitoring the client for events requiring support;

(b) upon the occurrence of an event requiring support, obtaining user authority to transmit data associated with the event requiring support to the server,

(c) gathering data associated with the event requiring support;

(d) generating a message containing the event data;

(e) transmitting the message to the server;

(f) receiving a response formulated by a server responding to the event data transmitted to the server; and

(g) providing support based on the response.

11. The method of claim 10, wherein the events requiring support are selected from the group of events consisting:

(a) an error message,

(b) a kernel mode fault,

(c) a device error,

(d) a user mode application fault,

(e) an application compatibility issue,

(f) an access denied to file/share/directory,

(g) a spontaneous reboot,

(h) an abnormal shutdown,

(i) a logon failure,

(j) a hung application,

(k) low resources,

(l) a defragmentation error,

(m) a disk check error,

(n) an application installation failure, and

(o) low disk space.

12. A computer-readable medium containing computer-readable instructions that, when executed by a computer, perform the method of claim 11.

13. The method of claim 10, wherein the support includes user-understandable instructions.

14. A computer-readable medium containing computer-readable instructions that, when executed by a computer, perform the method of claim 13.

15. The method of claim 10, wherein the support includes a software update.

16. A computer-readable medium containing computer-readable instructions that, when executed by a computer, perform the method of claim 15.

17. The method of claim 10, wherein the support includes a change to the system settings.

18. A computer-readable medium containing computer-readable instructions that, when executed by a computer, perform the method of claim 17.

19. The method of claim 10, wherein the response includes instructions directing the user to an address of a resource on the Internet.

20. The method of claim 10, wherein the support provided is prioritized in order of highest to lowest probability of causing the event requiring support.

21. The method of claim 10, wherein the support is provided using a video display device at the client.

22. The method of claim 10, wherein the response is received by electronic mail.

23. The method of claim 10, wherein obtaining user authority to transmit data associated with the event requiring support further includes obtaining user authority to apply the support automatically.

24. A computer-readable medium containing computer-readable instructions that, when executed by a computer, perform the method of claim 23.

25. The method of claim 10, wherein the support is applied automatically when authorized by the user.

26. A computer-readable medium containing computer-readable instructions that, when executed by a computer, perform the method of claim 10.

27. A method of providing electronic support from a server to a client machine comprising at the server:

(a) receiving the message from the client containing event data;

(b) extracting the event data from the message;

(c) applying the event data to support vector machines to obtain probability scores;

(d) using the probability scores to identify which, if any, categories are probable causes of the event data received from the client;

(e) formulating a response containing resolution information based on the category or categories, if any, that were identified as probable causes of the event data received from the client; and

(f) sending the response to the client.

28. The method of claim 27, wherein a category is identified as a probable cause of the event requiring support when the probability score of the category is above a threshold value.

29. A computer-readable medium containing computer-readable instructions that, when executed by a computer, perform the method of claim 28.

30. The method of claim 27, wherein a category is identified as a probable cause of the event requiring support when the probability score of the category is above one of a plurality of threshold values.

31. A computer-readable medium containing computer-readable instructions that, when executed by a computer, perform the method of claim 30.

32. The method of claim 27, wherein formulating the response includes prioritizing categories in order of highest to lowest probability of causing the event requiring support.

33. A computer-readable medium containing computer-readable instructions that, when executed by a computer, perform the method of claim 32.

34. The method of claim 27, wherein the event data is related to an event selected from the group of events consisting:

(a) an error message,

(b) a kernel mode fault,

(c) a device error,

(d) a user mode application fault,

(e) an application compatibility issue,

(f) an access denied to file/share/directory,

(g) a spontaneous reboot,

(h) an abnormal shutdown,

(i) a logon failure,

(j) a hung application,

(k) low resources,

(l) a defragmentation error,

(m) a disk check error,

(n) an application installation failure, and

(o) low disk space.

35. The method of claim 27, wherein the response includes user-understandable instructions.

36. The method of claim 27, wherein the response includes a software update.

37. The method of claim 27, wherein the response includes a change to the system settings.

38. The method of claim 27, wherein the response is transmitted by electronic mail.

39. The method of claim 27, wherein the response includes instructions directing the user to an address of a resource on the Internet.

40. A computer-readable medium containing computer-readable instructions that, when executed by a computer, perform the method of claim 27.