LOG-BASED DIAGNOSIS FOR DECLARATIVE-DEPLOYED APPLICATIONS

• US 20190129829A1
• Filed: 11/02/2017
• Published: 05/02/2019
• Est. Priority Date: 11/02/2017
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Chen, Peng Fei, Meng, Fan Jing, Xu, Jing Min, Yang, Lin
• Granted Patent: US 10,642,677 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/3604 Software analysis for verifying properties of programs byte-code verification G06F9/44589
• CPC Class Codes: G06N 20/10 using kernel methods, e.g. support vector machines [SVM]
• CPC Class Codes: G06N 20/20 Ensemble learning
• CPC Class Codes: G06N 3/045 Combinations of networks
• CPC Class Codes: G06N 5/01 Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound
• CPC Class Codes: G06N 5/048 Fuzzy inferencing
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks

Abstract

Techniques for log-based diagnosis for declarative-deployed applications can comprise: based on a labeled deployment declaration, classifying, by a device operatively coupled to a processor, a runtime log associated with an application, resulting in a classified runtime log. Techniques can also comprise: based on the classified runtime log, training, by the device, an aggregation model to represent a defined state of the application.

Claims

1. A system, comprising:

a memory that stores computer executable components; and

a processor that executes the computer executable components stored in the memory, wherein the computer executable components comprise;

a classification component that;

based on a labeled deployment declaration of an application, classifies a runtime log associated with the application, resulting in a classified runtime log; and

a training component that;

based on the classified runtime log, trains an aggregation model to represent a defined state of the application.

2. The system of claim 1, wherein the computer executable components further comprise:

a comparison component that compares the aggregation model to a log sample to identify a root cause of a problem, wherein the problem is a configuration problem associated with the application.

3. The system of claim 2, wherein the application is a first application, wherein the problem is a first problem, wherein the runtime log is a first runtime log, and wherein the comparison component compares the first runtime log to a second runtime log associated with a second application based on a second problem the second application has been determined to have encountered.

4. The system of claim 2, wherein the application is a first application, wherein the deployment declaration is a first deployment declaration, and wherein the comparison component compares the first deployment declaration to a second deployment declaration associated with the aggregation model to generate root cause analysis data associated with the potential root cause of the problem experienced by a second application.

5. The system of claim 1, wherein the runtime log is a first runtime log, wherein the deployment declaration is a first deployment declaration, and wherein the computer executable components further comprise:

a clustering component that;

based on a similarity between the first deployment declaration and a second deployment declaration, groups the first runtime log with a second runtime log.

6. The system of claim 1, wherein the labeled deployment declaration comprises a token for use in classifying the runtime log.

7. The system of claim 6, wherein the classifying comprises utilizing a Naï

ve Bayesian classifier to generate a deployment label.

8. A computer program product that facilitates log-based diagnosis for declarative-deployed applications, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to:

based on a labeled deployment declaration, classify a runtime log associated with the application, resulting in a classified runtime log; and

based on the classified runtime log, train an aggregation model to represent a defined state of the application.

9. The computer program product of claim 8, wherein the program instructions are further executable by the processor to cause the processor to:

compare the aggregation model to a log sample to identify a potential root cause of a problem, wherein the problem is a configuration problem associated with the application.

10. The computer program product of claim 9, wherein the application is a first application, wherein the runtime log is a first runtime log, and wherein the program instructions are further executable by the processor to cause the processor to:

compare the first runtime log to a second runtime log associated with a second application based on the problem the second application has been determined to have encountered.

11. The computer program product of claim 9, wherein the application is a first application, wherein the deployment declaration is a first deployment declaration, and wherein the program instructions are further executable by the processor to cause the processor to:

compare the first deployment declaration to a second deployment declaration associated with the aggregation model to generate root cause analysis data associated with the potential root cause of the problem experienced by a second application.

12. The computer program product of claim 8, wherein the runtime log is a first runtime log, wherein the deployment declaration is a first deployment declaration, and wherein the program instructions are further executable by the processor to cause the processor to:

based on a similarity between the first deployment declaration and a second deployment declaration, group the first runtime log with a second runtime log.

13. The computer program product of claim 9, wherein the program instructions are further executable by the processor to cause the processor to:

store the runtime log and an operation log associated with the application in a database for access by a comparison component.

14. The computer program product of claim 8, wherein the labeled deployment declaration comprises a token for use in classifying the runtime log.

15. A computer-implemented method, comprising:

based on a labeled deployment declaration, classifying, by a device operatively coupled to a processor, a runtime log associated with an application, resulting in a classified runtime log; and

based on the classified runtime log, training, by the device, an aggregation model to represent a defined state of the application.

16. The computer-implemented method of claim 15, further comprising:

comparing, by the device, the aggregation model to a log sample to identify a potential root cause of a problem, wherein the problem is a configuration problem associated with the application.

17. The computer-implemented method of claim 16, wherein the application is a first application, wherein the runtime log is a first runtime log, and further comprising:

comparing, by the device, the first runtime log to a second runtime log associated with a second application based on the problem the second application has been determined to have encountered.

18. The computer-implemented method of claim 16, wherein the application is a first application, wherein the deployment declaration is a first deployment declaration, and further comprising:

comparing, by the device, the first deployment declaration to a second deployment declaration associated with the aggregation model to generate root cause analysis data associated with the potential root cause of the problem experienced by a second application.

19. The computer-implemented method of claim 15, wherein the application is a first application, wherein the deployment declaration is a first deployment declaration, and further comprising:

comparing, by the device, the first deployment declaration to a second deployment declaration associated with the aggregation model to generate root cause analysis data associated with a potential root cause of a problem experienced by a second application.

20. The computer-implemented method of claim 15, wherein the runtime log is a first runtime log, wherein the deployment declaration is a first deployment declaration, and further comprising:

based on a similarity between the first deployment declaration and a second deployment declaration, grouping, by the device, the first runtime log with a second runtime log.

21. A system, comprising:

a memory that stores computer executable components; and

a processor that executes the computer executable components stored in the memory, wherein the computer executable components comprise;

a tokenizing component that;

applies one or more tokens to data associated with a deployment declaration of an application; and

separates the data according to the one or more tokens, resulting in on or more separated tokens;

a filtering component that;

based on the one or more separated tokens, removes one or more extraneous tokens from the one or more separated tokens, resulting in a reduced number of the one or more separated tokens; and

a classification component that;

based on the reduced number of the one or more separated tokens, classifies a runtime log associated with the application.

22. The system of claim 21, wherein the computer executable components further comprise:

a comparison component that;

compares an aggregation model associated with the runtime log to a log sample to identify a potential root cause of a problem, wherein the problem is a resource problem associated with the application.

23. The system of claim 22, wherein the application is a first application, wherein the runtime log is a first runtime log, and wherein the comparison component compares the first runtime log to a second runtime log associated with a second application based on the potential root cause of the problem.

24. A computer program product that facilitates identification of an application irregularity, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to:

separate a file associated with a deployment declaration of an application, resulting in one or more separated tokens;

based on the one or more separated tokens, remove one or more unneeded tokens from the one or more separated tokens; and

based on the one or more separated tokens, classify a runtime log associated with the application.

25. The computer program product of claim 24, wherein the program instructions are further executable by the processor to cause the processor to:

compare an aggregation model to a log sample to identify a potential root cause of a problem, wherein the problem is a network problem associated with the application.