Systems and methods for spatially displaced correlation for detecting value ranges of transient correlation in machine data of enterprise systems

• US 9,658,910 B2
• Filed: 07/29/2014
• Issued: 05/23/2017
• Est. Priority Date: 07/29/2014
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Poola, Thyagaraju, Karpuram, Venkata Ramana, Volchegursky, Vladimir
• Primary Examiner(s): MASKULINSKI, MICHAEL C
• Application Number:
  US14/446,131
• Publication Number:
  US 20160034328A1
• Time in Patent Office: 1,029 Days
• CPC Class Codes: G06F 11/0748 in a remote unit communicating with a single-box computer node experiencing an error/fault remote testing G06F11/2294
• CPC Class Codes: G06F 11/0754 by exceeding limits
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/34 Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
• CPC Class Codes: G06F 2201/81 Threshold

Abstract

Aspects of the present disclosure include systems and/or methods for detecting ranges of data that represent transient correlations in machine data corresponding to various hardware and/or software systems, such as enterprise systems employed by an information technology (“IT”) organization. In various aspects, the machine data may comprise one or more operational metrics that represent system performance, usage, and/or business activity of the enterprise system. The operational metrics may be used to identify operational issues within the enterprise system.

Claims

1. A method comprising:

collecting, from a system, a set of machine data including a plurality of operational metrics that track, over time, performance of two or more hardware or software components deployed within the system;

generating, by one or more computing devices, a plurality of ranges of data based on a first time-series dataset, included in the set of machine data, that tracks a first metric measuring a first performance of a first hardware or software component, wherein each respective range of data includes a different respective subset of data points from a particular period of time in the first time-series dataset, wherein each respective range of data includes a different respective first edge defining a high boundary for values from the particular period of time in the first time-series dataset to include in the respective subset of data points for the respective range of data and a second edge defining a low boundary for values from the particular period of time in the first time-series dataset to include in the respective subset of data points for the respective range of data, wherein data points from the particular period of time in the first time-series dataset that have a corresponding value above the high boundary or below the low boundary of the respective range of data are not included in the respective subset of data points for the respective range of data;

for at least one respective range of data of the plurality of ranges of data;

determining a first correlation coefficient based on the respective subset of data points of the respective range of data and a corresponding subset of data points from a second time-series dataset, included in the set of machine data that tracks a second metric measuring a second performance of a second hardware or software component of the system;

modifying the respective subset of data points from the first time-series dataset included in the respective range of data by moving at least one of the respective first edge or the respective second edge to increase a number of data points within the particular period of time of the first time-series dataset that are included in the respective subset of data points for the respective range of data; and

determining at least a second correlation coefficient based on the modified subset of data points and the corresponding subset of data points from the second time-series dataset;

determining a representative correlation coefficient for at least one respective range of data based on the first correlation coefficient and the at least second correlation coefficient; and

based on the representative correlation coefficient for the at least one respective range of data, adjusting a configuration of at least one hardware or software component that is correlated to degradation of the second performance.

2. The method of claim 1, wherein modifying the respective subset of data points comprises:

updating, for a particular range of data of the at least one respective range of data, the respective subset of data points by increasing the first edge of the particular range of data to add a first number of data points to the respective subset of data points within the particular range of data;

wherein determining at least the second correlation coefficient comprises;

updating the corresponding subset of data points from the second time-series dataset by increasing a second number of data points within the corresponding subset of data points from the second time-series dataset; and

determining an updated correlation coefficient based on the updated respective subset of data points for the particular range and the updated corresponding subset of data points from the second time-series dataset;

the method further comprising;

determining a first value, the first value being a sum of squares of correlation coefficients, based on the first correlation coefficient and the updated correlation coefficient; and

when the first value is greater than the representative correlation coefficient, moving the first edge of the data points to increase the number of data points within the particular range of data.

3. The method of claim 2, further comprising:

when the first value is less than the representative correlation coefficient, identifying the first value as a new representative correlation coefficient.

