# US 11,443,205 B2 · Self-managing database system using machine learning

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,443,205 B2
- Document ID: US11443205B2
- Status: Granted
- Kind: B2
- Application number: 16/713,348
- Filed: 2019-12-13
- Published: 2021-06-17
- Granted: 2022-09-13
- Earliest claimed: 2019-12-13
- Assignees: salesforce.com, inc.
- Applicants: salesforce.com, inc.
- Inventors: Sudheendran Koyyalummal; Asharam Yadav; Sai Prasad Mysary; Mahesh Kumar Bolagum; Esha Sharma
- Web page: https://patentgrep.com/patent/US11443205B2

## CPC

- G06N 5/02: Knowledge representation; Symbolic representation
- G06N 5/04: Inference or reasoning models
- G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems}
- G06F 11/0754: {by exceeding limits}
- G06F 11/0769: {Readable error formats, e.g. cross-platform generic formats, human understandable formats}
- G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)}
- G06F 11/0793: {Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40)}
- G06F 16/21: Design, administration or maintenance of databases
- G06F 16/27: Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
- G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A self-managing database system includes a metrics collector to collect metrics data from one or more databases of a computing system and an anomaly detector to analyze the metrics data and detect one or more anomalies. The system includes a causal inference engine to mark one or more nodes in a knowledge representation corresponding to the metrics data for the one or more anomalies and to determine a root cause with a highest probability of causing the one or more anomalies using the knowledge representation. The system includes a self-healing engine, to take at least one remedial action for the one or more databases in response to determination of the root cause.

## Claims

### Claim 1

A system, comprising:
a metrics collector to collect metrics data from one or more databases of a computing system;
an anomaly detector, coupled to the metrics collector, to analyze the metrics data and detect one or more anomalies;
a causal inference engine, coupled to the anomaly detector, to mark one or more nodes in a knowledge representation corresponding to the metrics data for the one or more anomalies and to determine a root cause with a highest probability of causing the one or more anomalies using the knowledge representation; and
a self-healing engine, coupled to the causal inference engine, to take at least one remedial action for the one or more databases in response to determination of the root cause.

### Claim 2 (depends on 1)

The system of claim 1, wherein the metrics data comprises at least one of database metrics and operating system metrics.

### Claim 3 (depends on 1)

The system of claim 1, wherein the metrics data comprises at least one of log scanner metrics and change scanner metrics.

### Claim 4 (depends on 1)

The system of claim 1, wherein the metrics collector is to store metrics data collected within a most recent selected period of time as recent metrics data in a memory of the computing system and metrics data collected earlier than the most recent selected period of time as historical metrics data in a long term storage device of the computing system.

### Claim 5 (depends on 4)

The system of claim 4, wherein the anomaly detector is to compute a median value, a median absolute deviation, and a critical threshold for a metric of the historical metrics data.

### Claim 6 (depends on 5)

The system of claim 5, wherein the anomaly detector is to compute an anomaly value called a Z score for a sample of a metric from the recent metrics data according to a formula:
zscore(of xr)=(xr−median(Xh))÷(median(|Xh(i)−median(Xh)|i=1 . . . n))
where xr is a metrics data sample value from the recent metrics data, Xh are metrics data sample values from the historical metrics data, and Xh(i)where i=1 . . . n are metrics data sample values in Xh.

### Claim 7 (depends on 6)

The system of claim 6, wherein the anomaly detector is to mark the sample as anomalous when an absolute value of the Z score of the sample is greater than an absolute value of the critical threshold.

### Claim 8 (depends on 7)

The system of claim 7, wherein the anomaly detector is to mark the metric as anomalous when a number of anomalous samples for the metric is greater than a predetermined threshold.

### Claim 9 (depends on 1)

The system of claim 1, wherein the knowledge representation comprises a Bayesian network.

### Claim 10 (depends on 9)

The system of claim 9, wherein the causal inference engine is to
mark nodes of the Bayesian network corresponding to metrics of the one or more anomalies;
for each marked node, traverse a path in the Bayesian network from the marked node to a leaf node and from the marked node to a root node;
for each path, compute a probability of the leaf node being the root cause;
determining a path with the highest probability for the leaf node and mark the path as a root cause path; and
marking the leaf node with the highest probability as the root cause.

### Claim 11

A computer-implemented method comprising:
collecting metrics data from one or more databases of a computing system;
analyzing the metrics data and detecting one or more anomalies;
marking one or more nodes in a knowledge representation corresponding to the metrics data for the one or more anomalies and determining a root cause with a highest probability of causing the one or more anomalies using the knowledge representation; and
taking at least one remedial action for the one or more databases in response to determination of the root cause.

