Techniques for determining models for performing diagnostics

• US 8,171,343 B2
• Filed: 06/16/2009
• Issued: 05/01/2012
• Est. Priority Date: 06/16/2009
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Beg, Mirza Mohsin, Sum, Charles P.
• Primary Examiner(s): SCHELL, JOSEPH O
• Application Number:
  US12/485,759
• Publication Number:
  US 20100318855A1
• Time in Patent Office: 1,050 Days
• Field of Search: 714/26, 714/31, 714/32, 714/33, 714/37, 714/38.1
• US Class Current: 714/37
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/2257 using expert systems
• CPC Class Codes: H04L 41/0604 using filtering, e.g. reduction of information by using priority, element types, position or time
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network

Abstract

Techniques for performing diagnostics are described. In one embodiment, in response to an alert or a request to perform diagnostics, a topological relationship is generated comprising a set of applications and a set of systems determined based upon information in the alert or request. The topological relationship encapsulates relationships between the set of applications and the set of systems. In one embodiment, a set of causal network models to be used for performing the diagnostics is determined based upon the applications and systems in the topological relationship.

Claims

1. A computer-readable storage medium storing a plurality of instructions for controlling a processor to perform diagnostics, the plurality of instructions comprising:

instructions that cause the processor to receive an alert that is generated based upon one or more conditions detected in a monitored system;

instructions that cause the processor to determine a first application and a first system based upon the alert;

instructions that cause the processor to determine a set of applications based upon the first application;

instructions that cause the processor to determine a set of systems based upon the first application, the first system, and the set of applications; and

instructions that cause the processor to, subsequent to determining the first application, the set of applications, the first system, and the set of systems, generate a topological relationship in response to the alert identifying relationships between the first application, one or more applications in the set of applications, the first system, and one or more systems in the set of systems.

2. The computer-readable storage medium of claim 1 wherein the instructions that cause the processor to determine the set of applications comprise instructions that cause the processor to determine the set of applications based upon data flow dependencies of the first application.

3. The computer-readable storage medium of claim 2 wherein the instructions that cause the processor to determine the set of applications based upon data flow dependencies of the first application comprise instructions that cause the processor to identify one or more applications that provide data to the first application.

4. The computer-readable storage medium of claim 1 wherein the instructions that cause the processor to determine the set of applications comprise instructions that cause the processor to use mapping information to determine the set of applications, the mapping information mapping the first application to other applications including the set of applications.

5. The computer-readable storage medium of claim 1 wherein:

the instructions that cause the processor to determine the first system comprise instructions that cause the processor to determine a system executing the first application; and

the instructions that cause the processor to determine the set of systems comprise instructions that cause the processor to determine one or more systems executing the applications in the set of applications.

6. The computer-readable storage medium of claim 1 wherein the plurality of instructions further comprises instructions that cause the processor to determine a set of models based upon the topological relationship, the set of models comprising a model for the first application, a model for the first system, a model for each application in the set of applications, and a model for each system in the set of systems, wherein each model in the set of models is a Bayesian network.

7. The computer-readable storage medium of claim 1 wherein the instructions that cause the processor to generate the topological relationship comprise:

instructions that cause the processor to establish relationships between a set of nodes, each node in the set of nodes representing an application and a system on which the application executes, wherein the application represented by a node is either the first application or an application in the set of applications.

8. A system for performing diagnosis, comprising:

a processor configured to;

receive an alert generated based upon one or more conditions detected in a monitored system;

determine a first application and a first system based upon the alert;

determine a set of applications based upon the first application;

determine a set of systems based upon the first application, the first system, and the set of applications; and

subsequent to determining the first application, the set of applications, the first system, and the set of systems, generate a topological relationship in response to the alert identifying relationships between the first application, one or more apps in the set of applications, the first system, and one or more systems in the set of systems.

9. The system of claim 8 wherein the processor is configured to determine the set of applications based upon data flow dependencies of the first application.

10. The system of claim 9 wherein the processor is configured to determine the set of applications based upon data flow dependencies of the first application by identifying one or more applications that provide data to the first application.

11. The system of claim 8 wherein the processor is configured to use mapping information stored in the memory to determine the set of applications, the mapping information mapping the first application to other applications including the set of applications.

12. The system of claim 8 wherein the processor is configured to:

determine the first system by determining a system executing the first application; and

determine the set of systems by determining one or more systems executing the applications in the set of applications.

13. The system of claim 8 wherein the processor is configured to determine a set of models based upon the topological relationship, the set of models comprising a model for the first application, a model for the first system, a model for each application in the set of applications, and a model for each system in the set of systems, wherein each model in the set of models is a Bayesian network.

14. The system of claim 8 wherein the processor is configured to generate the topological relationship by establishing relationships between a set of nodes, each node in the set of nodes representing an application and a system on which the application executes, wherein the application represented by a node is either the first application or an application in the set of applications.

15. A method for performing diagnostics, the method comprising:

receiving, by a processing system, an alert that is generated based upon one or more conditions detected in a monitored system;

determining, by the processing system, a first application and a first system based upon the alert;

determining, by the processing system, a set of applications based upon the first application;

determining, by the processing system, a set of systems based upon the first application, the first system, and the set of applications; and

subsequent to determining the first application, the set of applications, the first system, and the set of systems, generating, by the processing system, a topological relationship in response to the alert identifying relationships between the first application, one or more applications in the set of applications, the first system, and one or more systems in the set of systems.

16. The method of claim 15 wherein:

determining the set of applications comprises

determining data flow dependencies of the first application by identifying one or more applications that provide data to the first application, and

determining the set of applications based upon the data flow dependencies;

determining the first system comprises determining a system executing the first application; and

determining the set of systems comprises determining one or more systems executing the applications in the set of applications.

17. The method of claim 15 further comprising determining a set of models based upon the topological relationship, the set of models comprising a model for the first application, a model for the first system, a model for each application in the set of applications, and a model for each system in the set of systems, wherein each model in the set of models is a Bayesian network.

18. The method of claim 15 wherein generating the topological relationship comprises:

establishing relationships between a set of nodes, each node in the set of nodes representing an application and a system on which the application executes, wherein the application represented by a node is either the first application or an application in the set of applications.