Storage Alert Bundling With ML Root Cause Self-Healing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional storage systems lack effective mechanisms to correlate and mask alerts across distributed components, leading to a flood of uncorrelated notifications that overwhelm administrators and require constant maintenance to identify root causes.
Innovation Solution
Implement a machine learning-based approach using a reinforcement learning framework with a decision transformer architecture to generate alert bundle self-healing policies, correlating alerts and identifying root causes to automate remediation actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional storage systems monitor and notify all alerts from distributed components, then complete alert coverage is achieved, but administrators are overwhelmed by a flood of uncorrelated notifications
Solution Approach 1:
The patent combines multiple related alerts into a single correlated alert notification. The system identifies alerts that are causally related or part of the same failure event and merges them into one consolidated notification, reducing the volume of alerts administrators must process while maintaining complete coverage of system issues.
Solution Approach 2:
The patent introduces an intermediary alert correlation system that sits between the storage components and administrators. This intermediary layer analyzes incoming alerts, correlates them using machine learning models, and presents processed information to administrators, thereby reducing notification overload while preserving alert coverage.
2Ease of operation
If storage systems implement traditional alert correlation rules, then some alert filtering is achieved, but constant maintenance is required to update rules and identify root causes
Solution Approach 1:
The patent implements a self-learning alert correlation system that automatically improves its correlation rules through machine learning. The system continuously analyzes alert patterns and automatically updates its correlation models without requiring manual rule maintenance, thereby reducing maintenance effort while improving alert filtering capability.
Solution Approach 2:
The patent uses machine learning models that dynamically adjust correlation parameters based on observed alert patterns. Instead of static rules requiring manual updates, the system changes its correlation parameters automatically based on learned patterns, reducing maintenance complexity while improving filtering effectiveness.
3Extent of automation
If machine learning models are trained on historical alert data, then automated root cause identification is achieved, but the system requires significant computational resources and training data
Solution Approach 1:
The patent applies partial machine learning processing by using pre-trained models for common alert patterns and reserving full computational resources for complex or novel situations. This approach achieves automated root cause identification for typical cases while conserving computational resources for edge cases requiring more intensive analysis.
Data Source
AI summary
An apparatus comprises at least one processing device configured to determine information characterizing alerts detected on a set of storage systems, the determined information characterizing (i) times at which the alerts are raised and cleared, (ii) times at which recovery actions are taken, and (iii) system state information before and after the recovery actions. The at least one processing device is also configured to generate, utilizing one or more machine learning algorithms that take as input at least a portion of the determined information, an alert bundle self-healing policy for a given set of alerts, the alert bundle self-healing policy identifying a root cause alert and at least one recovery action to take in response to the root cause alert to remediate the given set of alerts. The at least one processing device is further configured to provision the alert bundle self-healing policy in storage controllers of the storage systems.