Classifying telemetry data to identify and remediate issues

#This invention relates generally to computing devices and, more particularly to receiving telemetry data from multiple (e.g., millions of) computing devices, where the telemetry data indicates the occurrence of various events on each computing, determining whether a particular set of events in the telemetry data indicates an issue, such as compromised key or application bug, and remediating the issue.

#As the value and use of information continues to increase, individuals and businesses seek additional ways to process and store information. One option available to users is information handling systems. An information handling system generally processes, compiles, stores, and/or communicates information or data for business, personal, or other purposes thereby allowing users to take advantage of the value of the information. Because technology and information handling needs and requirements vary between different users or applications, information handling systems may also vary regarding what information is handled, how the information is handled, how much information is processed, stored, or communicated, and how quickly and efficiently the information may be processed, stored, or communicated. The variations in information handling systems allow for information handling systems to be general or configured for a specific user or specific use such as financial transaction processing, airline reservations, enterprise data storage, or global communications. In addition, information handling systems may include a variety of hardware and software components that may be configured to process, store, and communicate information and may include one or more computer systems, data storage systems, and networking systems.

#A computer manufacturer, such as, for example, Dell®, may install a software agent on each computing device (e.g., laptop, tablet, desktop, server, and the like) before the computing device is shipped. The software agent installed on a computing device may gather data associated with the computing device and periodically send the gathered data (“telemetry data”) to one or more servers (e.g., cloud-based servers). The manufacturer may, for example, analyze the data to determine how users are using the products (e.g., computing devices).

#A more complete understanding of the present disclosure may be obtained by reference to the following Detailed Description when taken in conjunction with the accompanying Drawings. In the figures, the left-most digit(s) of a reference number identifies the figure in which the reference number first appears. The same reference numbers in different figures indicate similar or identical items.

#FIG. 1 is a block diagram of a system that includes a computing device sending data to a server, according to some embodiments.

#FIG. 2 is a block diagram illustrating determining distances between a particular feature of an event and each cluster of multiple clusters, according to some embodiments.

#For purposes of this disclosure, an information handling system (IHS) may include any instrumentality or aggregate of instrumentalities operable to compute, calculate, determine, classify, process, transmit, receive, retrieve, originate, switch, store, display, communicate, manifest, detect, record, reproduce, handle, or utilize any form of information, intelligence, or data for business, scientific, control, or other purposes. For example, an information handling system may be a personal computer (e.g., desktop or laptop), tablet computer, mobile device (e.g., personal digital assistant (PDA) or smart phone), server (e.g., blade server or rack server), a network storage device, or any other suitable device and may vary in size, shape, performance, functionality, and price. The information handling system may include random access memory (RAM), one or more processing resources such as a central processing unit (CPU) or hardware or software control logic, ROM, and/or other types of nonvolatile memory. Additional components of the information handling system may include one or more disk drives, one or more network ports for communicating with external devices as well as various input and output (I/O) devices, such as a keyboard, a mouse, touchscreen and/or video display. The information handling system may also include one or more buses operable to transmit communications between the various hardware components.

#A computer manufacturer, such as, for example, Dell®, may install a software agent on each computing device (e.g., laptop, tablet, desktop, server, and the like) before the computing device is shipped. The software agent installed on the computing device may gather data associated with the computing device, such as when the computing device is turned on for very first time, determine which retailer (e.g., Walmart®, Dell.com, Best Buy®, and the like) the computing device was purchased from, when an operating system that was installed by the factory crashed and what caused the crash (e.g., software bug, hardware bug, firmware bug or the like), when a software application that was installed prior to shipping crashed and what caused the crash, whether a blue screen of death (BSOD) occurred, how often an involuntary (e.g., non-user initiated) restart of the computing device has occurred, when the user selected (e.g., clicked on) a particular selection (e.g., to provide a rating for the computing device on a review site), and other device-related information. The data sent by the agent may include a unique identifier, such as a service tag or a serial number, that enables the servers to identify the computing device, thereby enabling the servers to identify the device's original hardware profile (e.g., which hardware components were installed at the factory) and the device's original software profile (e.g., which software applications and operating system were installed at the factory). Each agent installed on a computing device may use a key, such as an application programming interface (API) key, to prevent unauthorized agents (or other entities) from sending data to the servers. An API key is a code passed by the agent when calling an API to identify the agent and indicate that the agent is authorized to access the API to send the data.

#The agent may periodically (e.g., at a predetermined time interval) or in response to a particular set of events (e.g., multiple restarts within a particular time interval, multiple crashes by a particular software application within a particular time interval, and the like), send the gathered data to the servers (e.g., cloud-based servers associated with the manufacturer). The servers are an example of an IHS. The servers may analyze the data to identify how users are using the computing device, e.g., which software applications are being used, an amount of time each application is being used, when (e.g., time of day, day of the week, and the like) the application is being used, which hardware components are being used, which peripherals have been or are current connected to the computing device, and the like. In some cases, the manufacturer of the computing device may perform an analysis of the data sent by the agent and make software, hardware, and/or peripherals recommendations based on the analysis. For example, if the computing device spends a large amount of time executing applications that make use of a hard drive or the main memory (e.g., random access memory (RAM)), the manufacturer may send an offer to upgrade the hard drive from a mechanical drive to a solid-state drive (SSD) or purchase additional memory.