US 10,853,161 B2Granted

Automatic anomaly detection and resolution system

AssigneeOracle International Corporation

InventorRafiul Ahad

Life of this patent

Estimating the term…

Loading patent…

Abstract

An anomaly detection and resolution system (ADRS) is disclosed for automatically detecting and resolving anomalies in computing environments. The ADRS may be implemented using an anomaly classification system defining different types of anomalies (e.g., a defined anomaly and an undefined anomaly). A defined anomaly may be based on bounds (fixed or seasonal) on any metric to be monitored. An anomaly detection and resolution component (ADRC) may be implemented in each component defining a service in a computing system. An ADRC may be configured to detect and attempt to resolve an anomaly locally. If the anomaly event for an anomaly can be resolved in the component, the ADRC may communicate the anomaly event to an ADRC of a parent component, if one exists. Each ADRC in a component may be configured to locally handle specific types of anomalies to reduce communication time and resource usage for resolving anomalies.

Claims20

Dependent claims

A method comprising:

providing, by a computer system, a service using a plurality of components, the plurality of components including a first component and a second component, wherein the first component runs a thread or process using resources that are available to the second component;
providing, by the computer system, a first anomaly detection and resolution component (ADRC) for detecting one or more anomaly events for the first component;
providing, by the computer system, a second ADRC for detecting one or more anomaly events for the second component;
detecting, by the first ADRC, an anomaly event based on determining that a metric related to the provided service satisfies a set of one or more measures that have been defined for the provided service;
and
responsive to the detecting of the anomaly event:
determining, by the first ADRC, that the first ADRC does not have a policy for resolving the anomaly event;
notifying the second component that the anomaly event cannot be resolved by the first component;
identifying, by the second ADRC, a first policy for handling the anomaly event, the first policy comprising a set of one or more rules;
determining, by the second ADRC, a corrective action based on satisfaction of a rule from the set of one or more rules by the anomaly event;
and
initiating, by the second ADRC, the corrective action.

9 more elements

A computer system comprising:

one or more processors;
and
a memory accessible by the one or more processors, the memory storing instructions which, upon execution by the one or more processors, cause the one or more processors to:
provide a service using a plurality of components, the plurality of components including a first component and a second component, wherein the first component runs a thread or process using resources that are available to the second component;
provide a first anomaly detection and resolution component (ADRC) for detecting one or more anomaly events for the first component;
provide a second ADRC for detecting one or more anomaly events for the second component;
detect, using the first ADRC, an anomaly event based on determining that a metric related to the provided service satisfies a set of one or more measures that have been defined for the provided service;
and
responsive to the detecting of the anomaly event:
determine, using the first ADRC, that the first ADRC does not have a policy for resolving the anomaly event;
notify the second component that the anomaly event cannot be resolved by the first component;
identify, using the second ADRC, a first policy for handling the anomaly event, the first policy comprising a set of one or more rules;
determine, using the second ADRC, a corrective action based on satisfaction of a rule from the set of one or more rules by the anomaly event;
and
initiate, using the second ADRC, the corrective action.

12 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/050,429Filed 31 Jul 2018 · continuation
Priority: 28 May 2015
Published: US 2019/0042353 A17 Feb 2019
Granted: 1 Dec 2020
Term ends: Not estimatedThe source records don’t support an estimate.

Classification17 codes

G06F 11/0793
Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of…
G06F 11/0709
The processing taking place on a specific hardware platform or in a specific software environment: in a distributed system consisting of a…
G06F 11/0751
Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of…
G06F 11/079
Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of…

Family

Application62/167,851Us provisional application · filed 28 May 2015
Application62/199,895Us provisional application · filed 31 Jul 2015
Application62/245,706Us provisional application · filed 23 Oct 2015
Application15/165,298Parent of this continuation · filed 26 May 2016
US 2019/0042353 A1Pre-grant publication · published 7 Feb 2019
US 10,042,697 B2Parent of this continuation
US 2016/0350173 A1Published application
US 10,853,161 B2This patent

From the US filing history. Foreign family members aren’t listed.