Method and apparatus for automating the root cause analysis of system failures

• US 20050210331A1
• Filed: 03/19/2004
• Published: 09/22/2005
• Est. Priority Date: 03/19/2004
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Connelly, Jon Christopher, Loy, Eric William
• Granted Patent: US 7,516,362 B2
• Time in Patent Office: Days
• US Class Current: 714/26
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0748 in a remote unit communicating with a single-box computer node experiencing an error/fault remote testing G06F11/2294
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 43/0805 by checking availability
• CPC Class Codes: H04L 69/40 for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06

Abstract

A method for analyzing the root cause of system failures on one or more computers. An event is generated when a computer system detects a system failure. The cause of the failure is determined. The event, including the cause is transmitted from the computer system to a central repository. And the system failure is analyzed in the central repository.

Claims

1. A method for analyzing the root cause of system failures on one or more computers, comprising:

generating an event when a computer system detects a system failure;

determining the cause of the system failure;

transmitting the event, including the determined cause, from the computer system to a central repository; and

analyzing the system failure event in the central repository.

2. The method of claim 1, further comprising:

re-transmitting the event if a receipt confirmation message is not received from the central repository.

3. The method of claim 1, further comprising:

storing the event in a local repository located on the computer system.

4. The method of claim 1, further comprising:

holding the event in a queue if a receipt confirmation message is not received from the central repository; and

re-transmitting the events in the queue after a period of time.

5. The method of claim 1, further comprising:

determining if the system failure was due to a hardware problem by analyzing a file log.

6. The method of claim 1, further comprising:

determining if the system failure was due to a software problem by analyzing system core files.

7. The method of claim 2, further comprising:

assigning a sequence number to each event generated;

receiving a status request from the central repository; and

synchronizing the local repository and the central repository if the sequence number does not match the expected sequence number.

8. The method of claim 6, wherein the synchronizing step further comprises:

transmitting missing events in the central repository from the computer system.

9. The method of claim 8, wherein the synchronizing step further comprises:

transmitting missing events in the local repository from the central repository.

10. The method of claim 6, wherein the synchronizing step further comprises:

discarding events that have already been received.

11. The method of claim 1, further comprising,

retransmitting the information stored in the central repository to another computer system for further analysis.

12. An apparatus for analyzing the root cause of system failures on one or more computers, comprising:

a network;

a local support computer coupled to said network; and

a computer system coupled to the network, said computer system programmed to monitor itself and another computer system for system failures, to determine the cause of the system failure, and to transmit system failure events to said local support computer.

13. An apparatus of claim 12, further comprising:

the local support computer programmed to collect and analyze the system failure information.

14. An apparatus of claim 12, further comprising:

the computer system programmed to re-transmit the event if a receipt confirmation message is not received from the local support computer.

15. An apparatus of claim 12, further comprising:

the computer system programmed to store the event in a local repository located on the computer system.

16. An apparatus of claim 12, further comprising:

the computer system programmed to hold the event in a queue if a receipt confirmation message is not received from the central repository, and to re-transmit the events in the queue after a period of time.

17. An apparatus of claim 12, further comprising:

the computer system programmed to determine if the system failure was due to a hardware problem by analyzing a file log.

18. An apparatus of claim 12, further comprising:

the computer system programmed to determine if the system failure was due to a software problem by analyzing system core files.

19. An apparatus of claim 14, further comprising:

the computer system programmed to assign a sequence number to each event generated;

the local support computer programmed to send a status request to the computer system, and to synchronize the local repository with the local support computer if the sequence number does not match the expected sequence number.

20. An apparatus of claim 12, further comprising:

a remote support computer connectable to the local support computer for receiving system failure data from said local support computer.

21. A means for analyzing the root cause of system failures on one or more computers, comprising:

a means for transmitting data from one computer to another,

a local support computer coupled to said means for transmitting data,

a computer system coupled to said means for transmitting data,

a means for said computer system to monitor itself or another computer system for system failures and determining the causes of said failures,

a means for transmitting the causes of said failures to the local support computer, 22. A means for analyzing the root cause of system failures on one or more computers, of claim 21, further comprising;

a remote support computer,

a means for transmitting system failure information from the local support computer to the remote support computer.