# US 12,117,892 B2 · Automated error triage scoring > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,117,892 B2 - Document ID: US12117892B2 - Status: Granted - Kind: B2 - Application number: 17/878,375 - Filed: 2022-08-01 - Published: 2024-02-01 - Granted: 2024-10-15 - Earliest claimed: 2022-08-01 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Wenjing Wang; Youquan Su; Zi Ye; Ya Lin; Shirley F. Tan; Ashwin Shrinivas; Mathieu Baptiste Demarne; Grant R. Culbertson; Yvonne Mckay; Thomas R. Michaels, Jr.; Barton K. Duncan; Zhirui Yuan - Web page: https://patentgrep.com/patent/US12117892B2 ## CPC - G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)} - G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems} - G06F 11/076: {by exceeding a count or rate limit, e.g. word- or bit count limit} - G06F 11/0781: {Error filtering or prioritizing based on a policy defined by the user or on a policy defined by a hardware/software module, e.g. according to a severity level} - G06F 11/0784: {Routing of error reports, e.g. with a specific transmission path or data flow} - G06F 11/0706: {the processing taking place on a specific hardware platform or in a specific software environment} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A computing system automatically manages error reports. Each error report specifies an error that occurred within a subsystem of the computing system. A received error report is added into a root cause grouping. Each root cause grouping contains error reports having error types traceable to a same root cause. A deployment time at which the subsystem corresponding to the error report was deployed within the computing system is determined. A severity score for the root cause grouping is generated as a function of the deployment time. The severity score inversely correlates to a time period length between the deployment time and the occurrence time of the error. The root cause grouping is assigned to a ranked error container of a plurality of ranked error containers based on the generated severity score. Each ranked error container contains root cause groupings having severity scores within a specified score range. ## Claims ### Claim 1 A method of managing error reports for a computing system, each error report specifying an error that occurred within a subsystem of the computing system, the method comprising: receiving an error report from the computing system, wherein the error report is assigned to a first ranked error container of a plurality of ranked error containers, each ranked error container containing root cause groupings having severity scores within a specified score range, the first ranked error container corresponds to a first allocated error processing resource, and access to the first ranked error container including the error report is provided to the first allocated error processing resource; adding the error report into a root cause grouping of a plurality of root cause groupings, each root cause grouping containing error reports having error types traceable to a same root cause; determining a deployment time at which the subsystem corresponding to the error report was deployed within the computing system; generating a severity score for the root cause grouping as a function of the deployment time, wherein the severity score inversely correlates to a time period length between the deployment time and an occurrence time of the error; assigning the root cause grouping to a second ranked error container of the plurality of ranked error containers based on the generated severity score, wherein the second ranked error container corresponds to a second allocated error processing resource and the first allocated error processing resource is different from the second allocated error processing resource; and providing access by the second allocated error processing resource to the second ranked error container of the plurality of ranked error containers based on the root cause groupings and severity scores. ### Claim 2 (depends on 1) The method of claim 1, wherein the severity score is further based on a detected spike in crash counts over time. ### Claim 3 (depends on 1) The method of claim 1, wherein the severity score is further based on a detected spike in trending counts over time. ### Claim 4 (depends on 1) The method of claim 1, wherein the severity score is further based on a normalized count parameter corresponding to at least one of a crash count, an impacted cluster count, and an impacted application count. ### Claim 5 (depends on 1) The method of claim 1, wherein providing access by the second allocated error processing resource comprises: transmitting the error report from the second ranked error container to a support personnel user. ### Claim 6 (depends on 1) The method of claim 1, wherein the received error report includes a static memory snapshot of the subsystem captured in response to the error. ### Claim 7 (depends on 1) The method of claim 1, wherein each root cause grouping includes error reports for errors occurring in a specified occurrence period and traceable to the same root cause. ### Claim 8 A system for managing error reports for a computing system, each error report specifying an error that occurred within a subsystem of the computing system, the system comprising: one or more hardware processors; an input interface executable by the one or more hardware processors and configured to receive an error report from the computing system, wherein the error report indicates an error type of the error, herein the error report is assigned to a first ranked error container of a plurality of ranked error containers, each ranked error container containing root cause groupings having severity scores within a specified score range, the first ranked error container corresponds to a first allocated error processing resource, and access to the first ranked error container including the error report is provided to the first allocated