Event-based automated diagnosis of known problems

• US 7,337,092 B2
• Filed: 11/03/2006
• Issued: 02/26/2008
• Est. Priority Date: 06/21/2005
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Ma, Wei-Ying, Zhang, Zheng, Wang, Yi-Min, Wen, Ji-Rong, Yuan, Chun
• Primary Examiner(s): Cosimano; Edward R
• Application Number:
  US11/556,638
• Publication Number:
  US 20070061623A1
• Time in Patent Office: 480 Days
• Field of Search: 738/659, 324/500, 340/3.1, 340/3.43, 340/500, 340/635, 382/100, 382/155, 382/159, 700/90, 700/108, 702/33, 702/34, 702/35, 702/127, 702/182, 702/183, 702/184, 702/185, 702/186, 702/187
• US Class Current: 702/185
• CPC Class Codes: G06F 11/0715 in a system implementing multitasking multitasking per se G06F9/46
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36

Abstract

System events preceding occurrence of a problem are likely to be similar to events preceding occurrence of the same problem at other times or on other systems. Thus, the cause of a problem may be identified by comparing a trace of events preceding occurrence of the problem with previously diagnosed traces. Traces of events preceding occurrences of a problem arising from a known cause are reduced to a series of descriptive elements. These elements are aligned to correlate differently timed but otherwise similar traces of events, converted into symbolic representations, and archived. A trace of events leading to an undiagnosed a problem similarly is converted to a symbolic representation. The representation of the undiagnosed trace is then compared to the archived representations to identify a similar archived representation. The cause of the similar archived representation is presented as a diagnosis of the problem.

Claims

1. A system for determining a cause of an encountered problem occurring during operation of a computer system, comprising:

a tracer configured to log events processed by the computer system preceding the encountered problem;

a preprocessor configured to create a representation of at least a portion of the events logged, wherein the creating of the representation includes sequentially aligning the events with occurrence of corresponding events included in a base sequence of events; and

a classifier configured to;

compare the representation with a plurality of stored representations, each of the stored representations signifying a plurality of events associated with a known cause of a catalogued problem; and

identify the cause of the encountered problem as the known cause associated with a similar stored representation for solving an identified problem found to be comparable with the representation.

2. The system of claim 1, further comprising a diagnostic interface operable to at least one of:

direct the tracer to at least one of start and stop logging events;

or

communicate the cause of the encountered problem to the user.

3. The system of claim 1, wherein:

each of the stored representations includes a vector including elements indicating correspondence and lack of correspondence with elements of a base sequence for a known cause with which each of the representations is associated; and

the representation includes a vector including elements indicating correspondence and lack of correspondence of the events logged with the base sequence associated with the stored representations.

4. The system of claim 1, wherein at least one of the classifier and the plurality of stored representations resides on a diagnostic server in communication with the system.

5. The system of claim 1, wherein the functions are performed by using a program stored on a computer-readable media.

6. A system for determining a cause of an encountered problem occurring during operation of a computer system, comprising:

a diagnostic interface to receive identification of an encountered problem;

a tracer configured to log events processed by the computer system preceding the encountered problem;

a preprocessor configured to create a representation of at least a portion of the events logged;

wherein the creating of the representation includes;

sequentially aligning the events with occurrence of corresponding events included in a base sequence of events and

generating a vector representing instances of correspondence and lack of correspondence of the aligned events with the base sequence; and

a classifier configured to;

compare the representation with a plurality of stored representations, each of the stored representations signifying a plurality of events associated with a known cause of a catalogued problem; and

identify the cause of the encountered problem as the known cause associated with a similar stored representation comparable with the representation.

7. The system of claim 6, wherein the diagnostic interface comprises at least one of:

direct the tracer to at least one of start and stop logging events;

communicate the cause of the encountered problem to the user.

8. The system of claim 6, wherein:

each of the stored representations includes a vector including elements indicating correspondence and lack of correspondence with elements of a base sequence for a known cause with which each of the representations is associated; and

the representation includes a vector including elements indicating correspondence and lack of correspondence of the events logged with the base sequence associated with the stored representations.

9. The system of claim 6, wherein:

identifying the cause of the encountered problem includes comparing the vector with a plurality of stored vectors, each of the stored vectors representing the plurality of stored representations.

10. The system of claim 6, wherein at least one of the classifier and the plurality of stored representations resides on a diagnostic server in communication with the system.

11. The system of claim 6, wherein the wherein the functions are performed by using a program stored on a computer-readable media.