International Business Machines Corporation

Jonathan Ian Settle

Anthony T Brew

Kristian Jon Stewart

Timothy Finbarr McCarthy

Jonathan W L Short

Roderick G C Moore

John Mark Clifton

Vinh Tuan Thai

Ian Manning

Zhenni Yan

Roderick G Moore

Mudhakar Srivatsa

Paul Basil French

Mathews Thomas

Paul Nicholas Cashman

Christopher B E Beeken

David Ray Kahler

Joanna Katharine Brown

Michael John Jones

Utpal Mangla

Ronald J Venturi

Roderick Guy Charles Moore

Tram Thi Mai Nguyen

Dale Burr

Raymond Jepson

Matthew Richard James Thornhill

Satishkumar Sadagopan

Huw Francis

Thomas Van Der Veen

Isabell Sippli

John D Postoyko

Richard Harry Hopkins

Tim F McCarthy

Zhenni V N Yan

Yasser Abduallah

Jon Short

Haydn Richard Davis

David Lawrence Leskovec

Jonathan William Lewis Short

Roderick Guy Moore

Timothy Finbarr Mccarthy

Method and system are provided for scoring events as likely cause events in a resource network. The method processes incoming events relating to resources in a resource network to correlate related events as a related group and maps the events of the related group onto nodes of a sub-topology representing resources of the resource network and having edges representing relationships between the resources. The method scores each event by discovering one or more paths between the node event and other node events of the related group, with the scoring based on a combination of an event classification weight and a discovered path score of aggregated relationship scores of edges of a discovered path.

Scoring events as likely cause events in a resource network

A method for determining a correlation of one or more events occurring in a plurality of nodes of a network includes accessing, by a computing device, address information associated with each of the plurality of nodes on the network. The computing device can further access one or more event IDs associated with one or more events occurring on the plurality of nodes. The computing device can further create an association the one or more events occurring on the plurality of nodes with related events occurring on others of the plurality of nodes, the association including the address information.

Topology-homogeneity for enriching event patterns in artificial intelligence operations

A method, computer system, and a computer program for grouping a plurality of computing system fault events is provided. The present invention may include extracting a summary of computing system fault events based on at least one similarity detected. The present invention may then include generating a plurality of vectors in which each vector corresponds to a summary, clustering the plurality of vectors into a plurality of clusters based on the at least one similarity, and compressing each cluster of the plurality of clusters into at least one cluster centroid. The present invention may further include generating a group centroid for a group including the plurality of clusters based on the at least one cluster centroid. The present invention may also include presenting a correlation statement derived from a result associated with the group centroid and generating a system fault solution based on the correlation statement.

Intelligent grouping of events in computing system event and computing system incident management domains

A method and system are provided for identification of constituent events in an event storm in operations management. The method includes: detecting an event storm by detecting an anomaly from a dynamic baseline range of expected event rates in a sample time period; and, when an event storm is detected, for each of a group of events grouped by an event category and occurring in a sample time period of an event storm, identifying the group of events as constituting part of the event storm if the rate of the event occurrences of the group in the sample time period is outside a threshold deviation from an average for that group.

Identification of constituent events in an event storm in operations management

Aspects of the present invention disclose a method for automated incident prioritization in network monitoring systems. The method includes one or more processors determining historical sentiment impact scores for one or more incident parameters based at least in part on textual content of customer feedback and changes of a customer sentiment during a time period corresponding to one or more system incidents of the time period. The method further includes assigning a classification to the one or more system incidents, wherein the classification corresponds to the one or more incident parameters. The method further includes determining an active incident sentiment impact score for each of one or more active incidents. The method further includes applying the active incident sentiment impact scores as a factor to prioritize incident handling of the one or more active incidents.

Automated incident prioritization in network monitoring systems

Method and system are provided for event relationship analysis in fault management. The method includes: providing a history of a plurality of event instances relating to multiple events identified by event identifiers, where an event instance has one or more event occurrences referencing an event identifier, the history including the event occurrences and resolution event information; analyzing the event occurrences relating to each event identifier to identify a first occurrence(s) of an event instance; analyzing the resolution event information relating to each event identifier to identify any event resolution time for an event instance; comparing two event identifiers to obtain a relationship score between the two event identifiers, wherein the comparing is based on a combination of first occurrences of event instances relating to the two event identifiers and resolution times of the event instances; and creating a group of events that are related based on the relationship scores.

Event relationship analysis in fault management

A plurality of first event instances of a first event and a plurality of second event instances of a second event are received based on the first event occurring and the second event occurring. Each event instance has an event identifier and a timestamp. A first event type of the plurality of first event instances and a second event type of the plurality of second event instances are identified. A time period of overlap between the first event and the second event are determined by detecting regular intervals between the plurality of first event instances, as compared to each other, and the plurality of second event instances, as compared to each other. A relationship between the first event and the second event are scored based on the time period of overlap. The first event and the second event are grouped based on the scored relationship.

Event analysis in network management event streams

Method and system for event relationship analysis in fault management. The method includes identifying a group of related events based on a history of a plurality of event instances relating to multiple events. For each event occurrence of each event of the group of related events, there is identified: an event type; and one or more resources associated with the event occurrence. The method also comprises: identifying a set of event occurrences of the same type; and identifying event occurrences associated with the same resource.

Processing of a set of event log data that includes event records. A search criteria is received from a user, and a subset of the set of event log data that includes event records from the set of event log data that satisfy the search criteria is determined. For each event record in the subset of event log data, a similarity score for the event record is determined, where the similarity score is indicative of the similarity of the event record to the other event records in the subset of event log data. The subset of event log data is updated by adding to each event record its similarity score, and the updated subset of event log data is then returned to the user.

Processing event log data

An event management method of attributing a seasonal fault to maintenance activity is described. The method includes identifying a sequence of fault events as a seasonal fault, and calculating an initial seasonality metric indicating a degree of seasonality of the sequence of fault events. One or more maintenance windows are identified, and then a subset of the sequence of the fault events which correspond in time with the maintenance windows are identified. A compensated seasonality metric is calculated for the sequence of fault events minus at least some of the subset of fault events. Based on determining that the compensated seasonality metric indicates a reduction in seasonality compared with the initial seasonality metric, an indication that the sequence of fault events is associated with maintenance activities is generated.

Associating a sequence of fault events with a maintenance activity based on a reduction in seasonality

Anomaly detection is provided. A first component of a first data resource of a plurality of data resources is identified. Each data resource of the plurality of data resources includes one or more components. A score of the first component is determined based, at least in part, on underlying data of the first component and underlying data of one or more other components of data resources of the plurality of data resources that correspond to the first component. An interest level of the first data resource is determined. A relationship between the score of the first component and the interest level of the first data resource is modeled.

Data resource anomaly detection

Method for monitoring data events using calendars are provided. Aspects include accessing a plurality of calendars, each calendar defining a schedule of calendar days and receiving a plurality of inputs from one or more applications, each input defining a data event for a specific source, for each calendar of the plurality of calendars. Aspects also include maintaining, for each data event source, a count for each calendar day and a count for each non-calendar day, for each calendar of the plurality of calendars. Aspects further include determining, for each data event source, if a comparison of the count for each calendar day and the count for each non-calendar day is statistically significant, and generating an output for a data event source, if the comparison of the count for each calendar day and the count for each non-calendar day is statistically significant.

Monitoring data events using calendars

Growing community of inventors

Southampton, United Kingdom

Jonathan Ian Settle