Methods and systems to detect business disruptions, determine potential causes of those business disruptions, or both

• US 20070168915A1
• Filed: 11/15/2005
• Published: 07/19/2007
• Est. Priority Date: 11/15/2005
• Status: Abandoned Application

• Current Assignee: Cesura, Inc.
• Original Assignee: Cesura, Inc.
• Inventors: Rousselle, Philip, Smith, Timothy, Williams, Scott, Fabbio, Robert, Immel, Chris
• Application Number:
  US11/274,636
• Publication Number:
  US 20070168915A1
• Time in Patent Office: Days
• US Class Current: 717/101
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/0757 by exceeding a time limit, i.e. time-out, e.g. watchdogs
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36

Abstract

Multivariate analysis can be performed to determine whether a computing environment is encountering a business disruption (e.g., relatively long end-user response times) or other problem. Cluster analysis (comparing more recent data with a particular cluster of good operating data), predictive modeling, or other suitable multivariate analysis can be used. A probable cause analysis may be performed in conjunction with the multivariate analysis. A probable cause analysis may be used when one or more abnormal instruments, abnormal components, abnormal load patterns, suspicious actions (such as resource provisioning or deprovisioning activities), software or hardware updates or failures, recent changes to the computing environment (component provisioning, change of a control, etc.), or any combination thereof. The probable cause analysis can include ranking potential causes based on likelihood, and such ranking can include statistical analysis, policy violations, recent changes to the computing environment, or any combination thereof.

Claims

1. A method of determining whether a business disruption associated with a computing environment has occurred, the method comprising:

accessing an actual end-user response time, demand of the computing environment, and capacity of the computing environment; and

determining whether the first end-user response time exceeds a threshold, wherein the threshold is a function of the demand and capacity.

2. The method of claim 1, wherein determining whether the actual end-user response time exceeds a threshold comprises:

accessing first operating data associated with the computing environment, wherein;

the first operating data include first sets of readings from a first set of instruments associated with the computing environment; and

the first set of instruments includes an end-user response time gauge and a load gauge;

separating the first operating data into different sets of clustered operating data, including a first set of clustered operating data;

accessing second operating data associated with the computing environment, wherein;

the second operating data include a second set of readings from the first set of instruments; and

the second set of readings includes the actual end-user response time;

determining that the second operating data is closer to the first set of clustered operating data as compared to any other different set of clustered operating data; and

determining whether the actual end-user response time from the second operating data is greater than a corresponding end-user response time from the first operating data.

3. The method of claim 1, wherein determining whether the actual end-user response time exceeds a threshold comprises:

determining a predicted end-user response time using a predictive model, wherein inputs to the predictive model includes data associated at least with demand and capacity of the computing environment; and

determining whether the actual end-user response time is greater than the predicted end-user response time.

4. The method of claim 1, wherein determining whether the actual end-user response time exceeds a threshold comprises:

accessing a policy associated with a specified end-user response time, demand, and capacity; and

determining whether the policy has been violated based at least in part on the actual end-user response time.

5. A system operable for carrying out the method of claim 1.

6. A method of operating a computing environment including a plurality of instruments comprising:

accessing first operating data associated with the computing environment, wherein;

the first operating data include first sets of readings from a first set of instruments associated with the computing environment; and

the plurality of instruments includes the first set of instruments;

separating the first operating data into different sets of clustered operating data, including a first set of clustered operating data;

accessing second operating data associated with the computing environment,

wherein the second operating data include a second set of readings from the first set of instruments; and

determining that the second operating data is closer to the first set of clustered operating data as compared to any other different set of clustered operating data.

7. The method of claim 6, wherein the first sets of readings from the first set of instruments reflect when the computing environment is known or believed to be operating when in a typical state.

8. The method of claim 6, further comprising adding additional operating data associated with a health of the computing environment to the first operating data after determining that the second operating data is closer to the first set of clustered operating data as compared to any other different set of clustered operating data, wherein substantially no data is removed from the first operating data at substantially a same time as adding the additional operating data.

