International Business Machines Corporation

Globalfoundries Inc.

Yuk Lung Chan

Deepti M Naphade

Heidi L Lagares-Greenblatt

Rajaram B Krishnamurthy

Carl Joseph Parris

Peter Bergersen Yocom

Michael D Essenmacher

Andrew P Wack

Jairo A Pava

Christopher Cramer

Jia Qi Li

Fan Jing Meng

Tian Wu

Lei Yu

Gisela C Cheng

Tin Hang To

Kin Ng

David Bruce Lection

Hong Min

Victor G Alonzo

Eric Leonard Masselle

Robert G King

Lawrence Alfred Clevenger

Eileen Patricia Tedesco

Daniel F Hogerty

Al Chakra

Kyle Gilbertson

Vaughn C Page

Alain F Loiseau

Lin Y Yang

Robert M Abrams

Kin Choi

Wei Zhou

Zachary A Burns

Liam S Harpur

Anuja Deedwaniya

Anthony M Cocuzza

Nancy S Tilley

Janice M Young

Zhi Shuai Han

Rakesh Ranjan

Tabari H Alexander

Derrick L Washington

Mark Allen Scott

Joydeep Basu

Badalkumar L Choudhary

Karunakaran Karuppiah

Nicholas A Vargas

Vatatmaja

Jonathan D Dunne

Benjamin David Briggs

Jenny S Li

John Alan Bivens

Jian Jun Wang

Xinlin Wang

Natalie Brooks Powell

Yuksel Gunal

Michael C Buzzetti

Uman Chan

Andrew Tsang

Sergio E Ascencio Rios

Apurv R Johar

Xiao Ling Chen

Natesan Venkateswaran

Jing Lu

Mathew S Thoennes

Mary Swift

Ea-Ee Jan

Bao Zhang

Hiren Ramlal Shah

Jeffrey David Aman

Carlos A Hoyos

Jin Hong Fu

Shi Chong Ma

Jayapreetha Natesan

Michael L Greenblatt

Raquel Norel

Dwifuzi Coe

Niraj Kumar

Philip Mullins

James M Hertzig

Adam Benjamin Childers

Michael S Wang

Deppti M Naphade

Susan Shumway

Mikhail Flom

Kyle E Gilberston

Albert S Jumba

Tejinder Luthra

Sue Mallepalle

Florin-Traian Pistoleanu

David J B Flaherty

Goduwin R Ravindranath

Rekha M Sreedharan

Gilbert Y Lee

Abraham Sweiss

Abhishek Dokania

Sheryl Taylor

Hemanth Yarlagadda

Charles Kichler

Examples described herein provide a computer-implemented method that includes receiving a list of objects with anomaly detection results associated therewith. The method further includes generating a resource graph, wherein the resource graph comprises at least two nodes, each of the at least two nodes being associated with one of the objects. The method further includes determining a relationship between the at least two nodes. The method further includes assigning an anomaly score to at least one of the objects. The method further includes calculating for at least one of the nodes, an overall anomaly score for the at least one of the nodes based on the anomaly score for the at least one of the objects and based on the anomaly score for another node related to the at least one of the nodes.

Aggregating results from multiple anomaly detection engines

Aspects of the invention include computer systems, computer-implemented methods, and computer program products configured to integrate documentation knowledge with log mining data. A non-limiting example computer-implemented method includes determining a message-message relationship based on log message documentation and building a first subgraph based on the message-message relationship. The method further includes receiving a first message log entry having a message identifier and message field data. A second message log entry is correlated with the first message log entry based on at least one of the message identifier and the message field data. A second subgraph is built that includes the first message log entry and the second message log entry. The method includes building a graph that includes the first subgraph and the second subgraph.

Integrating documentation knowledge with log mining for system diagnosis

Examples described herein provide a computer-implemented method that includes defining a key performance indicator associated with a non-instrumented object of a processing system. The method further includes determining a current anomaly level of the key performance indicator for an instrumented object having a relationship with the non-instrumented object. The method further includes assigning an anomaly level to the non-instrumented object based on the current anomaly level.

Assigning an anomaly level to a non-instrumented object

Embodiments of the invention are directed to annotating a log based on processing log documentation. Aspects include obtaining the data set and obtaining a set of templates, wherein one or more template of the set of templates includes a variable labeled as the data type. Aspects also include annotating the data set based on the set of templates, wherein the annotating includes labeling each value of the variable in the data set with the data type. Aspects further include creating an updated data set by replacing each value of the variable in the data set that is labeled with the data type with a new data value.