4. The method of claim 1, wherein modifying the respective subset of data points comprises:

updating, for a particular range of data of the at least one respective range of data, the respective subset of data points by decreasing the second edge of the particular range of data to add a first number of data point within the respective range of data;

wherein determining at least the second correlation coefficient comprises;

updating the corresponding subset of data points from the second time-series dataset by increasing a second number of data points within the corresponding subset of data points from the second time-series dataset; and

determining an updated correlation coefficient based on the updated respective subset of data points for the particular range and the updated corresponding subset of data points from the second time-series dataset;

the method further comprising;

determining a first value, the first value being a sum of squares of correlation coefficients, based on the first correlation coefficient and the updated correlation coefficient; and

when the first value is greater than the representative correlation coefficient, moving the first edge of the data points to increase the number of data points within the particular range of data.

5. The method of claim 4, further comprising:

when the first value is less than the representative correlation coefficient, identifying the first value as a new representative correlation coefficient.

6. The method of claim 1, wherein each respective range of data of the plurality of ranges of data includes data points from a particular time interval within the first time-series dataset, the plurality of ranges including a first range of data and a second range of data, the first range of data including at least one data point from a particular point in time within the time interval that falls between two data points from the second range of data, and wherein the first data point is matched to a corresponding data point in the corresponding subset of data points from the second time-series dataset based on a timestamp associated with the first data point.

7. The method of claim 1, wherein the first correlation coefficient is calculated using at least one of a Pearson or Spearman correlation algorithm and wherein the representative correlation coefficient is a maximum correlation coefficient of the first correlation coefficient and at least the second correlation coefficient.

8. The method of claim 1, wherein adjusting the configuration of at least one hardware or software component comprises deploying additional resources.

9. The method of claim 1, further comprising:

based on the representative correlation coefficient of each discrete range of data, identifying a specific range of data from the plurality of ranges of data that identifies an acceptable correlation between the first metric and the second metric.

10. The method of claim 9, further comprising:

determining a p-value corresponding to the range of data; and

when the p-value proves a hypothesis of correlation between the first metric and the second metric, generating an indication.

11. The method of claim 1, further comprising:

based on the representative correlation coefficient of each discrete range of data, identifying specific ranges of data from the plurality of ranges of data that identifies an acceptable correlation between the first metric and the second metric; and

determining a plurality of p-values corresponding to the specific ranges of data; and

when at least one of the plurality of p-values proves a hypothesis of correlation between the first metric and the second metric, generating an indication.

12. A non-transitory computer readable medium storing instructions, which when executed by one or more hardware processors, cause operations comprising:

collecting, from a system, a set of machine data including a plurality of operational metrics that track, over time, performance of two or more hardware or software components deployed within the system;

generating, by one or more computing devices, a plurality of ranges of data based on a first time-series dataset, included in the set of machine data, that tracks a first metric measuring a first performance of a first hardware or software component, wherein each respective range of data includes a different respective subset of data points from a particular period of time in the first time-series dataset, wherein each respective range of data includes a different respective first edge defining a high boundary for values from the particular period of time in the first time-series dataset to include in the respective subset of data points for the respective range of data and a second edge defining a low boundary for values from the particular period of time in the first time-series dataset to include in the respective subset of data points for the respective range of data, wherein data points from the particular period of time in the first time-series dataset that have a corresponding value above the high boundary or below the low boundary of the respective range of data are not included in the respective subset of data points for the respective range of data;

for at least one respective range of data of the plurality of ranges of data;

determining a first correlation coefficient based on the respective subset of data points of the respective range of data and a corresponding subset of data points from a second time-series dataset, included in the set of machine data that tracks a second metric measuring a second performance of a second hardware or software component of the system;

modifying the respective subset of data points from the first time-series dataset included in the respective range of data by moving at least one of the respective first edge or the respective second edge to increase a number of data points within the particular period of time of the first time-series dataset that are included in the respective subset of data points for the respective range of data; and

determining at least a second correlation coefficient based on the modified subset of data points and the corresponding subset of data points from the second time-series dataset;

determining a representative correlation coefficient for at least one respective range of data based on the first correlation coefficient and the at least second correlation coefficient; and

based on the representative correlation coefficient for the at least one respective range of data, adjusting a configuration of at least one hardware or software component that is correlated to degradation of the second performance.