9. The method of claim 6, further comprising:

determining, for one or more instruments within the first set of instruments, a degree of abnormality associated with the one or more instrument within the first set of instruments, based on the first set of clustered operating data; and

determining which of the one or more instruments has a reading within the second operating data that is beyond a threshold of abnormality for the one or more instruments.

10. The method of claim 9, wherein the one or more instruments include a gauge for response time, request load, request failure rate, request throughput, or any combination thereof.

11. The method of claim 10, further comprising performing a probable cause analysis after determining which of the one or more instruments has the reading within the second operating data that is beyond the threshold.

12. The method of claim 11, wherein performing the probable cause analysis comprises:

determining degrees of abnormality for at least two instruments within the plurality of instruments; and

ranking potential causes in order of likelihood based at least in part on the degrees of abnormality.

13. The method of claim 11, wherein performing the probable cause analysis comprises:

accessing relationship information associated with relationships between at least two of the plurality instruments associated with the computing environment, wherein the plurality of instruments includes at least one instrument outside of the first set of instruments; and

ranking potential causes in order of likelihood based in part on the relationship information.

14. The method of claim 13, further comprising filtering potential causes based on a criterion, wherein at least some of the plurality of instruments affect an end-user response time.

15. The method of claim 14, wherein the criterion includes which of the plurality of instruments are used by an application running within the computing environment, and wherein filtering potential causes comprises:

performing statistical analysis on the other instruments associated with the computing environment to determine which of the other instruments are significantly affected when running the application within the computing environment;

accessing a user-defined list that includes at least one of the other instruments;

accessing configuration information associated with the computing environment;

accessing network data regarding a flow, a stream, a connection and its utilization, or any combination thereof;

or

any combination thereof.

16. The method of claim 11, wherein performing the probable cause analysis comprises:

accessing a predefined policy for the computing environment;

determining that the predefined policy has been violated; and

determining the probable cause based in part on the violation of the predefined policy.

17. The method of claim 6, further comprising receiving a predetermined number for the different sets of clustered operating data before separating the first operating data.

18. The method of claim 6, further comprising:

determining when a new operating pattern will occur in the future; and

setting the computing environment to not generate alerts when data is being collected during a time period corresponding to the new operating pattern.

19. A system operable for carrying out the method of claim 6.

20. A method of operating a computing environment including a plurality of instruments, the method comprising:

determining that a reading from at least one instrument within the plurality of instruments is abnormal, wherein determining is performed at least in part using a multivariate analysis involving at least two instruments within the plurality of instruments; and

ranking potential causes of a problem in the computing environment in order of likelihood.

21. The method of claim 20, further comprising determining degrees of abnormality for at least two instruments within the plurality of instruments, wherein ranking the potential causes in order of likelihood comprises ranking the potential causes based at least in part on the degrees of abnormality.

22. The method of claim 20, further comprising accessing relationship information between a first instrument and other instruments associated with the computing environment, wherein ranking the potential causes in order of likelihood comprises ranking the potential causes based at least in part on the relationships between the first and the other instruments.

23. The method of claim 20, further comprising retaining a set of instruments from the other instruments, wherein the set of instruments meet a criterion.

24. The method of claim 23, wherein the criterion includes which of the plurality of instruments are used by an application running within the computing environment, and wherein retaining a set of instruments comprises:

performing statistical analysis on the other instruments associated with the computing environment to determine which of the other instruments are significantly affected when running the application within the computing environment;

accessing a user-defined list that includes at least one of the other instruments;

accessing a configuration file that includes configuration information associated with the computing environment;

accessing network data regarding a flow, a stream, a connection and its utilization, or any combination thereof;

or

any combination thereof.

25. The method of claim 20, wherein ranking potential causes of the atypical state comprises:

determining that a policy violation is a more probable cause than any pattern violation;

determining that a change to the computing environment is a more probable cause than the pattern violation;

or

any combination thereof.

26. The method of claim 20, wherein determining that an application is running within the computing environment in an atypical state comprises determining that a first instrument has a reading that is beyond a threshold of abnormality.

