SYSTEM AND METHOD FOR INCIDENT MANAGEMENT ENHANCED WITH PROBLEM CLASSIFICATION FOR TECHNICAL SUPPORT SERVICES

• US 20100318846A1
• Filed: 06/16/2009
• Published: 12/16/2010
• Est. Priority Date: 06/16/2009
• Status: Active Grant

• Current Assignee: Maplebear Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Song, Yang, Sailer, Anca, Shaikh, Hidayatullah Habeebullah
• Granted Patent: US 8,365,019 B2
• Time in Patent Office: Days
• US Class Current: 714/26
• CPC Class Codes: G06F 11/0706 the processing taking place on a specific hardware platform or in a specific software environment
• CPC Class Codes: G06F 11/0748 in a remote unit communicating with a single-box computer node experiencing an error/fault remote testing G06F11/2294
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36

Abstract

A system and method of problem determination and resolution utilizes enhanced problem classification, and effectively categorizes any problem a user experiences by leveraging all available data to recognize the specific problem. Historical problem data is labeled with the cause of that problem and is analyzed to learn problem patterns. The historical problem data is classified into a predefined hierarchical structure of taxonomies by using an incremental online learning algorithm. The hierarchical structure and learned patterns are utilized to recognize problems and generate the root cause of the problem when given a new set of monitoring data and log data.

Claims

1. An incident management system enhanced with problem classification, comprising:

a monitor and data collector configured to monitor an Information Technology environment, collect available data about the environment and in response to a problem, send collected problem data to at least one of a historic problem data storage device and a problem data pattern classifier;

a storage device configured to store historic problem data labeled with a root cause of the problem associated with that data; and

a problem data pattern classifier which classifies current problem data into a predefined hierarchical structure and automatically generates the root cause of the current problem based on the historic problem data stored in the storage device.

2. The incident management system of claim 1 wherein the hierarchy includes one or more trees, each comprising a root node and one or more leaf nodes.

3. The incident management system of claim 2 wherein a linear classifier is trained for each node in the hierarchy.

4. The incident management system of claim 3 wherein the root cause of new problems are generated by traversing the hierarchy in a top-down fashion and utilizing the trained linear classifiers at each node.

5. The incident management system of claim 1 further comprising:

a problem determination module in communication with a user node in an IT environment.

6. The incident management system of claim 5, wherein the problem determination module receives problem notifications and communicates problem notifications to the monitor and data collector.

7. The incident management system of claim 5, wherein the problem determination module, in response to a problem, receives problem data from the monitor and data collector, receives the automatically generated root cause of the problem from the problem data pattern classifier and presents the problem data and generated root cause to the user or technical support personnel through an input/output interface.

8. The incident management system of claim 5, wherein the problem determination module, after the problem has been solved, receives from the user the actual root cause of the problem and communicates a cause to the historic problem data storage as a label of the data associated with that problem.

9. The incident management system of claim 1, wherein the problem data pattern classifier learns problem patterns from the historic problem data and root causes stored in the storage device and generates the root cause of new problems based on the learned patterns.

10. The incident management system of claim 9, wherein the problem data pattern classifier further stores the learned patterns in memory or a storage device.

11. The incident management system of claim 10, wherein the monitor and data collector compares currently monitored data to the stored data patterns to recognize problems.

13. The incident management system of claim 9 wherein the problem data classifier learn patterns incrementally when new historic problem data is available.

12. The incident management system of claim 12, wherein the monitor and data collector further sends a problem notification to lie problem determination module if a problem is recognized.

14. A method of problem determination and resolution, comprising the steps of:

learning patterns of problem causes by classifying problem data into a predefined hierarchical structure;

collecting all available data from an Information Technology environment when a problem occurs;

generating a root cause of the problem using the collected data and the learned problem patterns;

utilizing the generated root cause and the collected data to solve the problem; and

storing the collected data in a storage device and labeling the data with the root cause of the problem associated with that data.

15. The method of claim 14 wherein the step of learning patterns is performed incrementally when new historical problem data is available.

16. The method of claim 14 wherein the hierarchical structure comprises one or more nodes and a linear classifier is trained for each node.

17. The method of claim 14 wherein the root cause is generated by traversing the hierarchy in a top-down fashion and utilizing the trained linear classifiers at each node.

18. The method of claim 14 further comprising the step of presenting the generated root cause and the collected data to a user via an input/output interface, wherein the user utilizes the root cause and the collected data to solve the problem.

19. The method of claim 18 further comprising the steps of:

receiving from a user either confirmation that the generated root cause is the actual root cause or, alternatively, a new root cause which was found to be the actual root cause; and

the collected data stored in the storage device is labeled with the actual root cause confirmed or entered from the user.

20. The method of claim 14 wherein the step of learning problem patterns further comprises storing the learned patterns in memory or a storage device.

21. The method of claim 20 further comprising the step of determining if a problem has occurred in the Information Technology environment by collecting monitoring data from the Information Technology environment and comparing the monitored data with the stored problem patterns.

22. A computer readable storage medium comprising a computer readable program, wherein the computer readable program when executed on a computer causes the computer to:

learn patterns of problem causes incrementally when new historical problem data is available by classifying the problem data into a predefined hierarchical structure, wherein the hierarchical structure comprises one or more nodes and a linear classifier is trained for each node, and wherein the learned patterns are stored in memory or a storage device;

determine if a problem has occurred in an Information Technology environment by collecting monitoring data from the Information Technology environment and comparing the monitored data with the stored problem patterns;

collect all available data from the Information Technology environment when a problem occurs;

generate a root cause of the problem using the collected data and the learned problem patterns by traversing the hierarchy in a top-down fashion and utilizing the trained linear classifiers at each node; and

store the collected data in a storage device and labeling the data with the root cause of the problem associated with that data.

23. The computer readable storage medium of claim 22 which, when executed on a computer, further causes the computer to utilize the generated root cause and the collected data to solve the problem.

24. The computer readable storage medium of claim 22 which, when executed on a computer, further causes the computer to present the generated root cause and the collected data to a user via an input/output interface, wherein the user utilizes the root cause and the collected data to solve the problem.

25. The computer readable storage medium of claim 24 which, when executed on a computer, further causes the computer to:

receive from a user either confirmation that the generated root cause is the actual root cause or, alternatively, a new root cause which was found to be the actual root cause; and

label the collected data stored in the storage device with the actual root cause confirmed or entered from the user.