Supporting Detection of Failure Event

• US 20110202802A1
• Filed: 10/20/2009
• Published: 08/18/2011
• Est. Priority Date: 10/30/2008
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Kaneyasu, Yuhsuke, Gotoh, Yasuhisa
• Granted Patent: US 8,806,273 B2
• Time in Patent Office: Days
• US Class Current: 714/45
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: H04L 41/0604 using filtering, e.g. reduction of information by using priority, element types, position or time
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/0686 Additional information in the notification, e.g. enhancement of specific meta-data
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications

Abstract

In a mechanism for supporting detection of a failure event, history information of a system including log information of the system including plural components and/or failure information output from each component upon occurrence of a failure in the system is collected. A detection rule for detecting an event included in a component related to the failure that has occurred is generated, and a symptom with additional information added to the generated detection rule is applied to detect the event that has caused the failure. System configuration information as configuration information of the system is acquired, and from the acquired system configuration information, partial configuration information as system configuration information related to the component that sent out the event the selection of which has been accepted is extracted. The extracted partial configuration information is added to the symptom to update the symptom.

Claims

1. An apparatus comprising:

a processor; and

a memory coupled to the processor, wherein the memory comprises instructions which, when executed by the processor, cause the processor to;

collect history information of a system including plural components, the history information including log information of the system and failure information output from at least one component upon occurrence of a failure in the system;

a detection rule for detecting an event included in at least one component related to the failure that has occurred;

store a symptom with additional information added to the generated detection rule;

acquire system configuration information as configuration information of the system;

accept selection of an event;

extract, from the acquired system configuration information, partial configuration information as system configuration information related to a component that sent out the event the selection of which has been accepted; and

add the extracted partial configuration information to the symptom to update the symptom.

2. The apparatus of claim 1, extracting partial configuration information comprises extracting the partial configuration information to include related information among the components.

3. The apparatus of claim 1, wherein the instructions further cause the processor to:

present the partial configuration information to a user; and

accept an update of the presented partial configuration information from the user.

4. The apparatus of claim 1, wherein the instructions further cause the processor to:

convert the log information and failure information into a unified data format.

11. The apparatus of claim 1, wherein the instructions further cause the processor to:

calculate a degree-of-confidence value associated with the partial configuration information;

sort symptoms in ascending order of degree-of-confidence value; and

extract symptoms in order of degree-of-confidence.

12. The apparatus of claim 11, wherein calculating the degree-of-confidence value comprises:

for each matching component, calculating a first degree-of-confidence value based on a first coefficient and an assigned value of the component;

for each link, calculating a second degree-of-confidence value based on a second coefficient and an assigned value of the link; and

adding the first degree-of-confidence value and the second degree-of-confidence value to form the degree-of-confidence value.

13. The apparatus of claim 12, wherein calculating the degree-of-confidence value further comprises:

responsive to there being consecutive links, adding a third degree-of-confidence value to the degree-of-confidence value.

14. The apparatus of claim 1, wherein the instructions further cause the processor to:

calculate a goodness of fit value associated with the partial configuration information; and

present symptom, partial configuration information, and goodness of fit value to the user.

15. The apparatus of claim 14, wherein calculating the goodness of fit value comprises:

for each matching component, calculating a first goodness of fit value based on a first coefficient and an assigned value of the component;

for each link, calculating a second goodness of fit value based on a second coefficient and an assigned value of the link; and

adding the first goodness of fit value and the second goodness of fit value to form the goodness of fit value.

16. The apparatus of claim 15, wherein calculating the goodness of fit value further comprises:

responsive to there being consecutive links, adding a third goodness of fit value to the goodness of fit value.

17. The apparatus of claim 1, wherein the instructions further cause the processor to:

receive an input of a result of determination as to whether a symptom that fits the failure that has occurred has been detected correctly;

responsive to a determination that the symptom fits correctly, add to the partial configuration information an indication that the symptom was detected correctly; and

responsive to a determination that the symptom does not fit correctly, add to the partial configuration information an indication that the symptom was detected incorrectly.

5. A method comprising:

collecting history information of a system including plural components, the history information including log information of the system and failure information output from at least one component upon occurrence of a failure in the system;

generating a detection rule for detecting an event included in at least one component related to the failure that has occurred;

storing a symptom with additional information added to the generated detection rule;

acquiring system configuration information as configuration information of the system;

accepting selection of an event;

extracting, from the acquired system configuration information, partial configuration information as system configuration information related to a component that sent out the event the selection of which has been accepted; and

adding the extracted partial configuration information to the symptom to update the symptom.

18. The method of claim 5, wherein the instructions further cause the processor to:

calculate a degree-of-confidence value associated with the partial configuration information;

sort symptoms in ascending order of degree-of-confidence value; and

extract symptoms in order of degree-of-confidence.

19. The method of claim 18, wherein calculating the degree-of-confidence value comprises:

for each matching component, calculating a first degree-of-confidence value based on a first coefficient and an assigned value of the component;

for each link, calculating a second degree-of-confidence value based on a second coefficient and an assigned value of the link; and

adding the first degree-of-confidence value and the second degree-of-confidence value to form the degree-of-confidence value.

20. The method of claim 19, wherein calculating the degree-of-confidence value further comprises:

responsive to there being consecutive links, adding a third degree-of-confidence value to the degree-of-confidence value.

21. The method of claim 5, wherein the instructions further cause the processor to:

calculate a goodness of fit value associated with the partial configuration information; and

present symptom, partial configuration information, and goodness of fit value to the user.

22. The method of claim 21, wherein calculating the goodness:

of fit value comprises;

for each matching component, calculating a first goodness of fit value based on a first coefficient and an assigned value of the component;

for each link, calculating a second goodness of fit value based on a second coefficient and an assigned value of the link; and

adding the first goodness of fit value and the second goodness of fit value to form the goodness of fit value.

23. The method of claim 22, wherein calculating the goodness of fit value further comprises:

responsive to there being consecutive links, adding a third goodness of fit value to the goodness of fit value.

24. The method of claim 5, wherein the instructions further cause the processor to:

receive an input of a result of determination as to whether a symptom that fits the failure that has occurred has been detected correctly;

responsive to a determination that the symptom fits correctly, add to the partial configuration information an indication that the symptom was detected correctly; and

responsive to a determination that the symptom does not fit correctly, add to the partial configuration information an indication that the symptom was detected incorrectly.

6. A computer program product comprising a computer recording medium having stored thereon a computer program capable of being executed on a computer to support detection of an event that has caused a failure in a system including plural components, the program causing the computer to:

collect history information of the system including log information of the system and failure information output from at least one component upon occurrence of the failure in the system;

generate a detection rule for detecting an event included in at least one component related to the failure that has occurred;

store a symptom with additional information added to the generated detection rule;

acquire system configuration information as configuration information of the system;

accept selection of an event;

extract, from the acquired system configuration information, partial configuration information as system configuration information related to a component that sent out the event the selection of which has been accepted; and

add the extracted partial configuration information to the symptom to update the symptom.

7. The computer program product of claim 6, wherein extracting the partial configuration information comprises extracting the partial configuration information to include related information among the components.

8. The computer program product of claim 6, the program causing the computer to:

present the partial configuration information extracted by the partial configuration information extracting means; and

accept an update of the presented partial configuration information.

9. The computer program product of claim 6, the program further causing the computer to:

convert the log information and failure information into a unified data format.

10. (canceled)