CLUSTERING PROCESS FOR SOFTWARE SERVER FAILURE PREDICTION

• US 20090132864A1
• Filed: 01/26/2009
• Published: 05/21/2009
• Est. Priority Date: 10/28/2005
• Status: Active Grant

• Current Assignee: Lenovo International Limited (Lenovo Group Ltd.)
• Original Assignee: Zachary A. Garbow
• Inventors: Garbow, Zachary A.
• Granted Patent: US 7,761,745 B2
• Time in Patent Office: Days
• US Class Current: 714/47
• CPC Class Codes: G06F 11/008 Reliability or availability analysis
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: H04L 41/147 for predicting network behaviour
• CPC Class Codes: H04L 43/0817 by checking functioning

Abstract

Embodiments of the present invention allow the prevention and/or mitigation of damage caused by server failure by predicting future failures based on historic failures. Statistical data for server parameters may be collected for a period of time immediately preceding a historic server failure. The data may be clustered to identify cluster profiles indicating strong pre-fault clustering patterns. Real time statistics collected during normal operation of the server may be applied to the cluster profiles to determine whether real time statistics show pre-fault clustering. If such a pattern is detected, measures to prevent or mitigate server failure may be initiated.

Claims

1. A computer-implemented method for predicting failure of a server, comprising:

collecting real time server parameters of the server;

applying the real time server parameters to at least one cluster profile retrieved from a computer readable storage medium, wherein the cluster profile comprises;

one or more server parameters;

one or more clustering parameters; and

a weight associated with each server parameter,

wherein the server parameters, the clustering parameters, and the weight associated with each server parameter are selected on the basis of historical pre-fault clustering of the server parameters; and

executing a monitoring application on a computer processor to determine a probability of failure of the server based on a relationship between the real time server parameters and the one or more cluster profiles.

7. The method of claim 1, wherein determining the probability of failure of the server comprises determining a probability of failure with respect to each cluster profile.

8. The method of claim 7, further comprising:

in response to determining the probability of failure with respect to each cluster profile;

identifying a failure type based on the probability of failure with respect to each cluster profile; and

initiating at least one of preventive and mitigating measures based on the identified failure type.

2-6. -6. (canceled)

9. A computer readable storage medium containing a program for predicting failure of a server which, when executed by a computer processor, performs an operation, comprising:

collecting real time server parameters of the server;

applying the real time server parameters to at least one cluster profile retrieved from a computer storage medium, wherein the cluster profile comprises;

one or more server parameters;

one or more clustering parameters; and

a weight associated with each server parameter,

wherein the server parameters, the clustering parameters, and the weight associated with each server parameter are selected on the basis of historical pre-fault clustering of the server parameters; and

determining a probability of failure of the server based on a relationship between the real time server parameters and the one or more cluster profiles.

10. The computer readable storage medium of claim 9, wherein the operations further comprise creating the cluster profiles, comprising:

for each historical server failure, collecting data for server parameters for a period of time immediately preceding the historical server failure;

determining at least one setting, wherein the setting comprises;

the one or more server parameters;

the one or more clustering parameters; and

the weight associated with each of the one or more parameters;

determining a set of points, wherein each point comprises values of the one or more server parameters;

determining clusters of points within the set of points based on the distance between each pair of points in the set of points, the one or more clustering parameters, and the weight associated with each server parameter;

for each setting, determining whether the setting generates a pre-fault clustering pattern, wherein the pre-fault clustering pattern comprises at least one of

a high rate of change of clusters prior to the server failure; and

clusters previously defined as high-risk clusters; and

if the setting generates a pre-fault clustering pattern, saving the setting as a cluster profile.

11. The computer readable storage medium of claim 10, wherein each point in the set of points is a multi-dimensional point {D1, D2, . . . Di} comprising the server parameter values, wherein D is a given parameter value and i is an integer greater than or equal to one.

12. The computer readable storage medium of claim 10, wherein determining clusters of points comprises:

for each point in the set of points;

determining a set of neighboring points within a predefined distance, wherein the predefined distance is defined by the clustering parameters;

determining a set of nearest neighbors within the set of neighboring points based on a predefined number defined by the clustering parameters, wherein the predefined number determines the total number of points that may be included as nearest neighbors;

assigning a rank value to each nearest neighbor based on the proximity of the nearest neighbor to the point;

determining a mutual nearest neighbor score for each pair of nearest neighbor points in the set of points based on the rank values; and

clustering the points based on the mutual nearest neighbor score.

