# US 11,307,915 B1 · Grouping anomalous components of a distributed application > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,307,915 B1 - Document ID: US11307915B1 - Status: Granted - Kind: B1 - Application number: 17/244,024 - Filed: 2021-04-29 - Granted: 2022-04-19 - Earliest claimed: 2021-04-29 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Larisa Shwartz; Jinho Hwang; Pooja Aggarwal; Seema Nagar - Web page: https://patentgrep.com/patent/US11307915B1 ## CPC - H04L 41/0677: Localisation of faults - G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems} - G06F 11/0715: {in a system implementing multitasking (multitasking per se G06F9/46)} - G06F 11/0745: {in an input/output transactions management context (input/output processing in general G06F13/00)} - G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)} - G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)} - G06F 11/302: {where the computing system component is a software system} - G06F 11/3466: {Performance evaluation by tracing or monitoring} - H04L 41/0659: by isolating or reconfiguring faulty entities - H04L 43/091: Measuring contribution of individual network components to actual service level - G06F 2201/865: Monitoring of software - H04L 41/069: using logs of notifications; Post-processing of notifications - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems, devices, computer-implemented methods, and/or computer program products that facilitate fault localization for distributed applications. In one example, a system can comprise a process that executes computer executable components stored in memory. The computer executable components can comprise a graph compiler and a partitioning component. The graph compiler can generate a hypernode graph for a distributed application using causality data inferred from log data generated by services emitting errors. The distributed application can comprise the services. The partitioning component can cluster the services into a plurality of groups using the hypernode graph and an objective function. ## Claims ### Claim 1 A system, comprising: a processor that executes the following computer-executable components stored in memory: a graph compiler that generates a hypernode graph for a distributed application using causality data inferred from log data generated by services emitting errors, wherein the distributed application comprises the services and the hypernode graph includes a hypernode that corresponds to a particular service of the distributed application; a partitioning component that clusters the services into a plurality of groups using the hypernode graph and an objective function. ### Claim 2 (depends on 1) The system of claim 1, wherein the hypernode graph includes a node inside the hypernode that corresponds to a given error template observed for the particular service, an edge coupling a respective pair of nodes that are causally related, a hyperedge coupling a respective pair of hypernodes that are causally related, or a combination thereof. ### Claim 3 (depends on 1) The system of claim 1, wherein the graph compiler generates the hypernode graph using a template-level causal graph constructed using template-level timeseries data obtained from the log data. ### Claim 4 (depends on 1) The system of claim 1, wherein the graph compiler generates the hypernode graph using a service-level causal graph constructed using service-level timeseries data obtained from the log data. ### Claim 5 (depends on 1) The system of claim 1, wherein the objective function includes a modularity metric that evaluates intergroup cohesion and intragroup cohesion of the plurality of groups. ### Claim 6 (depends on 5) The system of claim 5, wherein the partitioning component clusters the services into the plurality of groups by maximizing the modularity metric using the hypernode graph. ### Claim 7 (depends on 1) The system of claim 1, wherein the objective function includes a textual similarity metric that evaluates intergroup log line similarity and intragroup log line similarity. ### Claim 8 (depends on 1) The system of claim 1, wherein the objective function includes a cross-entropy metric that evaluates intergroup entropy relative to intragroup entropy. ### Claim 9 (depends on 1) The system of claim 1, further comprising: a token component that generates token vectors for the services using tokens flowing across the services that are observed in the log data. ### Claim 10 (depends on 9) The system of claim 9, wherein the objective function includes a cross-entropy metric that evaluates intergroup cross-entropy relative to intragroup cross-entropy of the plurality of groups, and wherein the partitioning component clusters the services into the plurality of groups by evaluating the cross-entropy metric using the token vectors. ### Claim 11 A computer-implemented method, comprising: generating, by a system operatively coupled to a processor, a hypernode graph for a distributed application using causality data inferred from log data generated by services emitting errors, wherein the distributed application comprises the services and the hypernode graph includes a hypernode that corresponds to a particular service of the distributed application; and clustering, by the system, the services into a plurality of groups using the hypernode graph and an objective function. ### Claim 12 (depends on 11) The computer-implemented method of claim 11, a node inside the hypernode that corresponds to a given