Alert Impact Quantification for Distributed System Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current management tools in distributed computing systems generate numerous alerts, leading to alert fatigue and uncertainty in prioritizing responses due to varying meanings of alerts across different environments, making it challenging for administrators to effectively address system issues.
Innovation Solution
The system computes an impact factor to quantify and prioritize alerts by analyzing event messages before and after a problem occurs, using techniques such as Jensen-Shannon divergence and inverse cosine to determine the global or local impact, and generates recommendations for responding to alerts based on their priority.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If management tools generate alerts to notify administrators of problems or significant changes, then system monitoring capability is improved, but alert fatigue and difficulty in prioritizing responses increases
Solution Approach 1:
The system changes the parameters of alert representation by introducing impact factors and priority levels. Instead of presenting raw alert data, the system transforms alerts into prioritized items with quantitative impact measurements, making it easier for administrators to focus on critical issues first.
Solution Approach 2:
The system implements feedback mechanisms by analyzing event messages before and after problems occur to compute impact factors. This feedback loop continuously refines alert prioritization based on actual system behavior, improving both monitoring reliability and operational ease over time.
2Reliability
If multiple alerts are generated to cover all system changes, then comprehensive monitoring is improved, but noise and alert fatigue increases
Solution Approach 1:
The system applies local quality by differentiating alerts based on their specific impact characteristics. Each alert is assigned a priority level and impact factor specific to its nature and consequences, allowing comprehensive monitoring while filtering out noise through localized prioritization rather than uniform treatment.
Solution Approach 2:
The system extracts the essential information from comprehensive alert data by separating critical alerts with high impact factors from less significant ones. This extraction process maintains comprehensive monitoring coverage while removing noise by focusing only on alerts that require administrator attention.
3Loss of time
If administrators speculate on alert impact based on previous experience, then response time is reduced, but measurement precision of alert impact is insufficient
Solution Approach 1:
The system enables self-service by automatically computing impact factors and priority levels without requiring administrator speculation or manual assessment. The system serves itself by using event message analysis to objectively determine alert impact, eliminating the need for human guesswork while providing precise measurements.
Solution Approach 2:
The system replaces the mechanical system of human speculation and experience-based judgment with an automated computational approach. By substituting human cognitive processing with algorithmic impact factor calculation based on event message comparison, the system achieves both rapid response time and precise measurement.
Data Source
AI summary
Methods and systems are directed to quantifying and prioritizing the impact of problems or changes in a computer system. Resources of a computer system are monitored by management tools. When a change occurs at a resource of a computer system or in log data generated by event sources of the computer system, one or more of the management tools generates an alert. The alert may be an alert that indicates a problem with the computer system resource or the alert may be an alert trigger identified in an event message of the log data. Methods described herein compute an impact factor that serves as a measure of the difference between event messages generated before the alert and event messages generated after the alert. The value of the impact factor associated with an alert may be used to quantitatively prioritize the alert and generate appropriate recommendations for responding to the alert.