Detecting statistical variation from unclassified process log

• US 8,543,552 B2
• Filed: 02/01/2012
• Issued: 09/24/2013
• Est. Priority Date: 02/01/2012
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Jain, Anshu N., Kummamuru, Krishna, Tamilselvam, Srikanth G.
• Primary Examiner(s): LE, UYEN T
• Application Number:
  US13/363,466
• Publication Number:
  US 20130198147A1
• Time in Patent Office: 601 Days
• Field of Search: None
• US Class Current: 707/688
• CPC Class Codes: G06F 40/216 using statistical methods
• CPC Class Codes: G07C 3/14 Quality control systems

Abstract

A system and associated method for detecting a statistical variation of a process from a textual log of the process as performed by a process behavior analysis (PBA) system for monitoring the process operating in an Information Technology (IT) delivery system. The PBA system includes a PBA engine and a data storage storing exception rules used by the PBA engine. The PBA engine merges entities appearing in the textual log into one or more groups based on similarities of respective time series of the entities. Control charts are generated for merged entities and the PBA engine subsequently analyzes process behavior of the process by use of the control charts for exceptions defined in the stored exception rules. The PBA engine generates a PBA report for the process pursuant to the analysis result of the textual log with detailed information including to what type of exceptions had or had not occurred.

Claims

1. A method for detecting a statistical variation of a process operating in an Information Technology (IT) delivery system from a textual log of the process, the method comprising:

grouping, by a process behavior analysis (PBA) engine, entities appearing in the textual log of the process based on a respective time series corresponding to each entity of said entities, wherein a data storage operatively coupled to the PBA engine stores the textual log of the process and at least one exception rule defining the statistical variation used by the PBA engine;

analyzing, by a processor of a computer system, statistical process behavior of the process by running the PBA engine with the entities from said grouping such that each entity of said entities is represented by a respective control chart associated with said each entity and such that the PBA engine is enabled to determine whether said each entity violates said at least one exception rule; and

generating a PBA report for the process pursuant to a result from said analyzing, wherein the PBA report comprises data items selected from the group consisting of a first time window within which a first time series of a first entity of the entities in the textual log is being monitored by the PBA engine for the statistical variation, a second entity being grouped with the first entity, a first shift value for a first exception detected for the first entity, and combinations thereof.

2. The method of claim 1, said grouping comprising:

extracting the entities from the textual log of the process, wherein said each entity of the entities represents a respective phrase describing problems of the IT delivery system, wherein the PBA engine is monitoring the process running in the IT delivery system by use of the textual log;

extracting a respective time series corresponding to said each entity from the textual log, wherein the respective time series represents a respective sequence of data points associated with said each entity, as being measured at uniform time intervals such that the respective time series of said each entity demonstrates a respective statistical pattern of occurrences of said each entity in the textual log; and

merging the second entity with the first entity upon determining that a second time series of the second entity is statistically similar to the first time series of the first entity, wherein statistical similarity is determined based on said at least one exception rule.

3. The method of claim 1, said analyzing comprising:

generating a first control chart corresponding to the first time series for the first entity, wherein the first control chart comprises a center mean line ( X), an upper control limit (UCL), and a lower control limit (LCL), wherein UCL=( X+3σ

), wherein σ

is a standard error, and wherein LCL=( X−

3σ

);

determining that the first entity violates the first exception according to said at least one exception rule;

identifying, responsive to said determining, the first exception type and the first time window;

calculating a first rank score of the first entity based on said identifying; and

associating the first entity, the first exception type, the first time window, the first control chart, and the first rank score and subsequent storing the associated data items in the data storage.

4. The method of claim 3, wherein said at least one exception rule is represented on the first control chart,

wherein a first exception rule of said at least one exception rule represents a first exception type comprising a data point of the first time series that is either greater than the UCL or less than the LCL,

wherein a second exception rule of said at least one exception rule represents a second exception type wherein a predetermined number of consecutive data points of the first time series are either above X or below X, wherein the predetermined number is selected from the group consisting of seven (7) and nine (9),

wherein a third exception rule of said at least one exception rule represents a third exception type wherein six (6) or more consecutive data points of the first time series show a continuous increase or a continuous decrease,

wherein a fourth exception rule of said at least one exception rule represents a fourth exception type wherein fourteen (14) or more consecutive data points of the first time series oscillate above and below X,

wherein a fifth exception rule of said at least one exception rule represents a fifth exception type wherein two (2) or more consecutive data points of the first time series are either above ( X+2σ

) or below ( X−

2σ

),

wherein a sixth exception rule said at least one exception rule represents a sixth exception type wherein four (4) or more consecutive data points of the first time series are either above ( X+σ

) or below ( X−

σ

),

wherein a seventh exception rule said at least one exception rule represents a seventh exception type wherein fifteen (15) or more consecutive data points of the first time series are between ( X−

σ

) and ( X+σ

),

wherein an eighth exception rule said at least one exception rule represents an eighth exception type wherein eight (8) or more consecutive data points of the first time series are either less than ( X−

σ

) or greater than ( X+σ

).

