International Business Machines Corporation

Pooja Aggarwal

Seema Nagar

Amitkumar Manoharrao Paradkar

Larisa Shwartz

Harshit Kumar

Rohan R Arora

Prateeti Mohapatra

Jinho Hwang

Ajay Gupta

Gargi Banerjee Dasgupta

Mudit Verma

Atri Mandal

Dipanwita Guhathakurta

Kuntal Dey

Ruchi Mahindru

Mudhakar Srivatsa

Vijay A Kumar

Malolan Chetlur

Padmanabha Venkatagiri Seshadri

Rama Kalyani T Akkiraju

Anbang Xu

Charanjit Singh Jutla

Pradeep Kumar Dubey

Amar Prakash Azad

Raghav Batta

Zhe Liu

Joshua M Rosenkranz

Saneem Ahmed Chemmengath

Seep Goel

Xiaotong Liu

Qing Wang

Ian Manning

Matthew Richard James Thornhill

Bing Zhou

Jakub Krchák

Nikhil Verma

Stephen James Hussey

Shubham Atreja

Noah Zheutlin

Pratibha Moogi

Ishaan Nikhil Shah

Akhil Tandon

Hau-Wen Chang

Franco Forti

Karan Bhukar

Krishnendu Chatterjee

Methods, computer program products, and systems are presented. The method computer program products, and systems can include, for instance: iteratively examining logging data; detecting multiple faults in a computer environment in dependence on the examining of the logging data; generating for respective ones of the detected multiple faults one or more candidate remediation to provide a set of candidate remediations for the computer environment; prioritizing remediations defining the set of candidate remediations from the generating and ordering the remediations in a remediation queue according to an order of the prioritizing; and deploying remediations according to the ordering of remediations in the remediation queue.

Prioritized fault remediation

A computer-implemented method, according to one approach, includes: receiving observability data produced by a first portion of a distributed application. The observability data is evaluated and in response to determining that the observability data indicates the first portion of the distributed application is degraded, the amount of the observability data produced by the first portion of the distributed application is increased. Additionally, the amount of observability data produced by other portions of the distributed application that are correlated with the first portion of the distributed application is also increased.

Dynamically adjusting observability based on real-time performance

Techniques are provided for dynamic alert suppression policy management. In one embodiment, the techniques involve receiving an event stream, wherein the event stream includes metric values comprising at least one of: log anomaly data and metric anomaly data, determining an anomalous event based on the event stream, determining a persistent region of the anomalous event, determining a quantum representation of the persistent region, determining X-Y values of the persistent region based on the quantum representation, and generating a policy based on a set of the X-Y values.

Dynamic alert suppression policy management

Localizing a faulty microservice in a microservice architecture is achieved by developing healthy execution sequence data for comparison to execution sequences during system failures. Oftentimes the faulty microservice does not emit a failure signal. Frequent sub-sequences arising from log template time series data during healthy execution facilitates localization of faulty services when there is no failure signal from the faulty service.

Fault localization in a distributed computing system

A computer-implemented method and a computer system for identifying persistent anomalies for failure prediction. The computer system receives a time series data stream. The computer system received a predetermined number N and a predetermined number M which is a fraction of N. The computer system segments the time series data stream into N consecutive sliding windows. The computer system performs supervised persistent anomaly detection to determine whether anomalies across the N consecutive sliding windows are persistent, by using a binary classification model. The computer system performs unsupervised persistent anomaly detection to determine whether the anomalies across the N consecutive sliding windows are persistent. The computer system combines results of the supervised persistent anomaly detection and results of the unsupervised persistent anomaly detection to determine persistent anomalies.

Identifying persistent anomalies for failure prediction

An embodiment includes detecting a set of anomalies recorded during a first predefined window of time in log entries for a computer environment. The embodiment also includes generating cluster data representative of a cluster of anomalies from among the set of anomalies, where the cluster is formed using a lattice clustering algorithm that spatially distinguishes the cluster of anomalies from other anomalies in the set of anomalies. The embodiment also includes composing an explanation using log templates generated from log entries associated with the cluster of anomalies.

Generating incident explanations using spatio-temporal log clustering

Detecting system log anomalies by receiving multivariate time-series system log data an multivariate metric data, inferring system metrics from the system log data and metric data, receiving a metric causal graph including causal relationships between system metrics, determining a univariate variation score for the system metrics, determining a causal variation score for the multivariate time series system metric data, according to the causal graph, determining an overall activity score according to the univariate variation score, and causal variation score, and altering a review window duration according to the activity score.

