Method for first pass filtering of anomalies and providing a base confidence level for resource usage prediction in a utility computing environment

• US 20060025950A1
• Filed: 07/29/2004
• Published: 02/02/2006
• Est. Priority Date: 07/29/2004
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Childress, Rhonda L., Gasca, Miguel E. Jr., Tittizer, Abigail A., Pagan, Elfred
• Granted Patent: US 7,409,314 B2
• Time in Patent Office: Days
• US Class Current: 702/92
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 2201/81 Threshold
• CPC Class Codes: G06F 2201/86 Event-based monitoring

Abstract

Provided is a method for monitoring resources in a utility computing environment (UCE). Measurements are evaluated to determine whether or not a particular resource requires remedial or other type of action. A sliding measurement window is employed to assemble a number of measurements corresponding to a particular resource. The number of intervals in a sliding measurement window is based upon best practices corresponding to the resource being measured and analyzed. A first threshold-crossing event and subsequent events are stored until the window is full, or closed. When the window is closed, the threshold-crossing measurements are analyzed to determine whether or not there exists an issue with the resource that requires action. Once a window has been closed and analyzed, the first threshold-crossing event and each subsequent event up to a second threshold-crossing event are discarded and the window reopens.

Claims

1. A method of detecting resource events in a utility computing environment, the method comprising:

periodically retrieving a measurement corresponding to a resource;

defining a threshold for the resource measurement;

detecting a first measurement that crosses the threshold;

storing in a memory the first measurement and an indicator of threshold crossing;

for a predetermined number of periods, periodically retrieving subsequent measurements corresponding to the resource and storing in the memory the measurements and corresponding indicators of whether or not the subsequent measurements cross the threshold;

signaling a resource event if the number of stored threshold crossing measurements exceed a second threshold after said predetermined number of periods.

2. The method of claim 1, further comprising investigating the functionality of the resource if a resource event is signaled.

3. The method of claim 1, further comprising generating a report on the first and subsequent measurements and the resource if a resource event is signaled.

4. The method of claim 1, further comprising,

discarding the first measurement and corresponding indicator and each subsequent measurement and corresponding indicator preceding a second measurement in which the threshold was crossed;

and

continuing the periodic retrieving, storing and signaling.

5. The method of claim 1, further comprising,

determining, after the predetermined number of periods, whether or not only one threshold crossing measurement is stored;

discarding all the measurements and corresponding indicators if only one threshold crossing measurement is stored;

continuing the periodically retrieving and detecting; and

continuing the storing of measurements and indicators once a measurement crosses the first threshold.

6. The method of claim 1, further comprising:

storing in a memory a plurality of durations attributes, each duration attribute based upon a measurement and a corresponding indicator, each attribute indicating whether or not both the corresponding measurement crossed the threshold and a predefined percent of a predefined number of immediately preceding measurements crossed the threshold.

7. The method of claim 6, wherein the score is calculated based upon the duration attributes.

8. A system for evaluating resources coupled to a computing system, comprising:

a polling interval corresponding to a resource;

a predefined number of time intervals, each time interval corresponding to the polling interval;

a threshold corresponding to a measurement associated with the resource;

logic for storing in a memory a first threshold-crossing measurement and corresponding evaluation indicating the measurement crosses the threshold;

logic for storing in the memory a plurality of measurements and corresponding evaluations subsequent to the first measurement, each evaluation corresponding to whether or not the corresponding measurement crosses the threshold;

logic for determining when a total number of measurements, wherein the total number of measurements includes the first and subsequent measurements, equals the predefined number of time intervals; and

logic for calculating, once the total number of measurements equals the predefined number of time intervals, a score corresponding to the number of total measurements that cross the threshold.

9. The system of claim 8, further comprising logic for investigating the functionality of the resource if the score exceeds a predetermined value.

10. The system of claim 8, further comprising logic for generating a report on the measurements and the resource if the score exceeds a predetermined value.

11. The system of claim 8, further comprising,

logic for discarding the first measurement and corresponding evaluation and each measurement of the plurality of measurements and corresponding evaluations preceding a first subsequent measurement in which the evaluation indicates the threshold was crossed,

wherein all measurements and corresponding evaluations are discarded if there is no first subsequent measurement in which the evaluation indicates the threshold was crossed.

12. The system of claim 8, further comprising a plurality of durations attributes, each duration attribute corresponding to a measurement and a corresponding evaluation and indicating whether or not both the evaluation crossed the threshold and a predefined number of immediately preceding number of evaluations crossed the threshold.

13. The system of claim 12, further comprising logic for calculating a plurality of duration attributes.

14. A computer programming product for evaluating resources coupled to a computing system, comprising:

a memory;

a polling interval, stored on the memory, corresponding to a resource coupled to a computing system;

a predefined number of time intervals, stored on the memory, each time interval corresponding to the polling interval;

a threshold, stored on the memory, corresponding to a measurement associated with the resource;

a first threshold-crossing measurement and corresponding evaluation indicating that the first measurement crosses the threshold;

both measurement and evaluation stored on the memory;

a plurality of measurements and corresponding evaluations subsequent to the first measurement, stored on the memory, each evaluation corresponding to whether or not the corresponding measurement crosses the threshold;

logic, stored on the memory, for determining when a total number of measurements, wherein the total number of measurements includes the first and subsequent measurements, equals the predefined number of time intervals; and

logic, stored on the memory, for calculating, once the total number of measurements equals the predefined number of time intervals, a score corresponding to the number of measurements that cross the threshold.

15. The computer programming product of claim 14, further comprising logic, stored on the memory, for investigating the functionality of the resource if the score exceeds a predetermined value.

16. The computer programming product of claim 14, further comprising logic, stored on the memory, for generating a report on the measurements and the resource if the score exceeds a predetermined value.

17. The computer programming product of claim 14, further comprising logic, stored on the memory, for discarding the first measurement and corresponding evaluation and each measurement and corresponding evaluation preceding a second measurement in which the evaluation indicates the threshold was crossed,

wherein, if there is no first subsequent measurement in which the corresponding evaluation indicates the threshold was crossed, all measurements and corresponding evaluations are discarded.

18. The computer programming product of claim 14, further comprising a plurality of duration attributes, stored on the memory, each measurement and corresponding evaluation and indicating whether or not both the evaluation crossed the threshold and a predefined percent of immediately preceding evaluations crossed the threshold.

19. The computer programming product of claim 18, further comprising logic, stored on the memory, for discarding all the duration attributes.

20. The computer programming product of claim 18, wherein the score is calculated based upon the evaluation and the duration attributes.