Event-Based Automated Diagnosis of Known Problems
First Claim
1. A system for determining a cause of an encountered problem occurring during operation of a computer system, comprising:
- a tracer configured to log events processed by the computer system preceding the encountered problem;
a preprocessor configured to create a representation of at least a portion of the events logged, wherein the creating of the representation includes sequentially aligning the events with occurrence of corresponding events included in a base sequence of events;
and a classifier configured to;
compare the representation with a plurality of stored representations, each of the stored representations signifying a plurality of events associated with a known cause of a catalogued problem; and
identify the cause of the encountered problem as the known cause associated with a similar stored representation for solving an identified problem found to be comparable with the representation.
1 Assignment
0 Petitions
Accused Products
Abstract
System events preceding occurrence of a problem are likely to be similar to events preceding occurrence of the same problem at other times or on other systems. Thus, the cause of a problem may be identified by comparing a trace of events preceding occurrence of the problem with previously diagnosed traces. Traces of events preceding occurrences of a problem arising from a known cause are reduced to a series of descriptive elements. These elements are aligned to correlate differently timed but otherwise similar traces of events, converted into symbolic representations, and archived. A trace of events leading to an undiagnosed a problem similarly is converted to a symbolic representation. The representation of the undiagnosed trace is then compared to the archived representations to identify a similar archived representation. The cause of the similar archived representation is presented as a diagnosis of the problem.
-
Citations
11 Claims
-
1. A system for determining a cause of an encountered problem occurring during operation of a computer system, comprising:
-
a tracer configured to log events processed by the computer system preceding the encountered problem;
a preprocessor configured to create a representation of at least a portion of the events logged, wherein the creating of the representation includes sequentially aligning the events with occurrence of corresponding events included in a base sequence of events;
and a classifier configured to;
compare the representation with a plurality of stored representations, each of the stored representations signifying a plurality of events associated with a known cause of a catalogued problem; and
identify the cause of the encountered problem as the known cause associated with a similar stored representation for solving an identified problem found to be comparable with the representation. - View Dependent Claims (2, 3, 4)
-
-
5. A system for determining a cause of an encountered problem occurring during operation of a computer system, comprising:
-
a diagnostic interface to receive identification of an encountered problem;
a tracer configured to log events processed by the computer system preceding the encountered problem;
a preprocessor configured to create a representation of at least a portion of the events logged;
wherein the creating of the representation includes;
sequentially aligning the events with occurrence of corresponding events included in a base sequence of events and generating a vector representing instances of correspondence and lack of correspondence of the aligned events with the base sequence;
and a classifier configured to;
compare the representation with a plurality of stored representations, each of the stored representations signifying a plurality of events associated with a known cause of a catalogued problem; and
identify the cause of the encountered problem as the known cause associated with a similar stored representation comparable with the representation. - View Dependent Claims (6, 7, 8, 9)
-
-
10. A computer-readable media comprising a tangible component of machine instructions that, when executed on one or more processors, perform the actions comprising:
-
developing an archive for diagnosing a cause of a problem;
identifying a plurality of causes for at least one known problem;
logging events processed by a processor preceding at least one occurrence of the known problem attributable to a known cause;
creating a representation of at least one occurrence of the logging events;
comparing the representation with a plurality of stored representations, wherein each of the stored representations signifying a plurality of events associated with a known cause of a catalogued problem; and
identifying the cause of the encountered problem as the known cause associated with a similar stored representation for solving an identified problem comparable with the representation. - View Dependent Claims (11)
-
Specification