13. The non-transitory computer readable medium of claim 12, wherein instructions for modifying the respective subset of data points comprise instructions for:

wherein determining at least the second correlation coefficient comprises;

updating the corresponding subset of data points from the second time-series dataset by increasing a second number of data points within the corresponding subset of data points from the second time-series dataset; and

determining an updated correlation coefficient based on the updated respective subset of data points for the particular range and the updated corresponding subset of data points from the second time-series dataset;

the instructions further causing operations comprising;

determining a first value, the first value being a sum of squares of correlation coefficients, based on the first correlation coefficient and the updated correlation coefficient; and

when the first value is greater than the representative correlation coefficient, moving the first edge of the data points to increase the number of data points within the particular range of data.

14. The non-transitory computer readable medium of claim 13, wherein the instructions further cause operations comprising:

when the first value is less than the representative correlation coefficient, identifying the first value as a new representative correlation coefficient.

15. The non-transitory computer readable medium of claim 12, wherein instructions for modifying the respective subset of data points comprise instructions for:

updating, for a particular range of data of the at least one respective range of data, the respective subset of data points by decreasing the second edge of the particular range of data to add a first number of data point within the respective range of data;

wherein determining at least the second correlation coefficient comprises;

updating the corresponding subset of data points from the second time-series dataset by increasing a second number of data points within the corresponding subset of data points from the second time-series dataset; and

determining an updated correlation coefficient based on the updated respective subset of data points for the particular range and the updated corresponding subset of data points from the second time-series dataset;

the instructions further causing operations comprising;

determining a first value, the first value being a sum of squares of correlation coefficients, based on the first correlation coefficient and the updated correlation coefficient; and

when the first value is greater than the representative correlation coefficient, moving the first edge of the data points to increase the number of data points within the particular range of data.

16. The non-transitory computer readable medium of claim 15, wherein the instruction further cause operations comprising:

when the first value is less than the representative correlation coefficient, identifying the first value as a new representative correlation coefficient.

17. The non-transitory computer readable medium of claim 12, each respective range of data of the plurality of ranges of data includes data points from a particular time interval within the first time-series dataset, the plurality of ranges including a first range of data and a second range of data, the first range of data including at least one data point from a particular point in time within the time interval that falls between two data points from the second range of data, and wherein the first data point is matched to a corresponding data point in the corresponding subset of data points from the second time-series dataset based on a timestamp associated with the first data point.

18. The non-transitory computer readable medium of claim 12, wherein the first correlation coefficient is calculated using at least one of a Pearson or Spearman correlation algorithm and wherein the representative correlation coefficient is a maximum correlation coefficient of the first correlation coefficient and at least the second correlation coefficient.

19. The non-transitory computer readable medium of claim 12, wherein adjusting the configuration of at least one hardware or software component comprises deploying additional resources.

20. The non-transitory computer readable medium of claim 12, further comprising:

based on the representative correlation coefficient of each discrete range of data, identifying a specific range of data from the plurality of ranges of data that identifies an acceptable correlation between the first metric and the second metric.

21. The non-transitory computer readable medium of claim 20, further comprising:

determining a p-value corresponding to the range of data; and

when the p-value proves a hypothesis of correlation between the first metric and the second metric, generating an indication.

22. The non-transitory computer readable medium of claim 12, wherein the instructions further cause operations comprising:

based on the representative correlation coefficient of each discrete range of data, identifying specific ranges of data from the plurality of ranges of data that identifies an acceptable correlation between the first metric and the second metric; and

determining a plurality of p-values corresponding to the specific ranges of data; and

when at least one of the plurality of p-values proves a hypothesis of correlation between the first metric and the second metric, generating an indication.