Feedback-based symptom and condition correlation

• US 8,812,659 B2
• Filed: 05/26/2011
• Issued: 08/19/2014
• Est. Priority Date: 05/26/2011
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Mestemaker, Paul A., DePue, Adam C., Jayapal, Prasanna Kumar, Rizzi, Lorenzo, Gilbert, Mark, Sanghvi, Ashvin J.
• Primary Examiner(s): Shah, Chirag
• Assistant Examiner(s): ULYSSE, JAEL M
• Application Number:
  US13/115,996
• Publication Number:
  US 20120303793A1
• Time in Patent Office: 1,181 Days
• Field of Search: 709/204, 709/206, 709/217, 709/224, 709/223, 706/12, 706/47, 706/52, 706/50, 370/241, 370/230, 707/707, 707/708, 707/602, 717/113, 726/22
• US Class Current: 709/224
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis

Abstract

Feedback data can be received from client agents running on client computer systems. The feedback data can include data on the symptoms and conditions for rules that relate computer system symptoms to computer system conditions. The feedback data can be analyzed to produce correlation information that quantifies a degree of correlation between the symptom(s) and condition(s) related by the rule(s). It may be determined whether analysis of the feedback data warrants including one of the rules in correlation mappings to be applied to monitored computer systems. If so, then that rule can be included in the mappings. Information representing the correlation mappings may be transmitted to the monitored computer system(s). Additionally, information representing the correlation mappings may be transmitted to the monitored computer system(s), and types of feedback data collected from the client agents can be altered on the basis of the correlation information.

Claims

1. A computer-implemented method, comprising:

receiving user input, the user input identifying one or more rules, each of the one or more rules relating one or more computer system symptoms to one or more computer system conditions;

receiving feedback data from a plurality of client agents running on a plurality of client computer systems, the feedback data including data indicating presence of the one or more symptoms in the client computer systems for each of the one or more rules and indicating presence of the one or more conditions in the client computer systems for each of the one or more rules;

analyzing the feedback data to produce correlation information for each of the one or more rules, the correlation information quantifying a degree of correlation between presence of the one or more symptoms and presence of the one or more conditions related by each of the one or more rules, the one or more rules comprising a set of one or more correlation mappings;

generating computer support information derived from at least one of the one or more rules;

transmitting one or more mapping representations to a set of monitored computer systems, the one or more mapping representations including instructions that, when executed in the set of monitored computer systems, apply the set of one or more correlation mappings to the set of monitored computer systems;

receiving an alert if one of the mappings is met in a monitored computer system in the set of monitored computer systems;

refining the set of correlation mappings, the refinement being based on analysis of additional feedback data received from the set of monitored computer systems; and

altering types of feedback data collected from the plurality of client agents, the alteration being based on the correlation information.

2. The method of claim 1, wherein the one or more rules comprise one or more hypotheses and the set of one or more correlation mappings, and wherein the method further comprises determining whether the correlation information warrants including at least one of the one or more hypotheses in the set of one or more correlation mappings.

3. The method of claim 2, further comprising including the at least one of the one or more hypotheses in the set of one or more correlation mappings if it is determined that the inclusion of the at least one hypothesis is warranted by the feedback data.

4. The method of claim 2, wherein altering types of feedback data collected from the plurality of client agents comprises instructing the plurality of client agents to refrain from collecting data related to one or more rules that have been removed from the set of one or more mappings.

5. The method of claim 2, further comprising applying the set of one or more correlation mappings to the set of monitored computer systems, applying the set of one or more mappings including determining for each monitored computer system in the set of monitored computer systems whether one or more of the one or more mappings is met in that monitored computer system.

6. The method of claim 1, further comprising processing the alert.

7. The method of claim 1, wherein the refinement is based on the correlation information.

8. The method of claim 1, wherein the feedback data comprises one or more indications of one or more conditions that are not present on one or more computer systems.

9. The method of claim 1, further comprising instructing the client agents to limit the feedback data to data that meets one or more conditions.

10. The method of claim 1, wherein the correlation information comprises a correlation weight for each of the one or more rules.

