Real-Time IT Operations Management Through Adaptive Event Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Complex IT systems generate overwhelming volumes of disparate event messages, overwhelming manual and pre-programmed monitoring systems, limiting scalability and adaptability in managing operations.
Innovation Solution
A real-time adaptive performance management system that clusters IT operations events based on characteristics, applies machine learning to predict resolution metrics, and adjusts models when errors exceed thresholds, enabling intelligent maintenance actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual techniques and pre-programmed rules are used for monitoring IT systems, then operational visibility is provided, but the systems become labor intensive and expensive
Solution Approach 1:
The system enables self-service monitoring through automated machine learning models that independently analyze event data, generate predictions, and identify root causes without requiring manual intervention. The adaptive models continuously learn from new data and automatically adjust to changing system conditions, eliminating the need for human analysts to manually monitor each metric.
Solution Approach 2:
Manual monitoring techniques are replaced with automated machine learning-based systems. The patent substitutes human analysts and pre-programmed rules with adaptive ML models that process event data, detect patterns, and generate predictions automatically, transforming the mechanical manual process into an intelligent automated system.
2Reliability
If monitoring systems are arrayed to provide visibility to operational metrics, then operational visibility is improved, but the sheer size and complexity result in a flooding of disparate event messages
Solution Approach 1:
The system extracts and focuses on only the most relevant information from the flooding of disparate event messages. Machine learning models identify and extract key patterns and anomalies from the vast amount of event data, filtering out noise and presenting only the critical information needed for operational visibility, thereby reducing the perceived complexity.
Solution Approach 2:
The patent merges disparate event messages from multiple monitoring systems into unified event clusters. By combining related events and identifying common patterns across different sources, the system reduces the number of separate messages while maintaining comprehensive operational visibility through consolidated views.
3Reliability
If manual techniques are used to manage complex distributed IT systems, then operational management is provided, but the ability to scale and evolve is limited
Solution Approach 1:
The system implements dynamic adaptability through machine learning models that continuously learn from new event data and automatically adjust to changing system conditions. The models evolve over time, improving their predictive accuracy and adapting to new patterns without requiring manual reconfiguration, enabling the system to scale and evolve with the IT infrastructure.
Solution Approach 2:
The patent incorporates feedback mechanisms where the machine learning models continuously receive feedback from new event data and prediction outcomes. This feedback loop enables the models to learn from past performance, adjust their parameters, and improve their accuracy over time, allowing the system to scale effectively as the IT environment grows and changes.
Data Source
AI summary
Embodiments are directed to managing operations. If Operations events are provided, event clusters may be associated with one or more Operations events, such that the Operations events may be associated with the event clusters based on characteristics of the Operations events. Metrics including resolution metrics, root cause analysis, notes, and other remediation information may be associated with the event clusters. Then a modeling engine may be employed to train models based on the Operations events, the event clusters, and the resolution metrics, such that the trained model may be trained to correlate and predict the resolution metrics from real-time Operations events. If real-time Operations events may be provided, the trained models may be employed to predict the resolution metrics that are associated with the real-time Operations events. If model performance degrades beyond accuracy requirements, new observations may be added to the training set and the model re-trained.