Alert Ranking via Invariant Networks for System Problem Determination
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current rule-based systems for managing large computing systems face challenges in accurately determining the importance of alerts due to varying problem reporting accuracy and the complexity of system dependencies, where a single problem can trigger multiple alerts, making it difficult to prioritize which alert to analyze first.
Innovation Solution
A system and method that utilize invariant networks to compute equivalent thresholds for multiple rules, allowing alerts to be ranked based on consensus from peer rules, rather than relying solely on local thresholds, thereby enhancing the accuracy of alert prioritization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If rule-based systems are used for operational system management, then system management can be automated, but alerts from various rules have different problem reporting accuracy due to manually set thresholds based on operators' experience and intuition
Solution Approach 1:
The patent transforms the static, manually-set threshold parameters into dynamic, data-driven thresholds by extracting invariants from historical alert data. This changes the parameter setting approach from subjective operator experience to objective statistical analysis, improving measurement precision while maintaining automation.
Solution Approach 2:
The system performs self-service by automatically extracting invariants from its own historical data to compute equivalent thresholds, eliminating the need for manual threshold adjustment by operators. The system uses its own operational data to improve its own alert accuracy.
2Ease of operation
If operators check alerts one by one using limited domain knowledge, then they can determine alert importance, but this approach is not scalable for large systems with huge complexity
Solution Approach 1:
The patent introduces an intermediary mechanism (the invariant-based ranking system) that automatically determines alert importance. This intermediary processes alerts through computed equivalent thresholds and rankings, eliminating the need for operators to manually assess each alert while maintaining ease of operation and enabling scalability.
Solution Approach 2:
The manual mechanical process of operators checking alerts one by one is replaced with an automated computational system. The invariant-based ranking mechanism substitutes human cognitive processes with algorithmic computations, enabling the system to handle large volumes of alerts efficiently.
3Reliability
If event correlation mechanisms are used to correlate alerts with specific problems, then alerts can be grouped by known problem signatures, but this approach requires prior knowledge of various problems which is difficult to obtain in complex and dynamic systems
Solution Approach 1:
The patent performs preliminary action by extracting invariants from historical data before new alerts need to be correlated. This advance preparation creates a foundation of equivalent thresholds that can be applied to new alerts without requiring real-time analysis or prior knowledge of specific problem signatures.
Solution Approach 2:
The system transitions from static problem signatures to dynamic invariant-based thresholds. Instead of relying on fixed, pre-defined problem signatures that may become outdated in dynamic systems, the patent uses continuously extractable invariants that adapt to changing system conditions, improving reliability without increasing complexity.
Data Source
AI summary
A system and method for prioritizing alerts includes extracting invariants to determine a stable set of models for determining relationships among monitored system data. Equivalent thresholds for a plurality of rules are computed using an invariant network developed by extracting the invariants. For a given time window, a set of alerts are received from a system being monitored. A measurement value of the alerts is compared with a vector of equivalent thresholds, and the set of alerts is ranked.