International Business Machines Corporation

Amitkumar Manoharrao Paradkar

Birgit Monika Pfitzmann

Pooja Aggarwal

Matthew A Markley

Seema Nagar

Larisa Shwartz

Rohan R Arora

Pradeep Varma

Donald Philip Pazel

Ashok Anand

Yunwu Huang

Beth Rush Tibbitts

Venkata Vinay Parisa

William Robert Reohr

Ajay Gupta

Nikolai A Joukov

Joel W Branch

Harshit Kumar

Peter Urbanetz

John K Baker

Venkata Vinay Kumar Parisa

Avik Sinha

Moises I Galvan

Dipanwita Guhathakurta

Mudhakar Srivatsa

Ruchi Mahindru

Vugranam Chakravarthy Sreedhar

Yixin Diao

Elaine Rivette Palmer

Ea-Ee Jan

Paul Ashley Karger

Daniel Brand

Karin Murthy

Clay Edwin Williams

Linh Hue Lam

Suzanne K McIntosh

Rajeev Puri

Amar Prakash Azad

Joshua M Rosenkranz

Atri Mandal

Dipyaman Banerjee

David Claude Toll

Ian Manning

Kenneth David Christiance

Sinem Guven

Matthew Richard James Thornhill

Prateeti Mohapatra

Samuel Monk Weber

Bing Zhou

Matthew N Kaplan

Victoria Lee Guerra

Michael G McIntosh

Suranjana Samanta

Eyal Shnarch

Emi K Olsson

John Robert Davis

Nicholas Tsang

Igor Khapov

Philippe G Charles

Stephen James Hussey

Noah Zheutlin

Anupama Ray

Christopher Fryett

Florian Wilhelm

Franco Forti

Karan Bhukar

Gregory J Chiarella

Aaron T Corette

Paul G Easton

Matthew M Kaplan

Techniques are provided for dynamic alert suppression policy management. In one embodiment, the techniques involve receiving an event stream, wherein the event stream includes metric values comprising at least one of: log anomaly data and metric anomaly data, determining an anomalous event based on the event stream, determining a persistent region of the anomalous event, determining a quantum representation of the persistent region, determining X-Y values of the persistent region based on the quantum representation, and generating a policy based on a set of the X-Y values.

Dynamic alert suppression policy management

A computer-implemented method and a computer system for identifying persistent anomalies for failure prediction. The computer system receives a time series data stream. The computer system received a predetermined number N and a predetermined number M which is a fraction of N. The computer system segments the time series data stream into N consecutive sliding windows. The computer system performs supervised persistent anomaly detection to determine whether anomalies across the N consecutive sliding windows are persistent, by using a binary classification model. The computer system performs unsupervised persistent anomaly detection to determine whether the anomalies across the N consecutive sliding windows are persistent. The computer system combines results of the supervised persistent anomaly detection and results of the unsupervised persistent anomaly detection to determine persistent anomalies.

Identifying persistent anomalies for failure prediction

A computer-implemented method, system and computer program product for generating rules to be utilized by a rule-based system. A parser analyzes a received string of words according to grammatical rules to generate a parse tree. The parse tree may then be reviewed by a user to determine if such a parse tree represents the appropriate syntactic structure of the string of words. If the user believes that the parse tree does not represent the appropriate syntactic structure of the string, then the user, who does not need to possess the expertise of natural language processing, may select the nodes and/or edges of the parse tree in a particular order that corresponds to the correct syntactic structure of the string of words. A grammatical rule is then created for parsing the string of words based on the user selection of nodes and/or edges of the parse tree in a particular order.

Self-learning annotations to generate rules to be utilized by rule-based system

An embodiment includes detecting a set of anomalies recorded during a first predefined window of time in log entries for a computer environment. The embodiment also includes generating cluster data representative of a cluster of anomalies from among the set of anomalies, where the cluster is formed using a lattice clustering algorithm that spatially distinguishes the cluster of anomalies from other anomalies in the set of anomalies. The embodiment also includes composing an explanation using log templates generated from log entries associated with the cluster of anomalies.

Generating incident explanations using spatio-temporal log clustering

Detecting system log anomalies by receiving multivariate time-series system log data an multivariate metric data, inferring system metrics from the system log data and metric data, receiving a metric causal graph including causal relationships between system metrics, determining a univariate variation score for the system metrics, determining a causal variation score for the multivariate time series system metric data, according to the causal graph, determining an overall activity score according to the univariate variation score, and causal variation score, and altering a review window duration according to the activity score.

Dynamic window-size selection for anomaly detection

Methods, systems, and computer program products for mining multi-party collaboration platforms to create triaging trees and playbooks are provided herein. A computer-implemented method includes obtaining, from a multi-user platform, conversations related to at least one technical issue; generating a plurality of triaging trees by analyzing the conversations, wherein each of the triaging trees stores information corresponding to temporal sequences of steps related to diagnosing and resolving said at least one technical issue; and deriving a playbook for resolving said at least one technical issue at least in part by combining two or more of the plurality of triaging trees.

