# US 10,481,966 B2 · Methods and systems to prioritize alerts with quantification of alert impacts

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,481,966 B2
- Document ID: US10481966B2
- Status: Granted
- Kind: B2
- Application number: 15/604,460
- Filed: 2017-05-24
- Published: 2018-11-29
- Granted: 2019-11-19
- Earliest claimed: 2017-05-24
- Assignees: VMware, Inc.
- Applicants: VMware, Inc.
- Inventors: Ashot Nshan Harutyunyan; Vardan Movsisyan; Arnak Poghosyan; Naira Movses Grigoryan
- Web page: https://patentgrep.com/patent/US10481966B2

## CPC

- G06F 11/0781: {Error filtering or prioritizing based on a policy defined by the user or on a policy defined by a hardware/software module, e.g. according to a severity level}
- G06F 11/0766: {Error or fault reporting or storing}
- G06F 11/0793: {Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40)}
- G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)}
- G06F 11/327: {Alarm or error message display}
- G06F 11/3452: {Performance evaluation by statistical analysis}
- G06F 11/3495: {for systems}
- G06F 2201/81: Threshold
- G06F 2201/815: Virtual
- G06F 2201/86: Event-based monitoring
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Methods and systems are directed to quantifying and prioritizing the impact of problems or changes in a computer system. Resources of a computer system are monitored by management tools. When a change occurs at a resource of a computer system or in log data generated by event sources of the computer system, one or more of the management tools generates an alert. The alert may be an alert that indicates a problem with the computer system resource or the alert may be an alert trigger identified in an event message of the log data. Methods described herein compute an impact factor that serves as a measure of the difference between event messages generated before the alert and event messages generated after the alert. The value of the impact factor associated with an alert may be used to quantitatively prioritize the alert and generate appropriate recommendations for responding to the alert.

## Claims

### Claim 1

A method stored in one or more data-storage devices and executed using one or more processors of a computing environment to prioritize alerts generated by management tools that monitor a computing system, the method comprising:
reading pre-alert event messages from an event store, the pre-alert event messages generated by one or more event sources of the system before triggering an alert indicating a change to the system;
reading post-alert event messages from the event store, the post-alert event messages generated by the one or more event sources after triggering the alert;
computing an impact factor that provides a quantitative measure of the change to the system based on the pre-alert event messages and the post-alert event messages;
determining a rank for the alert based on a comparison between the impact factor with impact factors of other alerts generated for the system; and
generating a recommendation for responding to the alert based on the rank of the alert.

### Claim 2 (depends on 1)

The method of claim 1, wherein reading pre-alert event messages and reading post-alert event messages comprises:
reading event messages of the event store with time stamps that occur in a pre-alert time interval that ends at a time when the alert is generated; and
reading event message of the event store with time stamps that occur in a post-alert time interval that begins at a time when the alert is generated.

### Claim 3 (depends on 1)

The method of claim 1, wherein reading pre-alert event messages and reading post-alert event messages comprises:
determining a time of an alert trigger in the pre-alert event messages;
reading event messages of the event store with time stamps that occur in a pre-alert time interval that ends at the time of the alert trigger; and
reading event message of the event store with time stamps that occur in a post-alert time interval that begins at the time of the alert trigger.

### Claim 4 (depends on 1)

The method of claim 1, wherein computing the impact factor comprises:
computing a global impact factor based on the pre-alert event messages and the post-alert event messages;
setting the impact factor equal to the global impact factor when the global impact factor is greater than a global impact threshold;
computing a local impact factor based on the pre-alert event messages and the post-alert event messages when the global impact factor is less than the global impact threshold; and
setting the impact factor equal to the local impact factor.

### Claim 5 (depends on 4)

The method of claim 4, wherein computing the global impact factor comprises:
determining an event type of each event message in the pre-alert event messages;
computing relative frequency of each event type in the pre-alert event messages;
forming a pre-alert event type distribution from the relative frequencies of the event types in the pre-alert event messages;
determining an event type of each event message in the post-alert event messages;
computing relative frequency of each event type in the post-alert event messages;
forming a post-alert event type distribution from the relative frequencies of the event types in the post-alert event messages; and
computing a global impact factor from the pre-alert event type distribution and the post-event type distribution.

### Claim 6 (depends on 4)

The method of claim 4, wherein computing the local impact factor comprises:
determining log field values based on a definition of the alert;
computing relative frequencies of the log field values in event message in the pre-alert event messages;
forming a pre-alert distribution of the relative frequencies of the log field values in the pre-alert event messages;
computing relative frequencies of the log field values in event message in the post-alert event messages;
forming a post-alert distribution of the relative frequencies of the log field values in the post-alert event messages; and
computing a local impact factor from the pre-alert and post-alert distributions.

### Claim 7 (depends on 1)

The method of claim 1, wherein determining the rank for the alert based on the impact factor comprises rank ordering the alert with other alerts generated by the system in descending order of the impact factor associated with the alert and the impact factors associated with the other alerts.

### Claim 8

A computer system that prioritizes alerts indicating changes to a system, the computer system comprising:
one or more processors;
one or more data-storage devices; and
machine-readable instructions stored in the one or more data-storage devices that when executed uses the one or more processors to perform operations comprising:
reading pre-alert event messages from an event store, the pre-alert event messages generated by one or more event sources of the system before triggering an alert indicating a change to the system;
reading post-alert event messages from the event store, the post-alert event messages generated by the one or more event sources after triggering the alert;
computing an impact factor that provides a quantitative measure of the change to the system based on the pre-alert event messages and the post-alert event messages;
determining a rank for the alert based on a comparison between the impact factor with impact factors of other alerts generated for the system; and
generating a recommendation for responding to the alert based on the rank of the alert.

