Event Notification Clustering for Data Center Alert Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Large data centers generate vast amounts of monitoring data, making it impractical for humans to evaluate and respond to abnormal conditions in a timely manner, as each resource's status needs to be monitored and alerts generated for potentially impactful events.
Innovation Solution
The system clusters datapoints representing multiple metrics into groups based on similarity, using a machine-learning engine to classify these clusters as normal or abnormal, reducing the number of alerts and automating the classification process, allowing for prioritization and efficient notification of administrators.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all resource status metrics are monitored and evaluated individually, then complete coverage of abnormal conditions is achieved, but the amount of information overwhelming administrators increases significantly
Solution Approach 1:
The patent combines multiple individual resource status metrics into cluster groups based on similarity. Resources with comparable performance characteristics and anomaly patterns are merged into the same cluster, allowing administrators to evaluate clusters rather than individual resources. This reduces information volume while preserving detection coverage through representative cluster analysis.
Solution Approach 2:
The patent segments the vast set of monitored resources into distinct clusters based on their operational characteristics. By dividing the monolithic monitoring task into manageable cluster segments, the system maintains comprehensive coverage while making the information volume tractable for human evaluation.
2Speed
If individual alerts are generated for each abnormal metric, then timely notification of all anomalies is achieved, but the number of alerts becomes unmanageable
Solution Approach 1:
The patent merges multiple individual alerts into single cluster-level alerts. When resources within a cluster exhibit abnormal conditions, instead of generating separate alerts for each resource, the system generates one consolidated alert representing the entire cluster. This maintains timely notification while dramatically reducing alert management complexity.
3Measurement precision
If manual evaluation of all monitoring data is performed, then accurate classification of events is achieved, but the time required to respond to events increases
Solution Approach 1:
The patent performs preliminary automated classification of resource clusters using machine learning models before human evaluation. The system pre-processes monitoring data, identifies abnormal clusters, and prepares classified information for administrator review. This preliminary action maintains classification accuracy while reducing the time administrators need to spend on raw data evaluation.
Solution Approach 2:
The system enables self-service automated classification through machine learning models that independently analyze and categorize resource clusters. This automation handles the initial classification task, preserving accuracy while freeing administrators to focus on high-level decision-making, thereby reducing overall response time.
Data Source
AI summary
An event-notification system provides for monitoring resource-status parameters so as to repeatedly generate resource-status values for each of N resource-status parameters applicable to the resources. Each datapoint specifies a resource, a time of collection, and the values of parameters for the resource at the time. The datapoints are represented in an N-dimensional space, including N dimensions corresponding to the resource-status parameters and one dimension devoted to time. The datapoints are clustered on a proximity basis. The clusters are manually classified as Normal or Ack-Abnormal. A machine-learning engine develops a model that allows the classifications to be automated. Alerts are sent for respective Abnormal clusters rather than for each abnormal datapoint, thus reducing the amount of data an administrator must deal with to address potential problems.