Diagnosing anomalies based on deviation analysis

• US 9,979,607 B2
• Filed: 06/22/2015
• Issued: 05/22/2018
• Est. Priority Date: 06/22/2015
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Inventors: Mullarkey, Peter William, Davis, Kevin Eugene, Johns, Michael Charles
• Primary Examiner(s): DAILEY, THOMAS J
• Application Number:
  US14/745,781
• Publication Number:
  US 20160373308A1
• Time in Patent Office: 1,065 Days
• Field of Search: None
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/065 related to network devices
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 67/75 Indicating network or usage conditions on the user display

Abstract

A method for diagnosing system anomalies and presenting recommended solutions is described. The method comprises receiving current component performance data and historical component performance data regarding performance of a component of a multi-tier system. A baseline tier performance for each tier and a baseline component performance is determined. A cause of an anomaly in the performance of the component is determined by discovering deviations in current component performance data and current tier performance in compared to their baseline values. Based on these deviations, a recommended procedure for addressing the cause of the anomaly is determined. A display is formatted within a user interface of the recommended procedure for addressing the cause of the anomaly in the performance of the component.

Claims

1. A method, comprising:

receiving current component performance data and historical component performance data regarding performance of a component of a system, wherein the system comprises a plurality of tiers;

determining a baseline tier performance of each tier of the plurality of tiers of the system;

determining a baseline component performance of the component based on the historical component performance data;

determining a cause of an anomaly in the performance of the component, wherein determining the cause of the anomaly in the performance of the component comprises;

determining a first deviation between the current component performance data and the baseline component performance;

determining a second deviation between a current tier performance of a tier of the plurality of tiers and the baseline tier performance of the tier;

determining a third deviation between the current component performance data and component performance of an analogous component in a peer system;

determining a recommended procedure for addressing the cause of the anomaly in the performance of the component based on the first deviation, the second deviation and the third deviation, wherein determining the recommended procedure for addressing the cause of the anomaly in the performance of the component further comprises determining a plurality of recommended procedures for addressing the cause of the anomaly in the performance of the component, the plurality of recommended procedures including the recommended procedure;

receiving input regarding a select recommended procedure of the plurality of recommended procedures for addressing the cause of the anomaly in the performance of the component;

adjusting a ranking of the select recommended procedure according to the input;

formatting for display within a user interface the recommended procedure for addressing the cause of the anomaly in the performance of the component; and

implementing in the system the recommended procedure for addressing the cause of the anomaly.

2. The method of claim 1, further comprising:

quantifying current component performance data using fuzzy logic; and

formatting for display within the user interface the quantified current component performance data.

3. The method of claim 1, wherein determining the recommended procedure for addressing the cause of the anomaly in the performance of the component further comprises:

comparing the cause of the anomaly in the performance of the component to a prior cause of a prior anomaly in a database.

4. The method of claim 1, further comprising:

determining that the anomaly in the performance of the component indicates an error in the system;

receiving input regarding a context of the current component performance data; and

adjusting the ranking of the recommended procedure according to the context, the ranking of the recommended procedure being a ranking among the plurality of recommended procedures for addressing the cause of the anomaly in the performance of the component.

5. The method of claim 1, further comprising:

ranking the recommended procedure among the plurality of recommended procedures for addressing the cause of the anomaly in the performance of the component, wherein the ranking is based on a metric of potential effectiveness for addressing the cause of the anomaly.

6. The method of claim 1, wherein determining the cause of the anomaly in the performance of the component further comprises:

comparing a temporal context of the current component performance data to a similar temporal context in the historical component performance data.

7. The method of claim 1, wherein formatting for display within a user interface further comprises:

formatting for display a server response time of each tier of the plurality of tiers; and

formatting for display the baseline tier performance of each tier of the plurality of tiers.

