Method and system for troubleshooting a misconfiguration of a computer system based on configurations of other computer systems

• US 7,890,807 B2
• Filed: 06/13/2007
• Issued: 02/15/2011
• Est. Priority Date: 02/19/2004
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Platt, John C., Verbowski, Chad E., Wang, Jiahe Helen, Zhang, Ruyun, Chen, Yu
• Primary Examiner(s): Baderman; Scott T
• Assistant Examiner(s): Schell; Joseph
• Application Number:
  US11/762,634
• Publication Number:
  US 20070300103A1
• Time in Patent Office: 1,343 Days
• Field of Search: 713/100, 717168-178, 717/120, 717/121, 700/28, 700/29, 714/26, 714/31, 714/33, 714/37, 714/38, 714/39, 726/22, 726/23, 726/24
• US Class Current: 714/48
• CPC Class Codes: G06F 11/0748 in a remote unit communicating with a single-box computer node experiencing an error/fault remote testing G06F11/2294
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: H04L 41/0853 by actively collecting configuration information or by backing up configuration information
• CPC Class Codes: H04L 41/0869 Validating the configuration within one network element
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence

Abstract

A method and system for identifying a configuration parameter of a “sick” computer system that is at fault for causing an undesired behavior based on analysis of configuration parameters from other computer systems is provided. In one embodiment, a troubleshooting system collects “suspect” values for “suspect” configuration parameters used by a “sick” application when the undesired behavior was exhibited by the sick computer system. The troubleshooting system then compares the suspect values to sample values of the suspect configuration parameters retrieved from sample computer systems. The troubleshooting system uses that comparison to identify one or more suspect configuration parameters that are likely at fault for causing the application to exhibit the undesired behavior.

Claims

1. A method in a computer system for identifying a configuration parameter that is likely causing a component of a computing device to exhibit an undesired behavior, the method comprising:

collecting suspect values for suspect configuration parameters of the component;

providing sample values for the suspect configuration parameters for the component, the sample values being retrieved from other computing devices having the component; and

comparing the suspect values with the sample values to identify a suspect configuration parameter whose suspect value is likely to be causing the component of the computing device to exhibit the undesired behavior;

wherein the collecting includes running a program that intercepts and records accesses by the component to a configuration data store; and

wherein the configuration data store is a registry file.

2. The method of claim 1 wherein the comparing includes calculating a probability for each suspect configuration parameter.

3. The method of claim 1 wherein the suspect values are collected during execution of the component in which the undesired behavior was exhibited.

4. The method of claim 1 wherein the providing of values includes retrieving the sample values for the suspect configuration parameters from each sample component.

5. The method of claim 4 wherein the retrieving of the sample values is performed before the collecting of the suspect values wherein the sample values are retrieved for configuration parameters that include the suspect configuration parameters.

6. The method of claim 4 wherein the retrieving of the sample values is performed after collecting the suspect values.

7. The method of claim 1 wherein the component is software.

8. The method of claim 1 wherein an index is maintained that indicates computing devices that have the component installed.

9. The method of claim 1 wherein the values for configuration parameters are placed in a normal form.

10. The method of claim 1 wherein the component is a hardware device.

11. The method of claim 1 including aggregating the sample values prior to collecting the suspect values to facilitate comparing to the suspect values.

12. The method of claim 11 wherein the aggregating includes counting the number of distinct sample values for each suspect configuration parameter.

13. The method of claim 12 wherein the aggregating includes counting the number of sample components that have each distinct value.

14. The method of claim 1 including identifying a likely correct value for the sample configuration parameter that is identified as likely causing the component to exhibit the undesired behavior.

15. The method of claim 14 including changing the suspect value of the suspect configuration parameter that is identified as likely causing the component to exhibit the undesired behavior to the identified likely correct value.

16. The method of claim 14 including presenting to a user an indication of likely correct values for the suspect configuration parameter that is identified as likely causing the component to exhibit the undesired behavior.

17. The method of claim 14 including presenting to a user a ranking of suspect configuration parameters that may be causing the component to exhibit the undesired behavior.

18. A method in a computer system for identifying a configuration parameter that is likely causing a component of a computing device to exhibit an undesired behavior, the method comprising:

collecting suspect values for suspect configuration parameters of the component;

providing sample values for the suspect configuration parameters for the component, the sample values being retrieved from other computing devices having the component; and

comparing the suspect values with the sample values to identify a suspect configuration parameter whose suspect value is likely to be causing the component of the computing device to exhibit the undesired behavior;

wherein the collecting includes running a program that intercepts and records accesses by the component to a configuration data store; and

wherein the configuration data store is a resource file.

19. A computer-readable storage medium containing instructions for controlling a troubleshooting system to retrieve sample values for suspect configuration parameters of an application, by a method comprising:

identifying suspect configuration parameters of the application by monitoring the execution of the application on a computing device, the computing device having peer computing devices, the identifying of suspect configuration parameters including executing a tracer program that tracks accesses of the application of the computing device to configuration parameters;

maintaining an index of which peer computing devices have which applications installed;

identifying as sample computing devices the peer computing devices with the same application installed as indicated by the index; and

retrieving sample values for the identified configuration parameters from the identified sample computing devices for use in identifying a suspect configuration parameter that is likely causing the application executing on the computing device to exhibit an undesired behavior.

20. The computer-readable medium of claim 19 including, before identifying the suspect configuration parameters, collecting sample values for configuration parameters of applications installed on the sample computing devices and storing the sample values in a data store wherein the retrieving of the sample values includes retrieving the sample values from the data store after the suspect configuration parameters are identified.

21. The computer-readable medium of claim 19 wherein the retrieving includes dynamically collecting the sample values from the sample computing devices.

22. The computer-readable medium of claim 19 including comparing a value of a suspect configuration parameter to the sample values of the suspect configuration parameter to identify whether the suspect configuration parameter is likely causing the computing device to exhibit the undesired behavior.

23. A computer-readable storage medium containing instructions for controlling a troubleshooting system to identify a configuration parameter that is likely causing a component of a computer system to exhibit an undesired behavior, by a method of:

providing sample values of configuration parameters for sample components, the sample values of configuration parameters for a sample component being retrieved from other computer systems having the sample components;

receiving suspect values for suspect configuration parameters of the component that is exhibiting the undesired behavior; and

identifying a suspect configuration parameter whose suspect value as likely causing the component to exhibit the undesired behavior by comparing the suspect values of the suspect configuration parameters to the sample values of the suspect configuration parameters;

wherein the received suspect values are collected by running a program that intercepts and records accesses by the component to a configuration data store, and

wherein the configuration data store is a registry file.

24. The computer-readable medium of claim 23 wherein the comparing includes calculating a probability for each suspect configuration parameter.

25. The computer-readable medium of claim 23 wherein the suspect values are collected during execution of the component in which the undesired behavior was exhibited.

26. The computer-readable medium of claim 23 including aggregating the sample values prior to receiving the suspect values to facilitate comparing to the suspect values.

27. The computer-readable medium of claim 26 wherein the aggregating includes counting the number of distinct sample values for each suspect configuration parameter.

28. The computer-readable medium of claim 27 wherein the aggregating includes counting the number of sample components that have each distinct value.

29. The computer-readable medium of claim 23 including identifying a likely correct value for the suspect configuration parameter that is identified as likely causing the component to exhibit the undesired behavior.

30. The computer-readable medium of claim 29 including presenting to a user a ranking of suspect configuration parameters that may be causing the component to exhibit the undesired behavior.