### Claim 9 (depends on 8)

The computer system of claim 8, wherein reading pre-alert event messages and reading post-alert event messages comprises:
reading event messages of the event store with time stamps that occur in a pre-alert time interval that ends at a time when the alert is generated; and
reading event message of the event store with time stamps that occur in a post-alert time interval that begins at a time when the alert is generated.

### Claim 10 (depends on 8)

The computer system of claim 8, wherein reading pre-alert event messages and reading post-alert event messages comprises:
determining a time of an alert trigger in the pre-alert event messages;
reading event messages of the event store with time stamps that occur in a pre-alert time interval that ends at the time of the alert trigger; and
reading event message of the event store with time stamps that occur in a post-alert time interval that begins at the time of the alert trigger.

### Claim 11 (depends on 8)

The computer system of claim 8, wherein computing the impact factor comprises:
computing a global impact factor based on the pre-alert event messages and the post-alert event messages;
setting the impact factor equal to the global impact factor when the global impact factor is greater than a global impact threshold;
computing a local impact factor based on the pre-alert event messages and the post-alert event messages when the global impact factor is less than the global impact threshold; and
setting the impact factor equal to the local impact factor.

### Claim 12 (depends on 11)

The computer system of claim 11, wherein computing the global impact factor comprises:
determining an event type of each event message in the pre-alert event messages;
computing relative frequency of each event type in the pre-alert event messages;
forming a pre-alert event type distribution from the relative frequencies of the event types in the pre-alert event messages;
determining an event type of each event message in the post-alert event messages;
computing relative frequency of each event type in the post-alert event messages;
forming a post-alert event type distribution from the relative frequencies of the event types in the post-alert event messages; and
computing a global impact factor from the pre-alert event type distribution and the post-event type distribution.

### Claim 13 (depends on 11)

The computer system of claim 11, wherein computing the local impact factor comprises:
determining log field values based on a definition of the alert;
computing relative frequencies of the log field values in event message in the pre-alert event messages;
forming a pre-alert distribution of the relative frequencies of the log field values in the pre-alert event messages;
computing relative frequencies of the log field values in event message in the post-alert event messages;
forming a post-alert distribution of the relative frequencies of the log field values in the post-alert event messages; and
computing a local impact factor from the pre-alert and post-alert distributions.

### Claim 14 (depends on 8)

The computer system of claim 8, wherein determining the rank for the alert based on the impact factor comprises rank ordering the alert with other alerts generated by the system in descending order of the impact factor associated with the alert and the impact factors associated with the other alerts.

### Claim 15

A non-transitory computer-readable medium encoded with machine-readable instructions that implement a method carried out by one or more processors of a computer system to perform the operations
reading pre-alert event messages from an event store, the pre-alert event messages generated by one or more event sources of the system before triggering an alert indicating a change to the system;
reading post-alert event messages from the event store, the post-alert event messages generated by the one or more event sources after triggering the alert;
computing an impact factor that provides a quantitative measure of the change to the system based on the pre-alert event messages and the post-alert event messages;
determining a rank for the alert based on a comparison between the impact factor with impact factors of other alerts generated for the system; and
generating a recommendation for responding to the alert based on the rank of the alert.

### Claim 16 (depends on 15)

The computer-readable medium of claim 15, wherein reading pre-alert event messages and reading post-alert event messages comprises:
reading event messages of the event store with time stamps that occur in a pre-alert time interval that ends at a time when the alert is generated; and
reading event message of the event store with time stamps that occur in a post-alert time interval that begins at a time when the alert is generated.

### Claim 17 (depends on 15)

The computer-readable medium of claim 15, wherein reading pre-alert event messages and reading post-alert event messages comprises:
determining a time of an alert trigger in the pre-alert event messages;
reading event messages of the event store with time stamps that occur in a pre-alert time interval that ends at the time of the alert trigger; and
reading event message of the event store with time stamps that occur in a post-alert time interval that begins at the time of the alert trigger.

### Claim 18 (depends on 15)

The computer-readable medium of claim 15, wherein computing the impact factor comprises:
computing a global impact factor based on the pre-alert event messages and the post-alert event messages;
setting the impact factor equal to the global impact factor when the global impact factor is greater than a global impact threshold;
computing a local impact factor based on the pre-alert event messages and the post-alert event messages when the global impact factor is less than the global impact threshold; and
setting the impact factor equal to the local impact factor.

### Claim 19 (depends on 18)

The computer-readable medium of claim 18, wherein computing the global impact factor comprises:
determining an event type of each event message in the pre-alert event messages;
computing relative frequency of each event type in the pre-alert event messages;
forming a pre-alert event type distribution from the relative frequencies of the event types in the pre-alert event messages;
determining an event type of each event message in the post-alert event messages;
computing relative frequency of each event type in the post-alert event messages;
forming a post-alert event type distribution from the relative frequencies of the event types in the post-alert event messages; and
computing a global impact factor from the pre-alert event type distribution and the post-event type distribution.

### Claim 20 (depends on 18)

The computer-readable medium of claim 18, wherein computing the local impact factor comprises:
determining log field values based on a definition of the alert;
computing relative frequencies of the log field values in event message in the pre-alert event messages;
forming a pre-alert distribution of the relative frequencies of the log field values in the pre-alert event messages;
computing relative frequencies of the log field values in event message in the post-alert event messages;
forming a post-alert distribution of the relative frequencies of the log field values in the post-alert event messages; and
computing a local impact factor from the pre-alert and post-alert distributions.

### Claim 21 (depends on 15)

The computer-readable medium of claim 15, wherein determining the rank for the alert based on the impact factor comprises rank ordering the alert with other alerts generated by the system in descending order of the impact factor associated with the alert and the impact factors associated with the other alerts.