REDUCTION OF ALERTS IN INFORMATION TECHNOLOGY SYSTEMS

• US 20130132551A1
• Filed: 01/11/2013
• Published: 05/23/2013
• Est. Priority Date: 04/08/2011
• Status: Active Grant

• Current Assignee: Globalfoundries US Incorporated (GlobalFoundries, Inc.)
• Original Assignee: International Business Machines Corporation
• Inventors: Bose, Abhijit, Guo, Shang Q., Luan, Laura Z., Rosu, Daniela, Smadi, Mithkal M., Cheng, Winnie W., Kim, Sang K., Perpetua, Dennis A. Jr.
• Granted Patent: US 8,751,623 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/076 by exceeding a count or rate limit, e.g. word- or bit count limit
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3072 where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: H04L 41/50 Network service management, e.g. ensuring proper service fulfilment according to agreements

Abstract

Aspects of the present invention dynamically reduce a frequency at which IT infrastructure automatically generates alerts. Historical data across a plurality of data sources in the IT infrastructure is analyzed. An opportunity to reduce the frequency at which the IT infrastructure automatically generates the alerts is identified. A new alert policy addressing the opportunity to reduce alert frequency is generated. An impact of the new alert policy on a set of predefined service level objectives (SLOs) and service level agreements (SLAs) is evaluated. The new alert policy is deployed in the IT infrastructure.

Claims

1. A method for dynamically reducing a frequency at which an information technology (IT) infrastructure automatically generates alerts, the method comprising the steps of:

at least one processor identifying an opportunity to reduce a frequency at which the IT infrastructure automatically generates the alerts, the identifying comprising detecting, using historical data from a plurality of data sources in the IT infrastructure, false alerts generated in the IT infrastructure;

generating a new alert policy that addresses the opportunity to reduce the frequency; and

performing a simulation of applying the new alert policy in the IT infrastructure using historical data from a plurality of data sources in the IT infrastructure.

2. The method of claim 1, further comprising the step of deploying the new alert policy in the IT infrastructure.

3. The method of claim 1, further comprising calculating, based on the simulation, a projected reduction in false alerts that, by applying the new alert policy in the IT infrastructure, would occur in the IT infrastructure while ensuring that service level agreements and service level objectives are satisfied.

4. The method of claim 1, wherein the step of identifying the opportunity to reduce the frequency at which the IT infrastructure automatically generates the alerts comprises the computer classifying a plurality of incident tickets based on a solution field.

5. The method of claim 1, wherein the step of generating the new alert policy addressing the opportunity to reduce the frequency comprises the computer adjusting a threshold associated with a current alert policy of the IT infrastructure.

6. The method of claim 1, further comprising the at least one processor assessing the risk of applying the new alert policy in the IT infrastructure.

7. The method of claim 1, further comprising generating a benefit model representing an expected alert reduction rate across the IT infrastructure.

8. The method of claim 6, wherein the assessing step comprises the determining the impact of the new alert policy on a plurality of Key Performance Indicators (KPIs).

9. A computer program product for dynamically reducing the frequency at which an information technology (IT) infrastructure automatically generates alerts, the computer program product comprising one or more computer-readable tangible storage devices and program instructions stored on at least one of the one or more computer-readable tangible storage devices, the program instructions comprising:

program instructions to identify an opportunity to reduce a frequency at which the IT infrastructure automatically generates the alerts, the program instructions to identify the opportunity to reduce the frequency comprising program instructions to detect, using historical data from a plurality of data sources in the IT infrastructure, false alerts generated in the IT infrastructure;

program instructions to generate a new alert policy that addresses the opportunity to reduce the frequency; and

program instructions to perform a simulation of applying the new alert policy in the IT infrastructure using historical data from a plurality of data sources in the IT infrastructure.

10. The computer program product of claim 9, further comprising program instructions to deploy the new alert policy in the IT infrastructure.

11. The computer program product of claim 9, further comprising program instructions to calculate, based on the simulation, a projected reduction in false alerts that, by applying the new alert policy in the IT infrastructure, would occur in the IT infrastructure while the program instructions to calculate the projected reduction ensure that service level agreements and service level objectives are satisfied.

12. The computer program product of claim 9, wherein the program instructions to identify the opportunity to reduce the frequency comprise program instructions to classify a plurality of incident tickets based on a solution field.

13. The computer program product of claim 9, wherein the program instructions to generate a new alert policy addressing the opportunity to reduce the frequency comprise program instructions to adjust a threshold associated with a current alert policy of the IT infrastructure.

14. The computer program product of claim 9, further comprising program instructions to assess the risk of applying the new alert policy in the IT infrastructure.

15. The computer program product of claim 9, further comprising program instructions to generate a benefit model representing an expected alert reduction rate across the IT infrastructure.

16. The computer program product of claim 14, wherein the program instructions to assess the risk of applying the new alert policy comprise program instructions to determine the impact of the new alert policy on a plurality of Key Performance Indicators (KPIs).

17. A computer system for dynamically reducing the frequency at which an information technology (IT) infrastructure automatically generates alerts, the computer system comprising one or more processors, one or more computer-readable memories, one or more computer-readable tangible storage devices, and program instructions stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, the program instructions comprising:

program instructions to identify an opportunity to reduce a frequency at which the IT infrastructure automatically generates the alerts, the program instructions to identify the opportunity to reduce the frequency comprising program instructions to detect, using historical data from a plurality of data sources in the IT infrastructure, false alerts generated in the IT infrastructure;

program instructions to generate a new alert policy that addresses the opportunity to reduce the frequency; and

program instructions to perform a simulation of applying the new alert policy in the IT infrastructure using historical data from a plurality of data sources in the IT infrastructure.

18. The computer system of claim 17, further comprising program instructions to deploy the new alert policy in the IT infrastructure.

19. The computer system of claim 17, further comprising program instructions to calculate, based on the simulation, a projected reduction in false alerts that, by applying the new alert policy in the IT infrastructure, would occur in the IT infrastructure while the program instructions to calculate the projected reduction ensure that service level agreements and service level objectives are satisfied.

20. The computer system of claim 17, wherein the program instructions to identify the opportunity to reduce the frequency comprise program instructions to classify a plurality of incident tickets based on a solution field.

21. The computer system of claim 17, wherein the program instructions to generate a new alert policy addressing the opportunity to reduce the frequency comprise program instructions to adjust a threshold associated with a current alert policy of the IT infrastructure.

22. The computer system of claim 17, further comprising program instructions to assess the risk of applying the new alert policy in the IT infrastructure.

23. The computer system of claim 17, further comprising program instructions to generate a benefit model representing an expected alert reduction rate across the IT infrastructure.

24. The computer system of claim 22, wherein the program instructions to assess the risk of applying the new alert policy comprise program instructions to determine the impact of the new alert policy on a plurality of Key Performance Indicators (KPIs).