System and method for recording behavior history for abnormality detection

• US 20070198679A1
• Filed: 02/06/2006
• Published: 08/23/2007
• Est. Priority Date: 02/06/2006
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Uttamchandani, Sandeep, Duyanovich, Linda, Gomez, Juan, Pollack, Kristal
• Granted Patent: US 7,395,187 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3452 Performance evaluation by statistical analysis
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: G06F 2201/81 Threshold
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/5003 Managing SLA; Interaction between SLA and QoS
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/0829 Packet loss
• CPC Class Codes: H04L 43/0852 Delays
• CPC Class Codes: H04L 43/0888 Throughput
• CPC Class Codes: H04L 43/0894 Packet rate
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

Disclosed is an autonomic abnormality detection device having a plurality of agents, a server with a one or more processors, a data storage device and a corrective actions engine. The device is adapted to detect and diagnose abnormalities in system components. Particularly, the device uses agents to track performance/workload measurements of system components and dynamically compiles a history of those performance/workload measurements for each component. In order to detect abnormalities a processor compares current performance/workload measurements for a component to the compiled histories for that component and for other components. The processor can further be adapted to determine possible causes of a detected abnormality and to report the abnormality, including the possible causes, to a corrective actions engine.

Claims

1. An abnormality detection device for a system with a plurality of components, said abnormality detection device comprising:

a server comprising a processor;

a plurality of agents in communication with said components and with said server and wherein said agents are adapted to periodically determine current performance/workload measurements for each of said components and to periodically transmit said current performance/workload measurements to said server; and

a data storage device in communication with said server;

wherein said processor is adapted to dynamically compile a history of performance/workload measurements for each of said components and to compare said current performance/workload measurement for each of said components to said history for each of said components so as to detect an abnormality, and

wherein said data storage device stores said current performance/workload measurements for each of said components, said history for each of said components, and a record of detected abnormalities for each of said components.

2. The device of claim 1, wherein said processor is further adapted to compile said history by clustering performance/workload measurements for each of said components into clusters and determining an average performance/workload measurement for each of said clusters.

3. The device of claim 2, wherein each of said performance/workload measurements comprises a workload value, and wherein for each of said components said processor is adapted to detect an abnormality by:

identifying one average performance/workload measurement in which said workload value is approximately equal to said workload value of said current performance/workload measurement; and

determining if said current performance/workload measurement is greater than a predetermined value from said one average performance/workload measurement.

4. The device of claim 2, wherein each of said performance/workload measurements comprises a workload value, and wherein for each of said components said processor is adapted to detect an abnormality by:

identifying a predetermined number of said average performance/workload measurements having workload values closest to said workload value of said current performance/workload measurement;

determining a combined average of said predetermined number of said average performance/workload measurements; and

determining if said current performance/workload measurement is greater than a predetermined value from said combined average of said predetermined number of said average performance/workload measurements.

5. The device of claim 2, wherein said processor is further adapted to determine said average performance/workload measurement for each of said clusters by using at least one of a weighted average and a decay function to allow for changes in normal operation of each of said components over time.

6. The device of claim 1, wherein said processor is further adapted to analyze said record of detected abnormalities for each of said components to determine if said abnormality in said current performance/workload measurement is random.

7. The device of claim 1, wherein said server is further adapted to issue directives to said agents to adjust tracking parameters for said performance/workload measurements.

8. The device of claim 1, wherein said processor is further adapted to determine a possible cause of an abnormality detected in a current performance/workload measurement of one component based on said history of said one component and on said histories and said current performance/workload measurements of other components in an invocation path of said one component.

9. The device of claim 1, further comprising an engine in communication with said server and adapted to receive a report of a detected abnormality, to determine what if any corrective actions are necessary, and to implement said corrective actions in said system.

10. A method of detecting abnormalities in a system with a plurality of components, said method comprising:

using a plurality of agents to periodically determine a current performance/workload measurement for each of said components;

dynamically compiling a history of performance/workload measurements for each of said components;

comparing said current performance/workload measurement for each of said components to said history for each of said components to detect an abnormality in said current performance/workload measurement for each of said components; and

for each of said components, storing said current performance/workload measurements, said histories, and a record of detected abnormalities.

11. The method of claim 10, wherein said histories are compiled by clustering performance/workload measurements for each of said components into clusters and determining an average performance/workload measurement for each of said clusters.

12. The method of claim 11, wherein each of said performance/workload measurements comprises a workload value, and wherein said method further comprises detecting an abnormality in said current performance/workload measurement of one component by:

identifying one average performance/workload measurement for said one component in which said workload value is approximately equal to said workload value of said current performance/workload measurement of said one component, and

determining if said current performance/workload measurement is greater than a predetermined value from said one average performance/workload measurement.

13. The method of claim 11, wherein each of said performance/workload measurements comprises a workload value, and wherein said method further comprises detecting an abnormality by:

identifying a predetermined number of said average performance/workload measurements having workload values closest to said workload value of said current performance/workload measurement;

determining a combined average of said predetermined number of said average performance/workload measurements; and

determining if said current performance/workload measurement is greater than a predetermined value from said combined average of said predetermined number of said average performance/workload measurements.

14. The method of claim 11, wherein said determining of said average performance/workload measurement for each of said clusters comprises using at least one of a weighted average and a decay function to allow for changes in normal operation of each of said components over time.

15. The method of claim 10, further comprising issuing directives to said agents to adjust tracking parameters for said performance/workload measurements.

16. The method of claim 10, further comprising determining a possible cause of a detected abnormality in a current performance/workload measurement of one component based on said history of said one component and on said histories and said current performance/workload measurements of other components in an invocation path of said one component.

17. A program storage device readable by a computer, tangibly embodying a program of instructions executable by said computer to perform a method of detecting abnormalities in a system with a plurality of components, said method comprising:

using a plurality of agents to periodically determine a current performance/workload measurement for each of said components;

dynamically compiling a history of performance/workload measurements for each of said components;

comparing said current performance/workload measurement to said history to detect an abnormality in said current performance/workload measurement for each of said components; and

for each of said components, storing said current performance/workload measurements, said histories, and a record of detected abnormalities.

18. The program storage device of claim 17, wherein said histories are compiled by clustering performance/workload measurements for each of said components into clusters and determining an average performance/workload measurement for each of said clusters.

19. The program storage device of claim 18, wherein each of said performance/workload measurements comprises a workload value, and wherein said method further comprises detecting an abnormality in said current performance/workload measurement of one component by:

identifying one average performance/workload measurement in which said workload value is approximately equal to said workload value of said current performance/workload measurement of said one component; and

determining if said current performance/workload measurement is greater than a predetermined value from said one average performance/workload measurement.

20. The program storage device of claim 20, wherein each of said performance/workload measurements comprises a workload value, and wherein said method further comprises detecting an abnormality by:

identifying a predetermined number of said average performance/workload measurements having workload values closest to said workload value of said current performance/workload measurement;

determining a combined average of said predetermined number of said average performance/workload measurements; and

determining if said current performance/workload measurement is greater than a predetermined value from said combined average of said predetermined number of said average performance/workload measurements.