Supporting Detection of Failure Event

• US 20130191694A1
• Filed: 03/12/2013
• Published: 07/25/2013
• Est. Priority Date: 10/30/2008
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Gotoh, Yasuhisa, Kaneyasu, Yuhsuke
• Granted Patent: US 8,762,777 B2
• Time in Patent Office: Days
• US Class Current: 714/48
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: H04L 41/0604 using filtering, e.g. reduction of information by using priority, element types, position or time
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/0686 Additional information in the notification, e.g. enhancement of specific meta-data
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications

Abstract

In a mechanism for supporting detection of a failure event, history information of a system including log information of the system including plural components and/or failure information output from each component upon occurrence of a failure in the system is collected. A detection rule for detecting an event included in a component related to the failure that has occurred is generated, and a symptom with additional information added to the generated detection rule is applied to detect the event that has caused the failure. System configuration information as configuration information of the system is acquired, and from the acquired system configuration information, partial configuration information as system configuration information related to the component that sent out the event the selection of which has been accepted is extracted. The extracted partial configuration information is added to the symptom to update the symptom.

Claims

1-4. -4. (canceled)

5. A method comprising:

collecting history information of a system including plural components, the history information including log information of the system and failure information output from at least one component upon occurrence of a failure in the system;

generating a detection rule for detecting an event included in at least one component related to the failure that has occurred;

storing a symptom with additional information added to the generated detection rule;

acquiring system configuration information as configuration information of the system;

accepting selection of an event;

extracting, from the acquired system configuration information, partial configuration information as system configuration information related to a component that sent out the event the selection of which has been accepted; and

adding the extracted partial configuration information to the symptom to update the symptom.

11. The method of claim 5, wherein the instructions further cause the processor to:

calculate a degree-of-confidence value associated with the partial configuration information;

sort symptoms in ascending order of degree-of-confidence value; and

extract symptoms in order of degree-of-confidence.

12. The method of claim 11, wherein calculating the degree-of-confidence value comprises:

for each matching component, calculating a first degree-of-confidence value based on a first coefficient and an assigned value of the component;

for each link, calculating a second degree-of-confidence value based on a second coefficient and an assigned value of the link; and

adding the first degree-of-confidence value and the second degree-of-confidence value to form the degree-of-confidence value.

13. The method of claim 12, wherein calculating the degree-of-confidence value further comprises:

responsive to there being consecutive links, adding a third degree-of-confidence value to the degree-of-confidence value.

14. The method of claim 5, wherein the instructions further cause the processor to:

calculate a goodness of fit value associated with the partial configuration information; and

present symptom, partial configuration information, and goodness of fit value to the user.

15. The method of claim 14, wherein calculating the goodness of fit value comprises:

for each matching component, calculating a first goodness of fit value based on a first coefficient and an assigned value of the component;

for each link, calculating a second goodness of fit value based on a second coefficient and an assigned value of the link; and

adding the first goodness of fit value and the second goodness of fit value to form the goodness of fit value.

16. The method of claim 15, wherein calculating the goodness of fit value further comprises:

responsive to there being consecutive links, adding a third goodness of fit value to the goodness of fit value.

17. The method of claim 5, wherein the instructions further cause the processor to:

receive an input of a result of determination as to whether a symptom that fits the failure that has occurred has been detected correctly;

responsive to a determination that the symptom fits correctly, add to the partial configuration information an indication that the symptom was detected correctly; and

responsive to a determination that the symptom does not fit correctly, add to the partial configuration information an indication that the symptom was detected incorrectly.

18. The method of claim 5, extracting partial configuration information comprises extracting the partial configuration information to include related information among the components.

19. The method of claim 5, further comprising:

presenting the partial configuration information to a user; and

accepting an update of the presented partial configuration information from the user.

20. The method of claim 5, further comprising:

converting the log information and failure information into a unified data format.

6-10. -10. (canceled)