International Business Machines Corporation

Anthony T Brew

Jonathan Ian Settle

Vinh Tuan Thai

Kristian Jon Stewart

Donagh S Horgan

Ian Manning

Paul M J Barry

Zhenni Yan

Nathan Cullen

Felix Y Chang

Mark N Wegman

Robert J McKeown

John D Postoyko

Ryan A Garrett

Laura Flores Sánchez

Paul J Murphy

Michele Palmia

Anthony W Ward

Zhenni V N Yan

Fuguo Huang

Louise K Nestor

Method and system are provided for event relationship analysis in fault management. The method includes: providing a history of a plurality of event instances relating to multiple events identified by event identifiers, where an event instance has one or more event occurrences referencing an event identifier, the history including the event occurrences and resolution event information; analyzing the event occurrences relating to each event identifier to identify a first occurrence(s) of an event instance; analyzing the resolution event information relating to each event identifier to identify any event resolution time for an event instance; comparing two event identifiers to obtain a relationship score between the two event identifiers, wherein the comparing is based on a combination of first occurrences of event instances relating to the two event identifiers and resolution times of the event instances; and creating a group of events that are related based on the relationship scores.

Event relationship analysis in fault management

A plurality of first event instances of a first event and a plurality of second event instances of a second event are received based on the first event occurring and the second event occurring. Each event instance has an event identifier and a timestamp. A first event type of the plurality of first event instances and a second event type of the plurality of second event instances are identified. A time period of overlap between the first event and the second event are determined by detecting regular intervals between the plurality of first event instances, as compared to each other, and the plurality of second event instances, as compared to each other. A relationship between the first event and the second event are scored based on the time period of overlap. The first event and the second event are grouped based on the scored relationship.

Event analysis in network management event streams

In a method for visualizing cyclical patterns in metric data, receiving, by one or more processors, data relating to a computer environment. The method further includes creating, by one or more processors, a visualization, wherein the visualization presents the data in a first format. The method further includes causing, by one or more processors, the visualization to be displayed in a user interface. The method further includes receiving, by one or more processors, an indication of a user interaction in the user interface, wherein the user interaction indicates an alternative visualization of the data, wherein the alternative visualization presents the data in a second format that includes a fragment of the received data. The method further includes creating, by one or more processors, the alternative visualization.

Visualization of cyclical patterns in metric data

Deploying a model for anomaly detection in time series data. A period of data is received. A model of the period of data is received. It is determined that the model fits a part of the period of data and that the fitted part of the period of data includes the most recent data. A reduced model for the part of the period of data that fit the received model is built. The reduced model is deployed.

Anomaly detection model selection and validity for time series data

Processing of a set of event log data that includes event records. A search criteria is received from a user, and a subset of the set of event log data that includes event records from the set of event log data that satisfy the search criteria is determined. For each event record in the subset of event log data, a similarity score for the event record is determined, where the similarity score is indicative of the similarity of the event record to the other event records in the subset of event log data. The subset of event log data is updated by adding to each event record its similarity score, and the updated subset of event log data is then returned to the user.

Processing event log data

An event management method of attributing a seasonal fault to maintenance activity is described. The method includes identifying a sequence of fault events as a seasonal fault, and calculating an initial seasonality metric indicating a degree of seasonality of the sequence of fault events. One or more maintenance windows are identified, and then a subset of the sequence of the fault events which correspond in time with the maintenance windows are identified. A compensated seasonality metric is calculated for the sequence of fault events minus at least some of the subset of fault events. Based on determining that the compensated seasonality metric indicates a reduction in seasonality compared with the initial seasonality metric, an indication that the sequence of fault events is associated with maintenance activities is generated.

Associating a sequence of fault events with a maintenance activity based on a reduction in seasonality

Anomaly detection is provided. A first component of a first data resource of a plurality of data resources is identified. Each data resource of the plurality of data resources includes one or more components. A score of the first component is determined based, at least in part, on underlying data of the first component and underlying data of one or more other components of data resources of the plurality of data resources that correspond to the first component. An interest level of the first data resource is determined. A relationship between the score of the first component and the interest level of the first data resource is modeled.

Data resource anomaly detection

A method of identifying topics which a user requires help with when using a software program is described. For each of a plurality of help documents, the help document is associated with a set of topics and their relative prevalence within the help document. User access to the help documents is tracked during use of the software program. Topics in relation to which help was required during use of the software program are identified based on an amount of access to one or more of the help documents and the relative prevalence of topics within the accessed help documents.

Data processing

A computer program product is provided and includes a storage medium having program instructions. The program instructions are readable and executable by a processing circuit to cause the processing circuit to determine from historical data which anomaly detectors are associated with key performance indicators (KPIs), to extract descriptors of the first metric group from the KPIs to create a first feature profile thereof, to repeat the determining and the extracting with respect to historical data of second and third metric groups to create second and third feature profiles thereof, respectively, to ascertain which of the second and third feature profiles has a greater correlation to the first feature profile and to rank the second and third feature profiles based on which one has the greater correlation and compare the higher ranked one to future metrics in current or subsequent environments to determine if specific KPIs are likely to produce anomalies.

Selecting key performance indicators for anomaly detection analytics

Method for monitoring data events using calendars are provided. Aspects include accessing a plurality of calendars, each calendar defining a schedule of calendar days and receiving a plurality of inputs from one or more applications, each input defining a data event for a specific source, for each calendar of the plurality of calendars. Aspects also include maintaining, for each data event source, a count for each calendar day and a count for each non-calendar day, for each calendar of the plurality of calendars. Aspects further include determining, for each data event source, if a comparison of the count for each calendar day and the count for each non-calendar day is statistically significant, and generating an output for a data event source, if the comparison of the count for each calendar day and the count for each non-calendar day is statistically significant.

Monitoring data events using calendars

A method, computer program product, and system for constructing a dynamic knowledge base of software usage patterns. A user action is monitored to identify one or more user action sequences. A common action sequence for the user action is identified, based on the one or more user action sequences. An instructional information resource is identified that corresponds to the common action resource, wherein the instructional information resource is accessed by the user. A database is constructed based on the common action sequence. The database organizes the common action sequences and instruction information resource. The instructional information resource is determined to be above a threshold based on the number of times the user consults the instructional information resource.

Growing community of inventors

Dublin, Ireland

Anthony T Brew