8. A system comprising:

a processing system comprising a processor configured to perform processes comprising;

receiving current component performance data and historical component performance data regarding performance of a component of a system, wherein the system comprises a plurality of tiers;

determining a baseline tier performance of each tier of the plurality of tiers of the system;

determining a baseline component performance of the component based on the historical component performance data;

determining a cause of an anomaly in the performance of the component, wherein determining the cause of the anomaly in the performance of the component comprises;

determining a first deviation between the current component performance data and the baseline component performance;

determining a second deviation between a current tier performance of a tier of the plurality of tiers and the baseline tier performance of the tier;

determining a third deviation between the current component performance data and the component performance of an analogous component in a peer system;

determining a recommended procedure for addressing the cause of the anomaly in the performance of the component based on the first deviation, the second deviation and the third deviation, wherein determining the recommended procedure for addressing the cause of the anomaly in the performance of the component further comprises determining a plurality of recommended procedures for addressing the cause of the anomaly in the performance of the component, the plurality of recommended procedures including the recommended procedure;

receiving input regarding a select recommended procedure of the plurality of recommended procedures for addressing the cause of the anomaly in the performance of the component;

adjusting a ranking of the select recommended procedure according to the input;

formatting for display within a user interface the recommended procedure for addressing the cause of the anomaly in the performance of the component; and

implementing in the monitored system the recommended procedure for addressing the cause of the anomaly.

9. The system of claim 8, wherein the processing system is configured to perform further processes comprising:

quantifying current component performance data using fuzzy logic; and

formatting for display within the user interface the quantified current component performance data.

10. The system of claim 8, wherein determining the recommended procedure for addressing the cause of the anomaly in the performance of the component further comprises:

comparing the cause of the anomaly in the performance of the component to a prior cause of a prior anomaly in a database.

11. The system of claim 8, wherein the processing system is configured to perform further processes comprising:

determining that the anomaly in the performance of the component indicates an error in the monitored system;

receiving input regarding a context of the current component performance data; and

adjusting the ranking of the recommended procedure according to the context, the ranking of the recommended procedure being a ranking among the plurality of recommended procedures for addressing the cause of the anomaly in the performance of the component.

12. The system of claim 8, wherein the processing system is configured to perform further processes comprising:

ranking the recommended procedure among the plurality of recommended procedures for addressing the cause of the anomaly in the performance of the component, wherein the ranking is based on a metric of potential effectiveness for addressing the cause of the anomaly.

13. The system of claim 8, wherein determining the cause of the anomaly in the performance of the component further comprises:

comparing a temporal context of the current component performance data to a similar temporal context in the historical component performance data.

14. A computer program product comprising:

a non-transitory computer-readable storage medium having computer-readable program code embodied therewith, the computer-readable program code comprising;

computer-readable program code configured to receive current component performance data and historical component performance data regarding performance of a component of a system, wherein the system comprises a plurality of tiers;

computer-readable program code configured to determine a baseline tier performance of each tier of the plurality of tiers of the system;

computer-readable program code configured to determine a baseline component performance of the component based on the historical component performance data;

computer-readable program code configured to determine a cause of an anomaly in the performance of the component, wherein determining the cause of the anomaly in the performance of the component comprises;

computer-readable program code configured to determine a first deviation between the current component performance data and the baseline component performance;

computer-readable program code configured to determine a second deviation between a current tier performance of a tier of the plurality of tiers and the baseline tier performance of the tier;

computer-readable program code configured to determine a third deviation between the current component performance data and component performance of an analogous component in a peer system;

computer-readable program code configured to determine a recommended procedure for addressing the cause of the anomaly in the performance of the component based on the first deviation, the second deviation and the third deviation, wherein determining the recommended procedure for addressing the cause of the anomaly in the performance of the component further comprises determining a plurality of recommended procedures for addressing the cause of the anomaly in the performance of the component, the plurality of recommended procedures including the recommended procedure;

computer-readable program code configured to receive input regarding a select recommended procedure of the plurality of recommended procedures for addressing the cause of the anomaly in the performance of the component;

computer-readable program code configured to adjust a ranking of the select recommended procedure according to the input;

computer-readable program code configured to format for display within a user interface the recommended procedure for addressing the cause of the anomaly in the performance of the component; and

computer-readable program code configured to implement in the monitored system the recommended procedure for addressing the cause of the anomaly.