US 10,853,160 B2 · Methods and systems to manage alerts in a distributed computing system

Abstract

Computational methods and systems described herein manage alerts generated by event sources that run in a distributed computing system. Methods and system provide a graphical user interface that enables a user to define a dominant alert and select subsumed alerts generated by the event sources. Methods and systems may also compute a relative fraction that represents a number of times each alert is triggered with respect to a number of times another alert is triggered for each pair of alerts. The relative fractions may be displayed in the graphical user interface to allow a user to select dominant and subsumed alerts based on the relative fractions. Methods and systems identify log messages that correspond to user-identified subsumed alerts, suppress subsumed alerts and generate the dominant alert. Methods and systems may also execute remedial action to correct the problem represented by the dominant alert.

Claims15

Dependent claims

A method stored in one or more data storage devices and executed using one or more processors of a computer system to manage alerts generated in response to log messages generated by one or more event sources that run in a distributed computing system, the method comprising:

providing a graphical user interface that enables a user to define a dominant alert and select two or more subsumed alerts generated by the one or more event sources;
searching log-message files of the one or more event sources for log messages that correspond to the two or more subsumed alerts;
generating a single alert message that describes the dominant alert when a log message that corresponds to one of the two or more subsumed alerts is identified;
and executing remedial action to correct a problem represented by the dominant alert.

1 more element

A system to manage alerts generated by one or more event sources that run in a distributed computing system, the system comprising:

one or more processors;
one or more data-storage devices:
and machine-readable Instructions stored in the one or more data-storage devices that when executed using the one or more processors controls the system to perform operations comprising:
providing a graphical user interface that enables a user to define a dominant alert and select two or more subsumed alerts generated by the one or more event sources;
searching log-message files of the one or more event sources for log messages that correspond to the two or more subsumed alerts;
generating a single alert message that describes the dominant alert when a log message that corresponds to one of the two or more subsumed alerts is identified;
and executing remedial action to correct a problem represented by the dominant alert.

4 more elements

A non-transitory computer-readable medium encoded with machine-readable instructions that implement a method carried out by one or more processors of a computer system to perform operations comprising:

determining each type of alert recorded in log messages of one or more log-message files generated by one or more event sources;
determining a relative fraction of a pair of alerts co-occurring within a sliding time window applied to the one or more log-message files;
for each pair of alerts, identifying a first of the pair of alerts as a dominant alert and second of the pair of alerts as a subsumed alert when the relative fraction associated with the pair of alerts is greater than an alert threshold;
generating a single alert message that describes the dominant alert when a log message that corresponds to the subsumed alert co-occurs with the dominant alert;
and
executing remedial action to correct a problem represented by the dominant alert.

3 more elements

Dependencies are inferred from the claim text.

Methods and systems to manage alerts in a distributed computing system

Life of this patent

Methods and systems to manage alerts in a distributed computing system

Life of this patent

Abstract

Claims15