### Claim 12 (depends on 11)

The computer-implemented method of claim 11, wherein the metrics data comprises at least one of database metrics and operating system metrics.

### Claim 13 (depends on 11)

The computer-implemented method of claim 11, wherein the metrics data comprises at least one of log scanner metrics and change scanner metrics.

### Claim 14 (depends on 11)

The computer-implemented method of claim 11, comprising storing metrics data collected within a most recent selected period of time as recent metrics data in a memory of the computing system and metrics data collected earlier than the most recent selected period of time as historical metrics data in a long term storage device of the computing system.

### Claim 15 (depends on 14)

The computer-implemented method of claim 14, comprising computing a median value, a median absolute deviation, and a critical threshold for a metric of the historical metrics data.

### Claim 16 (depends on 15)

The computer-implemented method of claim 15, comprising computing an anomaly value called a Z score for a sample of a metric from the recent metrics data according to a formula:
zscore(of xr)=(xr−median(Xh))÷(median(|Xh(i)−median(Xh)|i=1 . . . n))
where xr is a metrics data sample value from the recent metrics data, Xh are metrics data sample values from the historical metrics data, and Xh(i)where i=1 . . . n are metrics data sample values in Xh.

### Claim 17 (depends on 16)

The computer-implemented method of claim 16, comprising marking the sample as anomalous when an absolute value of the Z score of the sample is greater than an absolute value of the critical threshold.

### Claim 18 (depends on 17)

The computer-implemented method of claim 17, comprising marking the metric as anomalous when a number of anomalous samples for the metric is greater than a predetermined threshold.

### Claim 19 (depends on 11)

The computer-implemented method of claim 11, wherein the knowledge representation comprises a Bayesian network.

### Claim 20 (depends on 19)

The computer-implemented method of claim 19, comprising:
marking nodes of the Bayesian network corresponding to metrics of the one or more anomalies;
for each marked node, traversing a path in the Bayesian network from the marked node to a leaf node and from the marked node to a root node;
for each path, computing a probability of the leaf node being the root cause;
determining a path with the highest probability for the leaf node and marking the path as a root cause path; and
marking the leaf node with the highest probability as the root cause.

### Claim 21

A tangible, non-transitory computer-readable storage medium having instructions encoded thereon which, when executed by a processing device, cause the processing device to:
collect metrics data from one or more databases of a computing system;
analyze the metrics data and detecting one or more anomalies;
mark one or more nodes in a knowledge representation corresponding to the metrics data for the one or more anomalies and determine a root cause with a highest probability of causing the one or more anomalies using the knowledge representation; and
take at least one remedial action for the one or more databases in response to determination of the root cause.

### Claim 22 (depends on 21)

The tangible, non-transitory computer-readable storage medium of claim 21, comprising instructions to store metrics data collected within a most recent selected period of time as recent metrics data in a memory of the computing system and metrics data collected earlier than the most recent selected period of time as historical metrics data in a long term storage device of the computing system.

### Claim 23 (depends on 22)

The tangible, non-transitory computer-readable storage medium of claim 22, comprising instructions to compute a median value, a median absolute deviation, and a critical threshold for a metric of the historical metrics data.

### Claim 24 (depends on 23)

The tangible, non-transitory computer-readable storage medium of claim 23, comprising instructions to compute an anomaly value called a Z score for a sample of a metric from the recent metrics data according to a formula:
zscore(of xr)=(xr−median(Xh))÷(median(|Xh(i)−median(Xh)|i=1 . . . n))
where xr is a metrics data sample value from the recent metrics data, Xh are metrics data sample values from the historical metrics data, and Xh(i)where i=1 . . . n are metrics data sample values in Xh.

### Claim 25 (depends on 24)

The tangible, non-transitory computer-readable storage of claim 24, comprising instructions to mark the sample as anomalous when an absolute value of the Z score of the sample is greater than an absolute value of the critical threshold.

### Claim 26 (depends on 25)

The tangible, non-transitory computer-readable storage medium of claim 25, comprising instructions to mark the metric as anomalous when a number of anomalous samples for the metric is greater than a predetermined threshold.

### Claim 27 (depends on 21)

The tangible, non-transitory computer-readable storage medium of claim 21, wherein the knowledge representation comprises a Bayesian network.

### Claim 28 (depends on 27)

The tangible, non-transitory computer-readable storage medium of claim 27, comprising instructions to:
mark nodes of the Bayesian network corresponding to metrics of the one or more anomalies;
for each marked node, traverse a path in the Bayesian network from the marked node to a leaf node and from the marked node to a root node;
for each path, compute a probability of the leaf node being the root cause;
determine a path with the highest probability for the leaf node and mark the path as a root cause path; and
mark the leaf node with the highest probability as the root cause.