error template observed for the particular service, an edge coupling a respective pair of nodes that are causally related, a hyperedge coupling a respective pair of hypernodes that are causally related, or a combination thereof. ### Claim 13 (depends on 11) The computer-implemented method of claim 11, wherein the system generates the hypernode graph using a template-level causal graph constructed using template-level timeseries data obtained from the log data and a service-level causal graph constructed using service-level timeseries data obtained from the log data. ### Claim 14 (depends on 11) The computer-implemented method of claim 11, wherein the objective function includes a modularity metric that evaluates intergroup cohesion and intragroup cohesion within the plurality of groups, and wherein the system clusters the services into the plurality of groups by maximizing the modularity metric using the hypernode graph. ### Claim 15 (depends on 11) The computer-implemented method of claim 11, further comprising: generating, by the system, token vectors for the services using tokens flowing across the services that are observed in the log data. ### Claim 16 (depends on 15) The computer-implemented method of claim 15, wherein the objective function includes an entropy-based metric that evaluates intergroup cross entropy and intragroup cross entropy of the plurality of groups, and wherein the system clusters the services into the plurality of groups by evaluating the entropy-based metric using the token vectors. ### Claim 17 A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to: generate, by the processor, a hypernode graph for a distributed application using causality data inferred from log data generated by services emitting errors, wherein the distributed application comprises the services and the hypernode graph includes a hypernode that corresponds to a particular service of the distributed application; and cluster, by the processor, the services into a plurality of groups using the hypernode graph and an objective function. ### Claim 18 (depends on 17) The computer program product of claim 17, the processor generates the hypernode graph using a template-level causal graph constructed using template-level timeseries data obtained from the log data and a service-level causal graph constructed using service-level timeseries data obtained from the log data. ### Claim 19 (depends on 17) The computer program product of claim 17, wherein the objective function includes a modularity metric that evaluates intergroup cohesion and intragroup cohesion within the plurality of groups, and wherein the processor clusters the services into the plurality of groups by maximizing the modularity metric using the hypernode graph. ### Claim 20 (depends on 17) The computer program product of claim 17, the program instructions executable by the processor to further cause the processor to: generate, by the processor, token vectors for the services using tokens flowing across the services that are observed in the log data, wherein the objective function includes an entropy-based metric that evaluates intergroup cross entropy and intragroup cross entropy of the plurality of groups, and wherein the processor clusters the services into the plurality of groups by evaluating the entropy-based metric using the token vectors. ### Claim 21 (depends on 17) The computer program product of claim 17, wherein the objective function includes a text-based metric that evaluates the log data for intergroup textual similarity and intragroup textual similarity within the plurality of groups. ### Claim 22 A system, comprising: a processor that executes the following computer-executable components stored in memory: a graph compiler that generates a hypernode graph for a distributed application using causality data inferred from log data generated by services emitting errors, wherein the distributed application comprises the services; a token component that generates token vectors for the services using tokens flowing across the services that are observed in the log data; and a partitioning component that clusters the services into a plurality of groups using the hypernode graph, the token vectors, and an objective function. ### Claim 23 (depends on 22) The system of claim 22, wherein the graph compiler generates the hypernode graph using a template-level causal graph constructed using template-level timeseries data obtained from the log data and a service-level causal graph constructed using service-level timeseries data obtained from the log data. ### Claim 24 A computer-implemented method, comprising: generating, by a system operatively coupled to a processor, a hypernode graph for a distributed application using causality data inferred from log data generated by services emitting errors, wherein the distributed application comprises the services; generating, by the system, token vectors for the services using tokens flowing across the services that are observed in the log data; and clustering, by the system, the services into a plurality of groups using the hypernode graph, the token vectors, and an objective function. ### Claim 25 (depends on 24) The computer-implemented method of claim 24, wherein the system generates the hypernode graph using a template-level causal graph constructed using template-level timeseries data obtained from the log data and a service-level causal graph constructed using service-level timeseries data obtained from the log data.