Oracle International Corporation

Manas Goswami

Raghu Hanumanth Reddy Patti

Ana Maria Hernandez McCollum

Christopher A Roy

Mark Charles Ramacher

Venkata Ramana Karpuram

Vladimir Volchegursky

Thyagaraju Poola

Constantina Marshman

Janet Kay Bacon

Ze Tian Ding

Janet Kay Kolko

Sreenivas Reddy

Ana Maria Hernandez Mccollum

Techniques for selecting a runbook to recommend for remediating a detected event are disclosed. When a system detects an event, the system obtains metadata associated with the event. The metadata provides information about the event and a system topology of the system in which the event occurred. The system generates a recommendation for a runbook to remediate the event based on one or both of characteristics of the event and characteristics of the topology in which the event occurred. The system compares a system topology to system topologies associated with previously-executed runbooks. The system recommends one of the previously-executed runbooks to remediate a detected event based on determining that the topology associated with the previously-executed runbook is similar to the topology of the system in which the event occurred.

Method and system for recommending runbooks for detected events

Techniques for recommending runbook operations during a runbook generation process are disclosed. The system recommends operations for including in the runbook based on user activity. Generating operations of a runbook based on user activity generates a runbook that captures a user's behavior. The recommended operations may be different than any operations performed by the user. The recommended operations may be based in part on data sets accessed by the user frequently, periodically, or continuously.

Automated runbook operation recommendations

Techniques for recommending runbook operations during a runbook generation process are disclosed. A system recommends operations for including in the runbook based on attributes of a detected event. The system presents event attributes associated with the detected event to a user in a runbook generation interface. When the user selects an event attribute, the system presents a set of candidate runbook operations associated with the event attribute. Based on user selections of runbook operations to include in a runbook, the system generates and stores a template of the runbook in which the attribute values associated with the detected event are omitted. Upon execution of the runbook at a future time, the system, or a user, may populate the event attributes in the runbook with values that correspond to the future event of the same event type.

Techniques for generating supplemental information based on runbook operation results are disclosed. A system generates and displays supplemental information for a runbook execution interface based on one of a system component associated with an executable operation of a runbook, and a set of runbook operation results corresponding to the executable operation. The system receives a user input to execute an operation defined by a runbook presented to remediate an event. The system generates supplemental information for the runbook execution interface based on the results of the operation executed by the user. The system identifies characteristics associated with the runbook operation results and identifies sources for additional information. Source may include performance data from the same component over a different period of time, performance data of a similar component, and performance data of topologically-connected components.

Identification and retrieval of supplemental information for runbook operations

Techniques for suppressing notifications are disclosed. An incident may repeatedly flap between various resolved and unresolved states. Furthermore, other incident attributes may flap between various states such as, for example, varying levels of incident severity. Each change in state results in the transmission of a notification. In order to reduce the number of notifications, the system estimates a flapping window for the incident based on the flapping behavior of prior incidents. The system computes a notification suppression window based at least in part on the estimated flapping window. The system suppresses notifications corresponding to changes in incident state that are detected during the notification suppression window. The notification suppression window may be extended in response to extending the estimated flapping window.

Method and system for managing notifications for flapping incidents

Correlations between patterns of events generated by various separate components within a cloud deployment are statistically determined. The determinations of the correlations can be based on dependencies between the components as indicated by a system topology graph including the components. The patterns correlated can be patterns of events from event streams generated by monitoring systems that monitor the components. The events in the event streams can represent changes over time in component state, behavior, or problem occurrence. Because the quantity of components within such a cloud deployment can be enormous, the quantity of events generated by the monitoring systems over a significant period of time can be voluminous.

Growing community of inventors

San Ramon, CA, United States of America

Manas Goswami