Clustering process for software server failure prediction

• US 7,484,132 B2
• Filed: 10/28/2005
• Issued: 01/27/2009
• Est. Priority Date: 10/28/2005
• Status: Expired due to Fees

• Current Assignee: Lenovo International Limited (Lenovo Group Ltd.)
• Original Assignee: International Business Machines Corporation
• Inventors: Garbow, Zachary A.
• Primary Examiner(s): DUNCAN, MARC M
• Application Number:
  US11/262,127
• Publication Number:
  US 20070101202A1
• Time in Patent Office: 1,187 Days
• Field of Search: 714/26, 714/47, 702/181
• US Class Current: 714/47.2
• CPC Class Codes: G06F 11/008 Reliability or availability analysis
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: H04L 41/147 for predicting network behaviour
• CPC Class Codes: H04L 43/0817 by checking functioning

Abstract

Embodiments of the present invention allow the prevention and/or mitigation of damage caused by server failure by predicting future failures based on historic failures. Statistical data for server parameters may be collected for a period of time immediately preceding a historic server failure. The data may be clustered to identify cluster profiles indicating strong pre-fault clustering patterns. Real time statistics collected during normal operation of the server may be applied to the cluster profiles to determine whether real time statistics show pre-fault clustering. If such a pattern is detected, measures to prevent or mitigate server failure may be initiated.

Claims

1. A computer-implemented method for predicting failure of a server. comprising:

creating cluster profiles;

collecting real time server parameters of the server;

applying the real time server parameters to at least one of the cluster profiles, wherein the cluster profile comprises;

one or more server parameters;

one or more clustering parameters; and

a weight associated with each server parameter,

wherein the server parameters, the clustering parameters, and the weight associated with each server parameter are selected on the basis of historical pre-fault clustering of the server parameters; and

determining a probability of failure of the server based on a relationship between the real time server parameters and the one or more cluster profiles;

wherein creating the cluster profiles, comprising;

for each historical server failure, collecting data for server parameters for a period of time immediately preceding the historical server failure;

determining at least one setting, wherein the setting comprises;

the one or more server parameters;

the one or more clustering parameters; and

the weight associated with each of the one or more server parameters;

determining a set of points, wherein each point comprises values of the one or more server parameter;

determining clusters of points within the set of points based on the distance between each pair of points in the set of points, the one or more clustering parameters, and the weight associated with each server parameter;

for each setting, determining whether the setting generates a pre-fault clustering pattern, wherein the pre-fault clustering pattern comprises at least one of;

a high rate of change of clusters prior to the server failure; and

clusters previously defined as high-risk clusters; and

if the setting generates a pre-fault clustering pattern, saving the setting as a cluster profile.

2. The method of claim 1, wherein each point in the set of points is a multi-dimensional point {D1, D2,. . . Di}comprising the server parameter values, wherein D is a given parameter value and i is an integer greater than or equal to one.

3. The method of claim 1, wherein determining clusters of points comprises:

for each point in the set of points;

determining a set of neighboring points within a predefined distance, wherein the predefined distance is defined by the clustering parameters;

determining a set of nearest neighbors within the set of neighboring points based on a predefined number defined by the clustering parameters, wherein the predefined number determines the total number of points that may be included as nearest neighbors;

assigning a rank value to each nearest neighbor based on the proximity of the nearest neighbor to the point;

determining a mutual nearest neighbor score for each pair of nearest neighbor points in the set of points based on the rank values; and

clustering the points based on the mutual nearest neighbor score.

4. The method of claim 1, wherein the pre-fault clustering pattern comprises:

a steady state period, wherein the data points merge into at least one of

a single cluster; and

a cluster previously defined as a normal cluster; and

an unsteady state period immediately preceding the server failure, wherein the data points merge into at least one of

one or more new clusters; and

the high-risk clusters.

5. The method of claim 1, wherein determining whether the setting generates a pre-fault clustering pattern comprises determining a strength of the setting, wherein the strength is based on at least one of an algorithm analysis and Fourier analysis to compare a pattern of the clusters of points in the set of data points to the pre-fault clustering pattern.