METHOD AND SYSTEM FOR TROUBLESHOOTING A MISCONFIGURATION OF A COMPUTER SYSTEM BASED ON CONFIGURATIONS OF OTHER COMPUTER SYSTEMS

• US 20070300103A1
• Filed: 06/13/2007
• Published: 12/27/2007
• Est. Priority Date: 02/19/2004
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Verbowski, Chad, Chen, Yu, Zhang, Ruyun, Platt, John, Wang, Jiahe
• Granted Patent: US 7,890,807 B2
• Time in Patent Office: Days
• US Class Current: 714/37
• CPC Class Codes: G06F 11/0748 in a remote unit communicating with a single-box computer node experiencing an error/fault remote testing G06F11/2294
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: H04L 41/0853 by actively collecting configuration information or by backing up configuration information
• CPC Class Codes: H04L 41/0869 Validating the configuration within one network element
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence

Abstract

A method and system for identifying a configuration parameter of a “sick” computer system that is at fault for causing an undesired behavior based on analysis of configuration parameters from other computer systems is provided. In one embodiment, a troubleshooting system collects “suspect” values for “suspect” configuration parameters used by a “sick” application when the undesired behavior was exhibited by the sick computer system. The troubleshooting system then compares the suspect values to sample values of the suspect configuration parameters retrieved from sample computer systems. The troubleshooting system uses that comparison to identify one or more suspect configuration parameters that are likely at fault for causing the application to exhibit the undesired behavior.

Claims

1. A method in a computer system for identifying a configuration parameter that is likely causing a component of a computing device to exhibit an undesired behavior, the method comprising:

collecting suspect values for suspect configuration parameters of the component;

providing sample values for the suspect configuration parameters for the components, the sample values being retrieved from other computing devices having the component; and

comparing the suspect values with the sample values to identify a suspect configuration parameter whose suspect value is likely to be causing the component of the computing device to exhibit the undesired behavior.

2. The method of claim 1 wherein the comparing includes calculating a probability for each suspect configuration parameter.

3. The method of claim 1 wherein the suspect values are collected during execution of the component in which the undesired behavior was exhibited.

4. The method of claim 1 wherein the providing of values includes retrieving the sample values for the suspect configuration parameters from each sample component.

5. The method of claim 4 wherein the retrieving of the sample values is performed before the collecting of the suspect values wherein the sample values are retrieved for configuration parameters that include the suspect configuration parameters.

6. The method of claim 4 wherein the retrieving of the sample values is performed after collecting the suspect values.

7. The method of claim 1 wherein the component is software.

8. The method of claim 1 wherein an index is maintained that indicates computing devices that have the component installed.

9. The method of claim 1 wherein the collecting includes running a program that intercepts and records accesses by the component to a configuration data store.

10. The method of claim 9 wherein the configuration data store is a registry file.

11. The method of claim 9 wherein the configuration data store is a resource file.

12. The method of claim 1 wherein the values for configuration parameters that are system-specific are placed in a canonical form.

13. The method of claim 1 wherein the values for configuration parameters are placed in a normal form.

14. The method of claim 1 wherein the component is a hardware device.

15. The method of claim 1 including aggregating the sample values prior to collecting the suspect values to facilitate comparing to the suspect values.

16. The method of claim 15 wherein the aggregating includes counting the number of distinct sample values for each suspect configuration parameter.

17. The method of claim 16 wherein the aggregating includes counting the number of sample components that have each distinct value.

18. The method of claim 1 including identifying a likely correct value for the sample configuration parameter that is identified as likely causing the component to exhibit the undesired behavior.

19. The method of claim 18 wherein the likely correct sample value is the value that is most common.

20. The method of claim 18 including changing the suspect value of the suspect configuration parameter that is identified as likely causing the component to exhibit the undesired behavior to the identified likely correct value.

21. The method of claim 18 including presenting to a user an indication of likely correct values for the suspect configuration parameter that is identified as likely causing the component to exhibit the undesired behavior.

22. The method of claim 18 including presenting to a user a ranking of suspect configuration parameters that may be causing the component to exhibit the undesired behavior.

23-39. -39. (canceled)

40. A computer-readable medium containing instructions for controlling a troubleshooting system to retrieve sample values for suspect configuration parameters of an application, by a method comprising:

identifying suspect configuration parameters of the application by monitoring the execution of the application on a computing device;

identifying as sample computing devices other computing devices with the same application installed; and

retrieving sample values for the identified configuration parameters from the identified sample computing devices for use in identifying a suspect configuration parameter that is likely causing the application executing on the computing device to exhibit an undesired behavior.

41. The computer-readable medium of claim 40 including, before identifying the suspect configuration parameters, collecting sample values for configuration parameters of applications installed on the other computing devices and storing the sample values in a data store wherein the retrieving of the sample values includes retrieving the sample values from the data store after the suspect configuration parameters are identified.

42. The computer-readable medium of claim 40 wherein the retrieving includes dynamically collecting the sample values from the other computing devices.

43. The computer-readable medium of claim 40 including maintaining a mapping of various applications to the other computing devices that have those various applications installed.

44. The computer-readable medium of claim 40 wherein the identifying of suspect configuration parameters includes executing a tracer program that tracks accesses of the application of the computing device to configuration parameters.

45. The computer-readable medium of claim 40 including comparing a value of a suspect configuration parameter to the sample values of the suspect configuration parameter to identify whether the suspect configuration parameter is likely causing the computing device to exhibit the undesired behavior.

46. A computer-readable medium containing instructions for controlling a troubleshooting system to identify a configuration parameter that is likely causing a component of a computer system to exhibit an undesired behavior, by a method of:

providing sample values of configuration parameters for sample components, the sample values of configuration parameters for a sample component being retrieved from other computer systems having the sample components;

receiving suspect values for suspect configuration parameters of the component that is exhibiting the undesired behavior; and

identifying a suspect configuration parameter whose suspect value as likely causing the component to exhibit the undesired behavior by comparing the suspect values of the suspect configuration parameters to the sample values of the suspect configuration parameters.

47. The computer-readable medium of claim 46 wherein the comparing includes calculating a probability for each suspect configuration parameter.

48. The computer-readable medium of claim 46 wherein the suspect values are collected during execution of the component in which the undesired behavior was exhibited.

49. The computer-readable medium of claim 46 including aggregating the sample values prior to receiving the suspect values to facilitate comparing to the suspect values.

50. The computer-readable medium of claim 49 wherein the aggregating includes counting the number of distinct sample values for each suspect configuration parameter.

51. The computer-readable medium of claim 50 wherein the aggregating includes counting the number of sample components that have each distinct value.

52. The computer-readable medium of claim 46 including identifying a likely correct value for the suspect configuration parameter that is identified as likely causing the component to exhibit the undesired behavior.

53. The computer-readable medium of claim 52 including presenting to a user a ranking of suspect configuration parameters that may be causing the component to exhibit the undesired behavior.