Hewlett-packard Development Company, L.p.

Hewlett Packard Enterprise Development LP

Entit Software LLC

Micro Focus Lcc

Eran Samuni

Ira Cohen

Ruth Bernstein

Yonatan Ben Simhon

Ori Adijes

Fernando Vizer

Alon Sade

Keren Gattegno

Daniel Adrian

Yohay Golan

Shahar Tal

In one example implementation, a log analysis system can comprise an activity engine to monitor user activity of a computer system, a baseline engine to generate an expected baseline of a log, and an abnormality engine to compare the log to the expected baseline to identify an abnormality, compare the abnormality to a user activity volume based on a correlation between the user activity volume and the log activity, and classify the log.

Log analysis based on user activity volume

A non-transitory, computer readable storage device includes software that, while being executed by a processor, causes the processor to choose, based on user activity, a plurality of candidate parameters to be monitored from a plurality of event messages. Further, the processor executes the software to estimate a level of similarity between the chosen plurality of candidate parameters by computing a similarity score for at least two of the chosen candidate parameters. Still further, the processor executes the software to determine a plurality of parameters from the chosen candidate parameters if the similarity score for the plurality of parameters is greater than a threshold.

Parameter suggestion based on user activity

Method and systems for analyzing event log elements are provided. In one example, a method includes receiving an event log element in a computer. A similarity index is calculated between the event log element and a text element. A threshold of similarity is calculated. The similarity index is compared to the threshold. If the similarity index is greater than the threshold, the event log element is grouped into a cluster with the text element to create a file of cluster assignments.

Event log analysis

Determining suspected root causes of anomalous network behavior includes identifying anomalous components in a network exhibiting anomalous behavior from a plurality of network components, assigning a likelihood score to network components based on a scoring policy that considers recent change events affecting the anomalous components, and identifying a subset of the network components that are suspected to be root causes based on the likelihood score.

Determining suspected root causes of anomalous network behavior

A method for automated detection of a real IT system problem may include obtaining monitor measurements of metrics associated with activities of a plurality of configuration items of the IT system. The method may also include detecting anomalies in the monitor measurements. The method may further include grouping concurrent anomalies of the detected anomalies corresponding to configuration items of the plurality of configuration items which are topologically linked to be regarded as a system anomaly. The method may further include calculating a significance score for the system anomaly, and determining that the system anomaly relates to a real system problem based on the calculated significance score.

Automated detection of a system anomaly

Determining root causes of network issues includes identifying a previous network issue, comparing a first behavior of network components during the previous network issue with a second behavior of the network components during a current issue of a network, and obtaining a previous user input about a previous root cause of the previous network issue collected while diagnosing the previous issue.

Determining root causes of network issues

An example of the present invention provides a method and system for automatically suppressing false alarms in an IT system, such as an IT application. The method includes consolidating abnormal metrics into a single anomaly. A size of the anomaly relative to the IT application is determined, as well as a distribution of the anomaly in the IT application. A false alarm is determined based on the size and the distribution of the anomaly.

Determining false alarms in an IT application

Methods, systems, and computer-readable media with executable instructions stored thereon for determining root cause are provided. A method for determining root cause can include receiving values for at least one performance metric for each of a plurality of components of an IT system to establish a normal value for each of the performance metrics, receiving an abnormal value that differs from the normal value for at least one of the plurality of components of the IT system, and determining a probability that the at least one of the plurality of components of the IT system is a root cause of the abnormal value.

Growing community of inventors

Yehud, Israel

Eran Samuni