Ranking the importance of alerts for problem determination in large systems

• US 8,098,585 B2
• Filed: 10/28/2008
• Issued: 01/17/2012
• Est. Priority Date: 05/21/2008
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Laboratories America Inc (NEC Corporation)
• Inventors: Jiang, Guofei, Chen, Haifeng, Yoshihira, Kenji
• Primary Examiner(s): Phillips, Hassan
• Assistant Examiner(s): Jones, Prenell
• Application Number:
  US12/259,623
• Publication Number:
  US 20090292954A1
• Time in Patent Office: 1,176 Days
• Field of Search: 370/241, 370/231, 370/235, 370/252, 370/271, 370/272, 370/389, 370/401, 705/37, 705/36, 706/47, 340/517, 726/22, 379/15, 379/88, 455/450, 713/181
• US Class Current: 370/241
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0781 Error filtering or prioritizing based on a policy defined by the user or on a policy defined by a hardware/software module, e.g. according to a severity level
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 43/16 Threshold monitoring

Abstract

A system and method for prioritizing alerts includes extracting invariants to determine a stable set of models for determining relationships among monitored system data. Equivalent thresholds for a plurality of rules are computed using an invariant network developed by extracting the invariants. For a given time window, a set of alerts are received from a system being monitored. A measurement value of the alerts is compared with a vector of equivalent thresholds, and the set of alerts is ranked.

Claims

1. A method for prioritizing alerts, comprising:

extracting invariants stored on a computer readable storage medium to determine a stable set of models for determining relationships among monitored system data;

computing equivalent thresholds for a plurality of rules using an invariant network developed by extracting the invariants;

for a given time window, receiving a set of alerts from a system being monitored;

comparing a measurement value of the alerts with a vector of equivalent thresholds; and

ranking the set of alerts.

2. The method as recited in claim 1, wherein extracting invariants includes:

computing a fitness score for monitored data models in a given time window;

filtering out the monitored data models below a fitness threshold; and

over a plurality of time windows, considering remaining monitored data models as invariants.

3. The method as recited in claim 1, wherein the invariant network includes nodes which represent measurements and further comprising propagating values between the nodes of the invariant network to estimate other measurements.

4. The method as recited in claim 1, wherein propagating values includes mapping thresholds from other nodes to provide equivalent thresholds.

5. The method as recited in claim 1, wherein comparing a measurement value of the alerts with a vector of equivalent thresholds includes comparing equivalent thresholds to determine an importance of an alert corresponding to the measurement value.

6. The method as recited in claim 1, wherein the importance includes a probability of reporting a true positive.

7. The method as recited in claim 1, wherein ranking includes handling the alerts in order of importance.

8. The method as recited in claim 1, wherein comparing a measurement value of the alerts with a vector of equivalent thresholds includes determining a number of threshold violations (NTVs);

and sorting the NTVs to rank the set of alerts.

9. A method for prioritizing alerts, comprising:

collecting historical monitoring data from one or more system components;

extracting invariants stored on a computer readable storage medium to determine a stable set of models for determining relationships among the historical monitoring system data;

collecting management rules from system components being monitored;

computing equivalent thresholds for the management rules using an invariant network developed by extracting the invariants;

for a given time window, receiving a set of alerts from the system components being monitored;

comparing a measurement value of the alerts with a vector of equivalent thresholds to compute a number of threshold violations (NTVs); and

sorting the NTVs to rank the set of alerts.

10. The method as recited in claim 9, wherein extracting invariants includes:

computing a fitness score for monitored data models in a given time window;

filtering out the monitored data models below a fitness threshold; and

over a plurality of time windows, considering remaining monitored data models as invariants.

11. The method as recited in claim 9, wherein the invariant network includes nodes which represent measurements and further comprising propagating values between the nodes of the invariant network to estimate other measurements.

12. The method as recited in claim 11, wherein propagating values includes mapping thresholds from other nodes to provide equivalent thresholds.

13. The method as recited in claim 9, wherein comparing a measurement value of the alerts with a vector of equivalent thresholds includes comparing equivalent thresholds to determine an importance of an alert corresponding to the measurement value.

14. The method as recited in claim 9, wherein the importance includes a probability of reporting a true positive.

15. The method as recited in claim 9, wherein sorting includes handling the alerts in order of importance.

16. A system for prioritizing alerts, comprising:

a program storage media stores an invariants network constructed using measurements as nodes and edges to represent invariant relationships among monitored system data, the invariant network being configured to compute equivalent thresholds for a plurality of rules;

an alert generator configured to generate alerts, for a given time window for a system being monitored; and

a peer review mechanism configured to compare a measurement value to a local threshold and to equivalent thresholds mapped from other rules to determine the importance of the alerts.

17. The system as recited in claim 16, wherein the invariant network includes nodes which represent measurements and values are propagated between the nodes of the invariant network to estimate other thresholds or measurements.

18. The system as recited in claim 16, wherein the importance includes a probability of reporting a true positive.

19. The system as recited in claim 16, wherein the measurement value of the alerts includes a vector of equivalent thresholds having a number of threshold violations (NTVs).