Hewlett-packard Development Company, L.P.

Hewlett Packard Enterprise Development LP

Ruth Bernstein

Ira Cohen

Eran Samuni

Chen Kahana

Keren Gattegno

Ifat Gavish

Determining suspected root causes of anomalous network behavior includes identifying anomalous components in a network exhibiting anomalous behavior from a plurality of network components, assigning a likelihood score to network components based on a scoring policy that considers recent change events affecting the anomalous components, and identifying a subset of the network components that are suspected to be root causes based on the likelihood score.

Determining suspected root causes of anomalous network behavior

A method for automated detection of a real IT system problem may include obtaining monitor measurements of metrics associated with activities of a plurality of configuration items of the IT system. The method may also include detecting anomalies in the monitor measurements. The method may further include grouping concurrent anomalies of the detected anomalies corresponding to configuration items of the plurality of configuration items which are topologically linked to be regarded as a system anomaly. The method may further include calculating a significance score for the system anomaly, and determining that the system anomaly relates to a real system problem based on the calculated significance score.

Automated detection of a system anomaly

A method and system comprise abstracting configuration items (CI) in at least a first anomaly and a second anomaly based on type of CI. Further, CIs are matched of a common type between the first and second anomalies based on a cost function. Additionally, a similarity score is computed for the first and second anomalies based, at least in part, on the cost function of the matched CI's and based on topology of the first and second anomalies.

Determining similarity scores of anomalies

Methods, systems, and computer-readable media with executable instructions stored thereon for determining root cause are provided. A method for determining root cause can include receiving values for at least one performance metric for each of a plurality of components of an IT system to establish a normal value for each of the performance metrics, receiving an abnormal value that differs from the normal value for at least one of the plurality of components of the IT system, and determining a probability that the at least one of the plurality of components of the IT system is a root cause of the abnormal value.

Determining root cause

At least one value of abnormal metrics is identified as being an abnormal dimension value. A dominant dimension related to the anomaly is identified based on the identified abnormal dimension value.

Identifying a dimension associated with an abnormal condition

Embodiments of methods and systems for analyzing performance of an application are provided. In that regard, an embodiment of a method for analyzing performance, among others, comprises collecting performance metric data from the application over time; segmenting the performance metric data into time segments representing sets of contiguous time samples which exhibit similar performance metric behavior; determining the presence of an anomaly in a time segment; and correlating the anomalous segment with other data available to the system to determine the cause of the anomaly.

Growing community of inventors

Kiryat Ono, Israel

Ruth Bernstein