11. A computer system comprising:

at least one processor; and

at least one memory including instructions stored thereon that when executed by the at least one processor cause the at least one processor to perform acts comprising;

receiving feedback data from a plurality of client agents running on a plurality of client computer systems, the feedback data including data indicating presence of one or more computer system symptoms in the client computer systems for each of one or more rules and data indicating presence of one or more computer system conditions in the client computer systems for each of the one or more rules, each of the one or more rules relating one or more of the conditions to one or more of the symptoms;

analyzing the feedback data to produce correlation information for each of the one or more rules, the correlation information quantifying a degree of correlation between presence of the one or more symptoms and presence of the one or more conditions related by each of the one or more rules;

altering types of feedback data collected from the plurality of client agents, the alteration being based on analysis of the feedback data received from the client agents;

determining whether the analysis of the feedback data warrants including at least one of the one or more rules in a set of correlation mappings to be applied to a set of one or more monitored computer systems;

if the analysis of the feedback data warrants including at least one of the one or more rules in the set of correlation mappings, then including the at least one of the one or more rules in the set of correlation mappings; and

transmitting mapping representations to the set of one or more monitored computer systems, the mapping representations including instructions that, when executed in the set of one or more monitored computer systems, apply the set of correlation mappings to the one or more monitored computer systems;

receiving an alert if criteria of one or more of the mappings is met in the set of monitored computer systems; and

refining the set of correlation mappings, the refinement being based on analysis of additional feedback data received from the set of one or more monitored computer systems.

12. The computer system of claim 11, wherein refining the set of correlation mappings comprises altering a mapping by adding a computer system condition item to the altered mapping.

13. The computer system of claim 11, wherein refining the set of correlation mappings comprises altering a mapping by removing a computer system condition item from the altered mapping.

14. The computer system of claim 11, wherein refining the set of correlation mappings comprises tracking correlation weights of the correlation mappings.

15. The computer system of claim 11, wherein refining the set of correlation mappings comprises removing one or more correlation mappings from the set of correlation mappings, the removal of the one or more correlation mappings being based on one or more correlation weights of the one or more removed correlation mappings.

16. The computer system of claim 11, wherein altering types of feedback data collected from the plurality of client agents comprises instructing the plurality of client agents to refrain from collecting data related to one or more rules that have been removed from the set of mappings.

17. One or more computer-readable storage media having computer-executable instructions embodied thereon that, when executed by at least one processor, cause the at least one processor to perform acts comprising:

receiving user input identifying one or more hypotheses, each of the one or more hypotheses relating one or more computer system symptoms to one or more computer system settings;

transmitting to client computer systems a first set of runnable content comprising instructions that when executed on a computer system performs acts comprising;

collecting feedback data including data indicating presence of the one or more symptoms and the one or more settings for each of the one or more hypotheses, collecting the feedback data comprising making one or more instrumentation measurements; and

transmitting the feedback data to a data store;

obtaining the feedback data from the data store;

analyzing the feedback data to produce correlation information for each of the one or more hypotheses, the correlation information including one or more correlation weights that each quantify a degree of correlation between presence of one or more symptoms and presence of one or more computer system settings of a hypothesis;

determining that analysis of the feedback data warrants including at least one of the one or more hypotheses in a set of correlation mappings to be applied to a set of one or more monitored computer systems;

including the at least one of the one or more hypotheses in the set of correlation mappings in response to the determination that the inclusion is warranted by the feedback data;

transmitting mapping representations to the monitored computer systems, the mapping representations including instructions that, when executed in the set of monitored computer systems, apply the set of correlation mappings to the monitored computer systems;

receiving an alert if criteria of one or more of the mappings is met in the set of monitored computer systems;

refining the set of correlation mappings, the refinement being based on analysis of additional feedback data received from the set of monitored computer systems; and

transmitting a second set of runnable content to the client systems, the second set of runnable content altering types of feedback data collected from the client systems.

18. The one or more computer-readable storage media of claim 17, wherein refining the set of correlation mappings comprises:

determining that the analysis of the additional feedback data warrants retiring one or more mappings from the set of correlation mappings; and

in response to determining that the analysis of the additional feedback data warranting retiring one or more mappings from the set of correlation mappings, retiring one or more mappings from the set of correlation mappings.

19. The one or more computer-readable storage media of claim 17, wherein refining the set of correlation mappings comprises:

determining that the analysis of the additional feedback data warrants changing one or more mappings from the set of correlation mappings to hypothesis status; and

in response to determining that the analysis of the additional feedback data warrants changing one or more mappings from the set of correlation mappings to hypothesis status, changing the one or more mappings from the set of correlation mappings to hypothesis status.

20. The one or more computer-readable storage media of claim 17, wherein the second set of runnable content comprises one or more instructions instructing the client systems to refrain from collecting data related to one or more rules that have been removed from the set of correlation mappings.