5. The method of claim 1, said generating comprising:

assigning a respective category to each entity of the entities pursuant to respective exception type defined in said at least one exception rule, and a decision respective to each exception type indicating whether or not said each exception type defined in said at least one exception rule had been violated by respective entity;

determining a respective stability value associated with the first entity; and

producing the PBA report with the respective category from said assigning, the decision respective to each exception type from said assigning, the respective stability value from said determining, and further data retrieved from the data storage for the data items selected for the PBA report.

6. A computer program product comprising:

a computer readable memory unit having a computer readable program code embodied therein, said computer readable program code containing instructions that perform detecting a statistical variation of a process operating in an Information Technology (IT) delivery system from a textual log of the process, said detecting comprising;

grouping, by a process behavior analysis (PBA) engine, entities appearing in the textual log of the process based on a respective time series corresponding to each entity of said entities, wherein a data storage operatively coupled to the PBA engine stores the textual log of the process and at least one exception rule defining the statistical variation used by the PBA engine;

analyzing statistical process behavior of the process by running the PBA engine with the entities from said grouping such that each entity of said entities is represented by a respective control chart associated with said each entity and such that the PBA engine is enabled to determine whether said each entity violates said at least one exception rule; and

generating a PBA report for the process pursuant to a result from said analyzing, wherein the PBA report comprises data items selected from the group consisting of a first time window within which a first time series of a first entity of the entities in the textual log is being monitored by the PBA engine for the statistical variation, a second entity being grouped with the first entity, a first shift value for a first exception detected for the first entity, and combinations thereof.

7. The computer program product of claim 6, said grouping comprising:

extracting the entities from the textual log of the process, wherein said each entity of the entities represents a respective phrase describing problems of the IT delivery system, wherein the PBA engine is monitoring the process running in the IT delivery system by use of the textual log;

extracting a respective time series corresponding to said each entity from the textual log, wherein the respective time series represents a respective sequence of data points associated with said each entity, as being measured at uniform time intervals such that the respective time series of said each entity demonstrates a respective statistical pattern of occurrences of said each entity in the textual log; and

merging the second entity with the first entity upon determining that a second time series of the second entity is statistically similar to the first time series of the first entity, wherein statistical similarity is determined based on said at least one exception rule.

8. The computer program product of claim 6, said analyzing comprising:

generating a first control chart corresponding to the first time series for the first entity, wherein the first control chart comprises a center mean line ( X), an upper control limit (UCL), and a lower control limit (LCL), wherein UCL=( X+3σ

), wherein σ

is a standard error, and wherein LCL=( X−

3σ

);

determining that the first entity violates the first exception according to said at least one exception rule;

identifying, responsive to said determining, the first exception type and the first time window;

calculating a first rank score of the first entity based on said identifying; and

associating the first entity, the first exception type, the first time window, the first control chart, and the first rank score and subsequent storing the associated data items in the data storage.

9. The computer program product of claim 8, wherein said at least one exception rule is represented on the first control chart,

wherein a first exception rule of said at least one exception rule represents a first exception type comprising a data point of the first time series that is either greater than the UCL or less than the LCL,

wherein a second exception rule of said at least one exception rule represents a second exception type wherein a predetermined number of consecutive data points of the first time series are either above X or below X, wherein the predetermined number is selected from the group consisting of seven (7) and nine (9),

wherein a third exception rule of said at least one exception rule represents a third exception type wherein six (6) or more consecutive data points of the first time series show a continuous increase or a continuous decrease,

wherein a fourth exception rule of said at least one exception rule represents a fourth exception type wherein fourteen (14) or more consecutive data points of the first time series oscillate above and below X,

wherein a fifth exception rule of said at least one exception rule represents a fifth exception type wherein two (2) or more consecutive data points of the first time series are either above ( X+2σ

) or below ( X−

2σ

),

wherein a sixth exception rule said at least one exception rule represents a sixth exception type wherein four (4) or more consecutive data points of the first time series are either above ( X+σ

) or below ( X−

σ

),

wherein a seventh exception rule said at least one exception rule represents a seventh exception type wherein fifteen (15) or more consecutive data points of the first time series are between ( X−

σ

) and ( X+σ

),

wherein an eighth exception rule said at least one exception rule represents an eighth exception type wherein eight (8) or more consecutive data points of the first time series are either less than ( X−

σ

) or greater than ( X+σ

).