Dynamic window-size selection for anomaly detection

Embodiments of the present invention provide a computer system, a computer program product, and a method that comprises identifying a plurality of data logs; generating a data model using analyzed time series data from the identified data logs; detecting anomalies within the generated data model; constructing a causal graph using the detected anomalies and retrieved domain knowledge; computing a severity value for the detected anomalies with the constructed causal graph; assigning the detected anomaly to a classification based on a function vector, wherein the computed severity value is a function vector; and automatically modifying a function of a computing device based on the function vector of the assigned, detected anomaly, wherein a modification addresses the detected anomaly located at a center of the constructed casual graph.

Severity computation of anomalies in information technology operations

Responsive to determining that a step in an interaction sequence has below a threshold similarity to any step in a set of log sequences, a first log entry is caused to be generated. The first log entry is emitted responsive to execution of the step in the interaction sequence by the software application. Responsive to determining that a starting key action lacks a corresponding ending key action, a second log entry is caused to be generated. The second log entry is emitted responsive to execution of code related to the corresponding ending key action by the software application. Responsive to determining, using a trained anomaly detection model, that a keyword related to an injected fault is not present in resulting fault log data, a third log entry is generated. The third log entry is emitted responsive to execution of code related to the keyword by the software application.

Application event logging augmentation

One embodiment provides a method, including: receiving an indication of an addition of a new participant in a textual communication between at least two existing participants; identifying at least one confidential topic contained within the textual communication by (i) parsing the textual communication and (ii) identifying at least one topic contained within the textual communication; the identifying comprising (i) accessing a confidentiality graph comprising (a) nodes representing participants and (b) edges representing confidential concepts that are acceptable discussion topics between participants connected by a corresponding edge and (ii) determining that an edge corresponding to the at least one confidential topic does not connect the new participant with both of the existing participants; and alerting one of the existing participants that the at least one confidential topic is included in the textual communication to be sent to the new participant.

Confidential information identification based upon communication recipient

One embodiment provides a method, including: identifying, utilizing one or more sensors operatively coupled to the smart device, a user operating a smart device; inferring, based upon the identifying the user, a knowledge level of the user with respect to the smart device; determining, based in part on the knowledge level of the user, at least one input within a plurality of inputs provided by the user is anomalous with respect to a pattern of inputs utilized to execute a command; transforming, based upon the anomalous at least one input and the pattern, the plurality of inputs to a plurality of inputs matching the pattern of inputs; and executing an action based upon the transformed plurality of inputs.

Executing actions based upon transformed inputs

Methods, systems, and computer program products for automatically generating datasets by processing collaboration forums using artificial intelligence techniques are provided herein. A computer-implemented method includes obtaining conversational data from collaboration forum sources; classifying, using a first set of artificial intelligence techniques, at least a portion of the conversational data into categories based on designated applications; extracting information, pertaining to test case-related issues, from at least a portion of the classified data; verifying at least a portion of the extracted information by analyzing, using a second set of artificial intelligence techniques, portions of the conversational data attributed to multiple entities and related to the extracted information; generating, using the verified information, one or more datasets related to at least one of the test case-related issues for at least one of the designated applications; performing at least one automated action based on the one or more generated datasets.

Automatically generating datasets by processing collaboration forums using artificial intelligence techniques

Methods, computer program products, and/or systems are provided that perform the following operations: in an information technology (IT) management system, grouping one or more ongoing service failure events into a service failure record; identifying a representative event for the service failure record; identifying one or more conversations that relate to the one or more ongoing service events; computing, using a similarity algorithm, feature similarity scores for respective conversations of the one or more conversations based, at least in part, on the features associated with the representative event and features associated with the respective conversations; linking a subset of the one or more conversations to the one or more ongoing service events in the service failure record based, at least in part, on the computed feature similarity scores; and providing the service failure record to a collaboration platform utilized in addressing the one or more ongoing service events.

Discovering insights and/or resolutions from collaborative conversations

Methods, systems, and computer program products for fault localization for cloud-native applications are provided herein. A computer-implemented method includes classifying an event-related alert directed to at least one system by processing one or more characteristics of the event-related alert; obtaining and processing multiple application logs based at least in part on the classification of the event-related alert; identifying error logs among the multiple application logs based at least in part on the processing of the multiple application logs; ordering the error logs using one or more prioritization techniques; and performing at least one automated action based at least in part on the ordering of the error logs.

Fault localization for cloud-native applications

Systems, devices, computer-implemented methods, and/or computer program products that facilitate fault localization for distributed applications. In one example, a system can comprise a process that executes computer executable components stored in memory. The computer executable components can comprise a graph compiler and a partitioning component. The graph compiler can generate a hypernode graph for a distributed application using causality data inferred from log data generated by services emitting errors. The distributed application can comprise the services. The partitioning component can cluster the services into a plurality of groups using the hypernode graph and an objective function.

Grouping anomalous components of a distributed application

Growing community of inventors

Bengaluru, India

Pooja Aggarwal