Mining multi-party collaboration platforms to create triaging trees and playbooks

Methods, systems, and computer program products for fault localization for cloud-native applications are provided herein. A computer-implemented method includes classifying an event-related alert directed to at least one system by processing one or more characteristics of the event-related alert; obtaining and processing multiple application logs based at least in part on the classification of the event-related alert; identifying error logs among the multiple application logs based at least in part on the processing of the multiple application logs; ordering the error logs using one or more prioritization techniques; and performing at least one automated action based at least in part on the ordering of the error logs.

Fault localization for cloud-native applications

A method comprises obtaining, from a service management database, one or more change tickets and one or more incident tickets relating to an information technology infrastructure, extracting, from the change tickets and the incident tickets, one or more dimensions indicating potential causality between one or more changes and one or more incidents, identifying configuration items of the information technology infrastructure associated with the one or more changes and the one or more incidents, defining one or more linkages between the one or more changes and the one or more incidents, storing, in the service management database, the defined linkages, building a risk assessment model using the defined linkages, and monitoring subsequent changes to the information technology infrastructure using the risk assessment model.

Discovering linkages between changes and incidents in information technology systems

A technique relates to computer artifacts in a computer system. The technique includes creating a list of insights from artifacts, determining a similarity level between the insights of the artifacts and a predefined area of capability, comparing similarity level of insights for each of the artifacts to a threshold metric, removing artifacts having the similarity level below threshold metric such that artifacts remaining meet the threshold metric, and performing a pair-wise similarity comparison on the artifacts remaining which compares insights of the artifacts to each other to determine which ones are least common. The technique includes creating feature vectors for artifacts that are least common, determining a feature vector having a most variation in feature vectors, an artifact associated with the feature vector being determined to comprise a unique insight, and generating a unique message using the artifact associated with the feature vector being the unique insight.

Computer structures for computer artifacts

Methods and systems for finding a migration target include building a constrained, layered graph from a catalog of possible configuration combinations and a distance function for each layer in the graph; and determining an available path through the graph, said path having a minimum overall distance from a source instance, by performing an optimized search that selectively evaluates available paths through the graph based on cumulative distances of paths through the graph from the source instance.

Efficient configuration combination selection in migration

Evaluating project schedules on a computer system. One or more tasks are identified and corresponding set of deterministic task durations are determined. An initial schedule for completing the tasks is generated based on the deterministic task durations and based on one or more resources. A set of probabilistic durations for the tasks are determined and execution of the tasks is simulated according to the initial schedule based on the set of probabilistic durations.

Scheduling and simulation system

Aspects generate costs for a business plan from normalized cost metric values by mapping (via a processor implementing an automated process) text artifacts of a business plan to different tags that each include a cost as a function of a time period for delivery of a service that is associated with a computer service element. Aspects also generate a summary view cost estimation as a function of the time period, costs of the mapped tags and a geographic region productive factor that is assigned to a region identified as providing delivery of the service that is associated with the computer service element. The summary view cost estimation estimates a total cost of delivering the computing services of the computer service element over time as a function of the normalized, mapped tag cost metrics.

Deriving comparable planned and actual service delivery cost metrics

As disclosed herein an information technology service ticket characterization method includes receiving tickets from one or more client devices during a time period, determining focus windows within the time period where each focus window includes an event window, identifying tickets received within the focus windows, determining a proportion of identified tickets that are related to a service event, and based on the proportion of identified tickets that are related to the service event, assessing the quality of the service event. A corresponding system and computer program product are also disclosed herein.

Characterization and assessment of information technology service events

A method for predicting a computerized service delivery organization workload including collecting data of a computer implementing service delivery routine including overlapping samples of load values, overlapping samples of performance values, overlapping samples of event outputs, ticket values and ticket volumes, building a first correlation of said load values with said performance values for predicting new performance values based on new data, building a second correlation of said performance values with said event outputs, said ticket values and said ticket volumes, combining said first and second correlations into a third correlation for correlating said load values with a ticket volume and an event volume, and determining at least one projected event volume or projected ticket volume value using said third correlation and at least one projected load value of said computer.

Predicting service delivery metrics using system performance data

In a source computing system having a source management infrastructure, at least one source infrastructure management component is discovered. A description of a target cloud infrastructure having a target management infrastructure is obtained. The description includes at least one mandatory target infrastructure management component. The at least one source infrastructure management component is analyzed to determine whether at least one conflict exists with the at least one mandatory target infrastructure management component.

Management infrastructure analysis for cloud migration

Growing community of inventors

Mohegan Lake, NY, United States of America

Amitkumar Manoharrao Paradkar