10. The computer program product of claim 6, said generating comprising:

assigning a respective category to each entity of the entities pursuant to respective exception type defined in said at least one exception rule, and a decision respective to each exception type indicating whether or not said each exception type defined in said at least one exception rule had been violated by respective entity;

determining a respective stability value associated with the first entity; and

producing the PBA report with the respective category from said assigning, the decision respective to each exception type from said assigning, the respective stability value from said determining, and further data retrieved from the data storage for the data items selected for the PBA report.

11. A computer system comprising a processor, a memory coupled to the processor, and a computer readable storage device coupled to the processor, said storage device containing program code configured to be executed by the processor via the memory to implement detecting a statistical variation of a process operating in an Information Technology (IT) delivery system from a textual log of the process, said detecting comprising:

grouping, by a process behavior analysis (PBA) engine, entities appearing in the textual log of the process based on a respective time series corresponding to each entity of said entities, wherein a data storage operatively coupled to the PBA engine stores the textual log of the process and at least one exception rule defining the statistical variation used by the PBA engine;

analyzing statistical process behavior of the process by running the PBA engine with the entities from said grouping such that each entity of said entities is represented by a respective control chart associated with said each entity and such that the PBA engine is enabled to determine whether said each entity violates said at least one exception rule; and

generating a PBA report for the process pursuant to a result from said analyzing, wherein the PBA report comprises data items selected from the group consisting of a first time window within which a first time series of a first entity of the entities in the textual log is being monitored by the PBA engine for the statistical variation, a second entity being grouped with the first entity, a first shift value for a first exception detected for the first entity, and combinations thereof.

12. The computer system of claim 11, said grouping comprising:

extracting the entities from the textual log of the process, wherein said each entity of the entities represents a respective phrase describing problems of the IT delivery system, wherein the PBA engine is monitoring the process running in the IT delivery system by use of the textual log;

extracting a respective time series corresponding to said each entity from the textual log, wherein the respective time series represents a respective sequence of data points associated with said each entity, as being measured at uniform time intervals such that the respective time series of said each entity demonstrates a respective statistical pattern of occurrences of said each entity in the textual log; and

merging the second entity with the first entity upon determining that a second time series of the second entity is statistically similar to the first time series of the first entity, wherein statistical similarity is determined based on said at least one exception rule.

13. The computer system of claim 11, said analyzing comprising:

generating a first control chart corresponding to the first time series for the first entity, wherein the first control chart comprises a center mean line ( X), an upper control limit (UCL), and a lower control limit (LCL), wherein UCL=( X+3σ

), wherein σ

is a standard error, and wherein LCL=( X−

3σ

);

determining that the first entity violates the first exception according to said at least one exception rule;

identifying, responsive to said determining, the first exception type and the first time window;

calculating a first rank score of the first entity based on said identifying; and

associating the first entity, the first exception type, the first time window, the first control chart, and the first rank score and subsequent storing the associated data items in the data storage.

14. The computer system of claim 13, wherein said at least one exception rule is represented on the first control chart,

wherein a first exception rule of said at least one exception rule represents a first exception type comprising a data point of the first time series that is either greater than the UCL or less than the LCL,

wherein a second exception rule of said at least one exception rule represents a second exception type wherein a predetermined number of consecutive data points of the first time series are either above X or below X, wherein the predetermined number is selected from the group consisting of seven (7) and nine (9),

wherein a third exception rule of said at least one exception rule represents a third exception type wherein six (6) or more consecutive data points of the first time series show a continuous increase or a continuous decrease,

wherein a fourth exception rule of said at least one exception rule represents a fourth exception type wherein fourteen (14) or more consecutive data points of the first time series oscillate above and below X,

wherein a fifth exception rule of said at least one exception rule represents a fifth exception type wherein two (2) or more consecutive data points of the first time series are either above ( X+2σ

) or below ( X−

2σ

),

wherein a sixth exception rule said at least one exception rule represents a sixth exception type wherein four (4) or more consecutive data points of the first time series are either above ( X+σ

) or below ( X−

σ

),

wherein a seventh exception rule said at least one exception rule represents a seventh exception type wherein fifteen (15) or more consecutive data points of the first time series are between ( X−

σ

) and ( X+σ

),

wherein an eighth exception rule said at least one exception rule represents an eighth exception type wherein eight (8) or more consecutive data points of the first time series are either less than ( X−

σ

) or greater than ( X+σ

).

