Correlation-based multi-source problem diagnosis

A system comprising:

• a memory having computer readable instructions;
• and
• one or more processors for executing the computer readable instructions, the computer readable instructions controlling the one or more processors to perform operations comprising:
• searching for a correlated log identifier in a correlation database based on detecting a metrics-based anomaly;
• providing, in a problem diagnosis, related log information associated with the correlated log identifier based on locating one or more log entries including the correlated log identifier in a same time window as the metrics-based anomaly;
• searching for a correlated metric in the correlation database based on detecting a log-based anomaly;
• providing, in the problem diagnosis, related metric information associated with the correlated metric based on locating one or more metrics records including the correlated metric in the same time window as the log-based anomaly, wherein the problem diagnosis is provided based on determining that an anomaly occurred with a confidence level below a confidence threshold and correlated evidence is available;
• preventing reporting of the anomaly based on determining that the correlated log identifier is not located in the one or more log entries;
• and
• preventing reporting of the anomaly based on determining that the correlated metric is not located in the one or more metrics records.

A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to perform operations comprising:

• searching for a correlated log identifier in a correlation database based on detecting a metrics-based anomaly;
• providing, in a problem diagnosis, related log information associated with the correlated log identifier based on locating one or more log entries including the correlated log identifier in a same time window as the metrics-based anomaly;
• searching for a correlated metric in the correlation database based on detecting a log-based anomaly;
• providing, in the problem diagnosis, related metric information associated with the correlated metric based on locating one or more metrics records including the correlated metric in the same time window as the log-based anomaly, wherein the problem diagnosis is provided based on determining that an anomaly occurred with a confidence level below a confidence threshold and correlated evidence is available;
• preventing reporting of the anomaly based on determining that the correlated log identifier is not located in the one or more log entries;
• and
• preventing reporting of the anomaly based on determining that the correlated metric is not located in the one or more metrics records.