Predictive Alert Threshold Determination Tool

• US 20130346594A1
• Filed: 06/25/2012
• Published: 12/26/2013
• Est. Priority Date: 06/25/2012
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Banerjee, Joydeep, Wojciak, Paul A.
• Granted Patent: US 9,378,112 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3447 Performance evaluation by modeling
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: G06F 2201/81 Threshold

Abstract

Mechanisms are provided for determining threshold conditions for performing operations within a performance monitoring tool. Metric data is collected from a computing system environment and clustering analysis is performed on the metric data to generate a plurality of clusters. One or more candidate clusters are selected that are candidate clusters for generating a threshold condition for performance monitoring. At least one threshold condition for performance monitoring is generated based on a composition of the selected one or more candidate clusters. The at least one threshold condition is then applied to future performance metric data to determine whether to perform an operation in response to the future performance metric data meeting or not meeting the at least one threshold condition.

Claims

1. A method, in a data processing system, for determining threshold conditions for performing operations within a performance monitoring tool, comprising:

collecting, by the data processing system, performance metric data from a computing system environment;

performing, by the data processing system, clustering analysis on the performance metric data to generate a plurality of clusters of performance metric data for one or more performance metrics;

selecting, by the data processing system, one or more candidate clusters in the plurality of clusters that are candidate clusters for generating a threshold condition for performance monitoring;

generating, by the data processing system, at least one threshold condition for performance monitoring based on a composition of the selected one or more candidate clusters; and

applying the at least one threshold condition to future performance metric data to determine whether to perform an operation in response to the future performance metric data meeting or not meeting the at least one threshold condition.

2. The method of claim 1, wherein generating at least one threshold condition for performance monitoring comprises:

determining one or more cluster definition rules associated with the selected one or more candidate clusters, the one or more cluster definition rules being rules defining metric data values that are members of the selected one or more candidate clusters; and

generating at least one threshold condition for performance monitoring based on the one or more cluster definition rules.

3. The method of claim 2, wherein generating the at least one threshold condition comprises combining conditions of the one or more cluster definition rules to specify a relationship between the conditions that defines the at least one threshold condition.

4. The method of claim 1, wherein the operation is an operation to post or output an alert message.

5. The method of claim 1, wherein the operation is one of initiating an application operation, outputting data, or generating a log report.

6. The method of claim 1, wherein the performance metric data is derived performance metric data that is derived from raw performance metric data obtained from components of the computing system environment.

7. The method of claim 1, wherein performing clustering analysis on the performance metric data further comprises:

performing a parameter reduction operation on the performance metric data to reduce a number of parameters within the performance metric data on which the clustering analysis is performed.

8. The method of claim 7, wherein the parameter reduction operation comprises at least one of a principle components analysis (PCA), a feature selection or factor analysis operation, or exploratory analysis.

9. The method of claim 1, wherein generating at least one threshold condition further comprises searching existing threshold conditions for a similar threshold condition to the generated at least one threshold condition and modifying the similar threshold condition based on the generated at least one threshold condition.

10. The method of claim 1, wherein selecting one or more candidate clusters in the plurality of clusters that are candidate clusters for generating a threshold condition for performance monitoring comprises classifying clusters in the plurality of clusters into classifications according to pre-defined importance criteria.

11. The method of claim 10, wherein the pre-defined importance criteria are at least one of:

manually defined by a user specifically identifying which clusters in the plurality of clusters are to be selected via a user interface,

semi-automatically defined based on user input specifying general importance criteria but otherwise automatically selecting the one or more candidate clusters based on the general importance criteria, or

fully automatically defined by an automated mechanism automatically defining the pre-defined importance criteria based on analysis of the performance metric data.