15. The computer system of claim 11, said generating comprising:

assigning a respective category to each entity of the entities pursuant to respective exception type defined in said at least one exception rule, and a decision respective to each exception type indicating whether or not said each exception type defined in said at least one exception rule had been violated by respective entity;

determining a respective stability value associated with the first entity; and

producing the PBA report with the respective category from said assigning, the decision respective to each exception type from said assigning, the respective stability value from said determining, and further data retrieved from the data storage for the data items selected for the PBA report.

16. A process for supporting computer infrastructure, said process comprising providing at least one support service for at least one of creating, integrating, hosting, maintaining, and deploying computer-readable code in a computing system, wherein the code in combination with the computing system is capable of performing detecting a statistical variation of a process operating in an Information Technology (IT) delivery system from a textual log of the process, said detecting comprising:

grouping, by a process behavior analysis (PBA) engine, entities appearing in the textual log of the process based on a respective time series corresponding to each entity of said entities, wherein a data storage operatively coupled to the PBA engine stores the textual log of the process and at least one exception rule defining the statistical variation used by the PBA engine;

analyzing, by a processor of a computer system, statistical process behavior of the process by running the PBA engine with the entities from said grouping such that each entity of said entities is represented by a respective control chart associated with said each entity and such that the PBA engine is enabled to determine whether said each entity violates said at least one exception rule; and

generating a PBA report for the process pursuant to a result from said analyzing, wherein the PBA report comprises data items selected from the group consisting of a first time window within which a first time series of a first entity of the entities in the textual log is being monitored by the PBA engine for the statistical variation, a second entity being grouped with the first entity, a first shift value for a first exception detected for the first entity, and combinations thereof.

17. The process of claim 16, said grouping comprising:

extracting the entities from the textual log of the process, wherein said each entity of the entities represents a respective phrase describing problems of the IT delivery system, wherein the PBA engine is monitoring the process running in the IT delivery system by use of the textual log;

extracting a respective time series corresponding to said each entity from the textual log, wherein the respective time series represents a respective sequence of data points associated with said each entity, as being measured at uniform time intervals such that the respective time series of said each entity demonstrates a respective statistical pattern of occurrences of said each entity in the textual log; and

merging the second entity with the first entity upon determining that a second time series of the second entity is statistically similar to the first time series of the first entity, wherein statistical similarity is determined based on said at least one exception rule.

18. The process of claim 16, said analyzing comprising:

generating a first control chart corresponding to the first time series for the first entity, wherein the first control chart comprises a center mean line ( X), an upper control limit (UCL), and a lower control limit (LCL), wherein UCL=( X+3σ

), wherein σ

is a standard error, and wherein LCL=( X−

3σ

);

determining that the first entity violates the first exception according to said at least one exception rule;

identifying, responsive to said determining, the first exception type and the first time window;

calculating a first rank score of the first entity based on said identifying; and

associating the first entity, the first exception type, the first time window, the first control chart, and the first rank score and subsequent storing the associated data items in the data storage.

19. The process of claim 18, wherein said at least one exception rule is represented on the first control chart,

wherein a first exception rule of said at least one exception rule represents a first exception type comprising a data point of the first time series that is either greater than the UCL or less than the LCL,

wherein a second exception rule of said at least one exception rule represents a second exception type wherein a predetermined number of consecutive data points of the first time series are either above X or below X, wherein the predetermined number is selected from the group consisting of seven (7) and nine (9),

wherein a third exception rule of said at least one exception rule represents a third exception type wherein six (6) or more consecutive data points of the first time series show a continuous increase or a continuous decrease,

wherein a fourth exception rule of said at least one exception rule represents a fourth exception type wherein fourteen (14) or more consecutive data points of the first time series oscillate above and below X,

wherein a fifth exception rule of said at least one exception rule represents a fifth exception type wherein two (2) or more consecutive data points of the first time series are either above ( X+2σ

) or below ( X−

2σ

),

wherein a sixth exception rule said at least one exception rule represents a sixth exception type wherein four (4) or more consecutive data points of the first time series are either above ( X+σ

) or below ( X−

σ

),

wherein a seventh exception rule said at least one exception rule represents a seventh exception type wherein fifteen (15) or more consecutive data points of the first time series are between ( X−

σ

) and ( X+σ

),

wherein an eighth exception rule said at least one exception rule represents an eighth exception type wherein eight (8) or more consecutive data points of the first time series are either less than ( X−

σ

) or greater than ( X+σ

).

20. The process of claim 16, said generating comprising:

assigning a respective category to each entity of the entities pursuant to respective exception type defined in said at least one exception rule, and a decision respective to each exception type indicating whether or not said each exception type defined in said at least one exception rule had been violated by respective entity;

determining a respective stability value associated with the first entity; and

producing the PBA report with the respective category from said assigning, the decision respective to each exception type from said assigning, the respective stability value from said determining, and further data retrieved from the data storage for the data items selected for the PBA report.