Techniques for gathering evidence for performing diagnostics

• US 8,140,898 B2
• Filed: 06/16/2009
• Issued: 03/20/2012
• Est. Priority Date: 06/16/2009
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Beg, Mirza Mohsin, Sum, Charles P.
• Primary Examiner(s): Beausoliel, Jr., Robert
• Assistant Examiner(s): Manoskey, Joseph D
• Application Number:
  US12/485,766
• Publication Number:
  US 20100318853A1
• Time in Patent Office: 1,008 Days
• Field of Search: 714/25, 714/26, 714/33, 714/37, 714/39
• US Class Current: 714/26
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/2257 using expert systems
• CPC Class Codes: H04L 41/0604 using filtering, e.g. reduction of information by using priority, element types, position or time
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network

Abstract

Techniques for performing diagnostics for a monitored system. In one embodiment, an aggregate model built using a set of models is used to determine a set of probes or tests to be executed for obtaining information related to the monitored system. The obtained evidence information is then applied to the aggregate model to perform diagnostics for one or more conditions detected in the monitored system.

Claims

1. A computer-readable storage medium storing a plurality of instruction for controlling a processor to perform diagnostics, the plurality of instructions comprising:

instructions that cause the processor to determine a set of tests based upon an aggregate model, the aggregate model comprising a plurality of models and links between the models, wherein each model in the aggregate model is a causal network;

instructions that cause the processor to receive evidence information obtained from executing the set of tests, the evidence information comprising information related to a monitored system; and

instructions that cause the processor to apply the evidence information to the aggregate model to obtain diagnostics results.

2. The computer-readable storage medium of claim 1 wherein each model in the plurality of models identifies causal relationships between one or more faults and observations.

3. The computer-readable storage medium of claim 2 wherein each model in the plurality of models is a Bayesian network.

4. The computer-readable storage medium of claim 1 wherein:

the plurality of instructions further comprises instructions that cause the processor to generate a request for a first model in the plurality of models, the request comprising one or more tests determined based upon the first model; and

the instructions that cause the processor to receive the evidence information comprise instructions that cause the processor to receive data obtained as a result of executing the request.

5. The computer-readable storage medium of claim 1 wherein the instructions that cause the processor to determine the set of tests based upon the aggregate model comprise instructions that cause the processor to determine one or more tests for a first model in the plurality of models, the first model corresponding to a system or an application, the one or more tests determined for the first model representing tests to be executed for obtaining information related to the system or application.

6. The computer-readable storage medium of claim 1 wherein the set of tests comprises one or more tests to be executed in the monitored system.

7. The computer-readable storage medium of claim 1 wherein the evidence information comprises observable information about the monitored system.

8. The computer-readable storage medium of claim 1 wherein the diagnostics results comprise information identifying one or more likely root causes for a symptom or condition detected in the monitored system.

9. A system for performing diagnostics, comprising:

a memory configured to store an aggregate model, the aggregate model comprising a plurality of models and links between the models, wherein each model in the aggregate model is a causal network; and

a processor coupled to the memory, the processor configured to

determine a set of tests based upon the aggregate model,

receive evidence information obtained from executing the set of tests, the evidence information comprising information related to a monitored system, and

apply the evidence information to the aggregate model to obtain diagnostics results.

10. The system of claim 9 wherein each model in the plurality of models identifies causal relationships between one or more faults and observations.

11. The system of claim 10 wherein each model in the plurality of models is a Bayesian network.

12. The system of claim 9 wherein the processor is configured to:

generate a request for a first model in the plurality of models, the request comprising one or more tests determined based upon the first model; and

receive data obtained as a result of executing the request.

13. The system of claim 9 wherein the processor is configured to determine one or more tests for a first model in the plurality of models, the first model corresponding to a system or an application, the one or more tests determined for the first model representing tests to be executed for obtaining information related to the system or application.

14. The system of claim 9 wherein the set of tests comprises one or more tests to be executed in the monitored system.

15. The system of claim 9 wherein the evidence information comprises observable information about the monitored system.

16. The system of claim 9 wherein the diagnostics results comprise information identifying one or more likely root causes for a symptom or condition detected in the monitored system.

17. A method of performing diagnostics, the method comprising:

determining, by a processor system, a set of tests based upon an aggregate model, the aggregate model comprising a plurality of models and links between the models, wherein each model in the aggregate model is a causal network;

receiving, by the processor system, evidence information obtained from executing the set of tests, the evidence information comprising information related to a monitored system; and

apply, by the processor system, the evidence information to the aggregate model to obtain diagnostics results.

18. The method of claim 17:

further comprising generating, by the processor system, a request for a first model in the plurality of models, the request comprising one or more tests determined based upon the first model; and

wherein receiving the evidence information comprises receiving data obtained as a result of executing the request.

19. The method of claim 17 wherein:

the set of tests comprises one or more tests to be executed in the monitored system; and

determining the set of tests based upon the aggregate model comprises determining one or more tests for a first model in the plurality of models, the first model corresponding to a system or an application, the one or more tests determined for the first model representing tests to be executed for obtaining information related to the system or application.

20. The method of claim 17 wherein the diagnostics results comprise information identifying one or more likely root causes for a symptom or condition detected in the monitored system.