224results about "Detecting faulty hardware using expert systems" patented technology

Embodiments of the invention provide a method for determining errors and metrics in a computer network. The method includes positioning an analyzer in communication with the network, capturing a data trace of the network with the analyzer, determining a network device topology from a first processing of the data trace, building user layer protocols using a second processing of the data trace and the determined device topology, determining errors in the network device topology using protocol experts applied to the user layer protocols in conjunction with the determined device topology, and displaying at least one of the device topology and the determined errors to a user.

A system (830) and method (800) for diagnosing a malfunctioning machine. A fault event is selected (806) together with sequential operating parameter data (808) from a selectively focused time interval about the fault event for evaluation of a machine (810). The selectively focused time interval may include data occurring just before, just after, or spanning the fault event. Characterizing information such as slope, rate of change, and absolute sign of the data may be derived (809) from the operating parameter data over the selectively focused time interval and used in the diagnosis. The fault event and operating parameter data may be compared to existing cases in a case database (834). A set of rules (817) or candidate anomalies (841) may be executed over the operating parameter data to further improve the accuracy of the diagnosis.

A method, system, and computer program product for associating events. A provided event dataset includes events occurring in each of N successive time intervals (N≧3). Association rules pertaining to successive events in the event dataset are deduced. Sequences of events are generated from the association rules. Clusters of the sequences of events are formed. Sequences of the clusters are created. The clusters of the sequences may be used: to identify at least one event occurring in a time interval of the N time intervals as being a probable cause of at least one event occurring in a later-occurring time interval of the N time intervals; or to predict an occurrence of at least one event in a time interval occurring after the N time intervals, wherein the at least one event had occurred within the N time intervals.

A computer implemented method on a computer readable media is provided for determining the source of a problem in a complex system of managed components based upon symptoms. The problem source identification process is split into different activities. Explicit configuration non-specific representations of types of managed components, their problems, symptoms and the relations along which the problems or symptoms propagate are created that can be manipulated by executable computer code. A data structure is produced for determining the source of a problem by combining one or more of the representations based on information of specific instances of managed components in the system. Computer code is then executed which uses the data structure to determine the source of the problem from one or more symptoms.

A method, computer program product, and data processing system for recognizing, tracing, diagnosing, and repairing problems in an autonomic computing system is disclosed. Rules and courses of actions to follow in logging data, in diagnosing faults (or threats of faults), and in treating faults (or threats of faults) are formulated using an adaptive inference and action system. The adaptive inference and action system includes techniques for conflict resolution that generate, prioritize, modify, and remove rules based on environment-specific information, accumulated time-sensitive data, actions taken, and the effectiveness of those actions. Thus, the present invention enables a dynamic, autonomic computing system to formulate its own strategy for self-administration, even in the face of changes in the configuration of the system.

A method for detecting network attacks is provided. In one implementation, the method receives a plurality of attack indications based on data transmitted on the network and applies rules to the plurality of attack indications. Also, the method generates an alert if an application of at least a subset of the rules on the plurality of attack indications indicates a potential attack. In addition, a network device that performs the method and a computer program corresponding to the method are provided.

An automatic documentation generation and management system and method, for documenting configurable systems such as complex software applications and hardware systems is disclosed. The method retrieves configuration parameters from the configurable system and utilizes them to automatically generate an explanatory document specific to the configured system. The invention also discloses a documentation appliance system, which is a dedicated documentation server coupled to the configurable system via a communication network, preferably via an Intranet. In yet another alternative, the invention may be practiced by integrating code for automatic documentation generation within the configurable system program.

A network management system (10) includes a fault diagnosis system (12) connectable to a communications network (20). The fault diagnosis system includes a fault object factory, a path determination module, and a fault diagnosis engine. The fault object factory is constructed and arranged to receive fault data and create fault objects. The path determination module is constructed to determine, in a communications network, a path related to the fault data. The fault diagnosis engine is constructed to perform, using the determined path, a fault analysis on the fault data to diagnose a fault related to the communications network. The network management may also include a help desk system (18), a topology mapper (14) or an impact analyzer (16).

A check for a knowledge automation engine to use in detecting product issues on products. A knowledge automation engine may evaluate a check against a fact to detect a product issue on a product and provide a user of the product remediation information. A check may contain a product issue description, a rule to evaluate against a fact in order to detect the product issue, and remediation information to help a user address the product issue if the product issue is detected on the product. Product issues may include product installation validation and known product bugs. Facts used by the knowledge automation engine may include product configuration facts.

An apparatus, program product, and method utilize a dynamic, automated, extensible and flexible intelligent agent-based product support “framework” to facilitate the provision of product support services to customers of computer-related products. Agent platforms are utilized on both a customer computer and a product support computer, with different agents configured to execute on one or both of such computers. Automated analysis and/or creation of remedial actions, based upon cross-customer operational data, and often relying upon intelligent agents for many or all of such actions, may be used to decrease product support personnel burden and effort. Publishing control may be provided to limit distribution of certain intelligent agents, as may multi-agent remediation of undesirable operational conditions, where agents from multiple parties collectively address a problem experienced by a customer.

A system for creating and editing checks for a knowledge automation engine to use in detecting product issues on products. A knowledge automation engine may evaluate a check against a fact to detect a product issue on a product and provide a client of the product remediation information. A check may contain a product issue description, a rule to evaluate against a fact in order to detect the product issue, and remediation information to help a client address the product issue if the product issue is detected on the product. Product issues may include product installation validation and known product bugs. Facts used by the knowledge automation engine may include product configuration facts. Statistics on check execution results may be accumulated to provide additional information on products through their life cycle.

An apparatus and method is provided for efficiently determining the source of problems in a complex system based on observable events. By splitting the problem identification process into two separate activities of (1) generating efficient codes for problem identification and (2) decoding the problems at runtime, the efficiency of the problem identification process is significantly increased. Various embodiments of the invention contemplate creating a causality matrix which relates observable symptoms to likely problems in the system, reducing the causality matrix into a minimal codebook by eliminating redundant or unnecessary information, monitoring the observable symptoms, and decoding problems by comparing the observable symptoms against the minimal codebook using various best-fit approaches. The minimal codebook also identifies those observable symptoms for which the greatest benefit will be gained if they were monitored as compared to others.

By defining a distance measure between symptoms and codes in the codebook, the invention can tolerate a loss of symptoms or spurious symptoms without failure. Changing the radius of the codebook allows the ambiguity of problem identification to be adjusted easily. The invention also allows probabilistic and temporal correlations to be monitored. Due to the degree of data reduction prior to runtime, extremely large and complex systems involving many observable events can be efficiently monitored with much smaller computing resources than would otherwise be possible.

Techniques for performing diagnostics are described. In one embodiment, in response to an alert or a request to perform diagnostics, a topological relationship is generated comprising a set of applications and a set of systems determined based upon information in the alert or request. The topological relationship encapsulates relationships between the set of applications and the set of systems. In one embodiment, a set of causal network models to be used for performing the diagnostics is determined based upon the applications and systems in the topological relationship.

A computer implemented method and apparatus for determining the source of at least one observed event occurring among a plurality of types of components is disclosed. The method, operable on a computer system, utilizes a data structure produced for determining the source of a problem by mapping a plurality of observed events and a plurality of known causing events, wherein the mapping represents a correlation between the observed events and the causing events, determines a distance measure based on mapped correlation values and determines at least one causing event based on a distance measure within a known tolerance above a minimum distance measure.