Client-Server Anomaly Detection via Log and Metric Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current techniques for detecting and determining root causes of mobile application faults and performance bottlenecks in client-server models are labor-intensive and lack an integrated view across client and server components, leading to inefficient anomaly detection.
Innovation Solution
A method that analyzes log entries from client and server interactions, utilizing temporal and textual analysis, along with environment analysis, to identify candidate root causes of anomalies, including round trip latency time and connection timeouts, thereby providing an integrated view of client-server interactions for efficient fault detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual searches are used to determine root cause of anomalies, then detailed analysis can be performed, but significant administrative labor time is required
Solution Approach 1:
The system performs preliminary automated analysis of logs, metrics, and traces to identify candidate root causes before human intervention. This pre-processing filters and prioritizes potential issues, so when administrators do investigate, they start with narrowed-down candidates rather than searching through all possible causes from scratch.
Solution Approach 2:
The patent introduces an automated diagnostic system as an intermediary between raw system data and human administrators. This intermediary automatically correlates logs, metrics, and traces to generate candidate root cause explanations, reducing the manual search burden while maintaining analytical depth.
2Device complexity
If only device analytics or only back-end analytics are used, then the analytics process is simpler, but an integrated view of client-server interactions is not achieved
Solution Approach 1:
The patent merges device-side analytics (client metrics) with back-end analytics (server logs and infrastructure metrics) into a unified diagnostic system. This combination correlates data from both ends of the client-server interaction, providing comprehensive visibility into the complete request lifecycle while maintaining manageable system architecture.
3Productivity
If automated diagnostic processes are implemented, then administrative labor time is reduced, but system complexity increases
Solution Approach 1:
The automated diagnostic system is segmented into distinct functional modules: log collection, metric collection, trace analysis, correlation engine, and candidate root cause generation. Each module handles a specific aspect of the diagnostic process, making the overall complex system manageable through clear separation of concerns and independent deployment of components.
Data Source
AI summary
An approach is provided for detecting and analyzing an anomaly in application performance in a client-server connection via a network. A status code of a response sent by a server to a client, a round trip latency time (RTT) of the response, and a time out of a connection between client and server are determined. Using a k-means clustering algorithm, buckets of RTT values clustered into lower and higher values, and running counts and means for the RTT values in each bucket, an RTT value is determined to exceed a threshold value. Based on the status code, the RTT value exceeding the threshold, and the connection time out, the anomaly is detected. Based on temporal and textual analyses of log entries and an environment analysis, candidate root causes of a failure that resulted in the anomaly are determined.