Alert Dependency Checking for Noise Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional alert generation systems produce noise by generating multiple alerts for a single system issue, making it difficult for users to determine the root cause of problems.
Innovation Solution
An alert system that generates active alerts based on alert dependency checking, reducing noise by filtering out dependent alerts and focusing on root causes, using telemetry data and alert definitions to identify triggered alerts and their dependencies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional alert generation systems generate alerts for every detected system issue, then system monitoring coverage is improved, but alert noise increases making it difficult to determine root causes
Solution Approach 1:
The system performs preliminary actions by checking alert dependencies before generating alerts. The alert dependency checker evaluates whether a triggered alert has dependent alerts that would also be triggered, and suppresses the parent alert generation in favor of generating only the child alerts. This preliminary checking prevents the harmful effect of alert noise before it occurs.
Solution Approach 2:
The patent introduces an intermediary component - the alert dependency checker - that sits between the alert triggering mechanism and alert generation. This intermediary evaluates dependency relationships and selectively blocks or permits alert generation, thereby mediating between complete monitoring coverage and noise reduction.
2Reliability
If multiple alerts are generated for the same system issue, then comprehensive system coverage is achieved, but triage efficiency deteriorates due to difficulty in identifying root causes
Solution Approach 1:
The system extracts and identifies the root cause alerts from the set of all triggered alerts by analyzing dependency relationships. The alert dependency checker determines which alerts are parent alerts (root causes) versus child alerts (symptoms), and selectively generates only the root cause alerts. This extraction process maintains comprehensive system coverage while improving triage efficiency by presenting only the most actionable information.
3Measurement precision
If alert dependency checking is implemented to reduce noise, then alert quality is improved, but system complexity increases
Solution Approach 1:
The alert dependency data structure is pre-computed and stored before alert generation occurs. This preliminary preparation of dependency information allows the alert dependency checker to quickly evaluate relationships without performing complex real-time analysis, thereby improving alert quality while minimizing the increase in system complexity.
Data Source
AI summary
Various embodiments provide for alert generation based on alert dependency. For some embodiments, the alert dependency checking facilitates alert noise reduction. Various embodiments described herein dynamically find or discover alert dependencies based on one or more alerts currently active, one or more active alerts generated in the past, or some combination of both. Various embodiments described herein provide alert monitoring that adapts based on an alert state of a machine. Various embodiments described herein generate a health score for a machine based on an alert state of the machine. Various embodiments described herein provide a tool for managing definitions of one or more alerts that can be identified as an active alert for a machine.