Automatic Determination of Dynamic Threshold for Accurate Detection of Abnormalities

• US 20110238376A1
• Filed: 07/30/2010
• Published: 09/29/2011
• Est. Priority Date: 03/26/2010
• Status: Active Grant

• Current Assignee: BMC Software Incorporated (KKR & Co., Inc.)
• Original Assignee: BMC Software Incorporated (KKR & Co., Inc.)
• Inventors: Scarpelli, Joe, Dang, Derek, Lefaive, Alex, Sodem, Sridhar
• Granted Patent: US 8,457,928 B2
• Time in Patent Office: Days
• US Class Current: 702/186
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 2201/81 Threshold
• CPC Class Codes: G06F 2201/86 Event-based monitoring

Abstract

An improved performance management technique allows automatic determination dynamic thresholds of a metric based on a baseline of the matching pattern. A pattern matching process is conducted against a set of baseline patterns to find the matching pattern. If a matching pattern is found, the baseline of the matching pattern is used as the dynamic threshold. A series of sanity checks are performed to reduce any false alarms. If the metric does not follow any pattern, a composite of baselines is selected as the dynamic threshold.

Claims

1. A method for monitoring performance of an information technology system, the method comprising:

retrieving data for a metric, said metric indicative of one or more operating parameters of the information technology system;

identifying a set of baseline patterns of the metric, wherein each of the set of baseline patterns having a baseline;

determining whether the data matches one of the set of baseline patterns;

if a matching pattern is determined, selecting a baseline of the matching pattern;

or selecting a composite baseline if there is no matching pattern; and

applying the selected baseline to dynamically adjust an event threshold for the metric.

2. The method of claim 1, wherein the act of determining whether the data matches one of the set of baseline patterns comprises:

selecting a baseline pattern from the set of baseline patterns;

performing pattern matching analysis on the selected baseline pattern;

selecting a baseline of a matching pattern if the act of performing pattern matching analysis identifies a matching pattern; and

evaluating the selected baseline by conducting at least one sanity check.

3. The method of claim 2, wherein the act of performing pattern matching analysis on the selected baseline pattern comprises performing correlation analysis on the selected baseline pattern.

4. The method of claim 3, wherein the act of performing correlation analysis comprises:

generating a correlation coefficient using a correlation coefficient generating technique; and

returning a matching status if the correlation coefficient is greater than a pre-specified threshold value.

5. The method of claim 4, wherein the correlation coefficient generating technique is a Pearson Product technique.

6. The method of claim 4, wherein the pre-specified threshold value is configurable.

7. The method of claim 2, wherein the at least one sanity check comprises a slow, steady increase pattern.

8. The method of claim 2, wherein the at least one sanity check comprises a slow, steady decrease pattern.

9. The method of claim 2, wherein the at least one sanity check comprises a long-lasting alarms pattern.

10. The method of claim 2, wherein the at least one sanity check comprises a more alarms pattern.

11. The method of claim 1, wherein the act of selecting a composite baseline comprises generating the composite baseline by:

setting a minimum value amongst the baselines of the set of baseline patterns and a current threshold of the metric data as a lower bound of the composite baseline; and

setting a maximum value amongst the baselines of the set of baseline patterns and the current threshold of the metric data as an upper bound of the composite baseline.

16. A performance monitoring system, comprising:

a processor;

an operator display, coupled to the processor;

a storage subsystem, coupled to the processor; and

a software, stored by the storage subsystem, comprising instructions that when executed by the processor cause the processor to perform the method of claim 1.

17. A programmable storage device having programmed instructions stored thereon for causing a programmable control device to perform a method according to claim 1.

18. A networked computer system comprising:

a plurality of computers communicatively coupled, at least one of the plurality of computers programmed to perform at least a portion of the method of claim 1 wherein the entire method of claim 1 is performed collectively by the plurality of computers.

12. A method for monitoring performance of an information technology system, the method comprising:

retrieving data for a metric, said metric indicative of one or more operating parameters of the information technology system;

identifying a set of baseline patterns of the metric, wherein each of the set of baseline patterns having a baseline;

selecting a baseline pattern from the set of baseline patterns;

performing pattern matching analysis on the selected baseline pattern;

selecting a baseline of a matching pattern if the act of performing pattern matching analysis identifies a matching pattern; and

applying the selected baseline to dynamically adjust an event threshold for the metric.

13. The method of claim 12 further comprising evaluating the selected baseline by conducting at least one sanity check.

14. The method of claim 12, wherein the act of performing pattern matching analysis on the selected baseline pattern comprises performing correlation analysis on the selected baseline pattern.

15. The method of claim 14, wherein the act of performing correlation analysis comprises:

generating a correlation coefficient using a correlation coefficient generating technique; and

returning a matching status if the correlation coefficient is greater than a pre-specified threshold value.

19. A programmable storage device having programmed instructions stored thereon for causing a programmable control device to perform a method according to claim 12.