FEEDBACK-BASED SYMPTOM AND CONDITION CORRELATION

• US 20120303793A1
• Filed: 05/26/2011
• Published: 11/29/2012
• Est. Priority Date: 05/26/2011
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Jayapal, Prasanna Kumar, Rizzi, Lorenzo, Sanghvi, Ashvin J., Mestemaker, Paul A., DePue, Adam C., Gilbert, Mark
• Granted Patent: US 8,812,659 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis

Abstract

Feedback data can be received from client agents running on client computer systems. The feedback data can include data on the symptoms and conditions for rules that relate computer system symptoms to computer system conditions. The feedback data can be analyzed to produce correlation information that quantifies a degree of correlation between the symptom(s) and condition(s) related by the rule(s). It may be determined whether analysis of the feedback data warrants including one of the rules in correlation mappings to be applied to monitored computer systems. If so, then that rule can be included in the mappings. Information representing the correlation mappings may be transmitted to the monitored computer system(s). Additionally, information representing the correlation mappings may be transmitted to the monitored computer system(s), and types of feedback data collected from the client agents can be altered on the basis of the correlation information.

Claims

1. A computer-implemented method, comprising:

receiving user input, the user input identifying one or more rules, each of the one or more rules relating one or more computer system symptoms to one or more computer system conditions;

receiving feedback data from a plurality of client agents running on a plurality of client computer systems, the feedback data including data on the one or more symptoms in the client computer systems for each of the one or more rules and on the one or more conditions in the client computer systems for each of the one or more rules;

analyzing the feedback data to produce correlation information for each of the one or more rules, the correlation information quantifying a degree of correlation between the one or more symptoms and the one or more conditions related by each of the one or more rules;

generating computer support information derived from at least one of the one or more rules; and

altering types of feedback data collected from the plurality of client agents, the alteration being based on the correlation information.

2. The method of claim 1, wherein the one or more rules comprise one or more hypotheses and a set of one or more correlation mappings to be applied to a set of one or more computer systems, and wherein the method further comprises determining whether the correlation information warrants including at least one of the one or more hypotheses in the set of one or more correlation mappings.

3. The method of claim 2, further comprising including the at least one of the one or more hypotheses in the set of one or more correlation mappings if it is determined that the inclusion of the at least one hypothesis is warranted by the feedback data.

4. The method of claim 2, wherein altering types of feedback data collected from the plurality of client agents comprises instructing the plurality of client agents to refrain from collecting data related to one or more rules that have been removed from the set of one or more mappings.

5. The method of claim 2, further comprising applying the set of one or more correlation mappings to a set of monitored computer systems, applying the set of one or more mappings including determining for each monitored computer system in the set of monitored computer systems whether one or more of the one or more mappings is met in that monitored computer system.

6. The method of claim 5, further comprising processing an alert if one of the mappings is met in a monitored computer system in the set of monitored computer systems.

7. The method of claim 2, further comprising refining the set of correlation mappings based on the correlation information.

8. The method of claim 1, wherein the feedback data comprises one or more indications of one or more conditions that are not present on one or more computer systems.

9. The method of claim 1, further comprising instructing the client agents to limit the feedback data to data that meets one or more conditions.

10. The method of claim 1, wherein the correlation information comprises a correlation weight for each of the one or more rules.

11. One or more computer-readable storage media having computer-executable instructions embodied thereon that, when executed by at least one processor, cause the at least one processor to perform acts comprising:

receiving feedback data from a plurality of client agents running on a plurality of client computer systems, the feedback data including data on one or more computer system symptoms in the client computer systems for each of one or more rules and data on one or more computer system conditions in the client computer systems for each of the one or more rules, each of the one or more rules relating one or more of the conditions to one or more of the symptoms;

analyzing the feedback data to produce correlation information for each of the one or more rules;

altering types of feedback data collected from the plurality of client agents, the alteration being based on analysis of the feedback data received from the client agents;

determining whether the analysis of the feedback data warrants including at least one of the one or more rules in a set of correlation mappings to be applied to a set of one or more monitored computer systems;

if the analysis of the feedback data warrants including at least one of the one or more rules in the set of correlation mappings, then including the at least one of the one or more rules in the set of correlation mappings; and

transmitting to the set of one or more monitored computer systems information representing the set of correlation mappings.

12. The one or more computer-readable storage media of claim 11, further comprising refining the set of correlation mappings based on an analysis of additional feedback data received from the set of one or more monitored computer systems applying the set of correlation mappings.

13. The one or more computer-readable storage media of claim 12, wherein refining the set of correlation mappings comprises altering a mapping by adding a computer system condition item to the altered mapping.

14. The one or more computer-readable storage media of claim 12, wherein refining the set of correlation mappings comprises altering a mapping by removing a computer system condition item from the altered mapping.

15. The one or more computer-readable storage media of claim 12, wherein refining the set of correlation mappings comprises tracking correlation weights of the correlation mappings.

16. The one or more computer-readable storage media of claim 12, wherein refining the set of correlation mappings comprises removing one or more correlation mappings from the set of correlation mappings based on one or more correlation weights of the one or more removed correlation mappings.

17. The one or more computer-readable storage media of claim 11, wherein altering types of feedback data collected from the plurality of client agents comprises instructing the plurality of client agents to refrain from collecting data related to one or more rules that have been removed from the set of mappings.

18. One or more computer-readable storage media having computer-executable instructions embodied thereon that, when executed by at least one processor, cause the at least one processor to perform acts comprising:

receiving user input identifying one or more hypotheses, each of the one or more hypotheses relating one or more computer system symptoms to one or more computer system settings;

transmitting to client computer systems runnable content comprising instructions that when executed on a computer system performs acts comprising;

collecting feedback data including data on the one or more symptoms and the one or more settings for each of the one or more hypotheses, collecting the feedback data comprising making one or more instrumentation measurements; and

transmitting the feedback data to a data store;

obtaining the feedback data from the data store;

analyzing the feedback data to produce correlation information for each of the one or more hypotheses, the correlation information including one or more correlation weights that each quantify a degree of correlation between one or more symptoms and one or more settings of a hypothesis;

determining whether analysis of the feedback data warrants including at least one of the one or more hypotheses in a set of correlation mappings to be applied to a set of one or more monitored computer systems;

including the at least one of the one or more hypotheses in the set of correlation mappings if it is determined that the inclusion is warranted by the feedback data;

transmitting mapping representations to the monitored computer systems, the mapping representations including instructions that, when executed in the set of monitored computer systems, apply the set of correlation mappings to the monitored computer systems;

receiving an alert if criteria of one or more of the mappings is met in the set of monitored computer systems; and

refining the set of correlation mappings based on analysis of additional feedback data received from the set of monitored computer systems; and

transmitting updated runnable content to the client systems, the updated runnable content altering types of feedback data collected from the client systems.

19. The one or more computer-readable storage media of claim 18, wherein refining the set of correlation mappings comprises:

determining whether the analysis of the additional feedback data warrants retiring one or more mappings from the set of correlation mappings; and

if the analysis of the additional feedback data warrants retiring one or more mappings from the set of correlation mappings, then retiring one or more mappings from the set of correlation mappings.

20. The one or more computer-readable storage media of claim 18, wherein refining the set of correlation mappings comprises:

determining whether the analysis of the additional feedback data warrants regressing one or more mappings from the set of correlation mappings to hypothesis status; and

if the analysis of the additional feedback data warrants regressing one or more mappings from the set of correlation mappings to hypothesis status, then regressing one or more mappings from the set of correlation mappings to hypothesis status.