error processing resource; a root cause collector executable by the one or more hardware processors and configured to add the error report into a root cause grouping of a plurality of root cause groupings, each root cause grouping containing error reports having error types traceable to a same root cause; a deployment time decay calculator executable by the one or more hardware processors and configured to determine a deployment time at which the subsystem corresponding to the error report was deployed within the computing system; a severity scoring engine executable by the one or more hardware processors and configured to generate a severity score for the root cause grouping as a function of the deployment time, wherein the severity score inversely correlates to a time period length between the deployment time and an occurrence time of the error; a ranking engine executable by the one or more hardware processors and configured to assign the root cause grouping to a second ranked error container of the plurality of ranked error containers based on the generated severity score, wherein the second ranked error container corresponds to a second allocated error processing resource and the first allocated error processing resource is different from the second allocated error processing resource; and a report assignment engine executable by the one or more hardware processors and configured to provide access by the second allocated error processing resource to the second ranked error container of the plurality of ranked error containers based on the root cause groupings and severity scores. ### Claim 9 (depends on 8) The system of claim 8, wherein the severity score is further based on a detected spike in crash counts over time. ### Claim 10 (depends on 8) The system of claim 8, wherein the severity score is further based on a detected spike in trending counts over time. ### Claim 11 (depends on 8) The system of claim 8, wherein the severity score is further based on a normalized count parameter corresponding to at least one of a crash count, an impacted cluster count, and an impacted application count. ### Claim 12 (depends on 8) The system of claim 8, further comprising: an output interface executable by the one or more hardware processors and configured to transmit the error report from the second ranked error container to a support personnel user. ### Claim 13 (depends on 8) The system of claim 8, wherein the received error report includes a static memory snapshot of the subsystem captured in response to the error. ### Claim 14 (depends on 8) The system of claim 8, wherein each root cause grouping includes error reports for errors occurring in a specified occurrence period and traceable to the same root cause. ### Claim 15 One or more tangible processor-readable storage media embodied with instructions for executing on one or more processors and circuits of a computing device a process for managing error reports for a computing system, the process comprising: receiving an error report for a subsystem of the computing system, wherein the received error report includes a static memory snapshot of the subsystem captured in response to an error and indicates an error type and an occurrence time of the error, wherein the error report is assigned to a first ranked error container of a plurality of ranked error containers, each ranked error container containing root cause groupings having severity scores within a specified score range, the first ranked error container corresponds to a first allocated error processing resource, and access to the first ranked error container including the error report is provided to the first allocated error processing resource; adding the error report into a root cause grouping of a plurality of root cause groupings, each root cause grouping containing error reports having error types traceable to a same root cause; determining a deployment time at which the subsystem corresponding to the error report was deployed within the computing system; generating a severity score for the root cause grouping as a function of the deployment time, wherein the severity score inversely correlates to a time period length between the deployment time and the occurrence time of the error; assigning the root cause grouping to a second ranked error container of the plurality of ranked error containers based on the generated severity score, wherein the second ranked error container corresponds to a second allocated error processing resource and the first allocated error processing resource is different from the second allocated error processing resource; and providing access by the second allocated error processing resource to the second ranked error container of the plurality of ranked error containers based on the root cause groupings and severity scores. ### Claim 16 (depends on 15) The one or more tangible processor-readable storage media of claim 15, wherein the severity score is further based on a detected spike in crash counts over time. ### Claim 17 (depends on 15) The one or more tangible processor-readable storage media of claim 15, wherein the severity score is further based on a detected spike in trending counts over time. ### Claim 18 (depends on 15) The one or more tangible processor-readable storage media of claim 15, wherein the severity score is further based on a normalized count parameter corresponding to at least one of a crash count, an impacted cluster count, and an impacted application count. ### Claim 19 (depends on 15) The one or more tangible processor-readable storage media of claim 15, wherein the process further comprises: transmitting the error report from the second ranked error container to a support personnel user. ### Claim 20 (depends on 15) The one or more tangible processor-readable storage media of claim 15, wherein each root cause grouping includes error reports for errors occurring in a specified occurrence period and traceable to the same root cause.