Monitoring data categorization and module-based health correlations

• US 8,533,536 B2
• Filed: 06/28/2012
• Issued: 09/10/2013
• Est. Priority Date: 06/17/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Yan, An, Li, Wilson, Janotti, Paulo, Avner, Jon
• Primary Examiner(s): Manoskey, Joseph D
• Application Number:
  US13/535,916
• Publication Number:
  US 20120271594A1
• Time in Patent Office: 439 Days
• Field of Search: 714/25, 714/26, 714/32, 714/33, 714/37, 714/47.1, 714/47.3, 714/48, 714/57
• US Class Current: 714/47.1
• CPC Class Codes: G06F 11/008 Reliability or availability analysis
• CPC Class Codes: G06F 11/0706 the processing taking place on a specific hardware platform or in a specific software environment
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36

Abstract

Architecture for aggregating health alerts from a number of related components into a single aggregated health state that can be analyzed to isolate the component responsible for the fault condition. In a hierarchy of related components within various component groups in a computer system, a number of health indicators can indicate alerts occurring in one or more of the related components whereas the fault condition occurs in only one component upon which the other components depend. The health indicators of related components are aggregated into an aggregated health state for each component group. These aggregated health states are analyzed to identify the related component associated with a root cause of the alert condition for an affected component group.

Claims

1. A computer-implemented method, comprising:

in a health model representing a hierarchy of related components within component groups in a computer system, each component having at least one health indicator, wherein a health indicator is associated with a category including at least one of;

a key health indicator (KHI), forensic data, and a non-service impacting issue (NSI);

selecting one of a plurality of KHIs for a component to be an aggregated KHI;

determining whether an alert condition exists for the aggregated KHI;

traversing the health model from a root to identify a path in the hierarchy having the alert condition;

determining that a first component in the path depends on a second component;

determining that the second component does not have an active alert and has a timestamp within a correlation time window; and

raising an alert for the second component.

2. The method of claim 1, comprising:

determining whether a NSI has an alert condition; and

raising a flag for the NSI.

3. The method of claim 1, comprising:

determining whether an alert condition exists for forensic data when an alert condition does exist for the aggregated KHI; and

collecting and linking the forensic data to the aggregated KHI when an alert condition does exist for the forensic data.

4. The method of claim 3, comprising:

collecting and linking the contents of non-selected KHIs to the aggregated KHI when an alert condition does exist for the forensic data.

5. The method of claim 1, comprising:

identifying, in the path having the alert, a component having the lowest dependency level;

determining whether an alert is already raised; and

raising an alert when an alert is not already raised.

6. The method of claim 1, wherein each health indicator comprises a vote of one of two possible conditions, the method comprising:

voting on which KHI to use as the aggregated KHI when a conflict among the KHI votes for a component exists.

7. A computer-implemented diagnostic apparatus, comprising:

a processor;

a health model executing on the processor to represent a hierarchy of related components within component groups in a computer system, each component having at least one health indicator, wherein a health indicator is associated with a category including at least one of;

a key health indicator (KHI), forensic data, and a non-service impacting issue (NSI);

an aggregation component to select one of a plurality of KHIs for a component to be an aggregated KHI;

a correlation component to;

determine whether an alert condition exists for the aggregated KHI;

traversing the health model from a root to identify a path in the hierarchy having the alert condition;

determine that a first component in the path depends on a second component;

determine that the second component does not have an active alert and has a timestamp within a correlation time window; and

raise an alert for the second component.

8. The apparatus of claim 7, the correlation component to:

determine whether a NSI has an alert condition; and

raise a flag for the NSI.

9. The apparatus of claim 7, the correlation component to:

determine whether an alert condition exists for forensic data when an alert condition does exist for the aggregated KHI; and

collect and link the forensic data to the aggregated KHI when an alert condition does exist for the forensic data.

10. The apparatus of claim 9, the correlation component to:

collect and link the contents of non-selected KHIs to the aggregated KHI when an alert condition does exist for the forensic data.

11. The apparatus of claim 7, the correlation component to:

identify, in the path having the alert, a component having the lowest dependency level;

determine whether an alert is already raised; and

raise an alert when an alert is not already raised.

12. The apparatus of claim 7, wherein each health indicator comprises a vote of one of two possible conditions, the aggregation component to:

vote on which KHI to use as the aggregated KHI when a conflict among the KHI votes for a component exists.

13. A computer-readable memory storage device comprising instructions that, when executed by a computing device, cause the computing device to:

receive health indicators that indicate an alert condition for components of a computer system, the health indicators representing health of components;

aggregate health indicators of related components into an aggregated health state;

vote to select a health indicator based on voting weight from the aggregated health indicators to determine which one health indicator defines the aggregated health state, wherein voting weight represents a relative importance of health indicators;

link a non-selected key health indicator of the aggregated health indicators to the selected health indicator as a forensic health indicator; and

analyze the aggregated health state to identify a related component having the alert condition.

14. The computer-readable memory storage device of claim 13, wherein a health indicator is associated with a category including at least one of:

a key health indicator (KHI), forensic data, and a non-service impacting issue (NSI), the storage device further comprising instructions that, when executed by the computing device, cause the computing device to;

represent, in a health model, a hierarchy of related components within component groups in a computer system, each component having at least one health indicator,

select one of a plurality of KHIs for a component to be an aggregated KHI;

determine whether an alert condition exists for the aggregated KHI;

traverse the health model from a root to identify a path in the hierarchy having the alert condition;

determine that a first component in the path depends on a second component;

determine that the second component does not have an active alert and has a timestamp within a correlation time window; and

raise an alert for the second component.

15. The computer-readable memory storage device of claim 13, further comprising instructions that, when executed by the computing device, cause the computing device to:

determine whether a NSI has an alert condition; and

raise a flag for the NSI.

16. The computer-readable memory storage device of claim 13, further comprising instructions that, when executed by the computing device, cause the computing device to:

determine whether an alert condition exists for forensic data when an alert condition does exist for the aggregated KHI; and

collect and link the forensic data to the aggregated KHI when an alert condition does exist for the forensic data.

17. The computer-readable memory storage device of claim 16, further comprising instructions that, when executed by the computing device, cause the computing device to:

collect and link the contents of non-selected KHIs to the aggregated KHI when an alert condition does exist for the forensic data.

18. The computer-readable memory storage device of claim 13, further comprising instructions that, when executed by the computing device, cause the computing device to:

identify, in the path having the alert, a component having the lowest dependency level;

determine whether an alert is already raised; and

raise an alert when an alert is not already raised.

19. The computer-readable memory storage device of claim 13, wherein each health indicator comprises a vote of one of two possible conditions, further comprising instructions that, when executed by the computing device, cause the computing device to:

vote on which KHI to use as the aggregated KHI when a conflict among the KHI votes for a component exists.