27. The method of claim 20, wherein determining that an application is running within the computing environment in an atypical state comprises determining that a first instrument has a reading that differs from a predicted value by more than a threshold amount.

28. A system operable for carrying out the method of claim 20.

29. A data processing system readable medium having code embodied within the data processing system readable medium, the code comprising:

an instruction to access an actual end-user response time, demand of the computing environment, and capacity of the computing environment; and

an instruction to determine whether the first end-user response time exceeds a threshold, wherein the threshold is a function of the demand and capacity.

30. The data processing system readable medium of claim 29, wherein the instruction to determine whether the actual end-user response time exceeds a threshold comprises:

an instruction to access first operating data associated with the computing environment, wherein;

the first operating data include first sets of readings from a first set of instruments associated with the computing environment, wherein the first set of instruments includes an end-user response time gauge and a load gauge;

an instruction to separate the first operating data into different sets of clustered operating data, including a first set of clustered operating data;

an instruction to access second operating data associated with the computing environment, wherein the second operating data include a second set of readings from the first set of instruments, and the second set of readings includes the actual end-user response time;

an instruction to determine that the second operating data is closer to the first set of clustered operating data as compared to any other different set of clustered operating data; and

an instruction to determine whether the actual end-user response time from the second operating data is greater than a corresponding end-user response time from the first operating data.

31. The data processing system readable medium of claim 29, wherein the instruction to determine whether the actual end-user response time exceeds a threshold comprises:

an instruction to determine a predicted end-user response time using a predictive model, wherein inputs to the predictive model includes data associated at least with demand and capacity of the computing environment; and

an instruction to determine whether the actual end-user response time is greater than the predicted end-user response time.

32. The data processing system readable medium of claim 29, wherein the instruction to determine whether the actual end-user response time exceeds a threshold comprises:

an instruction to access a policy associated with a specified end-user response time, demand, and capacity; and

an instruction to determine whether the policy has been violated based at least in part on the actual end-user response time.

33. A data processing system readable medium having code embodied within the data processing system readable medium, the code comprising:

an instruction to access first operating data associated with the computing environment, wherein;

the first operating data include first sets of readings from instruments associated with the computing environment; and

the plurality of instruments includes the first set of instruments;

an instruction to separate the first operating data into different sets of clustered operating data, including a first set of clustered operating data;

an instruction to access second operating data associated with the computing environment, wherein the second operating data include a second set of readings from the first set of instruments; and

an instruction to determine that second operating data is closer to the first set of clustered operating data as compared to any different set of clustered operating data.

34. The data processing system readable medium of claim 33, wherein the first sets of readings from the instruments reflect when the computing environment is known or believed to be operating when in a typical state.

35. The data processing system readable medium of claim 33, wherein the code further comprises an instruction to add additional operating data associated with a health of the computing environment to the first operating data after determining that the second operating data is closer to the first set of clustered operating data as compared to any other different set of clustered operating data, wherein substantially no data is removed from the first operating data at substantially a same time as when the instruction to add is being executed.

36. The data processing system readable medium of claim 33, wherein the code further comprises:

an instruction to determine, for one or more instruments within the first set of instruments, a degree of abnormality associated with the one or more instrument within the first set of instruments, based on the first set of clustered operating data; and

an instruction to determine which of the one or more instruments has a reading within the second operating data that is beyond a threshold of abnormality for the one or more instruments.

37. The data processing system readable medium of claim 36, wherein the one or more instruments include a gauge for response time, request load, request failure rate, request throughput, or any combination thereof.

38. The data processing system readable medium of claim 37, wherein the code further comprises an instruction to execute a probable cause analysis after determining which of the one or more instruments has the reading within the second operating data that is beyond a threshold of abnormality.

39. The data processing system readable medium of claim 38, wherein the instruction to perform the probable cause analysis comprises:

an instruction to determine degrees of abnormality for at least two instruments within the plurality of instruments; and

an instruction to rank potential causes in order of likelihood based at least in part on the degrees of abnormality.

