Alarm Classification for Distributed Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Distributed applications generate a high volume of alarms that overwhelm existing tools, making it difficult to assess their severity and take responsive action, especially due to complex service hierarchies and redundancy across multiple computational entities.
Innovation Solution
A system that classifies alarms based on the type of computational entity emitting them, calculates an aggregate score considering redundancy and current capacity, and adjusts the monitoring application's configuration or architecture topology to prioritize responsive actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If distributed applications use more diverse services and microservice architectures to handle complex computing loads, then scalability and code reuse are improved, but the volume of alarms emitted increases and overwhelms existing monitoring tools
Solution Approach 1:
The patent segments the alarm management system into multiple components: alarm collection from diverse services, alarm normalization to standard formats, alarm aggregation to combine related alarms, severity classification based on service hierarchy, and selective alerting. This segmentation allows the system to handle large volumes of alarms from microservice architectures without overwhelming monitoring tools.
2Measurement precision
If monitoring tools attempt to assess all alarms from complex distributed applications, then comprehensive monitoring coverage is improved, but the ability to accurately assess severity and take responsive action deteriorates due to alarm overload
Solution Approach 1:
The patent applies local quality by differentiating alarm handling based on the type and hierarchy of services generating them. Critical services receive higher priority monitoring and more rigorous severity assessment, while less critical services use simplified monitoring. This allows accurate severity assessment for important alarms without requiring equally complex processing for all alarms.
Solution Approach 2:
The patent introduces an intermediary alarm management layer between the distributed application services and the monitoring tools. This intermediary performs alarm normalization, aggregation, and classification, transforming the raw high-volume alarm data into a reduced set of prioritized, standardized alarm representations that monitoring tools can process effectively.
3Reliability
If existing monitoring tools process all emitted alarms from distributed applications, then complete alarm monitoring is achieved, but processing speed and responsive action capability deteriorate due to the overwhelming rate of alarm data
Solution Approach 1:
The patent performs preliminary actions by pre-classifying services into hierarchy levels and pre-defining alarm aggregation rules before alarms are generated. When alarms are emitted, the system can immediately apply the pre-established classification and aggregation logic, significantly reducing processing time compared to analyzing each alarm in isolation.
Solution Approach 2:
The patent merges multiple related alarms into single aggregated alarm events when they originate from the same service or related services. This combining reduces the total number of alarms requiring processing while maintaining complete monitoring coverage, as the aggregated alarms preserve essential information about the underlying issues.
Data Source
AI summary
Provided is a process including: receiving, with one or more processors, an alarm of a monitoring application that is monitoring a distributed application; determining, with one or more processors, a type of the identified computational entity among a plurality of different types of computational entities, wherein at least some of the different types take longer to provision than other types among the plurality of different types; classifying, with one or more processors, the alarm based on the type of the identified computational entity that emitted the alarm or a metric or event upon which the alarm is based; and based on the classification of the alarm, adjusting, with one or more processors, a configuration of the monitoring application or a logical-architecture or network-architecture topology of the distributed application.