12. A computer program product comprising a computer readable storage medium having a computer readable program stored therein, wherein the computer readable program, when executed on a computing device, causes the computing device to:

collect performance metric data from a computing system environment;

perform clustering analysis on the performance metric data to generate a plurality of clusters of performance metric data for one or more performance metrics;

select one or more candidate clusters in the plurality of clusters that are candidate clusters for generating a threshold condition for performance monitoring;

generate at least one threshold condition for performance monitoring based on a composition of the selected one or more candidate clusters; and

apply the at least one threshold condition to future performance metric data to determine whether to perform an operation in response to the future performance metric data meeting or not meeting the at least one threshold condition.

13. The computer program product of claim 12, wherein the computer readable program further causes the computing device to generate at least one threshold condition for performance monitoring by:

determining one or more cluster definition rules associated with the selected one or more candidate clusters, the one or more cluster definition rules being rules defining metric data values that are members of the selected one or more candidate clusters; and

generating at least one threshold condition for performance monitoring based on the one or more cluster definition rules.

14. The computer program product of claim 12, wherein the computer readable program further causes the computing device to generate the at least one threshold condition by combining conditions of the one or more cluster definition rules to specify a relationship between the conditions that defines the at least one threshold condition.

15. The computer program product of claim 12, wherein the operation is an operation to post or output an alert message.

16. The computer program product of claim 12, wherein the operation is one of initiating an application operation, outputting data, or generating a log report.

17. The computer program product of claim 12, wherein the performance metric data is derived performance metric data that is derived from raw performance metric data obtained from components of the computing system environment.

18. The computer program product of claim 12, wherein the computer readable program further causes the computing device to perform clustering analysis on the performance metric data further by:

performing a parameter reduction operation on the performance metric data to reduce a number of parameters within the performance metric data on which the clustering analysis is performed.

19. The computer program product of claim 18, wherein the parameter reduction operation comprises at least one of a principle components analysis (PCA), a feature selection or factor analysis operation, or exploratory analysis.

20. The computer program product of claim 12, wherein the computer readable program further causes the computing device to generate at least one threshold condition further by searching existing threshold conditions for a similar threshold condition to the generated at least one threshold condition and modifying the similar threshold condition based on the generated at least one threshold condition.

21. The computer program product of claim 12, wherein the computer readable program further causes the computing device to select one or more candidate clusters in the plurality of clusters that are candidate clusters for generating a threshold condition for performance monitoring by classifying clusters in the plurality of clusters into classifications according to pre-defined importance criteria.

22. The computer program product of claim 21, wherein the pre-defined importance criteria are at least one of:

manually defined by a user specifically identifying which clusters in the plurality of clusters are to be selected via a user interface,

semi-automatically defined based on user input specifying general importance criteria but otherwise automatically selecting the one or more candidate clusters based on the general importance criteria, or

fully automatically defined by an automated mechanism automatically defining the pre-defined importance criteria based on analysis of the performance metric data.

23. An apparatus, comprising:

a processor; and

a memory coupled to the processor, wherein the memory comprises instructions which, when executed by the processor, cause the processor to;

collect performance metric data from a computing system environment;

perform clustering analysis on the performance metric data to generate a plurality of clusters of performance metric data for one or more performance metrics;

select one or more candidate clusters in the plurality of clusters that are candidate clusters for generating a threshold condition for performance monitoring;

generate at least one threshold condition for performance monitoring based on a composition of the selected one or more candidate clusters; and

apply the at least one threshold condition to future performance metric data to determine whether to perform an operation in response to the future performance metric data meeting or not meeting the at least one threshold condition.

24. The apparatus of claim 23, wherein the instructions further cause the processor to generate at least one threshold condition for performance monitoring by:

determining one or more cluster definition rules associated with the selected one or more candidate clusters, the one or more cluster definition rules being rules defining metric data values that are members of the selected one or more candidate clusters; and

generating at least one threshold condition for performance monitoring based on the one or more cluster definition rules.

25. The apparatus of claim 23, wherein the instructions further cause the processor to perform clustering analysis on the performance metric data further by:

performing a parameter reduction operation on the performance metric data to reduce a number of parameters within the performance metric data on which the clustering analysis is performed.