40. The data processing system readable medium of claim 38, wherein the instruction to execute the probable cause analysis comprises:

an instruction to access relationship information associated with relationships between at least two of the instruments associated with the computing environment, wherein the plurality of instruments includes at least one instrument outside of the first set of instruments; and

an instruction to rank potential causes in order of likelihood based in part on the relationship information.

41. The data processing system readable medium of claim 40, wherein the code further comprises an instruction to filter potential causes based on a criterion, wherein at least some of the plurality of instruments affect an end-user response time.

42. The data processing system readable medium of claim 41, wherein the criterion includes which of the plurality of instruments are used by an application running within the computing environment, and wherein the instruction to filter potential causes comprises an instruction to determine which of the plurality of instruments are used by the application by executing:

an instruction to perform statistical analysis on the other instruments associated with the computing environment to determine which of the other instruments are significantly affected when running the application within the computing environment;

an instruction to access a user-defined list that includes at least one of the other instruments;

an instruction to access configuration information associated with the computing environment;

an instruction to access network data regarding a flow, a stream, a connection and its utilization, or any combination thereof;

or

any combination thereof.

43. The data processing system readable medium of claim 38, wherein an instruction to perform the probable cause analysis comprises:

an instruction to access a predefined policy for the computing system;

an instruction to determine that the predefined policy has been violated; and

an instruction to rank the policy violation as the probable cause.

44. The data processing system readable medium of claim 33, wherein the code further comprises an instruction to access a predetermined number for the different sets of clustered operating data before separating the first operating data.

45. The data processing system readable medium of claim 33, wherein the code further comprises:

an instruction to determine when a new operating pattern will occur in the future; and

an instruction to set the computing environment to not generate alerts when data is being collected during a time period corresponding to the new operating pattern.

46. A data processing system readable medium having code embodied within the data processing system readable medium, the code comprising:

an instruction to determine that a reading from at least one instrument within the plurality of instruments is abnormal, wherein determining is performed at least in part using a multivariate analysis involving at least two instruments within the plurality of instruments; and

an instruction to rank potential causes of a problem in order of likelihood.

47. The data processing system readable medium of claim 46, wherein the code further comprises an instruction to determine degrees of abnormality for at least two instruments within the plurality of instruments, wherein the instruction to rank the potential causes in order of likelihood comprises an instruction to rank the potential causes based at least in part on the degrees of abnormality.

48. The data processing system readable medium of claim 46, wherein the code further comprises an instruction to access relationship information between a first instrument and other instruments associated with the computing environment, wherein the instruction to rank the potential causes in order of likelihood comprises an instruction to rank the potential causes based at least in part on the relationships between the first and the other instruments.

49. The data processing system readable medium of claim 46, wherein the code further comprises an instruction to retain a set of instruments from the other instruments, wherein the set of instruments meet a criterion.

50. The data processing system readable medium of claim 49, wherein the criterion includes which of the plurality of instruments are used by an application running within the computing environment, and wherein an instruction to retain a set of instruments comprises:

an instruction to perform statistical analysis on the other instruments associated with the computing environment to determine which of the other instruments are significantly affected when running the application within the computing environment;

an instruction to access a user-defined list that includes at least one of the other instruments;

an instruction to access a configuration file that includes configuration information associated with the computing environment;

an instruction to access network data regarding a flow, a stream, a connection and its utilization, or any combination thereof;

or

any combination thereof.

51. The data processing system readable medium of claim 46, wherein the instruction to rank potential causes of the atypical state comprises:

an instruction to determine that a policy violation is a more probable cause than any gauge associated with the computing environment;

an instruction to determine that a change to the computing environment is a more probable cause than the any gauge associated with the computing environment;

or

any combination thereof.

52. The data processing system readable medium of claim 46, wherein the instruction to determine that an application is running within the computing environment in an atypical state comprises an instruction to determine that a first instrument has a reading that is outside a predetermined range.

53. The data processing system readable medium of claim 46, wherein an instruction to determine that an application is running within the computing environment in an atypical state comprises an instruction to determine that a first instrument has a reading that differs from a predicted value by more than a threshold amount.