ADAPTIVE FAULT DIAGNOSIS

• US 20140172371A1
• Filed: 02/20/2013
• Published: 06/19/2014
• Est. Priority Date: 12/04/2012
• Status: Active Grant

• Current Assignee: Accenture Global Services Limited (Accenture PLC)
• Original Assignee: Accenture Global Services Limited (Accenture PLC)
• Inventors: TUNG, Teresa, Zhu, Qian, XIE, Qing
• Granted Patent: US 9,298,525 B2
• Time in Patent Office: Days
• US Class Current: 702/185
• CPC Class Codes: G06F 11/0703 Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06Q 10/00 Administration; Management
• CPC Class Codes: G06Q 10/0639 Performance analysis of employees; Performance analysis of enterprise or organisation operations

Abstract

According to an example, an adaptive fault diagnosis system may include a memory storing machine readable instructions to receive metrics and events from an enterprise system, and use a substitution graph to determine if a received metric or a received event belongs to a cluster that includes one or more correlated metrics and/or events grouped based on similarity. If the received metric or the received event belongs to the cluster, the memory may further store machine readable instructions to use a detection graph to determine if the received metric or the received event is identifiable to form a fault pattern by traversing a fault path of the detection graph. Further, the memory may further store machine readable instructions to diagnose a fault based on the traversal of the fault path of the detection graph. The system may include a processor to implement the machine readable instructions.

Claims

1. An adaptive fault diagnosis system comprising:

a memory storing machine readable instructions to;

receive metrics and events from an enterprise system;

use a substitution graph to determine if a received metric or a received event belongs to a cluster that includes at least one of one or more correlated metrics and events grouped based on similarity;

if the received metric or the received event belongs to the cluster, use a detection graph to determine if the received metric or the received event is identifiable to form a fault pattern by traversing a fault path of the detection graph; and

diagnose a fault based on the traversal of the fault path of the detection graph; and

a processor to implement the machine readable instructions.

2. The adaptive fault diagnosis system of claim 1, further comprising machine readable instructions to:

generate the substitution graph by;

collecting metrics and events created by injection of a plurality of labeled faults in a training enterprise system;

using the collected metrics and events to generate the substitution graph to group at least one of one or more collected metrics and one or more collected events into a plurality of clusters such that at least one of the one or more collected metrics and events grouped in one cluster are more strongly related to at least one of the one or more collected metrics and events grouped in the one cluster as compared to at least one of the one or more collected metrics and events in other clusters; and

scoring each cluster based on how at least one of the one or more collected metrics and events in the scored cluster originated.

3. The adaptive fault diagnosis system of claim 1, further comprising machine readable instructions to:

generate the detection graph by;

collecting metrics and events created by injection of a plurality of labeled faults in a training enterprise system; and

using the collected metrics and events to generate the detection graph by;

ordering and connecting at least one of one or more collected metrics and events based on respective timestamps.

4. The adaptive fault diagnosis system of claim 3, wherein using the collected metrics and events to generate the detection graph further comprises machine readable instructions to:

select at least one of one or more collected metrics and events critical to a fault to form a fault pattern by using an EDGERANK process.

5. The adaptive fault diagnosis system of claim 3, wherein using the collected metrics and events to generate the detection graph further comprises machine readable instructions to:

select at least one of one or more collected metrics and events critical to a fault to form a fault pattern based on affinity, weight, and time decay related to at least one of the one or more collected metrics and events.

6. The adaptive fault diagnosis system of claim 3, wherein using the collected metrics and events to generate the detection graph further comprises machine readable instructions to:

rank at least one of the one or more collected metrics and events based on contribution to fault identification; and

select at least one of one or more ranked metrics and events critical to a fault to form a fault pattern.

7. The adaptive fault diagnosis system of claim 1, further comprising machine readable instructions to:

monitor a subset of the received metrics and events from the enterprise system based on previously detected fault patterns.

8. The adaptive fault diagnosis system of claim 1, further comprising machine readable instructions to:

update at least one of the substitution graph and the detection graph based on a new detected fault.

9. The adaptive fault diagnosis system of claim 1, further comprising machine readable instructions to:

utilize the fault pattern as a template to diagnose a new fault that includes at least one of different events and different metrics compared to at least one of the events and metrics of the fault pattern.

10. The adaptive fault diagnosis system of claim 1, wherein the substitution graph includes a metric A correlated to a metric B if the metric A is a function of the metric B.

11. The adaptive fault diagnosis system of claim 1, wherein the substitution graph includes an event A correlated to an event B if the event A and the event B always appear simultaneously or with a fixed order.

12. The adaptive fault diagnosis system of claim 1, wherein the substitution graph includes an event A correlated to a metric B if the event A occurs after the metric B reaches a threshold, or if the event A includes the metric B.

13. The adaptive fault diagnosis system of claim 1, wherein diagnosing the fault based on the traversal of the fault path of the detection graph further comprises machine readable instructions to:

determine if the fault path cannot be expanded, and diagnosing no fault;

determine if no additional metrics or events on the fault path match with known fault patterns, and diagnosing no fault; and

determine if traversal of the fault path matches a fault pattern, and diagnosing a fault.

14. The adaptive fault diagnosis system of claim 1, wherein diagnosing the fault based on the traversal of the fault path of the detection graph further comprises machine readable instructions to:

estimate a probability to determine if the fault path leads to a known fault.

15. The adaptive fault diagnosis system of claim 1, wherein diagnosing the fault further comprises machine readable instructions to:

determine a probability of detecting an unknown fault.

16. The adaptive fault diagnosis system of claim 1, further comprising machine readable instructions to:

adjust a threshold related to the fault pattern based on a ratio of applicability of a training enterprise system to the enterprise system.

17. The adaptive fault diagnosis system of claim 1, wherein the enterprise system is a cloud-based enterprise system.

18. A method for adaptive fault diagnosis, the method comprising:

receiving metrics and events from an enterprise system;

using a substitution graph to determine if a received metric or a received event belongs to a cluster that includes at least one of one or more correlated metrics and events grouped based on similarity;

if the received metric or the received event belongs to the cluster, using a detection graph to determine if the received metric or the received event is identifiable to form a fault pattern by traversing a fault path of the detection graph; and

diagnosing, by a processor, a fault based on the traversal of the fault path of the detection graph.

19. The method of claim 18, further comprising:

generating the substitution graph and the detection graph by;

collecting metrics and events created by injection of a plurality of labeled faults in a training enterprise system;

using the collected metrics and events to generate the substitution graph to group at least one of one or more collected metrics and one or more collected events into a plurality of clusters such that at least one of the one or more collected metrics and events grouped in one cluster are more strongly related to at least one of the one or more collected metrics and events grouped in the one cluster as compared to at least one of the one or more collected metrics and events in other clusters; and

using the collected metrics and events to generate the detection graph by ordering and connecting at least one of the one or more collected metrics and events based on respective timestamps.

20. A non-transitory computer readable medium having stored thereon a computer executable program to provide adaptive fault diagnosis, the computer executable program when executed causes a computer system to:

receive metrics and events from an enterprise system;

use a substitution graph to determine if a received metric or a received event belongs to a cluster that includes at least one of one or more correlated metrics and events grouped based on similarity;

if the received metric or the received event belongs to the cluster, use a detection graph to determine if the received metric or the received event is identifiable to form a fault pattern by traversing a fault path of the detection graph; and

diagnose, by a processor, a fault based on the traversal of the fault path of the detection graph.