Predicting service issues by detecting anomalies in event signal

• US 9,697,070 B2
• Filed: 08/31/2015
• Issued: 07/04/2017
• Est. Priority Date: 08/31/2015
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Bhattacharya, Pamela, Shah, Himesh, Pandey, Ganesh
• Primary Examiner(s): Wilson, Yolanda L
• Application Number:
  US14/840,518
• Publication Number:
  US 20170060656A1
• Time in Patent Office: 673 Days
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06Q 10/063 Operations research, analysis or management

Abstract

Service issues predicted by detecting anomalies in an event signal is provided. An application such as a signal analysis application receives an event signal for analysis. The event signal includes events captured during a time period. The event signal is processed to generate a trend line. The trend line includes a best fit line transposed across averages of number of events of each data point across the time period. The number of events of an end data point may be compared to an upper confidence score and a lower confidence score associated with the end data point on the trend line. In response to detecting the number of events of the end data point exceed the upper confidence score, a notification is transmitted to a stakeholder associated with the event signal. The notification may describe a symptom associated with the number of events on the end data point.

Claims

1. A computing device for predicting service issues by detecting anomalies in an event signal, the computing device comprising:

a networking device;

a memory configured to store instructions associated with a signal analysis application;

one or more processors coupled to the memory and the networking device, the one or more processors executing the signal analysis application in conjunction with the instructions stored in the memory, wherein the signal analysis application includes;

an analysis engine configured to;

receive, through the networking device, the event signal, wherein the event signal includes events captured during a time period;

process the event signal to generate a trend line;

compare a number of the events of an end data point within the event signal to an upper confidence score and a lower confidence score associated with the end data point within the trend line; and

a communication module configured to;

in response to detecting the number of the events exceed the upper confidence score, transmit, through the networking device, a notification that describes a symptom associated with the end data point within the event signal.

2. The computing device of claim 1, wherein the events include one or more of:

support activity events, hardware component status events, and performance status events.

3. The computing device of claim 1, wherein the analysis engine is further configured to:

one or more of;

query a personnel provider to identify a support team assigned to monitor the event signal;

identify the support team assigned to monitor the event signal from the event signal; and

provide the notification to the communication module to prompt the communication module to transmit the notification to the support team.

4. The computing device of claim 1, wherein the analysis engine is further configured to:

compute averages for the number of the events in each data point within the event signal; and

transpose a best fit line over the averages to generate the trend line.

5. The computing device of claim 1, wherein the end data point identifies a periodic section of the time period in which the event signal is captured, wherein the end data point includes one or more of:

a present time period within the event signal and a recent time period within the event signal.

6. The computing device of claim 1, wherein the analysis engine is further configured to:

query one or more components of a system associated with the event signal to identify one or more changes associated with the one or more components, wherein the event signal includes measurements associated with the one or more components; and

identify a relationship between a timing of the one or more changes and the number of the events of the end data point of the event signal.

7. The computing device of claim 6, wherein the relationship includes a causal time period between the timing of the one or more changes and the number of the events of the end data point of the event signal.

8. The computing device of claim 6, wherein the analysis engine is further configured to:

describe a correlation between the timing of the one or more changes and the number of the events of the end data point of the event signal within the notification, wherein the correlation is based on the relationship.

9. The computing device of claim 1, wherein the analysis engine is further configured to:

receive instructions to analyze a selected data point within the event signal;

compare a number of the events of the selected data point within the event signal against another upper confidence score and another lower confidence score associated with the selected data point within the trend line; and

in response to detecting the number of the events exceed the other upper confidence score, prompt the communication module to transmit another notification that describes another symptom associated with the selected data point within the event signal.

10. The computing device of claim 9, wherein the analysis engine is further configured to:

query one or more components of a system associated with the event signal to identify one or more resolutions associated with the symptom applied to the one or more components;

generate a historical report that includes the other notification and a description of the one or more resolutions applied to the one or more components; and

provide the historical report to the communication module to prompt the communication module to transmit the historical report.

11. The computing device of claim 1, wherein the analysis engine is further configured to:

in response to a detection of the number of the events fall below the lower confidence score,

query one or more components of a system associated with the event signal to identify one or more changes applied to the one or more components within a timing that is in proximity to the end data point within the event signal, wherein the event signal includes measurements associated with the one or more components; and

provide another notification to the communication module to prompt the communication module to transmit the other notification, wherein the other notification describes a success associated with the one or more changes.

12. A method executed on a computing device for predicting service issues by detecting anomalies in an event signal, the method comprising:

receiving the event signal, wherein the event signal includes events captured during a time period, wherein the time period includes one or more of;

hours, days, weeks, and months;

processing the event signal to generate a trend line;

comparing a number or the events on an end data point within the event signal to an upper confidence score and a lower confidence score associated with the end data point within the trend line; and

in response to detecting the number of the events exceed the upper confidence score, transmitting a notification that describes a symptom associated with the event signal on the end data point.

13. The method of claim 12, further comprising:

receiving an update to the event signal, wherein the update includes new events captured during a new time period;

applying the update to the event signal; and

updating the trend line with the number of new events.

14. The method of claim 13, further comprising:

comparing the number of the events of the end data point within the updated event signal against another upper confidence score and another lower confidence score associated with the end data point of the updated trend line; and

in response to detecting the number of the events exceed the other upper confidence score, transmitting another notification that describes another symptom associated with the updated event signal on the end data point.

15. The method of claim 12, further comprising:

computing the upper confidence score based on a variance between the trend line and a value of the number of the events for each data point of the event signal that is above the trend line.

16. The method of claim 12, further comprising:

computing the lower confidence score based on a variance between the trend line and a value of the number of the events for each data point of the event signal that is below the trend line.

17. The method of claim 12, wherein the event signal includes measurements of one or more of:

a geographic distribution of one or more components of a system, one or more components associated with an availability of a data store, and one or more components of a data center.

18. A method for predicting service issues by detecting anomalies in an event signal, the method comprising:

receiving the event signal, wherein the event signal includes events captured during a time period, wherein the time period includes one or more of;

hours, days, weeks, and months;

processing the event signal to generate a trend line;

comparing a number of the events on an end data point within the event signal to an upper confidence score and a lower confidence score associated with the end data point within the trend line;

in response to detecting the number of the events exceed the upper confidence score, transmitting a notification that describes a symptom associated with the event signal on the end data point, wherein the notification further describes a correlation between a timing of one or more changes associated with one or more components of a system and the number of the events of the end data point; and

in response to detecting the timing of the one or more changes is within a proximity to the end data point, prompting a stakeholder to resolve the symptom as associated with the one or more changes.

19. The method of claim 18, wherein the method further comprise:

querying the one or more components of the system associated with the event signal to identify the one or more changes associated with the one or more components, wherein the event signal includes measurements associated with the one or more components; and

identifying a relationship between the timing of the one or more changes and the number of the events of the end data point of the event signal,

wherein the correlation is based on the relationship.

20. The method of claim 18, wherein the method further comprise:

receiving an update to the event signal, wherein the update includes new events captured during a new time period;

applying the update to the event signal;

updating the trend line with the number of new events;

comparing the number of the events of the end data point within the updated event signal against another upper confidence score and another lower confidence score associated with the end data point of the updated trend line; and

in response to detecting the number of the events exceed the other upper confidence score, transmitting another notification that describes another symptom associated with the updated event signal on the end data point.