Reduction of alerts in information technology systems

• US 8,380,838 B2
• Filed: 04/08/2011
• Issued: 02/19/2013
• Est. Priority Date: 04/08/2011
• Status: Expired due to Fees

• Current Assignee: GlobalFoundries, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Bose, Abhijit, Cheng, Winnie Wing-Yee, Guo, Shang Qing, Kim, Sang Kyum, Luan, Laura Zaihua, Perpetua, Dennis Anthony Jr., Rosu, Daniela, Smadi, Mithkal M.
• Primary Examiner(s): Meky, Moustafa M
• Application Number:
  US13/082,786
• Publication Number:
  US 20120259962A1
• Time in Patent Office: 683 Days
• Field of Search: 709200-203, 709217-227, 714/4.1, 714/25, 714/39, 714/48, 714/57
• US Class Current: 709/223
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/076 by exceeding a count or rate limit, e.g. word- or bit count limit
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3072 where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: H04L 41/50 Network service management, e.g. ensuring proper service fulfilment according to agreements

Abstract

Aspects of the present invention dynamically reduce a frequency at which IT infrastructure automatically generates alerts. Historical data across a plurality of data sources in the IT infrastructure is analyzed. An opportunity to reduce the frequency at which the IT infrastructure automatically generates the alerts is identified. A new alert policy addressing the opportunity to reduce alert frequency is generated. An impact of the new alert policy on a set of predefined service level objectives (SLOs) and service level agreements (SLAs) is evaluated. The new alert policy is deployed in the IT infrastructure.

Claims

1. A method for dynamically reducing a frequency at which an information technology (IT) infrastructure automatically generates alerts, the method comprising the steps of:

a computer analyzing historical data across a plurality of data sources in the IT infrastructure;

after the step of performing the analysis of the historical data, the computer identifying an opportunity to reduce a frequency at which the IT infrastructure automatically generates the alerts;

the computer generating a new alert policy addressing the opportunity to reduce the frequency;

the computer evaluating an impact of the new alert policy on a set of predefined service level objectives (SLOs) and service level agreements (SLAs); and

the computer deploying the new alert policy in the IT infrastructure.

2. The method of claim 1, wherein the step of evaluating the impact of the new alert policy further comprises the computer simulating the new alert policy against the historical data.

3. The method of claim 1, wherein the step of evaluating the impact of the new alert policy on the set of predefined SLAs and SLOs further comprises the computer calculating a projected accuracy score of the new alert policy.

4. The method of claim 1, wherein the step of generating the new alert policy addressing the opportunity to reduce the frequency comprises the computer adjusting a threshold associated with a current alert policy of the IT infrastructure.

5. The method of claim 1, wherein the step of analyzing the historical data across the plurality of data sources in the IT infrastructure further comprises the computer analyzing the historical data across one or more of a current alert information source, a resource utilization and performance source, a system configuration information source, a change history information source, and an incident ticket information source.

6. The method of claim 1, wherein the step of analyzing the historical data across the plurality of data sources in the IT infrastructure further comprises the computer classifying a plurality of servers in a plurality of domains of the IT infrastructure into a group of servers having a common characteristic.

7. The method of claim 1, wherein the step of identifying the opportunity to reduce the frequency at which the IT infrastructure automatically generates the alerts comprises the computer determining that the IT infrastructure automatically generates a false alert.

8. The method of claim 1, wherein the step of analyzing the historical data across the plurality of data sources in the IT infrastructure further comprises the computer analyzing the historical data across the plurality of data sources in a plurality of domains.

9. A computer program product for dynamically reducing the frequency at which an information technology (IT) infrastructure automatically generates alerts, the computer program product comprising one or more computer-readable tangible storage devices and program instructions stored on at least one of the one or more computer-readable tangible storage devices, the program instructions comprising:

first program instructions to analyze historical data across a plurality of data sources in the IT infrastructure;

second program instructions to identify an opportunity to reduce a frequency at which the IT infrastructure automatically generates the alerts;

third program instructions to generate a new alert policy addressing the opportunity to reduce the frequency;

fourth program instructions to evaluate an impact of the new alert policy on a set of predefined service level objectives (SLOs) and service level agreements (SLAs); and

fifth program instructions to deploy the new alert policy in the IT infrastructure.

10. The computer program product of claim 9, wherein the fourth program instructions simulate the new alert policy against the historical data.

11. The computer program product of claim 9, wherein the fourth program instructions calculate a projected accuracy score of the new alert policy.

12. The computer program product of claim 9, wherein the third program instructions adjust a threshold associated with a current alert policy of the IT infrastructure.

13. The computer program product of claim 9, wherein the first program instructions analyze the historical data across one or more of a current alert information source, a resource utilization and performance source, a system configuration information source, a change history information source, and an incident ticket information source.

14. The computer program product of claim 9, wherein the first program instructions classify a plurality of servers in a plurality of domains of the IT infrastructure into a group of servers having a common characteristic.

15. The computer program product of claim 9, wherein the second program instructions determine that the IT infrastructure automatically generates a false alert.

16. The computer program product of claim 9, wherein the first program instructions analyze the historical data across the plurality of data sources in a plurality of domains.

17. A computer system for dynamically reducing the frequency at which an information technology (IT) infrastructure automatically generates alerts, the computer system comprising one or more processors, one or more computer-readable memories, one or more computer-readable tangible storage devices, and program instructions stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, the program instructions comprising:

first program instructions to analyze historical data across a plurality of data sources in the IT infrastructure;

second program instructions to identify an opportunity to reduce a frequency at which the IT infrastructure automatically generates the alerts;

third program instructions to generate a new alert policy addressing the opportunity to reduce the frequency;

fourth program instructions to evaluate an impact of the new alert policy on a set of predefined service level objectives (SLOs) and service level agreements (SLAs); and

fifth program instructions to deploy the new alert policy in the IT infrastructure.

18. The computer system of claim 17, wherein the fourth program instructions simulate the new alert policy against the historical data.

19. The computer system of claim 17, wherein the fourth program instructions calculate a projected accuracy score of the new alert policy.

20. The computer system of claim 17, wherein the third program instructions adjust a threshold associated with a current alert policy of the IT infrastructure.

21. The computer system of claim 17, wherein the first program instructions analyze the historical data across one or more of a current alert information source, a resource utilization and performance source, a system configuration information source, a change history information source, and an incident ticket information source.

22. The computer system of claim 17, wherein the first program instructions classify a plurality of servers in a plurality of domains of the IT infrastructure into a group of servers having a common characteristic.

23. The computer system of claim 17, wherein the second program instructions determine that the IT infrastructure automatically generates a false alert.

24. The computer system of claim 17, wherein the first program instructions analyze the historical data across the plurality of data sources in a plurality of domains.