Removing data having a data type from a data set

Aspects of the invention include computer systems, computer-implemented methods, and computer program products configured to perform message correlation extraction for mainframe operation. A non-limiting example computer-implemented method includes receiving a first message log entry having a message identifier and message field data. The first message log entry is pre-processed to determine the message identifier and to tokenize the message field data. A second message log entry is identified based on at least one of the message identifier and the tokenized message field data. The method further includes determining that the second message log entry is correlated with the first message log entry and providing an output comprising the message correlation between the first message log entry and the second message log entry.

Message correlation extraction for mainframe operation

Examples described herein provide a computer-implemented method that includes detecting an anomaly associated with an object of a computer system and determining an importance classification of the object. An object relationship of the object is determined with respect to one or more other objects of the computer system. An impact score of the anomaly is determined based on the importance classification and the object relationship. An anomaly report is output with the impact score.

Anomaly detection with impact assessment

Embodiments of the invention are directed to annotating a log based on processing log documentation. Aspects include obtaining the log having a plurality of entries. Aspects also include creating a set of log entry templates by processing the log documentation associated with the log, wherein each log entry template includes one or more constants and one or more variables. Aspects further include annotating each of the plurality of entries based on the set of templates, wherein the annotating includes labeling each value of the one or more variables with a variable name.

Annotating a log based on log documentation

According to an aspect, a method includes searching for a correlated log identifier in a correlation database based on detecting a metrics-based anomaly. The method also includes providing, in a problem diagnosis, related log information associated with the correlated log identifier based on locating one or more log entries including the correlated log identifier in a same time window as the metrics-based anomaly. The method further includes searching for a correlated metric in the correlation database based on detecting a log-based anomaly and providing, in the problem diagnosis, related metric information associated with the correlated metric based on locating one or more metrics records including the correlated metric in the same time window as the log-based anomaly.

Correlation-based multi-source problem diagnosis

Techniques include collecting current logs from distributed sources, selecting a group of the current logs that are from a related source of the distributed sources, and generating a feature vector using the group of the current logs. A current status model is created for the feature vector using the group of the current logs. One or more anomalies are determined in the group of the current logs based on a difference between the current status model and a reference status model, the reference status model being based on history logs.

Log-based status modeling and problem diagnosis for distributed applications

Aspects include identifying an event associated with extraction and transmission of a dataset from a data center over a network to one or more network servers and identifying a plurality of tasks associated with a plurality of users and the event. A predicted availability time of the dataset is determined for the one or more network servers based on data extraction performance from a backend data storage system of the data center. Processing is clustered of a plurality of posting requests of two or more of the users through the one or more network servers to align with the predicted availability time of the dataset.

Fence computing

Techniques include generating a log sequence for new logs that have been received, searching a log sequence database for the log sequence having been generated, and determining that the log sequence is anomalous in response to not finding an identical log sequence in the log sequence database. In response to the log sequence not being found in the log sequence database, the log sequence is compared to a graph of historical log sequences to find a closest sequence path to one or more historical log sequences. An anomaly of the log sequence is diagnosed based on an occurrence at which the log sequence deviates from the closest sequence path of the one or more historical log sequences.

Graph-based log sequence anomaly detection and problem diagnosis

Aspects of the invention include determining whether a first log message written by an application during a first job is a message of interest based on a context of the first log message and a probability that the application writes the message for a same job as the first job. Calculating in response to determining that the first log message is a message of interest and by the processor, a correlation score based on intersecting tokens between the first log message and a second log message. Determining the first log message correlates to the second log message based on comparing the score to a threshold score. Modifying a system log of a mainframe to link the first log message to the second log message based on the correlation.

Message-based event grouping for a computing operation

First sensor data generated by a first of a plurality of sensors and at least second sensor data generated by at least a second of the plurality of sensors can be received by a sensor data broker executed by a processor. The sensor data broker can publish to at least a first virtual sensor the first sensor data as first published sensor data. The sensor data broker can publish to at least a second virtual sensor the second sensor data as second published sensor data.

Sensor data segmentation and virtualization

Methods, systems and computer program products for prompting web-based user interaction are provided. Aspects include determining a plurality of items of interest based on data associated with a user. Aspects also include associating an emotion with each item of the plurality of items of interest. Aspects also include associating an emotion with each digital media clip of a plurality of digital media clips. Responsive to detecting an internet browsing action performed by the user, aspects include displaying a selected digital media clip of the plurality of digital media clips and a selected item of interest of the plurality of items of interest. The selected digital media clip and the selected item of interest are associated with a same emotion.

Prompting web-based user interaction

Modifying item packaging according to determined replenishment times. According to embodiments of the present disclosure, a method for modifying item packaging is described herein. An order is received from a user for an item. An exhaustion time for the item is calculated according to an inventory database for the user. An initial replenishment time for the item is calculated. A package quantity is calculated according to the exhaustion time, shipment time, initial replenishment time, and inventory database.

Automated inventory replenishment

Growing community of inventors

Rochester, NY, United States of America

Yuk Lung Chan