13. The computer readable storage medium of claim 10, wherein the pre-fault clustering pattern comprises:

a steady state period, wherein the data points merge into at least one of

a single cluster; and

a cluster previously defined as a normal cluster; and

an unsteady state period immediately preceding the server failure, wherein the data points merge into at least one of

one or more new clusters; and

the high-risk clusters.

14. The computer readable storage medium of claim 10, wherein determining whether the setting generates a pre-fault clustering pattern comprises determining a strength of the setting, wherein the strength is based on at least one of an algorithm analysis or Fourier analysis to compare a pattern of the clusters of points in the set of data points to the pre-fault clustering pattern.

15. The computer readable storage medium of claim 9, wherein determining the probability of failure of the server comprises determining a probability of failure with respect to each cluster profile.

16. The computer readable storage medium of claim 15, the operations further comprising:

in response to determining the probability of failure with respect to each cluster profile;

identifying a failure type based on the probability of failure with respect to each cluster profile; and

initiating at least one of preventive and mitigating measures based on the identified failure type.

17. A server, comprising:

a memory comprising a monitoring application and at least one cluster profile wherein the cluster profile comprises;

one or more server parameters;

one or more clustering parameters; and

a weight associated with each server parameter,

wherein the server parameters, the clustering parameters, and the weights associated with each server parameter are selected on the basis of historical pre-fault clustering of the server parameters;

a processor communicably connected to the memory which, when executing the monitoring application is configured to;

collect real time server parameters of the server;

apply the real time server parameters to the at least one cluster profile; and

determine a probability of failure of the server based on a relationship between the real time server parameters and the one or more cluster profiles.

18. The server of claim 17, wherein the memory further comprises a clustering application which, when executed by the processor, configures the processor to:

for each historic server failure, collect data for server parameters for a period of time immediately preceding the server failure;

determine at least one setting, wherein the setting comprises;

the one or more server parameters;

the one or more clustering parameters; and

the weights associated with each of the one or more server parameters;

determine a set of points, wherein each point comprises values of one or more server parameters;

determine clusters of points within the set of points based on the distance between each pair of points in the set of points, the one or more server parameters, and the weight associated with each server parameter;

for each setting, determine whether the setting generates a pre-fault clustering pattern, wherein the pre-fault clustering pattern comprises at least one of

a high rate of change of clusters prior to the server failure; and

clusters previously defined as high-risk clusters; and

if the setting generates a pre-fault clustering pattern, save the setting as a cluster profile.

19. The server of claim 18, wherein to determine clusters of points within the set of points, the processor is configured to:

for each point in the set of points;

determine a set of neighboring points within a predefined distance, wherein the predefined distance is defined by the clustering parameters;

determine a set of nearest neighbors within the set of neighboring points based on a predefined number defined by the clustering parameters, wherein the predefined number determines the total number of points that may be included as nearest neighbors;

assign a rank value to each nearest neighbor based on the proximity of the nearest neighbor to the point;

determine a mutual nearest neighbor score for each pair of points in the set of points based on the rank values; and

cluster the points based on the mutual nearest neighbor score.

20. The server of claim 17, wherein the processor, when executing the monitoring program, is further configured to:

in response to determining the probability of server failure;

determine a failure type based on the relationship between the one or more real time parameters and the one or more server profiles; and

initiate preventive or mitigating measures.

21. The server of claim 18, wherein, to determine whether the setting generates a pre-fault clustering pattern, the processor is configured to determine a strength of the setting, wherein the strength is based on at least one of an algorithm analysis and Fourier analysis to compare the clusters of the data points to the pre-fault clustering pattern.

22. The server of claim 17, wherein the processor is configured to determine the probability of failure of the server failure by first determining a probability of failure with respect to each cluster profile.

23. The server of claim 22, wherein the processor is further configured to:

in response to determining the probability of failure with respect to each cluster profile;

identify a failure type based on the probability of failure with respect to each cluster profile; and

initiate at least one of preventive and mitigating measures based on the identified failure type.