AUTOMATED DETECTION OF A SYSTEM ANOMALY

• US 20140229768A1
• Filed: 09/21/2011
• Published: 08/14/2014
• Est. Priority Date: 09/21/2011
• Status: Active Grant

• Current Assignee: Micro Focus LLC (Open Text Corporation)
• Original Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Inventors: Bernstein, Ruth, Cohen, Ira, Samuni, Eran
• Granted Patent: US 9,292,408 B2
• Time in Patent Office: Days
• US Class Current: 714/39
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/3419 by assessing time
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: H04L 41/065 involving logical or physical relationship, e.g. grouping and hierarchies
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 43/16 Threshold monitoring

Abstract

A method for automated detection of a real IT system problem may include obtaining monitor measurements of metrics associated with activities of a plurality of configuration items of the IT system. The method may also include detecting anomalies in the monitor measurements. The method may further include grouping concurrent anomalies of the detected anomalies corresponding to configuration items of the plurality of configuration items which are topologically linked to be regarded as a system anomaly. The method may further include calculating a significance score for the system anomaly, and determining that the system anomaly relates to a real system problem based on the calculated significance score.

Claims

1. A method for automated detection of a real IT system problem, the method comprising:

obtaining monitor measurements of metrics associated with activities of a plurality of configuration items of the IT system;

detecting anomalies in the monitor measurements;

grouping concurrent anomalies of the detected anomalies corresponding to configuration items of the plurality of configuration items which are topologically linked to be regarded as a system anomaly;

calculating a significance score for the system anomaly; and

determining that the system anomaly relates to a real system problem based on the calculated significance score.

2. The method of claim 1, wherein the detection of anomalies in the monitor measurements is based on an established baseline for each of the metrics.

3. The method of claim 1, further comprising saving information on real system anomalies in an anomaly knowledgebase for future reference.

4. The method of claim 3, further comprising searching the anomaly knowledgebase to find past similar significant anomalies.

6. The method of claim 1, further comprising referring to a threshold in the calculation of the significance score of the grouped anomalies.

5. The method of claim further comprising alerting a user of the determining of the real system problem.

7. A non-transitory computer readable medium having stored thereon instructions that when executed by a processor will cause the processor to perform the method of:

obtaining monitor measurements of metrics associated with activities of a plurality of configuration items of the IT system and establishing a baseline for each of the metrics;

detecting anomalies in the monitor measurements by referring to the baseline for each of the metrics;

grouping concurrent anomalies of the detected anomalies corresponding to configuration items of the plurality of configuration items which are topologically linked to be regarded as a system anomaly;

calculating a significance score for the system anomaly; and

determining that the system anomaly relates to a real system problem based on the calculated significance score.

8. The non-transitory computer readable medium of claim 7, wherein the baseline is determined over time.

9. The non-transitory computer readable medium of claim 7, wherein the calculation of the significance score includes using one or more of the parameters selected from the group consisting of a minimal number of configuration items of the plurality of configuration items expected in a significant system anomaly, a minimal number of metrics expected in a significant system anomaly, abnormality measure, and weight of an anomaly in relation to normal metric events.

10. The on-transitory computer readable medium of claim 7, wherein instructions further comprise saving information on real system anomalies in an anomaly knowledgebase for future reference.

11. An apparatus for automated detection of a real IT system problem, the system comprising:

a plurality of monitors to obtain monitor measurements of metrics associated with activities of a plurality of configuration items of the IT system;

a processor for detecting anomalies in the monitor measurements, grouping concurrent anomalies of the detected anomalies corresponding to configuration items of the plurality of configuration items which are topologically linked to be regarded as a system anomaly, calculating a significance score for the system anomaly; and

determining that the system anomaly relates to a real system problem based on the calculated significance score

12. The system of claim 11, wherein the detection of anomalies in the monitor measurements is based on an established baseline for each of the metrics.

13. The system of claim 11, wherein the processor is designed to save information on real system anomalies in an anomaly knowledgebase for future reference.

14. The system of claim 13, wherein the processor is designed to search the anomaly knowledgebase to find past similar significant anomalies.

15. The system of claim 11, further comprising alerting a user of the detection of the system anomaly.